Suspicious Activity Report Examples

10/11/2026

Rules and thresholds only go so far. The way most bankers actually learn suspicious activity reporting is by working through cases: what the activity looked like, what made it suspicious, which rule applied, how fast the bank had to move, and what the narrative needed to say.

This article walks through six suspicious activity report examples drawn from the typologies banks see most often. Every case below is fictional and illustrative. The names, amounts, dates and places are invented, and none describes a real customer, bank or filing. Real SARs are confidential by law and are never published; that confidentiality is the reason training has to rely on constructed examples like these.

Each case follows the same format: the facts, the red flags, the decision and the rule behind it, the clock, and what the narrative had to emphasize. The last case is one where the bank decided not to file, because knowing when a SAR is not required is part of the job.

The rules every example applies

A quick reference, so the reasoning in each case is easy to follow:

FinCEN's bank rule (31 CFR 1020.320) requires a SAR for transactions of at least $5,000, conducted or attempted, where the bank knows, suspects, or has reason to suspect illegal funds, evasion of BSA requirements such as structuring, or activity with no business or apparent lawful purpose for that customer.
The federal banking agencies' rules (for example, the OCC's at 12 CFR 21.11) require a SAR for suspected federal crimes against or through the bank: any amount for insider abuse, $5,000 or more when a suspect can be identified, and $25,000 or more regardless of whether one can be.
The clock is 30 calendar days from initial detection of facts that may be a basis for filing, extendable to a maximum of 60 days only when no suspect has been identified.
Confidentiality applies to every case: no one may tell the subject, or anyone not authorized, that a SAR was filed or considered.

Example	Typology	Main trigger	Filed?
1	Structuring at the teller line	BSA evasion, $5,000+	Yes
2	Elder financial exploitation	Suspected crime, suspect identified, $5,000+	Yes
3	Check kiting	Suspected crime against the bank, suspect identified	Yes
4	Teller embezzlement	Insider abuse, any amount	Yes
5	Customer defrauded by a business email compromise	Suspected crime through the bank	Yes
6	Cash-heavy restaurant near the CTR line	Near-threshold amounts only	No

Example 1: Structuring at the teller line (illustrative)

The facts. A long-standing customer who owns a small used-car lot comes in with $16,000 in cash. When the teller begins the currency transaction report, he asks whether the deposit "has to be reported," and on hearing that it does, deposits $9,500 and leaves. The next morning he deposits $6,500 at another branch. Over the following three weeks the business account receives nine more cash deposits between $8,800 and $9,800. Historically, the business deposited cash once or twice a week in amounts between $12,000 and $20,000, with CTRs filed as required.

The red flags.

The customer asked about reporting and reduced the deposit after the answer
Same-day and next-day splitting across branches
A sudden change from a long-established deposit pattern to amounts just under $10,000

The decision. The bank filed. The activity aggregated well over $5,000, and the customer's inquiry and immediate restructuring gave the bank reason to suspect the deposits were designed to evade CTR reporting, which is one of the FinCEN rule's triggers. Under 31 CFR 1010.100(xx), structuring does not require any single deposit to exceed $10,000, and it does not matter whether the cash came from legitimate car sales.

The clock. Detection dated from the analyst's review of the teller's same-day referral. The subject was known, so the 30-day deadline applied.

What the narrative emphasized. The customer's question and the reduced deposit, quoted as closely as the teller recorded them; the full list of deposits by date, amount and branch; the prior pattern; and an explicit statement that the bank suspected structuring. The narrative also noted that the source of the cash was unknown.

The lesson for staff. The teller did exactly the right thing: answered factually, accepted the deposit as presented, wrote down what happened, and referred it the same day without saying anything to the customer. CTR aggregation across branches is what made the pattern visible in the first place.

Example 2: Elder financial exploitation (illustrative)

The facts. An 81-year-old widow who has banked with the institution for decades starts making in-branch withdrawals every few days, always accompanied by a younger man she introduces as a family friend. Over six weeks she withdraws $31,000 in cash and buys a $12,000 cashier's check payable to a company with no prior connection to her. The friend does most of the talking. When a personal banker speaks with her alone, she cannot say what the money is for and becomes anxious about "getting in trouble." Before this, her account showed only Social Security deposits and routine household payments.

The red flags.

A sudden change in an older customer's long-stable activity
A new companion who directs the transactions and answers for her
Payments to an unfamiliar company
The customer's confusion and fear when asked directly

The decision. The bank filed. The activity suggested a federal crime conducted through the bank, the amount exceeded $5,000, and the companion was an identifiable suspect. The bank also followed its procedures and state law on reporting to adult protective services, which is a separate obligation from the SAR.

The clock. Detection dated from the banker's documented conversation, when the facts became a basis for filing. The suspect was identified, so the deadline was 30 days. Because the customer was still being drained, the BSA officer also considered whether the situation needed an immediate call to law enforcement, which the rules require for violations needing immediate attention.

What the narrative emphasized. The customer's age and history with the bank, described to explain the activity; the companion's role and statements; the dates and amounts; the payee; and the banker's observations. Following FinCEN's instructions, the customer was described as a victim in the narrative and not listed as a subject. Following FinCEN's June 2022 elder financial exploitation advisory, the filing included the advisory's key term in field 2 and checked the elder financial exploitation box.

The lesson for staff. The branch's observations made the case. A monitoring system would have seen withdrawals; only people saw who was in control. Our post on elder financial exploitation covers what to watch for and record.

Example 3: Check kiting (illustrative)

The facts. A small contracting business holds checking accounts at this bank and at another bank across town. Over a month, the account here shows a rising cycle: large checks drawn on the other bank are deposited, and within a day or two large checks drawn on this account are deposited at the other bank. Balances look healthy on paper, but almost all of them consist of uncollected funds. The business has no meaningful payroll, supplier or customer payments running through either account. Eventually a deposited check of $68,000 is returned unpaid, leaving the account overdrawn by about $52,000.

The red flags.

Round-trip check activity between two banks with no commercial purpose
High volume of deposits and withdrawals with low average collected balances
Frequent requests for immediate availability or overdraft exceptions
Activity inconsistent with a real operating business

The decision. The bank filed. Check kiting is a scheme to obtain credit from banks by exploiting the float between deposit and collection, and the bank was an actual victim. The suspect was identifiable and the amount well exceeded $5,000, meeting the agency rule's threshold for a suspected crime with an identifiable suspect.

The clock. Detection dated from when the deposit operations analyst escalated the kite-suspect report after reviewing the pattern, not from the date the $68,000 check was returned. Banks often see the kite pattern weeks before the loss crystallizes; the detection date reflects when the facts were recognized.

What the narrative emphasized. The two accounts and the other institution; the cycle of checks by date and amount, summarized in the narrative with the full list in the single CSV attachment FinCEN allows; the absence of real business activity; and the resulting loss. The narrative also described the bank's action, closing the account and pursuing recovery.

The lesson for staff. Kiting shows up in deposit operations reports before it shows up as a loss. Our guide to check fraud detection covers the reports and patterns that catch it.

Example 4: Teller embezzlement (illustrative)

The facts. A routine dormant-account review finds small withdrawals from three inactive accounts over eight months, each between $150 and $400, totaling $3,700. All were processed at one teller window using override codes, and the dates match a single teller's shifts. When interviewed, the teller admits taking the money to cover personal debts.

The red flags.

Activity on dormant accounts with no customer contact
A pattern tied to one employee's credentials and shifts
Small amounts designed to avoid attention

The decision. The bank filed even though the total was under $5,000. The agency rules require a SAR for insider abuse in any amount where the bank has a substantial basis for identifying a director, officer, employee, agent or other institution-affiliated party as having committed or aided the crime. The bank also reviewed its fidelity bond notice requirements and its own personnel process, which are separate matters.

The clock. Detection dated from when the review linked the withdrawals to the teller. The suspect was identified, so 30 days applied.

What the narrative emphasized. The employee's position and how that position enabled the theft, which FinCEN's instructions specifically ask for when a subject is an insider; the dates and amounts; the method; and the admission, including to whom and when it was given. Because the subject was an employee, the SAR could not be filed jointly with another institution.

The board. The agency rules require management to promptly notify the board, or a designated committee, of every SAR. If a suspect is a director or executive officer, that person is not notified but every other director is. Our article on internal fraud in banking covers the controls that catch insider schemes.

Example 5: A customer defrauded by business email compromise (illustrative)

The facts. A commercial customer, a distributor, sends a $142,000 wire to what it believes is a supplier's new bank account, following emailed instructions that appeared to come from the supplier. Two days later the real supplier asks why it has not been paid. The fraudulent account is at another U.S. bank. The customer calls in a panic, and the bank immediately requests a recall of the wire through the receiving bank. About $40,000 is recovered.

The red flags.

A change in payment instructions received by email
A first-time beneficiary account at a different bank from the supplier's usual one
A wire amount and timing that matched a real invoice

The decision. The bank filed. The bank was used to move the proceeds of a suspected federal crime, the amount exceeded $25,000, and a SAR was required whether or not a suspect could be identified. The beneficiary account holder was identifiable from the wire details, but the people behind the email were not.

The clock. Detection dated from the customer's report. The bank's first priority was the recall, and it also considered whether immediate notification to law enforcement was warranted. The SAR followed within the 30-day period, since the beneficiary account holder was identifiable.

What the narrative emphasized. How the scheme worked; the spoofed email and the changed instructions; the wire details, including the beneficiary bank and account; the recall and the amount recovered; and a clear statement that the customer was the victim. The customer was described in the narrative, not listed as a subject.

The lesson for staff. Most wire fraud SARs are filed on behalf of victims, not about bad customers. Callback verification of any changed payment instructions, on a phone number already on file, is the control that most often prevents these losses.

Example 6: The case where the bank did not file (illustrative)

The facts. Monitoring flags a family-owned restaurant for frequent cash deposits between $8,000 and $9,900. On review, the analyst finds the restaurant has made deposits in that range almost every business day for six years, matching its sales volume and opening hours. On many days its cash deposits exceed $10,000, and CTRs are filed. The owner has never asked about reporting, never split a deposit across branches, and never changed the pattern. Card receipts and payroll through the account are consistent with a restaurant of its size.

The decision. The bank did not file. FinCEN and the federal banking agencies said in their October 2025 FAQs that the mere presence of transactions at or near the $10,000 CTR threshold is not information sufficient to require a SAR; the bank must know, suspect, or have reason to suspect that the activity was designed to evade reporting. Nothing here suggested that purpose. The amounts reflect the business, not the threshold.

The record. The same FAQs state that there is no regulatory requirement or expectation to document a decision not to file, and that where a bank chooses to document, a short, concise statement will usually suffice. This bank's procedures call for a brief note, so the analyst recorded two sentences explaining the long-standing pattern and its consistency with the business, and tuned the monitoring rule so the same pattern would not keep alerting.

The lesson for staff. Good SAR programs are as much about not filing on noise as about filing on real suspicion. An alert is a question, not an answer.

What the examples have in common

Looking across the six cases, a few patterns show what makes suspicious activity reporting work:

Frontline observation carried most of the cases. The structuring inquiry, the elder customer's confusion and the teller's admission all came from people, not systems.
The "why" was always explicit. Each narrative stated what the bank expected, how the activity differed, and what it suspected.
The detection date was deliberate. In each case the bank could say when the facts became a basis for filing and why.
Victims were described, not listed as subjects.
The relationship decision was separate. Some accounts were closed, some kept and monitored; the SAR did not decide that.
Confidentiality held throughout. No customer, including the victims' companions, was told a report was filed.

For more patterns like these, our list of money laundering red flags explains what each looks like and what to do about it, and the bank fraud prevention topic page lists fraud-focused training.

Training built on red flags and investigation

Every example above turned on two skills: recognizing a red flag and investigating it well enough to decide. Our Financial Crimes Red Flags Training: Identifying and Investigating Red Flags course is built around exactly those two skills. For the reporting side, including the SAR itself, see SARs and Information Sharing.

Next step

Use these six scenarios in your next team meeting: have staff identify the red flags and the trigger before reading the decision. Then build the skills behind them with Financial Crimes Red Flags Training.

Frequently Asked Questions

What are examples of suspicious activity in banking?

Common examples include cash deposits split to stay under the $10,000 reporting threshold, a customer asking how to avoid a report, sudden unexplained changes in an older customer's withdrawals while accompanied by someone new, check kiting between banks, employee misuse of accounts, wire fraud schemes such as business email compromise, rapid in-and-out movement of funds, and activity that does not fit the customer's stated business or occupation.

Can I see real suspicious activity reports?

No. SARs are confidential by federal law, and neither banks nor government agencies may disclose them except as the rules permit. That is why training materials, including this article, use fictional examples. FinCEN does publish guidance, advisories and some older sanitized narrative examples to help filers, but individual filed SARs are never made public.

Does a bank file a SAR when the customer is the victim?

Often, yes. When a customer is defrauded through the bank, such as by a business email compromise or a scam targeting an older adult, the bank may have been used to facilitate a federal crime, and a SAR can be required if the thresholds are met. The victim is described in the narrative to explain the activity but is not listed as a subject of the report.

Is a SAR required for employee theft under $5,000?

Yes, for banks. The federal banking agencies' rules require a SAR for insider abuse in any amount when the bank has a substantial basis for identifying a director, officer, employee, agent or other institution-affiliated party as having committed or aided the crime. The $5,000 and $25,000 thresholds apply to other categories, not to insider abuse.

Is every deposit just under $10,000 suspicious?

No. FinCEN and the federal banking agencies clarified in October 2025 that transactions at or near the $10,000 CTR threshold, without more, are not enough to require a SAR. A business whose deposits have always reflected its sales is different from a customer who reduces a deposit after asking about reporting. The question is whether the bank knows, suspects, or has reason to suspect evasion.

Can a SAR be filed below the dollar thresholds?

Yes. The thresholds set when a SAR is mandatory; they do not limit voluntary filing. FinCEN's bank rule expressly allows a bank to file on any suspicious transaction it believes is relevant to a possible violation of law, even when not required. Voluntary filings receive the same safe harbor protection from civil liability as required ones.