What Is a Suspicious Activity Report (SAR)?

10/7/2026

A suspicious activity report, almost always shortened to SAR, is a confidential report a bank files with the Financial Crimes Enforcement Network (FinCEN) when it knows, suspects, or has reason to suspect that a transaction involves illegal funds, is designed to get around federal reporting rules, or makes no sense for the customer conducting it. It is the central reporting tool of the Bank Secrecy Act, and it is the one report in banking that the customer is never allowed to know about.

Most people in a bank never file a SAR themselves. Tellers, personal bankers, lenders and operations staff feed the process by noticing something and referring it; a BSA analyst or officer investigates and decides; the BSA function files. But everyone in the chain needs to understand what the report is, because the referral that starts it and the confidentiality that protects it both depend on frontline staff.

This explainer covers the definition-level questions: what a SAR is, who has to file, what triggers it, where it goes, and what it is not. For the step-by-step procedure, see our companion guide on how to file a SAR.

What a SAR is, in plain terms

A SAR is a structured electronic report. It identifies the people involved (the "subjects"), the accounts and amounts, the dates, the type of suspicious activity, the financial institution where it happened, and, most importantly, a written narrative explaining what happened and why the bank considers it suspicious.

Three features set it apart from almost every other bank report:

It is based on judgment, not a bright line. A currency transaction report is filed because cash crossed a number. A SAR is filed because a trained person looked at activity and concluded it was suspicious. The dollar thresholds in the rule only set a floor below which filing is optional.
It is confidential by law. The bank may not disclose a SAR, or any information that would reveal one exists, to the subject or to anyone not authorized to receive it.
It does not accuse anyone of a crime. A SAR reports suspicion. The bank does not have to prove anything, identify the underlying crime, or be right. Federal law gives filers a safe harbor from civil liability for making the report.

Outside the United States the same kind of filing is usually called a suspicious transaction report (STR). The international standard-setter, the Financial Action Task Force, uses that term, and many countries' financial intelligence units receive STRs. In the U.S. the regulatory name is the SAR, and when people search for a "SAR report" or "SAR in banking," this is what they mean.

A short history

Before the mid-1990s, banks reported suspected crimes on a patchwork of criminal referral forms sent to different agencies. The Annunzio-Wylie Anti-Money Laundering Act of 1992 gave Treasury authority to require suspicious transaction reporting and created the safe harbor, and the single SAR replaced the old referral forms. The USA PATRIOT Act later extended SAR obligations well beyond banks. Today the report is filed electronically as the FinCEN SAR through FinCEN's BSA E-Filing System.

Who has to file a SAR

For banks, the requirement sits in two places at once, and it is worth knowing both:

FinCEN's rule for banks, 31 CFR 1020.320, which applies to every bank and sets the core standard, deadline, retention and confidentiality rules.
Each federal banking agency's own SAR rule: 12 CFR 21.11 for the OCC, 12 CFR part 353 for the FDIC, 12 CFR 208.62 for the Federal Reserve, and 12 CFR 748.1(d) for credit unions under the NCUA. The agency rules add the categories based on known or suspected crimes against or through the bank, including insider abuse.

Banks are not the only filers. FinCEN's SAR rules also cover casinos and card clubs, money services businesses, broker-dealers, mutual funds, insurance companies, futures commission merchants and introducing brokers, loan or finance companies (which includes nonbank residential mortgage lenders and originators), and housing government-sponsored enterprises. Thresholds and details differ by industry; this article is about banks.

Inside a bank, "the bank files" really means the BSA function files, under procedures that name who has authority to decide. The rule obligates the institution and its directors, officers, employees and agents not to disclose the report, so the confidentiality obligation reaches every employee whether or not they ever see a SAR.

What triggers a SAR

Under FinCEN's bank rule, a transaction requires a SAR when it is conducted or attempted by, at, or through the bank, it involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect that:

The funds come from illegal activity, or the transaction is meant to hide or disguise such funds as part of a plan to violate federal law or avoid a reporting requirement.
The transaction is designed to evade the Bank Secrecy Act, for example by structuring cash to stay under the currency transaction report threshold.
The transaction has no business or apparent lawful purpose, or is not the sort of thing this customer would normally be expected to do, and the bank knows of no reasonable explanation after examining the available facts.

The federal banking agencies' rules add crime-based categories. Using the OCC's rule as the example (the FDIC and Federal Reserve rules are parallel), a bank must file when it detects a known or suspected federal criminal violation committed or attempted against the bank or through it, and:

Insider abuse is involved, in any amount, where the bank has a substantial basis for identifying a director, officer, employee, agent or other institution-affiliated party.
The amount involved is $5,000 or more and a suspect can be identified.
The amount involved is $25,000 or more, regardless of whether a suspect can be identified.

Situation	Threshold for a required SAR
Insider abuse by a director, officer, employee or agent	Any amount
Known or suspected crime, suspect can be identified	$5,000 or more
Known or suspected crime, no suspect identified	$25,000 or more
Money laundering, BSA evasion, or no apparent lawful purpose	$5,000 or more

Two points about these numbers trip people up. First, "involves or aggregates" means the bank adds related activity together; a series of $1,200 transactions can reach the threshold. Second, the thresholds are a floor for mandatory filing, not a ceiling on reporting. The rule expressly allows a bank to file voluntarily on suspicious activity below them, and banks routinely do when the facts warrant it.

What the triggers do not include

A transaction is not suspicious merely because it is large, in cash, or unusual for the bank. FinCEN and the federal banking agencies made this explicit in joint FAQs issued in October 2025: the mere presence of a transaction or series of transactions at or near the $10,000 currency transaction reporting threshold is not, by itself, enough to require a SAR. What matters is whether the bank knows, suspects, or has reason to suspect the activity was designed to evade reporting. That is a judgment about intent, informed by the pattern and the customer, not a mechanical rule about amounts.

Common examples

The categories on the SAR form give a good picture of what banks actually report. They include structuring, terrorist financing, fraud of many kinds (check, wire, ACH, card, loan), identity-related activity, money laundering, insider abuse, mortgage fraud, cyber events and elder financial exploitation. In practice, the referrals that most often reach a BSA analyst from a branch are:

Cash deposits deliberately kept just under $10,000, or a customer who reduces a deposit after asking about reporting
A customer who cannot or will not explain the source of funds, or whose activity bears no relation to their stated occupation or business
Rapid in-and-out movement of funds with no evident purpose
An older customer making unusual withdrawals while accompanied by someone who does the talking
Checks or wires that look like the product of a scam the customer has fallen for
Activity by an employee that looks like misuse of their position

Our list of money laundering red flags walks through what these look like at the counter and what to do when you see one.

When it has to be filed

The clock is set by regulation. A bank must file no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing. If no suspect was identified on the date of detection, the bank may take up to an additional 30 calendar days to identify one, but in no case may reporting be delayed more than 60 calendar days after initial detection.

Where a violation requires immediate attention, such as an ongoing money laundering scheme, the bank must also notify an appropriate law enforcement authority by telephone immediately, in addition to filing the SAR on time. The OCC's rule adds notifying the OCC as well.

"Initial detection" is not the date a monitoring system generates an alert, and it is not the date the investigation wraps up. It is the point at which the bank has facts that may constitute a basis for filing, which in practice usually means when a trained reviewer looks at the alert or referral and identifies potentially suspicious activity. Getting this date right, and writing it down, is a large part of SAR compliance.

Where a SAR goes after it is filed

A SAR is filed with FinCEN, not with the bank's regulator or the local police. FinCEN maintains the BSA database, and access to it is granted to authorized users: federal, state and local law enforcement agencies, the federal banking agencies and other regulators that examine for BSA compliance, and certain other government users.

What happens next varies enormously. Some SARs are pulled within days because they match an open investigation. Many are used in aggregate, where analysts link a subject across filings by several banks. Some are never individually read. A bank generally hears nothing back, and silence says nothing about whether the filing was useful.

The bank's obligations continue after filing:

Keep the SAR and its supporting documentation for five years from the filing date. Supporting documentation is deemed filed with the SAR, which means it is protected by the same confidentiality rules.
Make the supporting documentation available on request to FinCEN, law enforcement, and the regulators that examine for BSA compliance.
Tell the board. The OCC's rule, for example, requires management to promptly notify the board of directors, or a designated committee, whenever the bank files a SAR. If the suspect is a director or executive officer, that person may not be notified, but the directors who are not suspects must be.

Confidentiality: the rule everyone must know

The single most important thing for frontline staff to understand about SARs is this: you may not disclose a SAR, or any information that would reveal that one exists. This prohibition comes from federal statute and is restated in the bank rule. It applies to every director, officer, employee and agent.

In practice that means:

Never tell a customer that a SAR was filed, is being considered, or "might have to be filed."
Never hint. "Compliance is looking at your account because of those deposits" can reveal a filing just as clearly as saying it outright.
If anyone outside the authorized group asks for a SAR, including through a subpoena in a private lawsuit, the bank must decline to produce it and notify FinCEN of the request.
Share inside the bank only with people who need to know, under the bank's procedures.

The rule does allow the bank to share a SAR with FinCEN, law enforcement and the regulators that examine for BSA compliance, and to share it within its corporate organizational structure as permitted by regulation and guidance. The underlying facts and documents can be shared in limited circumstances, such as with another financial institution preparing a joint SAR.

The confidentiality rule cuts both ways. It protects the customer from being labeled by a report that may turn out to be unfounded, and it protects the investigation that may follow. That is why the response to a curious coworker, a customer's attorney, or the customer themselves is the same: say nothing about the existence of a report and route the question to the BSA officer.

What a SAR is not

A lot of misinformation surrounds SARs, some of it from customers and some of it from bankers.

It is not a CTR. A currency transaction report is a routine, objective filing for cash over $10,000 in a business day. Customers can know about it, and many large-cash businesses generate them daily. A SAR is subjective and secret. One transaction can require both.

It is not an accusation or a finding. It is a report of suspicion. Law enforcement decides what, if anything, to do with it.

It does not require closing the account. Filing a SAR is a reporting decision, not a relationship decision. Whether to keep the customer is a separate risk call, and sometimes law enforcement prefers the account stay open so activity remains visible.

It is not optional once the standard is met. Above the thresholds, when the bank knows, suspects or has reason to suspect, filing is required. Failure to file can lead to supervisory action, civil money penalties, and in serious cases action against individuals.

It is not the same as reporting a robbery. The bank rule exempts robberies and burglaries reported to law enforcement, and lost, missing, counterfeit or stolen securities reported on the securities form, from separate SAR filing.

The frontline role

A bank's monitoring system catches patterns across accounts. It cannot see that a customer was nervous, that someone else was coaching him, that he asked how much he could deposit "without paperwork," or that he walked out and came back with a smaller amount. Tellers and bankers see those things, and their referrals are often the best evidence in a SAR narrative.

A good referral answers a few questions while the details are fresh: who conducted the transaction, what happened, when and where, what was said, and why it seemed off. It goes to the BSA function through the bank's internal channel, not to a coworker or a manager's inbox. And it does not change how the employee treats the customer: complete the transaction as presented unless procedures say otherwise, be courteous, and do not tip anyone off.

The Bank Secrecy Act explained post shows how SAR reporting fits into the wider BSA program, and our BSA/AML FAQs answer the questions staff ask most often.

What's changing, and what isn't

SAR policy is under active review in Washington, so it pays to separate guidance and proposals from the rule itself.

The October 2025 FinCEN and agency FAQs clarified that near-threshold cash alone does not require a SAR, that banks are not required to run a separate post-filing review to see whether activity continued, that the "file continuing activity every 90 days" practice is a suggestion banks may follow rather than a requirement, and that there is no regulatory requirement to document a decision not to file. The FAQs state they do not change the regulations.
FinCEN's April 2026 proposed rule to reform AML/CFT program requirements is a proposal, not a final rule. It addresses how programs are built and supervised.
Bills to raise BSA reporting thresholds have been introduced in Congress. None had become law as of this writing, so the $5,000 and $25,000 SAR thresholds and the $10,000 CTR threshold remain in force.

Work to the current regulation, and watch FinCEN's guidance page for changes.

Training for the people who make SARs work

SAR quality depends on two groups: frontline staff who notice and refer, and the analysts and officers who investigate, decide and write. Both need training matched to their role. Our SARs and Information Sharing course is built around suspicious activity reporting and the information-sharing side of the BSA, and the suspicious activity reporting topic page lists related options. For staff who own the whole program, the Certificate in BSA and AML Compliance covers the framework end to end.

Next step

If your team handles referrals, investigations or filings, start with SARs and Information Sharing and pair it with a walkthrough of your own bank's referral procedure, so staff know exactly where a concern goes the moment they see it.

Frequently Asked Questions

What is a suspicious activity report in banking?

A suspicious activity report is a confidential filing a bank submits to FinCEN when it knows, suspects, or has reason to suspect that a transaction involves illegal funds, is designed to evade Bank Secrecy Act requirements, or has no apparent lawful purpose for that customer. It identifies the people, accounts, amounts and dates involved and includes a written narrative explaining why the activity is suspicious. Law enforcement and regulators can access it through FinCEN's database; the customer is never told it exists.

What triggers a SAR at a bank?

Under FinCEN's bank rule, a SAR is required when a transaction involving or aggregating at least $5,000 is suspected of involving illegal funds, evading BSA reporting, or having no business or apparent lawful purpose. The banking agencies' rules add known or suspected crimes: any amount for insider abuse, $5,000 or more when a suspect can be identified, and $25,000 or more regardless of a suspect. Banks may also file voluntarily below these amounts.

Who files a SAR, the teller or the bank?

The bank files. Tellers and other frontline staff typically refer concerns through an internal process, and the BSA function investigates and makes the decision under procedures that name who has authority. The person who notices the activity usually never sees the final report. Every employee, however, is bound by the confidentiality rule and may not tell anyone outside the authorized group that a report was made or considered.

How long does a bank have to file a SAR?

No later than 30 calendar days after initial detection of facts that may constitute a basis for filing. If no suspect was identified at detection, the bank may take up to 30 more days to identify one, but reporting may never be delayed beyond 60 calendar days from initial detection. For violations needing immediate attention, such as ongoing money laundering, the bank must also call law enforcement right away.

Will a customer find out if a SAR is filed on them?

Not from the bank. Federal law prohibits the bank and its staff from disclosing a SAR or any information that would reveal one exists, and a bank that receives a subpoena for a SAR in a private matter must decline and notify FinCEN. A customer may learn of an investigation later through law enforcement action, but the bank itself must never confirm or hint that it filed.

What is the difference between a SAR and a suspicious transaction report?

They are the same kind of report under different names. "Suspicious transaction report," or STR, is the term used by the Financial Action Task Force and many countries outside the U.S. In the United States the regulatory term is suspicious activity report, filed with FinCEN under the Bank Secrecy Act. The U.S. rules also cover attempted transactions, so "activity" is the broader word.