Suspicious Activity Report (SAR)

What Is Suspicious Activity Report (SAR)?

A Suspicious Activity Report, or SAR, is a formal report a bank, credit union, or other regulated financial institution files with the Financial Crimes Enforcement Network (FinCEN) when it identifies a transaction or pattern of activity that may indicate money laundering, fraud, or another form of financial crime. 1 Institutions are required to file a SAR under the Bank Secrecy Act whenever a transaction meets defined suspicious-activity criteria, regardless of the dollar amount involved, and the filing obligation applies even if the institution cannot determine with certainty that a crime took place. 2 SAR filings are confidential; institutions are legally prohibited from disclosing to the subject of a report that a SAR has been filed, which protects the integrity of any resulting law enforcement investigation. 3 The most commonly reported categories include suspicion around the source of funds, transactions with no apparent legitimate business purpose, structuring to avoid reporting thresholds, and increasingly, cyber-related financial crime and elder financial exploitation. 4 Because the standard is suspicion rather than proof, the SAR functions as an early alert to law enforcement rather than a finding of wrongdoing, and the institution is not expected to investigate the underlying crime itself.

Why It Matters

SAR data forms a core input for law enforcement investigations into money laundering, terrorist financing, and organized financial crime, and the volume of filings continues to climb as both financial crime and the sophistication of detection tools increase. 5 For financial institutions, SAR compliance is not optional. Institutions sanctioned for SAR-related failures are penalized for failing to file or filing late, not for filing too cautiously, which creates a strong institutional incentive toward defensive filing when activity looks even plausibly suspicious. Beyond the direct regulatory obligation, SAR data quality and timeliness increasingly factor into how examiners assess an institution's overall Bank Secrecy Act and anti-money-laundering program. 6 That pressure is one reason many institutions are future-proofing financial crime and compliance with AI-driven transaction monitoring that improves both detection accuracy and filing efficiency.

Banks, savings associations, and credit unions filed more than 2.193 million Suspicious Activity Reports in 2025, an increase of 7.66% over 2024, with all filer types combined submitting more than 4.105 million SARs industry-wide, per FinCEN SAR filing data.

How Suspicious Activity Report (SAR) Works

• Detection: Transaction monitoring systems, staff observation, or customer due diligence findings flag activity that appears suspicious.
• Internal investigation: A compliance analyst reviews the flagged activity, gathering context before deciding whether it meets the threshold for filing.
• Filing decision: The institution determines whether the activity meets regulatory criteria for a SAR, applying a risk-based judgment when the answer is not clear-cut.
• FinCEN submission: The completed SAR is filed electronically with FinCEN within the required timeframe, typically 30 to 60 days from initial detection. 7
• Confidentiality maintenance: The institution keeps the filing confidential from the subject of the report and retains supporting documentation as required.

SAR vs. CTR (Currency Transaction Report)

SARs and Currency Transaction Reports (CTRs) are both Bank Secrecy Act filings, but they serve different purposes and are triggered differently. A CTR is filed automatically whenever a currency transaction exceeds $10,000, regardless of whether anything about the transaction looks suspicious, since the trigger is purely the dollar amount involved. A SAR, by contrast, has no fixed dollar threshold and is filed based on judgment: an institution files a SAR when the nature, pattern, or context of a transaction or relationship appears suspicious, even for amounts well under the CTR threshold. A transaction can generate both filings if it exceeds the currency threshold and also displays suspicious characteristics, or it can generate a SAR alone for entirely non-currency activity, such as suspicious wire transfers, since a SAR is not limited to cash transactions the way a CTR is. 8 Understanding the distinction matters operationally, because a compliance team that treats the two as interchangeable risks both over-filing routine cash transactions and missing the judgment-based patterns a SAR is designed to catch.