How to Complete and File the Suspicious Activity Report (SAR Form 111)

To file a SAR on FinCEN Form 111, submit it electronically through FinCEN’s BSA E-Filing System within 30 calendar days after your institution first detects the suspicious activity, completing all five parts of the form and writing a factual narrative that explains who did what, when, where, why it looked suspicious, and how it was carried out. Paper filings have not been accepted since April 2013.¹ The rest of the job is knowing when the duty is triggered, how to write a narrative an investigator can actually use, and what you can and cannot say once the report is in.

When a Filing Is Required

Two things have to line up before a mandatory SAR is triggered: a dollar threshold and a reason to suspect illegal activity.

For banks, brokers and dealers in securities, and insurance companies, the threshold is $5,000 in funds or other assets involved in or aggregated across the suspicious transaction.²³⁴ Money services businesses file at $2,000, except that issuers of money orders or traveler’s checks reviewing clearance records report at $5,000.⁵ When the suspected wrongdoer is your own director, officer, employee, or agent, no minimum dollar amount applies. Insider abuse gets reported regardless of size.

The suspicion side of the test asks whether you know, suspect, or have reason to suspect that the transaction falls into any of these categories:

The funds appear derived from illegal activity, or the transaction is structured to hide the ownership, source, or control of such funds.
The transaction appears designed to evade BSA reporting requirements. Structuring cash deposits to stay under $10,000 is the classic example.
The activity has no apparent lawful purpose and does not match what the institution knows about the customer’s business.
The institution’s services are being used to facilitate criminal activity.

You can also file a SAR voluntarily on activity you believe may involve a violation of law even when the amount falls below the mandatory threshold.⁶ If it looks wrong but the numbers are small, nothing stops you from reporting.

Getting Access to the BSA E-Filing System

Form 111 can only be submitted through FinCEN’s BSA E-Filing System, and access is layered. Your institution first enrolls an initial supervisory user, who serves as the point of contact between the system and the organization.⁷ The supervisory user then creates accounts for general users, the compliance analysts who prepare and submit the actual reports. General users can only view and file the reports that the supervisory user has granted them access to.⁸ If you cannot see the SAR form after logging in, the fix is on the supervisory user’s side, not FinCEN’s.

Completing Form 111

Form 111 has five parts. Fields marked with an asterisk are critical and must be completed; non-critical fields may be left blank when the information is not readily available, but investigators use whatever you give them, so complete what you can.⁸

Part I: Subject Information

Complete a separate Part I for each known subject involved in the activity. Include the full legal name, date of birth, address, Social Security or Taxpayer Identification Number, and any account numbers tied to the activity. When the subject is an entity, the entity’s identifying information goes here in place of individual data.⁶

Part II: Suspicious Activity Information

Use the check boxes in Items 29 through 38 to categorize the activity: structuring, money laundering, fraud, identity theft, terrorist financing, and so on. Record the date range and the dollar amounts.

Part III: Financial Institution Where Activity Occurred

Complete a separate Part III for each branch or institution where the suspicious activity took place. This captures the institution’s name, address, regulatory identification numbers, and the role it played.

Part IV: Filing Institution Contact Information

Only one Part IV record is allowed per SAR. It names the lead institution or holding company filing the report and identifies a contact person for law enforcement follow-up. Pick someone who can actually answer questions about the underlying activity, because investigators may reach out directly based on what you filed.

Part V: The Narrative

The narrative is where most SARs succeed or fail. FinCEN calls it “critical to understanding the nature and circumstances of the suspicious activity.”⁶ Simply restating what you checked in Part II adds nothing. Federal examiners recommend building the narrative around six questions:⁹

Who is conducting the activity? Go beyond Part I. Describe occupation, business type, and the subject’s relationship to the institution.
What instruments or mechanisms are being used? Name the wire transfers, cash deposits, or products involved and describe how funds moved from origin to destination.
When did it happen? Give individual transaction dates and amounts where you can, not just an aggregate. Note when the activity was first observed and how long it continued.
Where did it occur? Identify the branch and any foreign jurisdictions in play.
Why is this suspicious? Contrast the activity against the customer’s known behavior, the products the institution offers, and what similar customers typically do. This is the analytical core.
How was it carried out? Describe the sequence of transactions, accounts used, and any layering or structuring pattern.

Write chronologically. Stick to facts. Connect the structured data in Parts I through IV to the story you are telling. Vague statements like “unusual activity was observed” without saying what made it unusual are one of the most common problems examiners flag.

Deadlines, Continuing Reports, and Corrections

The SAR must be filed no later than 30 calendar days after the institution first detects facts that may warrant a report. If no suspect has been identified by the detection date, you may take an additional 30 calendar days to identify one, but filing cannot be delayed beyond 60 calendar days after initial detection under any circumstances.²

When a situation demands immediate attention, such as an ongoing money laundering scheme, notify an appropriate law enforcement authority by telephone right away in addition to filing the SAR within the standard window.²

When suspicious activity continues, one SAR is not enough. File continuing reports at least every 90 days for as long as the activity persists, with each continuation SAR due no later than 120 days after the date of the previous related SAR.⁶ On the continuing report, check box 1c and enter the prior SAR’s BSA Identifier in field 1e.

To fix errors or add new information that does not justify a continuing report, file a corrected or amended SAR. Check box 1b, enter the prior report’s Document Control Number or BSA Identifier in field 1e, and describe every correction at the beginning of the Part V narrative.⁶ The corrected SAR must be filed in its entirety; you cannot submit only the changed fields.

Recordkeeping After Submission

A successful submission produces an electronic acknowledgment with a BSA Identifier, which functions as the tracking number for that filing. Retain a copy of the filed SAR and the original or business record equivalent of all supporting documentation for five years from the filing date.² Supporting documentation is legally deemed to have been filed with the SAR itself, so label it and store it as SAR-related material.

Confidentiality: What You Cannot Say

Under 31 U.S.C. § 5318(g)(2), no financial institution, and no director, officer, employee, or agent of one, may notify any person involved in the transaction that a SAR has been filed.¹⁰ The same prohibition binds government employees who learn a report was filed. Compliance staff cannot tell a customer that the real reason an account was closed or a transaction frozen was a SAR filing. The SAR itself should not be produced in response to a civil subpoena; the statutory confidentiality protection is separate from privilege and survives discovery.

Safe Harbor and Penalties

To encourage reporting, 31 U.S.C. § 5318(g)(3) shields the institution and any individual who files or requires a SAR filing from liability under any federal or state law, constitution, regulation, contract, or arbitration agreement, both for making the disclosure and for not notifying the subject of it.¹¹ A customer cannot successfully sue you for reporting them when the filing is made in the course of your BSA obligations. The safe harbor does not, however, protect the institution from government enforcement against its own regulatory violations.

On the other side, failing to file a required SAR, filing late, or breaching SAR confidentiality can trigger civil penalties under 31 U.S.C. § 5321 and criminal penalties under 31 U.S.C. § 5322 for willful violations, including fines and imprisonment. Regulators have imposed multimillion-dollar civil money penalties on institutions with systemic SAR failures, and individual compliance officers have faced personal liability where they knowingly allowed deficient programs to continue.

1
FinCEN.gov. Bank Secrecy Act Filing Information
2
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
3
eCFR. 31 CFR 1023.320 – Reports by Brokers or Dealers in Securities of Suspicious Transactions
4
eCFR. 31 CFR 1025.320 – Reports by Insurance Companies of Suspicious Transactions
5
eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
6
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
7
BSA E-Filing System. Becoming a Registered E-Filer
8
FinCEN. Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report (SAR)
9
FFIEC BSA/AML InfoBase. Appendix L – SAR Quality Guidance
10
Federal Financial Institutions Examination Council. 31 USC 5318 – Compliance and Exemptions, and Summons Authority
11
Office of the Law Revision Counsel. 31 US Code 5318 – Compliance, Exemptions, and Summons Authority