Banks and other financial institutions file a Suspicious Activity Report when a transaction of $5,000 or more looks like it may involve illegal funds, an attempt to dodge federal reporting rules, or behavior that has no apparent business purpose for that customer.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The specific patterns that trigger a Suspicious Activity Report, the red flags compliance teams are trained to watch for, fall into a handful of recognizable categories: structuring cash to stay below reporting thresholds, laundering patterns that move money without a coherent reason, opaque shell-company ownership, fraud pass-throughs, and sanctions or terrorist-financing indicators.
For a bank filing, the legal trigger has three prongs. The institution must know, suspect, or have reason to suspect that the money came from illegal activity or is being disguised; that the transaction is designed to evade Bank Secrecy Act reporting; or that the transaction has no apparent business or lawful purpose and doesn’t match what the customer normally does.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The third prong is where most judgment calls happen. A wire transfer is legal. A wire transfer that makes no sense for a particular customer is worth reporting.
Structuring Cash to Avoid the $10,000 Threshold
Any cash transaction over $10,000 requires the bank to file a Currency Transaction Report. Structuring is the practice of deliberately breaking up a larger amount into smaller pieces to stay under that line, and it is a federal crime on its own.2Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements The textbook pattern is a customer making repeated cash deposits of $9,000 or $9,500 over a few days, sometimes rotating between branches to blur the trail.
Structuring isn’t limited to deposits that fall just below the threshold. Under FinCEN’s rules, it also covers breaking any single sum above $10,000 into smaller pieces, or conducting a series of cash transactions at or below $10,000, when the goal is to keep the bank from filing a Currency Transaction Report.2Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements Using other people to make deposits on someone’s behalf is the same offense. Compliance officers sometimes call these individuals smurfs, and once monitoring software links the transactions the pattern is straightforward to see.
Money Laundering Patterns
Outside of structuring, laundering-related red flags share one trait: the movement of money doesn’t match any legitimate reason.
Rapid transfers through unrelated accounts. Money that bounces through several accounts with no clear business connection and then moves offshore suggests layering. The goal is to put so many steps between dirty money and its origin that the trail becomes impossible to follow.
Activity inconsistent with the customer’s profile. A customer with a history of modest direct deposits who suddenly wires large sums to a foreign jurisdiction is a classic mismatch. Banks compare what is happening against the customer’s stated occupation, income, and account purpose.
Transactions with no apparent purpose. If a bank examines the available facts and can find no reasonable explanation, that alone is a basis for filing.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Frequent currency exchanges or purchases of monetary instruments. Buying large quantities of money orders, cashier’s checks, or prepaid cards with cash, especially in round amounts, can indicate an effort to convert illicit cash into less traceable forms.
Shell Companies and Hidden Ownership
Shell companies are one of the most effective laundering tools because they place layers of ownership between the criminal and the money. FinCEN has flagged several red flags tied to corporate structure.
The biggest warning sign is complexity that serves no obvious business purpose. When ownership runs through multiple entities in different jurisdictions and the people behind it cannot be identified through database searches or direct inquiry, that opacity is often the point. Nominees in every public-facing role are another indicator. A shell may have a nominee officer, nominee shareholders, and a nominee bank signatory, typically a lawyer or accountant who opens accounts and passes instructions from the actual owners without ever naming them.3FinCEN.gov. Potential Money Laundering Risks Related to Shell Companies
On the transactional side, institutions look for wire transfers where the originator or beneficiary cannot be identified, payments with no stated purpose, and companies whose actual transaction volume far exceeds what the business profile would suggest.3FinCEN.gov. Potential Money Laundering Risks Related to Shell Companies
Fraud and Cybercrime
Fraud-related reports usually involve stolen funds moving through accounts that either belong to victims or were set up specifically to catch scam proceeds.
Account takeover is one of the most common triggers. A criminal uses stolen credentials to access a legitimate customer’s account and starts transfers the real account holder never authorized. Banks flag these when login behavior changes abruptly, such as access from a new device, a foreign IP address, or unusual hours, followed immediately by outgoing transfers.
Scam-related fund flows are another major category. Romance scams, elder exploitation, and business email compromise follow a similar financial shape: the victim deposits or wires money into an account controlled by the criminal or an unwitting intermediary, and the funds move out fast, often overseas, before the fraud comes to light. The speed itself is a red flag. When someone receives a large deposit and immediately wires the same amount to a foreign account, the behavior is inconsistent with normal banking and suggests the account is being used as a pass-through.
Counterfeit instruments still show up. Fraudulent checks, altered money orders, and forged cashier’s checks presented for deposit or cashing are reportable, and they get caught when routing information doesn’t match or when a customer repeatedly deposits checks from unrelated parties that later bounce.
Terrorist Financing and Sanctions Hits
Terrorist financing often looks different from traditional laundering because the amounts tend to be smaller. The goal may be moving relatively modest sums across borders without detection rather than cleaning millions. Red flags include frequent low-dollar purchases of prepaid cards, money orders, or stored value instruments in patterns that suggest cross-border movement.
Sanctions matches are their own category. When a financial institution identifies a customer or counterparty on a list administered by the Office of Foreign Assets Control, it must block the transaction and file a report with OFAC within ten business days.4FinCEN.gov. Interpretation of Suspicious Activity Reporting Requirements to Permit the Unitary Filing of Suspicious Activity and Blocking Reports FinCEN treats that OFAC report as satisfying the SAR obligation in those cases.
Charitable organizations get scrutiny when their use of funds doesn’t match their stated mission or when their financial activity shows transfers to high-risk jurisdictions with no clear charitable connection. If a bank suspects a customer may be linked to terrorist activity, FFIEC guidance calls for the bank to immediately call FinCEN’s Financial Institutions Hotline in addition to filing the SAR.5FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Suspicious Activity Reporting The phone call gets the information to law enforcement faster than the standard electronic filing.
What Happens After a Flag
If you are the subject of a SAR, you will not be told. Federal law prohibits the institution, its directors, officers, employees, agents, and contractors from telling anyone involved in the reported transaction that a report has been filed or that one exists.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority Asking the bank directly will not produce an answer, and the same confidentiality rule binds government employees who see the filing. Unauthorized disclosure can bring civil penalties of up to $100,000 per violation and criminal penalties of up to $250,000 and five years in prison.7FinCEN. SAR Confidentiality Reminder for Internal and External Counsel of Financial Institutions
Banks also enjoy a broad safe harbor for filing. Any financial institution that reports a possible violation of law to a government agency is protected from civil liability under federal, state, or local law, and from private contract claims including arbitration.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The safe harbor covers the failure to notify the customer as well. A customer generally cannot sue a bank for filing a SAR about their account, even if the reported activity turns out to be entirely legitimate, and the institution does not have to prove the suspicion was well-founded.
The other side of that calculus is the penalty for not filing when required. A willful violation of Bank Secrecy Act reporting rules carries criminal fines of up to $250,000, up to five years in prison, or both, with those figures doubling in pattern cases involving more than $100,000 in a 12-month period.8GovInfo. 31 USC 5322 – Criminal Penalties Filing carries legal protection. Not filing carries the risk of prison time. That asymmetry is why banks err heavily on the side of reporting, and why activity that looks only mildly unusual to the customer can still generate a SAR.