A Suspicious Activity Report, or SAR, is a confidential document that a bank or other financial institution files with the Financial Crimes Enforcement Network (FinCEN) when it sees a transaction that may involve money laundering, fraud, structuring, terrorist financing, or another financial crime. The Bank Secrecy Act requires the filing, federal law forbids the institution from telling you a report was made, and there is no public mechanism to find out whether one exists about you. What follows explains when a report is required, what triggers one, what it contains, and what the rules mean for the person whose transactions are being watched.
Who Files These Reports
The obligation to file reaches well beyond ordinary banks. National banks, state-chartered banks, savings associations, and credit unions all file.1eCFR. 12 CFR 208.62 – Suspicious Activity Reports So do money services businesses that handle currency exchange or money transmission, casinos and card clubs with more than $1 million in gross annual gaming revenue, and securities broker-dealers registered with the SEC.2eCFR. 31 CFR Part 1010 – General Provisions Insurance companies file when suspicious activity involves certain covered products.3eCFR. 31 CFR 1025.320 – Reports by Insurance Companies of Suspicious Transactions Each category has its own regulation that sets what must be reported and when.
The Dollar Thresholds
Whether a transaction is large enough to require reporting depends on the type of institution.
For banks, broker-dealers, casinos, and insurance companies, the floor is $5,000 in funds.4FFIEC BSA/AML Examination Manual. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting5eCFR. 31 CFR 1021.320 – Reports by Casinos of Suspicious Transactions Money services businesses have a lower bar, $2,000. Issuers of money orders or traveler’s checks whose reporting is derived from a review of clearance records report at $5,000.6eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
The threshold applies to a single transaction or to a pattern of related transactions that add up to the amount. A lone $4,500 wire at a bank sits below the $5,000 floor. Three related transfers from the same customer totaling $6,000 does not.
What Actually Triggers a Report
Meeting the dollar threshold is not enough on its own. The institution must also have a reason to suspect the transaction involves illegal activity, is designed to evade a reporting requirement, or has no apparent lawful purpose. Compliance staff look for recognizable patterns.
Structuring is the most common one. A customer who splits a $15,000 cash deposit into three $4,900 deposits over consecutive days is almost certainly trying to slip under the separate $10,000 Currency Transaction Report requirement. That deliberate splitting is a crime by itself, regardless of where the money came from, and institutions are trained to catch it even when the deposits move between branches.
Other common red flags include:
- Large deposits with no clear connection to the customer’s known income or business.
- Money arriving by wire and moving out immediately to unrelated parties, especially across borders.
- Activity that doesn’t fit the customer’s stated occupation, account history, or the type of account involved.
- A customer who tries to discourage an employee from filing paperwork or asks whether a transaction will be reported.
- Funds flowing through business accounts that show no apparent commercial operations, particularly when layered through several entities.
Cryptocurrency activity has its own set of warning signs. FinCEN has flagged repeat deposits at virtual currency kiosks just below reporting thresholds, wallets that blockchain analysis links to known fraud operations, and older customers with no crypto history who suddenly make high-value kiosk transactions at the direction of someone on the phone.7Financial Crimes Enforcement Network. FinCEN Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity That last pattern is a hallmark of scam-directed payments, and FinCEN has told institutions to watch for it.
Real estate is another high-risk area. Straw buyers, rapidly inflated property values, cash payments to title companies in amounts just under $10,000, and unexplained third-party funding of mortgage payments all routinely generate reports. Nothing has to be proven illegal for the filing duty to attach. A reasonable basis for suspicion is enough.
What the Report Contains
A SAR pairs structured data with a written narrative. The structured fields identify the subject: legal name, Social Security or Taxpayer Identification Number, date of birth, address, and contact information, pulled from the records gathered during account opening.
The narrative is where the substance is. FinCEN expects it to answer who the subject is, what instruments and accounts were involved, when the transactions occurred with specific dates and amounts, where the activity took place including any foreign jurisdictions, and why the filer considers it suspicious.8Financial Crimes Enforcement Network. Guidance on Preparing A Complete and Sufficient Suspicious Activity Report Narrative The narrative also describes how the subject carried out the activity. Everything is filed electronically through the BSA E-Filing System.9Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions
How Quickly the Report Gets Filed
An institution has 30 calendar days from the date it first detects facts suggesting a reportable transaction to file. If no suspect has been identified by day 30, it gets another 30 days to try, but filing cannot be delayed past 60 days from initial detection under any circumstances.10Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
After filing, the institution keeps a copy and all supporting documentation for five years, available on request to FinCEN, federal or state law enforcement, and any regulator examining the institution for BSA compliance.11eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions Supporting documentation covers transaction records, account statements, and the internal notes behind the filing decision.
Can You Find Out If a Report Was Filed About You
No. Federal law makes the confidentiality absolute from the subject’s side. Under 31 U.S.C. 5318(g)(2), no current or former employee or contractor of the institution may tell any person involved in the transaction that a report was filed or disclose anything that would indicate one exists.12Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The same prohibition binds government employees who learn about a SAR through their official duties. Violating it can bring criminal charges.
A teller cannot tell you that a deposit triggered a report. A branch manager cannot confirm one under direct questioning. A compliance officer who leaves the institution carries the obligation out the door. SARs are not subject to discovery in private litigation, and FinCEN does not release them to the public. If you suspect a report was filed, the institution is legally barred from confirming or denying it.
Institutions do have narrow, defined channels to share SAR information with FinCEN, their federal banking regulator, federal or state law enforcement, and regulators examining them for BSA compliance, as long as the person involved in the transaction is never notified.13eCFR. 12 CFR 163.180 – Suspicious Activity Reports and Other Reports and Statements They can also share the underlying transaction records that led to a filing with another financial institution when preparing a joint report, and they can include SAR-related information in written employment references when a former employee involved in suspicious activity applies elsewhere.
Institutions also participate in a voluntary information-sharing program under Section 314(b) of the USA PATRIOT Act, exchanging details about individuals, entities, and transactions when they have a reasonable basis to believe the information relates to possible money laundering or terrorist activity.14Financial Crimes Enforcement Network. Section 314(b) Fact Sheet This is one reason a customer who moves flagged activity from one bank to another often gets flagged at the second bank too.
Structuring Is Its Own Crime
The single thing most likely to catch an ordinary person off guard is that structuring, meaning deliberately breaking transactions into smaller amounts to stay under a reporting threshold, is a federal crime by itself. It does not matter whether the underlying money is legal. The offense targets the act of evading the reporting system.
A conviction carries a fine under Title 18 and up to five years in prison. Aggravated structuring, where the violation occurs alongside another federal crime or involves more than $100,000 in a 12-month period, doubles the available fine and raises the prison term to up to 10 years.15Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Attempts are punished the same as completed offenses.
Forfeiture follows automatically. On sentencing, the court must order the defendant to forfeit all property involved in the offense and any property traceable to it.16Office of the Law Revision Counsel. 31 USC 5317 – Search and Forfeiture of Monetary Instruments The government can also pursue civil forfeiture of the same property without a criminal conviction, using the procedures that apply in money laundering cases. If you deposit $30,000 in structured amounts, the government can move to seize the full $30,000 whether or not you are ever charged.
What Happens After the Report Is Filed
Every SAR flows into FinCEN’s BSA E-Filing System and becomes available to authorized law enforcement and regulatory users across federal, state, and local agencies.9Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions FinCEN analysts look for patterns across filings, connecting transactions at different institutions that may involve the same individuals or networks.
Actual investigative follow-up happens at the local level through SAR Activity Review Teams. Roughly 105 of these teams operate across the country, with at least one in every federal judicial district. A typical team pulls agents from IRS Criminal Investigation, the FBI, DEA, Secret Service, ICE, and the U.S. Attorney’s Office, along with state and local law enforcement. The team meets regularly to review new filings, divide them up by jurisdiction or crime type, and decide which warrant a full investigation.
Not every report leads anywhere. Filing volume is high, and many reports become part of the background intelligence picture rather than triggering an immediate response. A SAR can still resurface years later if the same subject shows up in a new investigation or if a pattern emerges across filings from different institutions. The record has a long memory.