What Are Suspicious Activity Reports (SARs)?

A Suspicious Activity Report, or SAR, is a confidential document that a bank, credit union, or other financial business files with the federal government when it spots a transaction that looks like it could involve criminal activity. Filers sent roughly 4.7 million of these reports to the Financial Crimes Enforcement Network (FinCEN) in fiscal year 2024.¹ The Bank Secrecy Act requires the filings, and both the customer and the general public are kept in the dark about them by design.

Who Has to File

The obligation reaches well past traditional banks. Federal regulations require SARs from banks and credit unions, casinos and card clubs, money services businesses (check cashers, money transmitters, currency exchangers, and sellers of money orders or traveler’s checks), brokers and dealers in securities, mutual funds, insurance companies, futures commission merchants, loan and finance companies, and the housing government-sponsored enterprises such as Fannie Mae and Freddie Mac.²

Cryptocurrency Exchanges

FinCEN treats businesses that accept and transmit convertible virtual currency as money transmitters. Cryptocurrency exchanges, including peer-to-peer exchangers, must register as money services businesses and follow the same SAR rules as any other MSB.³

Real Estate

Certain all-cash home purchases get pulled in through FinCEN’s Geographic Targeting Orders, which require title insurance companies to report residential purchases made by legal entities such as shell companies in designated high-risk metropolitan areas. The title company must file within 30 days of closing and identify anyone who owns 25% or more of the buying entity.⁴ Lender-financed purchases are already screened through the bank’s own compliance process and aren’t the target.

What Triggers a Filing

Two things have to line up: a dollar threshold and a reason to suspect the transaction.

The Dollar Thresholds

For banks, the baseline is $5,000. A bank must file a SAR for any transaction it conducts or attempts that involves at least $5,000 in funds or assets when it has reason to suspect the money came from illegal activity, the transaction is designed to evade reporting requirements, or the activity has no apparent lawful purpose.⁵ The same $5,000 floor covers broker-dealers, insurance companies, mutual funds, and other financial institutions.²

Money services businesses have a lower threshold of $2,000.⁶ Because crypto exchanges fall under the MSB category, that lower floor applies to them too.

Banks have one additional trigger. When suspicious activity aggregates to $25,000 or more and there’s no substantial basis for identifying a suspect, a SAR is still required even without a named subject.⁷

Red Flags

Structuring is the pattern that shows up most often. Someone breaks a large sum into smaller deposits or withdrawals to keep each piece below a reporting threshold. Structuring is a standalone federal crime under 31 U.S.C. § 5324, and it doesn’t matter whether the underlying money is clean.⁸

Beyond structuring, institutions watch for activity a particular customer would not normally be expected to engage in, when the bank can’t find a reasonable explanation after looking into it.⁵ A retiree wiring $50,000 overseas out of nowhere, a small cash business depositing ten times its usual weekly revenue, or rapid movement of money through several accounts and then abroad can each meet that standard. Attempted transactions count as well. If a customer walks away or the institution blocks the transfer, the attempt on its own can still require a filing when it meets the dollar and suspicion criteria.

How SARs Differ From Currency Transaction Reports

People often mix up SARs with Currency Transaction Reports (CTRs), and the difference matters. A CTR is automatic. Federal law requires a financial institution to file one for any cash transaction over $10,000, with no judgment call about suspicion involved.⁹ Multiple cash transactions by the same person on the same day that add up over $10,000 also trigger one.

A SAR is judgment-based. The compliance team decides whether the activity looks suspicious under the thresholds and red flags above. A $6,000 wire won’t produce a CTR, but it can absolutely produce a SAR if the circumstances look wrong. Banks are also allowed to tell customers about CTRs. They are not allowed to say anything about a SAR.

The 30-Day Filing Clock and Records

Once suspicious activity is detected, the institution has 30 calendar days to file the SAR with FinCEN.² If no suspect has been identified by that point, the institution gets an additional 30 days to try, but the total delay cannot go past 60 days from initial detection. For ongoing conduct involving the same person or account, the institution files continuing SARs covering each 90-day period of activity.

Copies of every SAR and its supporting documentation must be kept for five years from the filing date.¹⁰ The supporting records are identified as part of the file but not sent to FinCEN with the report itself.

What the Report Actually Contains

The centerpiece of a SAR is a written narrative. The filer explains in plain English what made the activity unusual, who benefited, whether the transaction was completed or only attempted, and where it occurred.⁷ The rest of the form captures structured data about the filing institution, the subject, the transaction amounts and dates, and the type of suspicious activity. When conduct spans multiple days, the narrative runs chronologically so investigators can follow the timeline. Filers also note evidence of any cover-up, any admissions the subject made, and whether the conduct looks isolated or part of a broader pattern.

Why Customers Never Find Out

The whole system depends on secrecy, because a subject who learned about a filing would change behavior, destroy evidence, or move funds. Federal law puts two protections around that.

Non-Disclosure

A financial institution cannot tell a customer, or anyone outside the compliance process, that a SAR has been filed or even that one exists. The prohibition covers current and former directors, officers, employees, agents, and contractors, and unauthorized disclosure is a federal crime.¹¹

The rule binds government agencies too. Federal, state, and local authorities can use SAR data only for their official duties, and those duties do not include producing a SAR to a private litigant.¹² You cannot obtain a SAR through a civil subpoena, a discovery request, or a Freedom of Information Act request. If a bank is subpoenaed for one, it must refuse to produce it.

One carve-out matters. The underlying transactions and business records the SAR was built from, such as account statements, wire transfer records, and deposit slips, are not themselves confidential. Those can still be obtained through normal civil discovery, so long as the production doesn’t reveal that a SAR exists.¹²

Safe Harbor for Filers

Under 31 U.S.C. § 5318(g)(3), a financial institution that reports a possible law violation, along with any director, officer, employee, or agent involved in that disclosure, is shielded from liability under federal law, state law, regulation, or contract, including arbitration agreements.¹³ The institution has no obligation to notify the subject. The protection applies even if the suspicion turns out to be wrong, so long as the filing was made in good faith.

Penalties

Enforcement runs both ways: against institutions that fail to file, and against anyone who leaks a filing.

Failure to File

A financial institution that willfully fails to file a required SAR faces civil penalties up to the greater of $100,000 or the amount of the transaction, plus $25,000 for each day the violation continues at each branch involved.¹⁴ Individual officers and employees personally responsible for the failure face the same exposure. Criminal penalties for a willful violation run up to a $250,000 fine and five years in prison, doubling to $500,000 and ten years when the failure is part of a pattern of illegal activity involving more than $100,000 in a 12-month period.¹⁵

Unauthorized Disclosure

Revealing the existence of a SAR carries civil penalties up to $100,000 per violation and criminal penalties up to $250,000 and five years in prison.¹¹ Institutions can face additional daily penalties up to $25,000 per day when the leak resulted from weaknesses in their anti-money-laundering program, such as inadequate training or weak internal controls. The obligation follows employees after they leave the institution, and each separate disclosure can count as a separate violation.

1
Financial Crimes Enforcement Network. FinCEN Year in Review for FY 2024
2
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements October 2025
3
Financial Crimes Enforcement Network. Advisory on Illicit Activity Involving Convertible Virtual Currency
4
Financial Crimes Enforcement Network. Geographic Targeting Order Covering Title Insurance Company
5
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
6
eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
7
Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions
8
Office of the Law Revision Counsel. 31 U.S. Code 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
9
Financial Crimes Enforcement Network. Notice to Customers – A CTR Reference Guide
10
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
11
Financial Crimes Enforcement Network. FinCEN Advisory FIN-2012-A002
12
Financial Crimes Enforcement Network. Confidentiality of Suspicious Activity Reports – Final Rule
13
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
14
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
15
Office of the Law Revision Counsel. 31 U.S. Code 5322 – Criminal Penalties