What Is a Suspicious Activity Report and How to File?

A Suspicious Activity Report, or SAR, is a confidential filing that banks and other financial businesses submit to the federal government when they spot a transaction that looks like it could involve money laundering, fraud, terrorism financing, structuring, or another financial crime. The requirement traces back to the Bank Secrecy Act of 1970, and the reports go to the Financial Crimes Enforcement Network (FinCEN), a Treasury bureau that makes the data available to law enforcement.¹ Filings are made on FinCEN Form 111 through a secure electronic portal, and the subject of the report is never told a SAR was filed.

Who Has to File

The Bank Secrecy Act reaches most of the financial system. Banks, savings associations, and credit unions file under regulations requiring reports on any suspicious transaction relevant to a possible legal violation.² Money services businesses, including check cashers, currency exchangers, and money transmitters, carry the same duty under a parallel rule.³ Casinos and card clubs must file for suspicious transactions above the applicable threshold.⁴

The obligation also runs to securities broker-dealers, mutual funds, insurance companies, and dealers in precious metals, stones, or jewels. FinCEN has continued to expand the perimeter, most recently through a rule bringing certain professionals involved in non-financed transfers of residential property to legal entities or trusts into the reporting system for transfers on or after March 1, 2026.⁵

When a SAR Is Required

Two things have to line up before a report is required: the transaction has to hit a minimum dollar amount, and the institution has to know, suspect, or have reason to suspect that something illegal is going on. For banks and most other financial institutions, the threshold is $5,000 in funds or assets, whether in a single transaction or across related transactions that add up.⁶ Money services businesses report at $2,000.⁷

Hitting the number alone is not enough. A $6,000 deposit from a customer with a steady paycheck and a history of similar deposits is not suspicious just because it clears $5,000. The institution also needs a reason to believe the transaction involves illegal funds, is designed to disguise the source of money, lacks any obvious lawful purpose for that customer, or is structured to dodge BSA reporting requirements.²

Structuring

One of the most common triggers is structuring: someone deliberately breaks a large sum into smaller deposits or withdrawals to stay under the $10,000 threshold that requires a Currency Transaction Report. Think of a person with $25,000 in cash who makes five separate $4,900 deposits across different branches or days. Structuring is itself a federal crime, even if the underlying money is completely legitimate.⁸ Still, transactions near the $10,000 line do not automatically require a SAR. The institution needs actual knowledge, suspicion, or reason to suspect that the pattern is designed to evade reporting.⁶

Insider Abuse

When the suspicious activity involves the bank’s own people, the dollar floor disappears. If a bank detects that a director, officer, employee, or agent committed or helped commit a criminal act, a SAR is required regardless of amount.⁹ An employee skimming $500 from customer accounts still gets reported.

Cyber-Related Threats

FinCEN has also directed institutions to file when a cyber-event appears intended to conduct, facilitate, or affect a financial transaction. A malware intrusion that puts customer accounts at risk, a data breach exposing account credentials, or a denial-of-service attack used to distract staff while an unauthorized transfer clears can all trigger a filing. FinCEN asks institutions to include technical details such as IP addresses with timestamps, device identifiers, and indicators of compromise.¹⁰

How to File

SARs go on FinCEN Form 111, formally the FinCEN SAR. For each known subject, the filer records identifying details: legal name, address, date of birth, Social Security or taxpayer identification number, and any account numbers tied to the activity. The form also captures transaction specifics, including dates, dollar amounts, and the type of suspicious activity involved.¹¹

The narrative section carries most of the weight. This is where the filer explains, in plain English, what happened and why it looked suspicious. FinCEN expects the narrative to answer who was involved, what transactions occurred, when and where they happened, and why the institution considers the activity suspicious. A strong narrative walks through the facts in chronological order, identifies the accounts and branches involved, and explains how the transactions deviated from what the institution would expect for that customer’s profile.¹² A form with every box checked but a vague two-sentence narrative gives investigators almost nothing to work with.

All SARs are submitted electronically through FinCEN’s BSA E-Filing System, a secure web portal that accepts individual filings and batch submissions.¹³

Deadlines

Once a bank detects facts that could warrant a SAR, it has 30 calendar days to file. If no suspect has been identified by the detection date, the bank gets another 30 days to investigate, but the filing cannot be delayed more than 60 calendar days after initial detection.² For situations demanding immediate attention, such as an ongoing money laundering scheme or suspected terrorism financing, the institution also has to notify the appropriate law enforcement agency by phone right away, on top of filing the SAR on time.⁹

Suspicious activity often does not stop after the first report. When the pattern continues, FinCEN has advised institutions to file follow-up SARs at least every 90 days, with the deadline for each continuing-activity SAR falling 120 calendar days after the previous filing, covering the 90-day window that followed it.⁶ Institutions are not required to run a separate review after each SAR just to check whether the activity continued; they can rely on normal risk-based monitoring. If that monitoring shows the pattern persists, the follow-up filing is expected.

Confidentiality: The Tipping-Off Rule

Federal law makes it illegal for anyone involved in the SAR process to tell the subject that a report was filed. The prohibition covers the institution itself, its current and former employees, and government officials who learn about the filing. No one may notify the person involved in the transaction or reveal information that would tip them off to the report’s existence.¹⁴ Violations can bring civil penalties of up to $100,000 per violation and criminal penalties of up to $250,000 in fines, five years in prison, or both.¹⁵ One narrow exception lets an institution include SAR-related information in a written employment reference given to another financial institution, so long as the reference does not disclose that a SAR was actually filed.

Safe Harbor for Filers

The same statute shields filers from lawsuits. An institution or employee that files a SAR, voluntarily or because the law requires it, cannot be held liable under any federal or state law, contract, or arbitration agreement for making the disclosure. Even if the reported transaction turns out to be entirely legitimate, the filer is protected from suit by the customer.¹⁴

Recordkeeping

Filing does not close the file. Banks must keep a copy of every SAR they file along with the original supporting documentation for five years from the filing date. Supporting documents are treated as if filed with the SAR itself, and the institution must produce them on request to FinCEN, federal and state regulators, and law enforcement agencies.² An FBI agent contacting a bank three years after a filing to ask for the account statements and internal memos behind it should get them.

Penalties for Failing to File

A financial institution or any of its partners, directors, officers, or employees who willfully violate BSA reporting requirements can face a civil penalty of up to $100,000 per transaction or $25,000, whichever is greater.¹⁶ Those numbers add up quickly across dozens or hundreds of transactions.

A willful criminal violation carries a fine of up to $250,000, up to five years in prison, or both. If the violation occurs while the person is also breaking another federal law, or is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximums jump to $500,000 and ten years.¹⁷

1
FinCEN. About FinCEN
2
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
3
eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
4
eCFR. 31 CFR 1021.320 – Reports by Casinos of Suspicious Transactions
5
FinCEN.gov. Residential Real Estate Rule
6
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
7
FinCEN.gov. MSB Threshold – $2,000 or More
8
Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
9
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
10
Financial Crimes Enforcement Network. FinCEN Advisory – Cyber Threats Advisory
11
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
12
FinCEN. Keys to a Well Prepared Suspicious Activity Report
13
FinCEN. BSA Direct E-Filing Fact Sheet
14
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
15
Financial Crimes Enforcement Network. FinCEN Advisory FIN-2012-A002
16
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
17
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties