A Suspicious Activity Report, or SAR, is a confidential form that banks and other financial businesses file with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) when they spot a transaction that may involve money laundering, fraud, terrorist financing, or another federal crime. The report is required by the Bank Secrecy Act, and it generally kicks in once a suspicious transaction crosses a set dollar amount: $5,000 for most banks, $2,000 for money services businesses. The institution has 30 calendar days from the date it detects the activity to file, with a possible 30-day extension when no suspect has yet been identified.
Which Businesses Have to File
The filing obligation reaches well beyond traditional banks. Rules sit in 31 CFR Chapter X, with a separate part for each industry.1eCFR. 31 CFR Chapter X – Financial Crimes Enforcement Network, Department of the Treasury Covered businesses include:
- Banks, savings associations, and credit unions2eCFR. 31 CFR Part 1020 – Rules for Banks
- Money services businesses, which cover money transmitters, currency exchangers, check cashers, and sellers of money orders or traveler’s checks3eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses
- Broker-dealers in securities4eCFR. 31 CFR 1023.320 – Reports by Brokers or Dealers in Securities of Suspicious Transactions
- Insurance companies5eCFR. 31 CFR 1025.320 – Reports by Insurance Companies of Suspicious Transactions
- Casinos and card clubs
- Dealers in precious metals, precious stones, or jewels
- Loan and finance companies, including non-bank mortgage lenders and originators6eCFR. 31 CFR 1029.320 – Reports by Loan or Finance Companies of Suspicious Transactions
Dollar Thresholds That Trigger a Filing
Dollar thresholds vary by institution type. For banks, the amount depends on whether a suspect can be identified and what the suspected offense is:
- $5,000 or more when the bank identifies a possible federal crime and has a known suspect.
- $25,000 or more when the bank believes it was victimized or used to facilitate a crime but cannot identify a suspect.
- $5,000 or more for any transaction that involves potential money laundering or a Bank Secrecy Act violation, whether or not a suspect is known.
Each tier applies to a single transaction or to a pattern of related transactions that together reach the threshold.7eCFR. 12 CFR 208.62 – Suspicious Activity Reports
Money services businesses have a lower $2,000 threshold. The one carve-out: issuers of money orders or traveler’s checks reviewing clearance records use $5,000.8eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
What Counts as Suspicious
Hitting a dollar amount is not enough on its own. The institution also needs reason to believe the transaction may involve illegal activity. A few patterns show up again and again.
Structuring
Structuring means breaking up a larger cash transaction into smaller pieces to stay under the $10,000 Currency Transaction Report threshold. Depositing $9,000 in cash on two consecutive days rather than making one $18,000 deposit is a textbook example. Structuring is a federal crime on its own, even if the money being deposited is clean.9Financial Crimes Enforcement Network. Notice to Customers – A CTR Reference Guide
Activity That Doesn’t Match the Customer
Financial institutions build a profile of expected activity for each customer: typical deposit size, how often wires go out, the nature of the business. A sharp departure from that baseline without an explanation is a red flag.10Financial Crimes Enforcement Network. Customer Due Diligence Requirements FAQ Think of frequent large wires to high-risk countries from an account holder with no overseas business, or a sudden surge in cash deposits that the customer’s known income cannot support.
Hiding the Source or Owner of Funds
Moves that look designed to obscure where money came from or who actually controls it also drive filings. Funneling funds through multiple accounts at different banks, routing payments through shell companies, and rapid layering through a series of accounts are common examples.
Cyber-Events
FinCEN has said that cyber-attacks aimed at a financial institution can trigger a SAR when the attack is meant to enable unauthorized transactions. A malware intrusion that puts customer funds at risk, or a denial-of-service attack used as cover for a fraudulent wire, both require a filing when the suspicious activity meets the applicable dollar threshold. Cyber-related SARs should include technical details: IP addresses, timestamps, device identifiers, and a description of how the attack unfolded.11Financial Crimes Enforcement Network. Advisory on Cyber-Events and Cyber-Enabled Crime
What Goes Into the Report
SARs are filed on FinCEN Form 111. The form collects three categories of information.
Subject information. The filer provides the subject’s legal name, address, Social Security or taxpayer identification number, date of birth, and a form of government ID such as a driver’s license or passport. These identifiers let federal agencies connect activity across different institutions.12Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
Institution information. The form captures the filer’s legal name, taxpayer ID, and primary federal regulator. The filer also selects codes identifying the type of suspicious activity, such as money laundering, structuring, or fraud, which helps FinCEN route the report.
The narrative. This is the heart of the SAR. In plain language, the filer explains what happened, when, how the activity was detected, and why it looks suspicious. Law enforcement leans heavily on the narrative when deciding whether to open an investigation. A clear chronological account is far more useful than codes and numbers alone.
Filing Deadlines and How the Report Is Submitted
A SAR must be filed within 30 calendar days after the institution first spots facts suggesting suspicious activity. When no suspect has been identified by day 30, the institution gets up to 30 more days, so 60 days total, to try to identify the person involved. The 60-day mark is a hard ceiling.7eCFR. 12 CFR 208.62 – Suspicious Activity Reports
All SARs go in electronically through the BSA E-Filing System, FinCEN’s secure portal. The system accepts both single filings and batch submissions.13FFIEC BSA/AML Manual. Appendix T – BSA E-Filing System Once filed, the report lands in a central database that the FBI, IRS, and other law enforcement agencies can query.
When Suspicious Activity Continues
If the behavior keeps up after the initial filing, more SARs are required. FinCEN tells institutions to review ongoing activity in 90-day windows. When the first SAR was filed on day 30 after detection, the first review period closes on day 120, and a follow-up SAR covering that stretch is due by day 150. Each later follow-up follows the same rhythm: a 90-day review period, then a 30-day window to file.14Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
When no suspect was identified and the initial filing landed on day 60, the schedule shifts: the first review period ends on day 150, and the follow-up SAR is due by day 180. Each follow-up should cover the full 90-day review period beginning the day after the previous SAR was filed.
Why You Won’t Be Told About a SAR
Federal law makes it illegal for an institution, its officers, employees, or agents to tell the person being reported, or anyone else, that a SAR has been filed. Government employees who learn of a SAR are bound by the same rule. The secrecy is meant to protect investigations and keep subjects from destroying evidence or fleeing.15Office of the Law Revision Counsel. 31 U.S.C. 5318 – Compliance, Exemptions, and Summons Authority
In exchange for the cooperation, a safe harbor shields filers from civil liability. An institution that files a SAR, whether required or voluntary, cannot be sued by the person reported, provided the filing was made in connection with a possible legal violation. The protection extends to any employee who takes part in or directs the filing.
Penalties for Failing to File
Missing a SAR obligation can produce both civil and criminal consequences.
On the civil side, a willful violation of the Bank Secrecy Act’s reporting rules can draw a penalty of up to the greater of $100,000 or the amount of the transaction, with a $25,000 cap per non-willful violation.16Office of the Law Revision Counsel. 31 U.S.C. 5321 – Civil Penalties After inflation adjustments in effect as of January 2025, willful BSA violations carry adjusted penalties ranging from $71,545 to $286,184 per violation, and a pattern of negligent violations by an institution can reach $111,308 per violation.17eCFR. 31 CFR 1010.821 – Penalty Adjustment and Table
On the criminal side, a person, including a bank employee, who willfully violates the BSA or its regulations faces up to $250,000 in fines, up to five years in prison, or both. When the violation happens alongside another federal crime, or is part of a pattern of illegal activity involving more than $100,000 over 12 months, the maximum penalties rise to $500,000 and up to ten years.18Office of the Law Revision Counsel. 31 U.S.C. 5322 – Criminal Penalties Institutions can also face supervisory enforcement from their federal regulator on top of any fines.