When Should a SAR Be Filed? Thresholds, Deadlines, and Penalties

A Suspicious Activity Report should be filed as soon as a covered financial institution knows, suspects, or has reason to suspect that a transaction involves criminal proceeds, is designed to evade Bank Secrecy Act reporting, or has no apparent lawful purpose, provided the activity meets the dollar threshold that applies to that type of institution. The clock is short: 30 calendar days from detection if a suspect has been identified, and no more than 60 days if one has not.

Dollar Thresholds That Trigger a Filing

The threshold depends on the kind of institution and, for banks, on whether a suspect can be named.

Banks and credit unions file at $5,000 when a suspect is known, and at $25,000 when no suspect can be identified but the institution believes it was used to facilitate a crime or was itself a victim.
Money services businesses — money transmitters, check cashers, currency exchanges, and sellers of money orders or traveler’s checks — file at $2,000.¹
Casinos and card clubs, broker-dealers in securities, and insurance companies file at $5,000 for suspicious transactions involving covered products.

The lower MSB threshold reflects the higher money-laundering risk in cash-intensive businesses. An MSB that applies the $5,000 bank threshold is already out of compliance.

One category ignores the dollar amount entirely. If the suspicious activity involves a director, officer, employee, or agent of the institution itself, a bank must file regardless of the sum involved, even if no money moved. Insider abuse triggers the duty at any amount because small, repeated acts by someone with access can cause serious damage.²

Behavior That Requires a Report

Dollar amounts are only half of the test. The nature of the transaction is the other half. A SAR is required when the institution knows, suspects, or has reason to suspect that funds come from illegal activity, that the transaction is structured to evade reporting requirements, or that it has no apparent lawful purpose after the institution reviews the available facts.²

Structuring is the most common behavioral trigger. Breaking a large cash transaction into smaller pieces to stay under the $10,000 Currency Transaction Report threshold is itself a federal crime, punishable by up to five years in prison and a $250,000 fine.³ Structuring is not always as obvious as two $9,500 deposits. It also covers spreading deposits across multiple branches, using different tellers in a single day, or routing cash through accounts held by family members.

Other qualitative triggers include customers who seem unusually nervous about routine paperwork, businesses whose cash deposits far exceed what their stated industry would generate, and wire transfers to high-risk jurisdictions with no visible business connection. The rules leave room for professional suspicion rather than tying everything to a number.

Cyber Events

Cyber-related incidents are reportable even when the attack failed. If an institution detects a hacking attempt, unauthorized account access, or malware intrusion that was intended to affect a transaction, or reasonably could have, the event is reportable whether or not the attacker succeeded.⁴ Regulators expect institutions to treat unsuccessful cyberattacks with the same seriousness as completed ones.

How Long You Have To File

The deadline starts when the institution first detects facts that may warrant a filing, not when it finishes its investigation or reaches a final determination.

Suspect identified at detection: 30 calendar days to file.²
No suspect identified: an additional 30 days is allowed to try to identify one, but the filing cannot be delayed beyond 60 calendar days from initial detection.⁵

When To Pick Up the Phone Instead

Some situations cannot wait for the paperwork. Activity that suggests terrorist financing should be reported by phone to FinCEN’s Financial Institutions Toll-Free Hotline at (866) 556-3974, which is staffed 24 hours a day, seven days a week. Any imminent threat should also go to local law enforcement immediately.⁶ The written SAR still has to be filed through the normal process, but the call gets the information to investigators without a 30-day delay.

Continuing Activity

Filing once does not close the file if the conduct continues. FinCEN guidance recommends that institutions review continuing activity at least every 90 days after the initial SAR. On that cadence, a follow-up SAR covering the prior 90 days is due 30 days after the review period ends — roughly day 150 counting from initial detection, if the first SAR went out on day 30.⁷ Institutions are not required to conduct a separate post-filing review to check for continuation; they may rely on their own risk-based monitoring. Regulators do notice, though, when an initial SAR is followed by silence on a customer whose pattern has not changed.

Filing Below the Threshold

Institutions are not limited to mandatory filings. Federal regulations expressly permit voluntary SARs for any suspicious transaction the institution believes may involve criminal activity, even below the required dollar amount.⁸ The same safe harbor that protects mandatory filings covers voluntary ones, so there is no added legal exposure in reporting something that later turns out to be legitimate.

Safe Harbor and the No-Tipping-Off Rule

Two federal protections sit at the core of the process, and they run in opposite directions. The safe harbor shields any institution that files a SAR, mandatory or voluntary, from civil liability arising from the disclosure.⁹ A customer cannot successfully sue a bank for reporting them, even if the suspicion turns out to be unfounded.

At the same time, the law flatly prohibits telling the subject that a SAR was filed. No director, officer, employee, or agent may notify the person involved or reveal information that would tip them off, and the same rule binds government employees who learn about a SAR through their duties.⁹ Violating the confidentiality rule can bring criminal charges against the individual who disclosed. A narrow exception lets institutions include SAR-related facts in written employment references requested by another financial institution, but even those cannot say a SAR was filed.

What Happens If a Required SAR Is Not Filed

Missing a required filing carries civil and criminal exposure. A financial institution, or any partner, director, officer, or employee, who willfully violates BSA reporting requirements faces civil penalties of up to the greater of $100,000 or $25,000 per violation.¹⁰ Willful violations can also draw criminal fines of up to $250,000 and imprisonment of up to five years. When the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, or occurs alongside another federal crime, those maximums double to $500,000 and ten years.¹¹ FinCEN has shown it will pursue smaller institutions as well, particularly where the compliance program was inadequate or staff ignored obvious red flags.

1
eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
2
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
3
FinCEN. A CTR Reference Guide
4
FinCEN.gov. Frequently Asked Questions Regarding the Reporting of Cyber-Events, Cyber-Enabled Crime, and Cyber-Related Information through SARs
5
Office of the Comptroller of the Currency (OCC). Suspicious Activity Report (SAR) Program
6
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report (SAR)
7
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
8
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
9
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
10
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
11
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties