Suspicious activity is behavior that has no clear lawful or business purpose, does not fit what you know about the customer, or otherwise points to possible money laundering, fraud, or other crime. It is the trigger for considering a SAR, and the bar is reasonable suspicion, not proof of a crime.
What is suspicious activity, in plain English?
Suspicious activity is conduct that makes you think, on reasonable grounds, that something illegal may be going on. It might have no clear lawful or business purpose, it might not fit what you know about the customer, or it might match a known laundering or fraud pattern. The key word is possible: you do not need to prove a crime, you need a reasonable basis for suspicion.
It sits at the heart of the monitoring workflow. Alerts and analyst reviews exist to surface activity, then a person decides whether that activity crosses from merely odd into genuinely suspicious. If it does, the institution considers filing a suspicious activity report with its financial intelligence unit.
The threshold is reasonable suspicion, which is lower than proof but higher than a vague unease. Context is everything: the same wire that looks alarming for one customer is perfectly normal for another whose business and history explain it.
Unusual versus suspicious
Analysts live on the line between activity that is merely unusual and activity that is truly suspicious. The difference decides whether you file:
What changes | Unusual activity | Suspicious activity |
What it means | Departs from expected pattern or peer norms. | Points to possible money laundering, fraud, or crime. |
Standard | Worth a closer look. | Reasonable suspicion, after review. |
Next step | Investigate and document the explanation. | Consider filing a SAR or STR. |
Typical outcome | Often has a legitimate explanation. | Escalated when no innocent explanation holds up. |
What it looks like in practice
In practice
A retail customer who normally keeps a few thousand dollars in the account suddenly receives ten wires of just under the reporting limit from different senders over two weeks, then sends the full balance to a newly added overseas beneficiary.
The analyst pulls the history, checks the stated occupation and known income, and finds nothing that explains the inbound funds or the new counterparty. There is no proof of a crime, but there is no innocent story either. The reasonable conclusion is suspicion of layering, the reasoning is documented, and the case is escalated for a SAR decision.
Why the judgment call matters
Deciding what counts as suspicious is the core of the job, and the risk runs both ways. Under-report genuine cases and real crime stays unflagged, which is exactly what examiners and law enforcement care about. Over-report by defensively filing on merely odd activity that review could explain, and you flood the intelligence system with low value reports that bury the signal.
What protects an operator is documented reasoning. It is rarely the raw activity that gets criticized; it is a filing decision, either way, that has no clear analysis behind it. Judgment backed by a written rationale is what turns a hunch into a defensible conclusion.
What to watch in the data
- No business rationale. Transactions that make no sense for the customer's known profile, income, or stated purpose.
- Structuring signs. Amounts repeatedly sitting just below reporting thresholds suggest deliberate avoidance.
- Sudden change. A dormant or low activity account that abruptly turns into a high velocity conduit.
- Evasive customers. Reluctance to explain source of funds, or shifting stories when asked, is itself a red flag.
- Context, not just amount. Small transactions can be suspicious and large ones innocent; the customer's profile decides.
Quick questions
Does suspicious mean I have proof of a crime?
No. The standard is reasonable suspicion, not proof. You need a rational basis to suspect possible illegal conduct, not evidence that would stand up in court. Proving the crime is law enforcement's job.
How is it different from unusual activity?
Unusual activity just departs from expected behavior and warrants a look. It becomes suspicious only after review leaves you with a reasonable suspicion of money laundering, fraud, or other crime. Much unusual activity turns out to be innocent.
What do I do once activity is suspicious?
Escalate it through your internal process for a SAR or STR decision, document the reasoning, and avoid tipping off the customer. Continuing activity may warrant follow up reports.
Can I be penalized for filing too much?
Defensive over-filing is not illegal, but it is a recognized problem. It clogs the system with low value reports and can itself draw examiner criticism if it signals that your analysis is weak rather than risk based.
Who decides if activity is suspicious?
Frontline analysts assess and document, but the final filing decision usually sits with a designated officer such as a BSA officer or MLRO, who owns the institution's reporting responsibility.
What if the customer has an innocent explanation?
Then you record it and, if it genuinely resolves the concern, you may not need to file. The point is that the explanation must hold up against what you know; document how you tested and resolved it.
Go deeper
- FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance.
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.