What is Suspicious Activity Report (SAR)?

--- title: What is Suspicious Activity Report (SAR)? source_page: https://www.sardine.ai/fraud-aml-glossary/suspicious-activity-report-sar canonical: https://www.sardine.ai/fraud-aml-glossary/suspicious-activity-report-sar format: text/markdown description: A SAR is a confidential report filed with the financial intelligence unit, in the US to FinCEN, describing activity suspected of involving money laundering, fraud, or other illegal conduct. It is generally due within a set period after you detect the activity. It is how private-sector monitoring feeds real intelligence to law enforcement. --- **Quick links:** [Human page](https://www.sardine.ai/fraud-aml-glossary/suspicious-activity-report-sar) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # What is Suspicious Activity Report (SAR)? **Read time:** 4 A SAR is a confidential report filed with the financial intelligence unit, in the US to FinCEN, describing activity suspected of involving money laundering, fraud, or other illegal conduct. It is generally due within a set period after you detect the activity. It is how private-sector monitoring feeds real intelligence to law enforcement. A SAR is a confidential report filed with a financial intelligence unit, in the US to FinCEN, describing activity suspected of involving money laundering, fraud, or other crime. It is how private sector monitoring feeds real intelligence to law enforcement, and it is strictly confidential. What is a SAR, in plain English? A SAR is the formal report a financial institution files when it has a reasonable suspicion that a customer's activity involves money laundering, fraud, or other illegal conduct. In the US it goes to FinCEN, the country's financial intelligence unit. It is the mechanism that turns everyday monitoring inside a bank into usable intelligence for investigators and law enforcement. A SAR is generally due within a set period after you detect the activity, commonly 30 days in the US, with a short extension if a subject is still unknown. The report combines structured fields about the parties and transactions with a written narrative that explains, in plain terms, what happened and why it looks suspicious. Two rules define how SARs work. They are strictly confidential, and telling the subject that one exists, or even might, is illegal tipping-off. The suspicion standard is reasonable suspicion, not proof, so the narrative describes concerns and evidence rather than proven crime. How a SAR gets filed A SAR is the end of an investigation, not a single click. The path runs from detection to submission: Detect — Activity is flagged. Monitoring, an analyst, or a referral surfaces behavior that looks unusual. Investigate — Gather the facts. The analyst reviews history, counterparties, and context to test whether suspicion is reasonable. Decide — Escalate to file or not. A designated officer decides whether the activity meets the filing standard and documents the call. File — Submit on time. The SAR is filed within the deadline, with a specific narrative, and kept strictly confidential. Ongoing — Continuing activity SAR. If the behavior keeps going, file follow up reports on a set cycle. Never — No tipping-off. Do not tell the subject a SAR exists; disclosure is a criminal offense. Who is involved? What it looks like in practice In practice An analyst reviews an alert on a small business account that has started receiving frequent round dollar transfers from unrelated individuals, then wiring the funds to a jewelry wholesaler abroad. The stated business is a lawn care service, which does not fit the flows. After documenting the mismatch and finding no innocent explanation, the analyst escalates. The BSA officer agrees the activity suggests possible layering, and a SAR is filed within the deadline with a narrative that lays out the accounts, amounts, timeline, and why it is suspicious. The customer is never told, and monitoring continues for a possible continuing activity report. Why SARs matter to operators SARs are the point where a monitoring program either delivers or fails. A well written SAR gives law enforcement something they can act on; a vague one adds noise. Examiners look hard at both timeliness and quality, and they scrutinize both late filing and defensive over-filing, so a program that files everything to feel safe can be criticized just as sharply as one that misses genuine cases. The confidentiality rules also carry real personal exposure. Tipping-off is a criminal offense, and mishandled SARs can bring penalties for the institution and individuals. Filing on time, backing the conclusion with a specific narrative, and protecting confidentiality are non negotiable parts of the job. What to watch when filing Deadline discipline. Track the detection date and file within the required window; late SARs are a common, avoidable finding. Specific narrative. Explain who, what, when, where, and why it is suspicious; a generic narrative weakens the whole report. No tipping-off. Never signal to the subject that a report exists, directly or indirectly. Continuing activity. When behavior persists, file follow up SARs on schedule rather than treating one filing as done. Defensive filing. Filing on activity you could reasonably explain floods the system and can itself draw criticism. Quick questions ### How long do I have to file a SAR? In the US the general rule is 30 days from detecting facts that establish a basis for filing, with up to 30 more days if the subject is not yet identified. Other countries set their own deadlines for the equivalent report. ### What is tipping-off? Tipping-off is telling the subject, or anyone unauthorized, that a SAR has been or may be filed. It is illegal because it can let a suspect destroy evidence or move funds, and it carries criminal liability. ### Does a SAR mean the customer is guilty? No. A SAR reflects reasonable suspicion, not proof. Many SARs describe activity that turns out to be legitimate. The institution's job is to report the suspicion, not to convict. ### What is a continuing activity SAR? When suspicious behavior keeps happening after an initial filing, institutions file follow up SARs, typically on a set cycle such as every 90 days, so law enforcement sees the ongoing pattern. ### How is a SAR different from a CTR? A SAR is suspicion based; you file it because activity looks suspicious. A CTR is threshold based; you file it purely because a cash transaction crosses a set amount, regardless of suspicion. The same activity can require both. ### What is an STR? An STR, or suspicious transaction report, is the equivalent of a US SAR used in many other countries. It does the same job, filed to that country's FIU, but the deadlines, formats, and triggers vary by jurisdiction. Go deeper FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance. FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.