Unusual activity is behavior that departs from a customer's expected pattern or from peer norms but has not yet been judged suspicious. It flags a need to look, not an automatic filing, and telling unusual apart from suspicious is the analyst's core judgment call.
What is unusual activity, in plain English?
Unusual activity is behavior that stands out. It departs from what you expect for a particular customer, based on their history and profile, or from what similar customers typically do. A quiet personal account that suddenly sees large international wires, or a small business whose volumes jump tenfold in a week, is unusual.
The important thing is what unusual is not: it is not yet a conclusion. Unusual activity flags a need to look, not an obligation to file. It is the raw material for investigation, the point where an analyst starts asking whether there is a legitimate explanation or something genuinely concerning.
Turning unusual into a decision is the analyst's core judgment. Many unusual patterns have perfectly legitimate explanations found during review, such as a bonus, an inheritance, or a new contract. Only when review leaves a reasonable suspicion does unusual become suspicious, and only then does a filing come into play.
Unusual versus suspicious
The whole workflow hinges on moving, or not moving, from one to the other:
What changes | Unusual activity | Suspicious activity |
What it signals | A departure from expected behavior. | Possible money laundering, fraud, or crime. |
Standard met | Worth a closer look. | Reasonable suspicion after review. |
Required action | Investigate and document. | Consider a SAR or STR. |
Common outcome | Often explained legitimately. | Escalated when no explanation holds. |
What it looks like in practice
In practice
A long standing customer who usually receives a steady salary suddenly gets a single deposit many times their normal monthly income. The monitoring system flags it as unusual because it breaks the account's baseline.
The analyst investigates rather than assuming the worst. A quick review and a documented note show the customer sold a property, with the funds arriving from a regulated conveyancer, which fully explains the deposit. The activity was genuinely unusual, but it was not suspicious. The analyst records how the concern was resolved and closes it. Had no innocent explanation appeared, the same alert would have moved toward a SAR.
Why the distinction matters to operators
Getting the unusual to suspicious call wrong hurts in both directions. Treat all unusual activity as reportable and you drive defensive filing that clogs the intelligence system with low value reports. Dismiss unusual activity too quickly, without genuine review, and you miss the cases that were actually suspicious. Neither error is safe.
What protects the operator, and makes the program defensible, is the documented reasoning. The value is not in the label you attach but in showing how each unusual pattern was reviewed and resolved. A file that records why activity was cleared, or why it was escalated, is what stands up to an examiner far better than the decision alone.
What to watch in the data
- Baseline breaks. Sudden changes in volume, value, geography, or counterparties against a customer's own history.
- Peer outliers. Behavior far outside what similar customers in the same segment normally do.
- Innocent explanations. Many unusual patterns resolve legitimately on review; capture the explanation you find.
- Documented resolution. Record how each unusual case was investigated and closed, not just the final label.
- Do not over-file. Escalating every unusual alert without review floods the system and weakens genuine reporting.
Quick questions
Does unusual activity always get reported?
No. Unusual activity flags a need to investigate, not an obligation to file. Only if review leaves a reasonable suspicion of illegal conduct does it become suspicious and warrant a SAR or STR. Much unusual activity is explained legitimately.
How do I decide if unusual becomes suspicious?
You investigate. Gather the customer's history and context, test whether a legitimate explanation fits, and document what you find. If no innocent explanation holds up, the activity crosses into suspicious and you consider filing.
What if I cannot find an explanation?
If review leaves you with a reasonable suspicion and no innocent explanation, escalate it for a filing decision. The absence of a plausible legitimate reason is itself part of what makes activity suspicious.
Why not just file on everything unusual?
Defensive over-filing clogs the intelligence system with low value reports, wastes analyst and law enforcement time, and can itself draw examiner criticism. The goal is reasoned judgment, not reporting every anomaly to feel safe.
Who reviews unusual activity?
Frontline analysts typically investigate and document unusual alerts, escalating genuine suspicion to a designated officer such as a BSA officer or MLRO, who owns the filing decision.
How is unusual activity detected?
Mainly through transaction monitoring that compares behavior against a customer's baseline and against peer norms, plus behavioral analytics and manual referrals. When activity breaks the expected pattern, it surfaces as an alert to review.
Go deeper
- FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance.
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.