What Is a Suspicious Activity Report? Triggers, Filing, and Penalties

A Suspicious Activity Report, or SAR, is a confidential document that banks and other financial businesses file with the Financial Crimes Enforcement Network (FinCEN) when they detect a transaction that may involve money laundering, fraud, terrorist financing, or another financial crime. Roughly 4.7 million SARs were filed in fiscal year 2024, making them one of the federal government’s primary tools for spotting and tracking illicit money.¹ The customer named in a SAR is never told about it. The report goes into a database that federal law enforcement can search, and the institution that filed it is legally shielded from being sued over the disclosure.

Who Has to File One

The Bank Secrecy Act requires a wide range of financial businesses to watch for suspicious transactions and report them. FinCEN, a bureau of the Treasury Department, administers the rules, which live in 31 CFR Chapter X with a separate part for each type of business.²

Filers include:

Banks, savings associations, and credit unions³
Money services businesses, including money transmitters, currency exchangers, check cashers, and sellers of money orders or traveler’s checks⁴
Broker-dealers in securities⁵
Insurance companies⁶
Casinos and card clubs
Dealers in precious metals, precious stones, or jewels
Loan and finance companies, including non-bank mortgage lenders and originators⁷

What Triggers a SAR

Two things have to line up before a SAR is required: the transaction has to hit a dollar threshold, and the institution has to have a reason to think something illegal is going on. A large transaction alone is not enough, and a suspicious small one below the threshold is not either.

Dollar Thresholds

For banks, the thresholds come in three tiers:

$5,000 or more when the bank can identify a suspect in a possible federal crime.
$25,000 or more when the bank believes it was victimized or used to facilitate a crime but cannot identify the suspect.
$5,000 or more for any transaction that looks like money laundering or a Bank Secrecy Act violation, whether or not a suspect is identified.

All three tiers apply to a single transaction or to a pattern of related transactions that add up to the threshold.⁸

Money services businesses file at $2,000, with a $5,000 threshold for issuers of money orders or traveler’s checks who review clearance records.⁹

Patterns That Draw Suspicion

Structuring. Breaking a large cash transaction into smaller pieces to stay under the $10,000 Currency Transaction Report threshold is a federal crime on its own, even if the money is clean. Two consecutive $9,000 deposits instead of a single $18,000 deposit is a classic example.¹⁰

Activity that doesn’t match the customer. Financial institutions build a baseline for each account: typical deposit sizes, frequency of wires, the nature of the customer’s business. When behavior shifts sharply from that baseline with no clear reason, it becomes a red flag.¹¹ Large wire transfers to high-risk countries from a customer with no international ties, or a sudden spike in cash deposits an income can’t explain, are common triggers.

Efforts to hide where money came from or who controls it. Funneling money through multiple accounts at different banks, layering transactions through shell companies, or moving funds rapidly through a chain of accounts to obscure the source all invite a filing.

Cyber-events. FinCEN has said cyber-attacks aimed at facilitating unauthorized transactions can require a SAR. A malware intrusion that puts customer funds at risk, or a distributed denial-of-service attack used as cover for an unauthorized wire, counts if the dollar threshold is met. Cyber-related SARs are expected to include technical detail such as IP addresses, timestamps, and device identifiers.¹²

What Goes Into the Report

SARs are filed on FinCEN Form 111. The form pulls together three things.

The first is information about the subject: legal name, permanent address, Social Security or taxpayer ID number, date of birth, and a government-issued ID such as a driver’s license or passport. These details let federal agencies connect activity across different institutions.¹³

The second is information about the filing institution: its legal name, tax ID, and primary federal regulator, plus codes categorizing the type of activity (money laundering, structuring, fraud, and so on) so FinCEN can route the report.

The third, and the most important, is the narrative. This is a plain-language account of what happened, when it happened, how the institution noticed it, and why it looks suspicious. Law enforcement leans on the narrative when deciding whether to open an investigation. A clear chronological account carries more weight than a form full of codes.

Deadline and How It Gets Filed

The clock starts the day the institution first detects facts suggesting suspicious activity. A SAR is due within 30 calendar days of that detection. If no suspect has been identified yet, the institution gets another 30 days to try, but filing cannot be delayed past 60 calendar days from initial detection.⁸

Filing is electronic. Every SAR goes through the BSA E-Filing System, FinCEN’s secure portal, which accepts single filings and batch submissions.¹⁴ Once submitted, the report enters a centralized database the FBI, IRS, and other law enforcement agencies can search.

When suspicious activity keeps going after the initial SAR, follow-up filings are required. FinCEN guidance calls for reviewing continuing activity in 90-day windows and filing a new SAR within 30 days after each window closes.¹⁵

The Customer Is Never Told

Federal law bars the institution, its officers, employees, and agents from telling the person named in a SAR — or anyone else — that a report has been filed. Government employees who learn about a SAR are held to the same rule. The secrecy is meant to protect ongoing investigations and keep suspects from destroying evidence or fleeing.¹⁶

In exchange, a safe harbor provision protects the institution and everyone involved in the filing from being sued by the person reported, as long as the SAR was made in connection with a possible legal violation. That protection covers voluntary filings as well as mandatory ones.¹⁶

Records Kept After Filing

The institution has to keep a copy of every SAR and all supporting documentation for at least five years from the filing date, organized so it can be produced quickly.⁸ FinCEN and law enforcement can request supporting documents at any time, and the institution must hand them over.¹⁷

Penalties for Not Filing

Missing a SAR obligation carries civil and criminal exposure. A willful violation of the Bank Secrecy Act’s reporting rules can bring a civil penalty of the greater of $100,000 or the amount involved in the transaction; non-willful violations are capped at $25,000 per violation by statute, with inflation adjustments applied through 31 CFR 1010.821.¹⁸¹⁹

On the criminal side, a person, including a bank employee, who willfully violates the BSA or its regulations faces up to $250,000 in fines, up to five years in prison, or both. Where the violation ties to another federal crime or is part of a pattern involving more than $100,000 over 12 months, the ceiling climbs to $500,000 in fines, up to ten years in prison, or both.²⁰ Failure to file can also draw supervisory action from the institution’s federal regulator, including enforcement orders.⁸

1
Financial Crimes Enforcement Network. FinCEN Year in Review for FY 2024
2
eCFR. 31 CFR Chapter X – Financial Crimes Enforcement Network, Department of the Treasury
3
eCFR. 31 CFR Part 1020 – Rules for Banks
4
eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses
5
eCFR. 31 CFR 1023.320 – Reports by Brokers or Dealers in Securities of Suspicious Transactions
6
eCFR. 31 CFR 1025.320 – Reports by Insurance Companies of Suspicious Transactions
7
eCFR. 31 CFR 1029.320 – Reports by Loan or Finance Companies of Suspicious Transactions
8
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
9
eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
10
Financial Crimes Enforcement Network. Notice to Customers – A CTR Reference Guide
11
Financial Crimes Enforcement Network. Customer Due Diligence Requirements FAQ
12
Financial Crimes Enforcement Network. Advisory on Cyber-Events and Cyber-Enabled Crime
13
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
14
FFIEC BSA/AML Manual. Appendix T – BSA E-Filing System
15
Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
16
Office of the Law Revision Counsel. 31 U.S.C. 5318 – Compliance, Exemptions, and Summons Authority
17
Financial Crimes Enforcement Network. Suspicious Activity Report Supporting Documentation
18
Office of the Law Revision Counsel. 31 U.S.C. 5321 – Civil Penalties
19
eCFR. 31 CFR 1010.821 – Penalty Adjustment and Table
20
Office of the Law Revision Counsel. 31 U.S.C. 5322 – Criminal Penalties