What a Suspicious Activity Report Is and Who Files One

A SAR is the report a bank or money services business sends FinCEN when a transaction may signal a possible violation of law. What the rules require, from thresholds to confidentiality.

Published	14 October 2026

Some deals at a bank may point to a broken law. The report that follows is the suspicious activity report. The FFIEC manual calls suspicious activity reporting the cornerstone of the BSA reporting system.

What a suspicious activity report is

A suspicious activity report, or SAR, is a form filed with FinCEN. It covers a suspicious transaction. The transaction may be relevant to a possible violation of law or regulation. The institution does not file it because a crime has been proven. It files because something about the transaction does not add up.

For banks, the duty comes straight from the rule. § 1020.320 requires every bank to file a report of any suspicious transaction relevant to a possible violation of law or regulation. The bank does not wait for certainty. Suspicion is the trigger. The report is how the bank hands that suspicion to the people whose job it is to act on it.

Who has to file a SAR

Two rules cover two types of institutions. Each rule has its own numbers.

Banks file under § 1020.320. § 1020.320 says a transaction requires reporting if it involves or aggregates at least $5,000 in funds or other assets. Money services businesses file under § 1022.320, which sets a lower line. § 1022.320 requires a money services business to report a suspicious transaction that involves or aggregates at least $2,000.

The two regimes should not be mixed. A bank cannot use the money services business threshold. A money services business cannot use the bank's. The bank rules get their own page on suspicious activity report banks. The wider set of duties is covered under suspicious activity report requirements.

Which transactions a bank must report

The word transaction is broader than many people assume. The FFIEC manual says a transaction includes a deposit, a withdrawal, a transfer between accounts, an exchange of currency, and an extension of credit. A cash deposit and a loan can both qualify.

The FFIEC manual ties one bank filing rule to whether a suspect can be identified. The FFIEC manual says banks must file a SAR for criminal violations aggregating $5,000 or more when a suspect can be identified. If the institution cannot say who is behind the activity, it gets more time. The FFIEC manual says if no suspect can be identified, the time period for filing a SAR is extended to 60 days.

For MSBs, one kind is named outright. § 1022.320 says a transaction designed through structuring or other means to evade Bank Secrecy Act requirements must be reported. The institution's job is to spot it in its own records. Then it reports.

There is also room below the line. FinCEN's advisory says institutions may file a SAR no matter the amount involved, even if the transaction was only attempted. A small or failed transaction can still be worth reporting if it looks wrong.

How the filing works

The current form is the BSAR, filed through the BSA E-Filing System. The FFIEC manual says the BSAR replaced FinCEN SAR-DI form TD F 90-22.47 and provides a uniform data collection format across multiple industries. Filers across multiple industries now use the same form. The FFIEC manual also says the BSAR does not create or change the existing rules and expectations for banks.

The system makes sure nothing is left blank. The FFIEC manual says the BSA E-Filing System will not accept filings in which fields marked as critical are left blank. The bank must either provide the requested information or check the unknown box. The unknown box is provided with each critical field.

The two rules word their limits in different ways. § 1022.320 requires a money services business to file each SAR no later than 30 calendar days after initial detection. For banks, § 1020.320 says reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

Initial detection is a term worth slowing down on. The FFIEC manual says the phrase initial detection should not be interpreted as meaning the moment a transaction is highlighted for review. A flag from a system starts a review.

Activity that keeps going gets repeat reports. FinCEN's guidelines suggest banks should report continuing suspicious activity by filing a report at least every 90 calendar days. How to submit the form is covered in file suspicious activity report.

What the institution must do around the filing

A SAR does not appear out of nowhere. The FFIEC manual says effective suspicious activity monitoring and reporting systems include five key components. Those systems typically mix people and tools. The FFIEC manual says monitoring systems typically include employee identification or referrals, transaction-based manual systems, surveillance automated systems, or a combination of these. The FFIEC manual says these components are present in banks of all sizes, though their structure and formality may vary.

The path from a first flag to a filed report should be traceable. The FFIEC manual says banks should have a clear escalation process from the first detection of unusual activity to the end of the investigation. The FFIEC manual says findings are typically sent to a final decision maker, which may be an individual or a committee.

The decision itself gets written down. The FFIEC manual says banks should document SAR decisions, including the specific reason for filing or not filing a SAR. A decision not to file is a decision that should be explained on paper.

One limit matters here. The FFIEC manual says banks are not required to investigate or confirm the underlying crime, because investigation is the responsibility of law enforcement. The bank reports what it saw. Detectives detect.

Confidentiality and the safe harbor

Filing comes with a legal protection. The FFIEC manual says federal law provides protection from civil liability for all reports of suspicious transactions made to appropriate authorities. The FFIEC manual says the safe harbor applies to SARs filed within the required reporting thresholds and to SARs filed voluntarily below the threshold.

The flip side is silence. The FFIEC manual says a SAR and any information that would reveal its existence are confidential, except as necessary to fulfill BSA obligations. The FFIEC manual says even the existence or non-existence of a SAR must be kept confidential. A bank cannot tell a customer it filed one.

Sharing has narrow openings. § 1020.320 allows a bank to share the underlying facts, transactions, and documents behind a SAR with another financial institution preparing a joint SAR. § 1020.320 allows a bank to share a SAR within its own corporate structure for purposes consistent with the Bank Secrecy Act. The FFIEC manual says a U.S. bank may share a SAR with controlling companies, whether domestic or foreign.

The report and its backup stay on file. FinCEN's advisory says a financial institution must keep a copy of a SAR and its supporting documentation for five years from the filing date. FinCEN's advisory says financial institutions must provide a requested SAR and its supporting documentation to FinCEN or an appropriate law enforcement or supervisory agency.

Filing quality and examination

The report goes to FinCEN. The rules also set a standard for the report itself. The FFIEC manual says banks are required to file SARs that are complete, thorough, and timely. The FFIEC manual says inaccurate information on the SAR, or an incomplete or disorganized narrative, may make further analysis difficult, if not impossible. FinCEN's advisory says filers must give a clear, complete, and concise description of the activity, including what was unusual or irregular.

There is an exam at the end of the road. § 1020.320 says FinCEN or its delegatees examine banks for compliance with this section, and failure may violate the Bank Secrecy Act.