Short answer: a suspicious activity report (SAR), also called a suspicious transaction report (STR), is a confidential report that a regulated firm sends to the national financial intelligence unit when it suspects money laundering, terrorist financing or another crime. The firm must not tell the customer, and the person who files in good faith is protected from liability. Rules on timing and thresholds differ by country.
What triggers a report
The test is suspicion, not proof. A firm does not need to know which crime was committed. FATF Recommendation 20 requires a report when a firm suspects or has reasonable grounds to suspect that funds are the proceeds of criminal activity or are related to terrorist financing, and it applies to attempted transactions as well as completed ones.
Typical starting points are an alert from transaction monitoring, a staff member's concern, adverse media, or a customer who refuses to explain activity. Investigators gather context, decide whether the activity has a plausible legitimate explanation, and document the decision either way.
United States
- Banks file SARs with FinCEN under the Bank Secrecy Act.
- Under the bank rule (31 CFR 1020.320), reporting is required for transactions of at least USD 5,000 where a suspect can be identified, at least USD 25,000 regardless of suspect, and for insider abuse in any amount, among other cases.
- The deadline is 30 calendar days after the initial detection of facts that may support a report; if no suspect is identified, the firm may take up to an additional 30 days, but not more than 60 days in total.
- Firms keep SARs and supporting documents for five years.
- SARs are confidential. The statutory safe harbour protects firms and staff from civil liability for reporting in good faith.
- Do not confuse a SAR with a currency transaction report (CTR), which is filed for cash transactions over USD 10,000 whether or not they look suspicious.
- Structuring cash transactions to avoid a CTR is itself an offence, and a SAR red flag. See structuring.
United Kingdom
- Reports go to the UK Financial Intelligence Unit at the National Crime Agency.
- Under the Proceeds of Crime Act 2002, people in the regulated sector commit an offence if they fail to report knowledge or suspicion (or reasonable grounds for suspicion) of money laundering.
- A report can ask for a defence against money laundering (DAML), which allows the firm to proceed with a transaction that would otherwise risk committing a laundering offence.
- Tipping off in the regulated sector is an offence once a report has been made or an investigation is under way.
European Union
Firms send STRs to the national FIU of the country where they are established. Cross-border cases are shared among FIUs. The EU AML package creates the Anti-Money Laundering Authority (AMLA) and brings more common rules; check the current status of each measure on the European Commission website.
Tipping off and confidentiality
Telling a customer, or anyone not entitled to know, that a report has been or will be filed can allow suspects to move funds or destroy evidence. Staff therefore need clear guidance on what they can say when a payment is delayed or an account restricted: say that the firm is carrying out routine checks, not that a report has been made. See tipping off.
Exam angles
- Suspicion is enough; no proof of a predicate offence is needed.
- Attempted transactions are reportable.
- The reporter is protected by safe harbour; the customer is never informed.
- Filing a SAR does not mean the firm must exit the relationship, and continuing activity may need further reports.
- Know the difference between SAR and CTR, and the 30/60-day US timing.