What Is a Suspicious Activity Report (SAR)? Triggers and Filing

Will Kenton is an expert on the economy and investing laws and regulations. He previously held senior editorial roles at Investopedia and Kapitall Wire and holds a MA in Economics from The New School for Social Research and Doctor of Philosophy in English literature from NYU.

Chip Stapleton is a Series 7 and Series 66 license holder, CFA Level 1 exam holder, and currently holds a Life, Accident, and Health License in Indiana. He has 8 years experience in finance, from financial planning and wealth management to corporate finance and FP&A.

What Is a Suspicious Activity Report (SAR)?

A suspicious activity report (SAR) is a tool provided under the Bank Secrecy Act (BSA) of 1970 for monitoring suspicious activities that would not ordinarily be flagged under other reports (such as the currency transaction report). The SAR became the standard form to report suspicious activity in 1996. An activity may be included in the SAR if the activity gives rise to a suspicion that the account holder is attempting to hide something or make an illegal transaction.

Key Takeaways

• A suspicious activity report (SAR) is a tool provided under the Bank Secrecy Act (BSA) of 1970 for monitoring suspicious activities that would not ordinarily be flagged under other reports (such as the currency transaction report).
• The SAR became the standard form to report suspicious activity in 1996.
• Activity may be included in the SAR if the activity gives rise to a suspicion that the account holder is attempting to hide something or make an illegal transaction.

Understanding a Suspicious Activity Report (SAR)

The SAR is filed by the financial institution that observes suspicious activity in an account. The report is filed with the Financial Crimes Enforcement Network, or FinCEN, who will then investigate the incident. FinCEN is a division of the U.S. Treasury.

The financial institution has the responsibility to file a report within 30 days regarding any account activity they deem to be suspicious or out of the ordinary. An extension of no more than 60 days may be obtained, if necessary to collect more evidence. The institution does not need proof that a crime has occurred. The client is not notified that a SAR has been filed regarding their account.

FinCen requires the SAR forms filed by financial institutions to identify the five essential elements of the suspicious activity being reported:

• Who is conducting the suspicious activity?
• What instruments or mechanisms are being used?
• When did the suspicious activity take place?
• Where did it take place?
• Why does the filer think the activity is suspicious?

In addition, the method of operation (or, how is the activity being carried out?) is also required to be included in the report.

Importance of SARs

SARs are part of the United State's anti-money laundering statutes and regulations, which have become much stricter since 2001. The Patriot Act significantly expanded SAR requirements as part of an effort to combat global and domestic terrorism. The goal of the SAR and the resulting investigation is to identify customers who are involved in money laundering, fraud, or terrorist funding.

Disclosure to the customer, or failure to file a SAR, can result in very severe penalties for both individuals and institutions. SARs allow law enforcement to detect patterns and trends in organized and personal financial crimes. This way they can anticipate criminal and fraudulent behavior and counteract it before it escalates. The requirements under the anti-money laundering statutes were significantly expanded again, as of Jan. 1, 2021, with the enactment of the Anti-Money Laundering Act of 2020.

In the United States, financial institutions must file a SAR if they suspect that an employee or customer has engaged in insider trading activity. A SAR is also required if a financial institution detects evidence of computer hacking or of a consumer operating an unlicensed money services business. SAR filings must be kept for five years from the date of the filing.

In numerous instances, SARs have enabled law enforcement authorities to initiate or pursue major investigations in money laundering or terrorist financing, and other criminal cases.

SARs are an important component of anti-money laundering prevention.

Common Patterns of Suspicious Activity

Some of the common patterns of suspicious activity identified by the Financial Crimes Enforcement Network are as follows:

• A lack of evidence of legitimate business activity (or any business operations at all) undertaken by many of the parties to the transactions(s)
• Unusual financial nexuses and transactions occurring among certain business types (for example, a food importer dealing with an auto parts exporter)
• Transactions not commensurate with the stated business type or that are unusual compared with volumes of similar businesses operating locally
• Unusually large numbers and/or volumes of wire transfers, repetitive wire transfer patterns
• Unusually complex series of transactions involving multiple accounts, banks, and parties
• Bulk cash and monetary instrument transactions
• Unusual mixed deposits into a business account
• Bursts of transactions within short periods, especially in dormant accounts
• Transactions or volumes of activity inconsistent with the expected purpose of the account or activity level as mentioned by the account holder when opening the account
• Transactions attempting to avoid reporting and recordkeeping requirements.
  

Example of a SAR

For example, Albert is an account holder at XYZ Financial Institution. Albert has been a client for nearly five years and has an established account history and very predictable transactions. Every month, he deposits $5,000 into the account and buys an index fund. One day, he starts to receive weekly transfers of $9,000 into the account. Almost as quickly as the money hits the account, it leaves again. This is out of the ordinary for Albert's account and usual activity. The financial institution may consider this to be suspicious activity and might file a Suspicious Activity Report.

What Is a Suspicious Activity Report?

A SAR is a document that financial institutions and certain businesses are required to file with the Financial Crimes Enforcement Network (FinCEN) when they detect or suspect illegal activities. The purpose of a SAR is to report activities that might indicate money laundering, fraud, terrorist financing, or other financial crimes.

What Types of Activities Trigger a SAR Filing?

SAR filings can be triggered by a variety of activities that appear suspicious such as large cash deposits or withdrawals, frequent wire transfers to high-risk countries, structuring transactions to avoid reporting requirements, and any transaction that doesn't seem to have a legitimate business purpose. Additionally, things like unusual behavior by a customer such as reluctance to provide information or attempting to avoid identification requirements can also lead to the filing of a SAR.

How Long Do Financial Institutions Have to File a SAR?

Financial institutions generally have 30 calendar days to file a SAR from the date of initial detection of facts that may constitute a basis for filing.

What Information Is Included in a SAR?

A SAR includes detailed information about the suspicious activity such as the identities of the individuals or entities involved, the nature of the suspicious transaction or behavior, the amounts involved, and the reasons why the activity is deemed suspicious. It also includes a narrative section where the filer provides a comprehensive explanation of the suspicious activity.

The Bottom Line

A suspicious activity report is a document that banks and businesses must file when they notice something suspicious, like possible fraud or money laundering. These reports help law enforcement investigate and stop financial crimes by sharing details about unusual transactions.