A suspicious activity report, or SAR for short, is a document that financial institutions in the United States must file with the federal government when they detect a transaction or pattern of activity that may indicate money laundering, fraud, or another financial crime. For fraud and compliance teams, understanding when a SAR is required, and how to file one correctly, is a vital part of meeting Bank Secrecy Act obligations.
What is a suspicious activity report?
A SAR is filed with the Financial Crimes Enforcement Network (or FinCEN), a bureau of the U.S. Department of the Treasury. Banks, credit unions, money services businesses, casinos, and several other categories of financial institutions are legally required to file a SAR when they identify a transaction that appears to have no clear business or lawful purpose, that might involve funds derived from illegal activity, or suggests the institution is being used to facilitate criminal conduct.
The filing itself doesn’t actually accuse anyone of a crime, as a SAR is just an alert, rather than an actual verdict. Its purpose is simply to give law enforcement and regulators visibility into patterns that a single institution’s fraud or compliance team has flagged as worth investigating further, so that pattern can be correlated with data from other institutions and other cases.
When is a SAR required?
Financial institutions are required to file a SAR within 30 calendar days of identifying a transaction that meets one of the reporting thresholds. If no suspect has been identified at that point, the institution is allowed to extend their filing window by an additional 30 days, but the total delay can’t exceed 60 calendar days from the date suspicious activity was first detected. Ongoing suspicious activity that continues beyond an initial filing generally requires a continuing report at least every 90 days.
The specific dollar thresholds and criteria vary by institution type and are defined in federal regulation, but the underlying standard across all filer types is the same: the institution has identified activity that appears designed to evade reporting requirements, that has no apparent lawful purpose given what the institution knows about the customer, or that otherwise suggests the account is being used for illegal activity.
How common are SAR filings, and what do they show?
Suspicious activity report filing volume has grown substantially in recent years. According to FinCEN, banks, savings associations, and credit unions filed more than 2.193 million SARs in 2025, a 7.66% increase over the previous year. Across all seven categories of institutions required to file, total SAR volume exceeded 4.105 million reports in 2025, up almost 8% year over year. For banks, savings associations, and credit unions, the single most common filing category was suspicion concerning the source of funds, cited in 9.08% of filings.
Cyber-related SARs are growing especially fast. Total cyber-related SAR filings rose 30% compared to 2024, showing that digital fraud and account takeover are now driving a large amount of the submitted reports from institutions.
The reports are especially valuable by providing evidence for investigations. IRS Criminal Investigation reported that 94% of its cases in 2025 were searched against Bank Secrecy Act data, which generated more than 3.9 million searches of BSA filings that year. Almost 80% of IRS-CI investigations had a primary subject associated with a SAR, and cases that used BSA data had a 98% conviction rate. They resulted in more than 450 million dollars in asset forfeitures and almost 500 million dollars in restitution to victims.
What fraud and compliance teams should know about the filing process
A SAR must be filed electronically through FinCEN’s BSA E-Filing System using FinCEN Form 111. Paper filing has largely been done away with, and all filing needs to be done electronically. In the filing, you’ll need to specify the persons involved, the activity that took place, when and where it occurred, and why the institution considers it to be suspicious. It should be detailed and specific, as using vague descriptions undermines the entire value of the filing for law enforcement analysts who may later use it.
Also keep in mind that confidentiality protections also apply to SARs. When your business files a SAR, it’s prohibited to disclose to the subject of the report or that a SAR has been filed, which is intended to prevent tipping someone off who’s under investigation. Institutions can share SARs with those who are affiliated, and in special circumstances, with the head offices and controlling companies, but these exceptions are very narrow and specific.
Why fraud detection quality affects SAR outcomes
The quality of your SAR will greatly depend on the quality of the detection that flagged the suspicious activity in the first place. Your business’s transaction monitoring system is really only capable of detecting obvious rule violations on the surface level, will catch very few genuinely suspicious patterns, and is more likely to generate more false positives over legitimate ones and waste analyst time on filings that provide very little value.
Sift can offer much more value by evaluating transaction and account behavior across the whole customer journey, giving compliance and fraud teams richer context, such as account history, device signals, and network-level patterns, to include in a suspicious activity report. Better context in the initial filing makes the report more useful to the law enforcement analysts who will eventually search it, and reduces the back-and-forth that follows an incomplete or generic filing.
For institutions handling high transaction volumes, the challenge is less about deciding whether any single transaction looks suspicious and more about surfacing actual fraudulent transactions out of millions of legitimate ones without burying compliance teams in low-value alerts. Combining behavioral, device, and network signals together into one single, real-time risk indicator instead of just relying on static rulesets helps compliance teams catch fraudulent activity much more quickly and effectively.
If this sounds like something your business could benefit from, read more about how Sift can help.
Frequently asked questions
Who is required to file a suspicious activity report?
Banks, savings associations, credit unions, money services businesses, casinos and card clubs, securities and futures firms, and other categories of financial institutions are all required to file SARs when they identify qualifying suspicious activity.
Can a financial institution tell a customer that a SAR was filed about them?
No. Federal law prohibits institutions from disclosing to the subject of a SAR, or to most third parties, that a report’s been filed about them in order to protect the integrity of any related investigation.
What happens after a SAR is filed?
The filing becomes part of FinCEN’s Bank Secrecy Act database, which law enforcement agencies have access to for ongoing investigations. A SAR doesn’t trigger an automatic investigation, but can be used as a resource for investigators.
