SARs and STRs: Filing Suspicious Activity Reports

Anti-money-laundering rules do not expect firms to catch every criminal, but they do require firms to report what looks suspicious. The mechanism for that report is the Suspicious Activity Report (SAR), known in many jurisdictions as a Suspicious Transaction Report (STR). It is the pipeline that feeds intelligence from banks and payment firms to law enforcement. Understanding when and how to file one — and the strict rules around secrecy — is core to any compliance function.

What a SAR is

A SAR is a confidential report submitted to a country's financial intelligence unit (FIU) when a regulated firm knows, suspects, or has reasonable grounds to suspect that funds or activity are linked to money laundering, terrorist financing, or other financial crime. In the United States, SARs go to FinCEN; in the United Kingdom, they go to the National Crime Agency. The report is not an accusation and not proof of a crime — it is an intelligence lead that the FIU can analyse, combine with other reports, and pass to investigators.

What triggers a report

The threshold is suspicion, which is deliberately lower than proof. Firms build detection around typologies and red flags, then investigate alerts to decide whether suspicion is genuine. Common triggers include:

• Structuring — breaking large amounts into smaller transactions to stay under reporting thresholds.
• Activity inconsistent with the customer profile — a modest account suddenly receiving and forwarding large sums.
• Rapid movement of funds — money in and straight out, characteristic of a mule account.
• Unexplained third parties — payments to or from parties with no logical connection to the customer.
• Links to high-risk jurisdictions or to sanctioned or adverse-media names.

Some regimes also require threshold-based reports regardless of suspicion — for instance, US Currency Transaction Reports for cash above a set amount — but the SAR itself is suspicion-driven, not amount-driven.

The internal process

Filing rarely happens at the whim of a single analyst. Most firms route a suspicion through an internal SAR to a designated officer — the Money Laundering Reporting Officer (MLRO) or nominated officer — who reviews the evidence and decides whether to file externally with the FIU. This gatekeeper role concentrates judgment and accountability. Once the decision is made, the report is submitted through the FIU's electronic channel, describing the customer, the activity, the reason for suspicion, and any supporting detail in a clear narrative. The quality of that narrative matters enormously: a vague report is far less actionable than one that explains precisely what looked wrong and why.

Tipping off: the cardinal rule

The most important operational constraint is the prohibition on tipping off. A firm generally must not tell the customer, or anyone else, that a SAR has been filed or that an investigation may be underway, because doing so could prejudice an investigation and is itself a criminal offence in many jurisdictions. This creates delicate situations: staff must continue to interact normally with a customer while a report is live, avoiding any hint that their activity has been reported. Training frontline teams to handle this without disclosure is a standard part of AML programmes.

Consent and the frozen decision

In some regimes, filing a SAR interacts with whether a firm can proceed with a transaction it suspects. In the UK, a firm may seek a Defence Against Money Laundering (DAML) — formerly "consent" — from the NCA before carrying out a transaction it suspects, and must wait through a notice and moratorium period during which the authorities can object. Get this wrong and the firm risks either committing a money-laundering offence by proceeding, or tipping off and breaching contract by refusing without explanation. The reporting officer navigates that tension.

Why volume and quality both matter

FIUs receive vast numbers of SARs — well into the hundreds of thousands or millions annually in large jurisdictions. That scale creates a paradox: over-reporting to be safe ("defensive filing") buries genuine intelligence in noise, while under-reporting misses crime and breaches obligations. Regulators increasingly emphasise quality over quantity — well-reasoned, well-evidenced reports that give investigators something to act on. A good compliance programme is judged not by how many SARs it files but by how good and how justified they are.

Key takeaways

• A SAR or STR is a confidential report to the financial intelligence unit about suspected financial crime.
• The trigger is reasonable suspicion — a lower bar than proof — driven by red flags and typologies.
• Firms usually route suspicions to a reporting officer who decides whether to file externally.
• Tipping off the customer that a report was filed is prohibited and often a criminal offence.
• Regulators value well-evidenced, high-quality reports over high-volume defensive filing.