At the end of the day, what constitutes suspicious activity can sometimes be hard to determine. To help you decide when you should (and shouldn’t) file a SAR, we outline a few different example cases below.
Ultimately, any suspicious behavior should be reported. It’s often better to err on the side of caution and report behavior that may not end up being suspicious in nature.
Example of a case where a SAR must be filed
A customer has a relatively new account, which has historically only been used for domestic payments. Onboarding was completed, and no red flags were presented.
Their account receives an international transfer of $27,000.
In this instance, a SAR must be filed, as the $25,000 transaction threshold has been exceeded.
Example of a case where a SAR may or may not be filed
A customer has been a client for 5 years. They are in good standing with the financial institution and have had no suspicious activity in the past. They make relatively routine transactions that have not raised any flags.
Seemingly out of nowhere, the customer makes a handful of transactions of $4,000 each. In total, they make 5 transactions two weeks apart, amounting to $20,000.
While this could be a legitimate attempt to transfer a large amount of money (spread out over a period of time), it could also be an attempt to skirt the $5,000 threshold for automatic AML filings.
Having a transaction monitoring solution can detect this anomaly, flagging it for investigation. After investigation, an analyst may find that the transactions are not suspicious, or could still have suspicions about the legitimacy of the transfers. This could be ruled out or could be escalated, with a SAR being filed.
Example of a case where a SAR does not need to be filed
A customer has been a client for over 5 years, and is in good standing with the financial institution. They have consistent transaction activity, none of which raises red flags.
The customer is in the process of purchasing their first home, and makes a large down payment. This transaction is undoubtedly out of the norm for their account activity, but it isn’t malicious. This would likely prompt an investigation, but an investigation should determine that this is a legitimate transaction. In most cases, this would not warrant a SAR filing.
FAQs
The Introduction
- Provide a brief statement of the SAR's purpose.
- Generally describe the known or suspected violation.
- Identify the date of any SARs previously filed on the subject & the purpose of that SAR.
- Indicate any internal investigative numbers used by the filing institution to maintain records of the SAR.
For example, if what appears to be structuring of currency deposits is matched with outgoing wire transfers from the accounts, the SAR narrative should include information about both the structuring and outbound transfers (including dates, destinations, amounts, accounts, frequency, and beneficiaries of the funds ...
What information should be included in a SAR report? ›
When a SAR is filed, five sections of information are required. First, reporters collect names, addresses, social security numbers, birth dates, driver licenses or passport numbers, occupations, and phone numbers of all parties involved.
What is an example of suspicious activity? ›
Suspicious activities or behaviors may include, but are not limited to: Wandering around campus areas attempting to open multiple doors. Seeming nervous and looking over their shoulders. Entering restricted areas when not authorized or following immediately behind others into card-access areas while the door is open.
How to write a perfect SAR? ›
A good rule when writing a SAR is to break it into parts to include: (1) an introduction; (2) account information and descrip- tion; (3) how the information was received and any relevant details obtained in the due diligence investigation; (4) exam- ples of dates and activity; and (4) conclusion.
What are the 5 key components of SAR? ›
An effective SAR has five vital components2:
- Introduction. The introduction to a SAR should begin with the reason for the filing, including the type of activity being reported. ...
- Account Information. ...
- Due Diligence/Investigation. ...
- Dates and Activity. ...
- Closing Statement and Conclusion.
Some examples of suspicious activities that may trigger a SAR include:
- Unusually large cash deposits or withdrawals.
- Frequent transactions just below the reporting threshold to avoid detection.
- Structuring transactions to avoid triggering regulatory requirements.
- Rapid movement of funds between multiple accounts.
Common red flags include: Unusual transactions: Transactions that are unusual for a customer's profile, such as a large cash deposit or withdrawal from an account that has not previously made such transactions.
What is a common reason to file a suspicious activity report? ›
An SAR is a document that financial institutions must file with the Financial Crimes Enforcement Network (FinCEN) as soon as they detect a suspected case of money laundering or fraud. SARs are an important tool for law enforcement to detect and investigate financial crimes.
What can I ask for in a SAR request? ›
You can ask for all the information an organisation holds about you. However, this doesn't mean you will get all the information they have about you. An organisation can sometimes refuse to provide you with all or some of the information. It might also mean you get a lot of information back that you don't need.
Suspicious transactions are any event within a financial institution that could be possibly related to fraud, money laundering, terrorist financing, or other illegal activities.
How much money triggers a suspicious activity report? ›
Dollar Amount Thresholds – Banks are required to file a SAR in the following circ*mstances: insider abuse involving any amount; transactions aggregating $5,000 or more where a suspect can be identified; transactions aggregating $25,000 or more regardless of potential suspects; and transactions aggregating $5,000 or ...
What are three suspicious activities? ›
Some common examples of suspicious activities include:
- A stranger loitering in your neighborhood or a vehicle cruising the streets repeatedly.
- Someone peering into cars or windows.
- A high volume of traffic going to and coming from a home on a daily basis.
- Someone loitering around schools, parks, or secluded areas.
When Does a Bank Have to Report Your Deposit? Banks report individuals who deposit $10,000 or more in cash. The IRS typically shares suspicious deposit or withdrawal activity with local and state authorities, Castaneda says.
What are suspicious things? ›
A person behaves strangely or exhibits unusual movements. A person concealing an object or carrying a weapon. A person looking into cars, moving from car to car, and/or tries door handle. A person looking into offices, patient rooms, labs, windows, or forcibly entering a car or a room.
Who fills out a SAR report? ›
A financial institution is required to file a suspicious activity report no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a suspicious activity report.
What does part 3 of the SAR ask you to provide? ›
A Part 3 SAR is a request made by or on behalf of someone for the information they are entitled to ask for under section 45(1). They may ask you to: confirm whether or not you are processing their information; and if so, provide them with access to it.
When filling out a SAR, what does FinCEN request? ›
Applicable SAR Instructions:
FinCEN requests that financial institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this alert by including the key term “FIN-2023-RUSSIACRE” in SAR field 2 (Filing Institution Note to FinCEN), as well as in the narrative.
