A suspicious activity report, or SAR, is the document a US bank files with the Financial Crimes Enforcement Network when it suspects a transaction is tied to money laundering, fraud or another crime. The filing itself stays confidential by law, but the rule that decides when one is required is precise: a dollar threshold, a specific fact pattern, and a filing clock that starts the moment a bank’s staff first notice something wrong.
Those conditions sit inside the Bank Secrecy Act. For most banks, FinCEN’s own regulation sets three tests. A transaction has to involve or add up to at least $5,000, and the bank has to know, suspect or have reason to suspect that the funds come from illegal activity, that the transaction is structured to get around a Bank Secrecy Act requirement, or that it has no business purpose a bank would reasonably expect from that customer. Crossing the dollar figure alone does not trigger a suspicious activity report; the suspicion has to attach to one of those three tests, which is why two analysts can look at the same $6,000 transfer and reach different conclusions about whether it belongs on a SAR.
Three thresholds, not one
The $5,000 figure is the one most compliance teams quote, but federal banking regulation sets two others. Where a bank believes it was the victim of a crime, or that it was used to facilitate one, and has no basis for identifying a suspect, the threshold rises to $25,000 under the rules that apply to national banks and Federal Reserve member banks. Where the suspected wrongdoing is insider abuse, meaning a director, officer, employee or other institution-affiliated party is implicated, there is no dollar floor at all: any amount qualifies, because the bank itself is the target.
Identifying a suspect under any of these tests often runs alongside a bank’s sanctions screening work, the name-matching process Fintechly covered in its explainer on the lists behind sanctions screening and why a name check on its own isn’t enough. The two disciplines are separate obligations under the Bank Secrecy Act, but an investigator building a SAR case file will usually check the same counterparty against the same watchlists.
The filing clock: 30 days, then a 60-day backstop
Detecting the fact pattern starts the clock, not the decision to file. A bank must submit a SAR no later than 30 calendar days after the date it first detects facts that may support filing one. If no suspect has been identified by that date, the bank can take a further 30 days to try to identify one, but the outer limit is fixed: a report is due no later than 60 calendar days after initial detection, whether or not a suspect has been found by then. Where the activity is an active scheme, such as money laundering still in progress, the bank must notify law enforcement by telephone straight away, separately from the written filing.
Why a suspicious activity report and a currency transaction report are different decisions
An $11,000 cash deposit triggers a currency transaction report automatically, because it crosses the $10,000 cash threshold, regardless of whether the bank suspects anything. A SAR is a different judgement. It does not depend on cash at all, and it depends entirely on whether the bank suspects something is wrong with the transaction’s purpose or origin. The two reports can both apply to a single transaction, and filing one never excuses a bank from filing the other if its own separate test is met.
Where the fact pattern comes from before the clock starts
The fact pattern that starts a SAR’s 30-day clock rarely surfaces from a single analyst’s memory of a customer any more. Most banks now rely on continuous transaction monitoring that flags unusual account behaviour as it happens, the shift Fintechly set out in its explainer on perpetual KYC and how continuous monitoring is replacing the periodic file review. That earlier-stage detection work decides what reaches a human investigator’s desk at all, long before anyone opens a SAR form.
FinCEN wants fewer low-value suspicious activity reports, not yet a changed rule
FinCEN has been open about wanting banks to file fewer reports that add nothing for investigators, without changing the underlying thresholds or deadlines. On 9 October 2025, FinCEN issued four frequently asked questions on suspicious activity reporting jointly with the Federal Reserve, the FDIC, the National Credit Union Administration and the OCC. Treasury’s Under Secretary for Terrorism and Financial Intelligence, John K. Hurley, said SARs “should deliver better outcomes by providing law enforcement the most useful information, not by overwhelming the system with noise,” and that Treasury would keep working “to de-prioritize low-value activity and direct compliance resources towards the most significant threats.”
FinCEN followed that in April 2026 with a proposed rule overhauling the anti-money-laundering programme requirements banks operate under, developed jointly with the Federal Reserve, the FDIC, the NCUA and the OCC. The proposed rule would give banks more discretion to direct compliance resources toward higher-risk activity and would require federal banking regulators to consult FinCEN before certain supervisory actions. Comments closed on 9 June 2026, and as of this writing the rule remains at the proposed stage, not yet final, with no published compliance date.
Filing volume kept rising while the reform effort was still underway
The thresholds and deadlines a bank operates under today are unchanged, and so is the trend in how many reports banks file. FinCEN’s own year-in-review data puts total SAR filings at 4.3 million in fiscal 2022, 4.6 million in fiscal 2023, 4.7 million in fiscal 2024 and 4.8 million in fiscal 2025, a rise of about 12% over four years even as the reform effort described above was taking shape. Depository institutions file the largest share of that total, ahead of money services businesses.
Where artificial intelligence is changing the job
The part of SAR work that AI vendors have targeted first is not the suspicion decision itself but the paperwork that follows it. Hawk, a compliance technology vendor, markets a regulatory reporting tool that drafts a SAR narrative directly from the evidence an analyst has already gathered in a closed case, a task the company says otherwise takes an analyst two to eight hours to write from a blank page. Hawk’s own account of the product keeps a human analyst’s sign-off as a required step before anything is submitted, rather than filing the report on its own.
That kind of tooling is not confined to the largest banks. Core banking technology provider CSI announced a partnership with Hawk AI in a March 2023 release to bring AI-driven anti-money-laundering and fraud detection tools to the smaller US community banks that already use CSI’s core systems, the route by which this kind of technology reaches institutions too small to build it themselves.
None of this changes what triggers a SAR or when it is due. A bank that adopts a narrative-drafting tool still has to meet the same $5,000, $25,000 and 30-to-60-day tests as a bank that writes every report by hand; what changes is how long the paperwork takes once the suspicion has already been identified. A fuller list of the compliance technology providers active in this space sits on Fintechly’s regtech sector directory.
Suspicious activity report FAQs
If a customer gives a satisfactory explanation before the 30-day deadline, does the bank still have to file?
The obligation to investigate starts the moment facts are detected, not after a customer is asked about them. If the bank’s review genuinely resolves the suspicion with a documented, reasonable explanation, a SAR is not required for that transaction. The 30-day clock governs how long a bank has to complete that investigation and file if suspicion remains, not a waiting period before asking questions.
If no suspect is identified by day 30, does the case get closed?
No. A bank with no identified suspect at the 30-day mark can take a further 30 days to try to identify one, but it cannot use that extension to avoid filing altogether. A report is still due no later than 60 calendar days after initial detection, with or without a named suspect.
If a transaction already triggered a currency transaction report, does it still need a SAR?
Yes, if the separate suspicious activity test is independently met. A currency transaction report is mandatory once a cash transaction crosses $10,000, regardless of suspicion. A SAR depends entirely on whether the bank suspects the transaction’s purpose or origin is improper. The two filings answer different questions, and one does not substitute for the other.
Does FinCEN’s push against low-value SARs mean a bank can safely file fewer reports right now?
No. The dollar thresholds and the 30-to-60-day filing deadlines in the current regulation are still legally in force. FinCEN’s October 2025 guidance and its pending 2026 proposed rule both describe a direction of travel, not a change a bank can act on before it is finalised.
If an AI tool drafts the SAR narrative, who is legally responsible for what it says?
The filing institution. Vendor tools marketed for this purpose, including the one described above, keep a named analyst’s review and approval as a required step before a report is submitted, so the narrative-drafting software shortens the task without shifting the filing obligation away from the bank’s own BSA compliance programme.
