< Back to Glossary

What is a Suspicious Activity Report (SAR)?

Last updated: 23 October 2026

What Is a Suspicious Activity Report (SAR)?

A suspicious activity report (SAR) is a confidential report that a financial institution files with its national financial intelligence unit when it suspects money laundering, terrorist financing, fraud or other financial crime. Outside the US it is often called a suspicious transaction report (STR). Filing is a legal obligation in most jurisdictions, and it’s one of the main ways institutions give law enforcement intelligence about illicit activity.

Who has to file a SAR?

Banks, broker-dealers, money services businesses, insurers, casinos and many other regulated firms must file. In the US, reports go to the Financial Crimes Enforcement Network (FinCEN). In the UK they go to the National Crime Agency (NCA), and in Canada they go to FINTRAC. The FATF standards require suspicious transaction reporting, which is why the obligation is so widespread.

When should you file a SAR?

You file when you know, suspect or have reasonable grounds to suspect that activity involves illicit funds, is designed to evade reporting requirements or has no apparent lawful purpose. Filing requires suspicion, not proof, and you are not expected to establish that a crime occurred. Common triggers include:

Deadlines vary by jurisdiction. In the US, for example, firms generally must file within 30 calendar days of detecting the facts that justify a report.

What should a SAR include?

A strong SAR answers who, what, where, when, why and how.

  • Details of the subjects and accounts involved
  • A description of the activity, with dates and amounts
  • The reasons the activity is suspicious
  • Any supporting evidence and the steps already taken

The narrative matters most, because it is what investigators read. A report that clearly explains the suspicion is more useful than one that lists transactions without context.

What is the difference between a SAR and an STR?

The two terms describe the same obligation in different regions. “SAR” is used in the US and UK, and “STR” is used by FATF and in many other jurisdictions, including Canada. Some regimes also have separate rules for reporting attempted transactions. In the UK, “SAR” can also mean a subject access request under data protection law, which is unrelated.

What is the difference between a SAR and a CTR?

A currency transaction report (CTR) is triggered by a fixed threshold, such as cash transactions above $10,000 in the US, regardless of whether anything looks suspicious. A SAR is triggered by suspicion, whatever the amount.

Can you tell the customer about a SAR?

No. SARs are confidential, and disclosing that one has been filed, known as tipping off, is prohibited in most jurisdictions. Many regimes also give firms legal protection for good-faith filings.

Why is SAR filing hard to do well?

Alert volumes are high and most alerts do not lead to a report. Investigators spend much of their time gathering data from separate systems and writing narratives by hand, and quality varies between analysts. This slows filing and risks missing deadlines. Poor-quality reports also reduce the value of the intelligence passed to law enforcement.

How does AI support SAR filing?

Agentic AI can gather evidence from across systems, prioritize alerts and draft the narrative for an investigator to review, which reduces the time from detection to filing while keeping a human accountable for the decision. Unified case management and a joined-up view of fraud and AML risk, as in FRAML, also help ensure related activity isn’t reported in fragments. See how SymphonyAI transaction monitoring speeds the path from alert to SAR.

FAQs

Does filing a SAR mean a crime has been committed?
No. A SAR reports suspicion, and it is up to law enforcement to investigate.

Can a customer’s account stay open after a SAR is filed?
Often yes, subject to the firm’s policies and any instructions from authorities. The decision to keep or close a relationship is separate from the filing.

What is a continuing activity SAR?
When suspicious activity continues after an initial report, firms may need to file follow-up reports. The timing depends on the jurisdiction.

Where do I report in my country?
Reports go to the national financial intelligence unit, such as FinCEN in the US, the NCA in the UK and FINTRAC in Canada.

For more, see money laundering and anti-money laundering (AML).

‍