Definition
Suspicious Activity Report (SAR)
The confidential filing a US financial institution makes to FinCEN when it knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA reporting, has no apparent lawful purpose, or facilitates criminal activity.
By Bart Mierzejewski · Founder, FinCrime Desk · Reviewed Sep 19, 2026
Why it matters
The SAR is the output of most of the AML function. Monitoring systems, investigations, and case management all exist to produce, or to justify not producing, this one document. An analyst's working life is largely SAR decisioning and SAR narrative writing, and the quality of that narrative is what an examiner reads.
In practice
Banks file within 30 calendar days of initial detection of facts constituting a basis for filing, extendable to 60 days if no suspect has been identified. There is no dollar threshold for insider abuse; the general threshold for identified suspects is $5,000. The narrative is the substance: who, what, when, where, why, and how, written so a reader with no access to the case file can follow it.