16.1 SARs and STRs: What They Are, When and Where to File, and Why They Matter
Key Takeaways
FATF Recommendation 20 requires financial institutions to report suspicions promptly to the financial intelligence unit when they suspect criminal proceeds or terrorist financing.
US banks file SARs at US$5,000 when a suspect is identified, at US$25,000 regardless of suspect, and for insider abuse at any amount; MSBs file at US$2,000.
In the UK, regulated firms report to the National Crime Agency, and a defence against money laundering request must be made before carrying out a transaction involving suspected criminal property.
FinCEN's October 2025 FAQs confirmed there is no requirement to conduct a separate continuing-activity review after filing a SAR.
CAFCA sub-topic 4.4 covers SARs and STRs: definitions, when and where they are required, why they are important, and best practices for writing them. This section covers the obligations, and the next covers narrative writing.
Definitions
- SAR, the suspicious activity report, is the term used in the US, the UK and some other countries. It covers activity, including attempted transactions, not only completed transactions.
- STR, the suspicious transaction report, is the term used in most other jurisdictions and in many FATF materials.
- Both send a firm's suspicion to the national financial intelligence unit (FIU), which analyses reports and passes intelligence to law enforcement.
FATF Recommendation 20 says that if a financial institution suspects, or has reasonable grounds to suspect, that funds are the proceeds of crime or related to terrorist financing, it must report its suspicion promptly to the FIU. Recommendation 21 requires legal protection for good-faith reporters and a ban on tipping off.
Where and when: key jurisdictions
| Jurisdiction | Report and recipient | Main thresholds and timing |
|---|---|---|
| United States | SAR to FinCEN through BSA E-Filing | Banks: US$5,000 or more where a suspect is identified; US$25,000 or more regardless of suspect; insider abuse at any amount. MSBs: US$2,000 or more. File within 30 calendar days of initial detection; banks may take up to 60 days if no suspect has been identified. Banks must notify law enforcement immediately in ongoing violations needing immediate attention |
| United Kingdom | SAR to the National Crime Agency through its online portal | No monetary threshold. Report as soon as practicable once there is knowledge or suspicion (or reasonable grounds) of money laundering. A defence against money laundering (DAML) request is needed before proceeding with a transaction involving suspected criminal property (Chapter 4) |
| European Union | STR to the national FIU (for example Tracfin in France) | No threshold for suspicion. Report promptly. Many FIUs use the UNODC goAML platform |
| Singapore | STR to the Suspicious Transaction Reporting Office | Report promptly when there is suspicion |
| Hong Kong | STR to the Joint Financial Intelligence Unit | Report as soon as practicable; failure to report suspicion is an offence |
Attempted activity counts. A suspicious account opening that the firm declines, or a payment it rejects, can still require a report.
Why SARs and STRs matter
- Intelligence: FIUs combine reports from many firms to see networks that no single firm can see.
- Investigations and prosecutions: SARs generate leads, link suspects and support asset recovery.
- Typologies: aggregated reporting shapes advisories, alerts and national risk assessments.
- Victim protection: fast reporting can support recalls and freezes in fraud and scam cases.
- Legal compliance and protection: reporting is mandatory where the threshold is met. Good-faith reports are protected by safe harbour provisions, such as 31 U.S.C. 5318(g)(3) in the US and the protected and authorised disclosure provisions of the UK Proceeds of Crime Act.
Supporting rules to remember
- Confidentiality. Never disclose a SAR or information that would reveal it. Store SAR records separately with restricted access.
- Joint filing. US rules allow institutions involved in the same transaction to file a joint SAR. For example, a sponsor bank and a FinTech MSB can file one report (Chapter 17).
- Continuing activity. FinCEN had long suggested filing at least every 90 days on ongoing activity. In October 2025, FinCEN and the federal banking agencies confirmed that there is no requirement to conduct a separate continuing-activity review after a SAR. Firms must still file when they detect further reportable activity.
- Decisions not to file. The BSA does not require them to be documented, but firms usually record them for QA and governance (Chapter 14).
- Advisory key terms. When a FinCEN alert or advisory applies, include its key term, such as FIN-2023-PIGBUTCHERING or FIN-2024-DEEPFAKEFRAUD, in SAR field 2 and the narrative.
Who decides
The decision to file belongs to the designated person: the BSA officer or SAR committee in the US, or the nominated officer (usually the MLRO) in the UK. In BaaS models, the sponsor bank decides on its own SAR, and a FinTech that is itself an MSB decides on its own (Chapter 17). Front-line staff report internally; they do not file directly.
Realistic exam scenario
A US MSB detects on 1 March that a customer has sent US$2,400 across six transfers to a counterparty linked to a reported investment scam. The customer cannot explain the payments. The total exceeds the MSB threshold of US$2,000, so the MSB must file a SAR within 30 calendar days of 1 March. The MSB rules have no 60-day extension, because that extension applies only to banks without an identified suspect. If the same activity occurred at a UK EMI, there would be no threshold. The EMI would report to the NCA as soon as practicable, and it would need a DAML before processing any further payment it suspected involved criminal property.
Common exam traps
- Applying bank thresholds to MSBs, or the 60-day extension to MSBs.
- "No completed transaction, no report." Attempted activity can be reportable.
- "UK SARs have a dollar threshold." They do not.
- Thinking continuing-activity reviews every 90 days are a legal requirement. FinCEN's 2025 FAQs say they are not.
A US MSB identifies suspicious transfers totalling US$2,300 with an identified suspect. What applies?
A SAR is required within 60 days, because MSBs always receive an extension
No SAR is needed, because the bank threshold of US$5,000 has not been met
A SAR is required: the MSB threshold is US$2,000, filed within 30 days of detection
A SAR is optional for any amount below the US$25,000 threshold
A UK e-money firm suspects that a customer's incoming funds are the proceeds of fraud and wants to process the customer's outbound payment. What does it generally need before proceeding?
A court order from the High Court authorising the payment
Nothing, because UK firms only report after the transaction completes
Written consent from the customer to process the payment
A DAML from the National Crime Agency, requested through a SAR
What did FinCEN's October 2025 FAQs say about continuing-activity reviews after filing a SAR?
No separate continuing-activity review is required, but further reportable activity must still be reported
SARs on continuing activity are now prohibited to reduce duplicate filings
They must be carried out every 30 days for as long as the account remains open
Continuing activity must always be reported to the customer as well as FinCEN
Sections you finish are checked off in the contents.