What Is a SAR? Bank Reports to FinCEN
Amount alone triggers a CTR; a SAR requires suspicious facts. The reporting paths differ: CTR and Form 8300 are cash-threshold reports, while a mandatory bank SAR generally requires at least $5,000 plus one of the specified suspicious-fact conditions.
Data behind this diagram
| Rule | Threshold or condition | Customer notice or record rule |
|---|---|---|
| Currency Transaction Report | More than $10,000 in cash in one business day at a bank | No general advance notice |
| Mandatory bank SAR | At least $5,000 plus specified suspicious facts | The bank may not disclose the SAR or reveal its existence |
| Voluntary SAR | Suspicious activity below the mandatory threshold may still be reported | The institution must assess the available facts |
| SAR condition: illegal proceeds | Funds may come from illegal activity or the transaction may conceal illegal proceeds | One of three specified grounds |
| SAR condition: BSA evasion | The transaction may be designed to evade Bank Secrecy Act rules | One of three specified grounds |
| SAR condition: no lawful purpose | No apparent lawful purpose, inconsistent with expected activity, and no reasonable explanation after review | One of three specified grounds |
| Form 8300 | More than $10,000 in cash received in a trade or business | Annual written statement generally required |
| SAR retention | The bank retains the SAR and supporting documentation for five years | Records supplied to authorized authorities on request |
| Cryptocurrency | Use alone is not the legal SAR test | Assess transaction facts, customer profile, and links to illicit activity |
A Suspicious Activity Report is a confidential filing that a bank or another covered financial institution sends to the Financial Crimes Enforcement Network, or FinCEN. The report describes activity the institution believes may involve a violation of law or regulation.
The person named in a SAR is not notified. A SAR is not a criminal charge or a finding that a crime occurred. It is a report that can be reviewed by FinCEN, regulators, and law enforcement.
Key points
- Banks cannot tell a customer that a SAR was filed about the customer.
- FinCEN reported about 4.7 million SAR filings in fiscal year 2025.
- A $5,000 threshold applies to mandatory bank SARs, but suspicion still requires a factual basis.
- FY2025 SAR FILINGS
- 4.7M
- Warning
- FinCEN FY2025 BSA data
- BANK SAR THRESHOLD
- $5,000
- Caution
- 31 CFR 1020.320
- CTR THRESHOLD
- >$10,000
- Caution
- 31 CFR 1010.311
- SAR RECORD RETENTION
- 5 YEARS
- Recorded
- 31 CFR 1020.320
When a bank must file
Under 31 CFR 1020.320, a bank must report a transaction or attempted transaction that involves at least $5,000 when it knows, suspects, or has reason to suspect one of three things:
- The funds came from illegal activity or the transaction is meant to hide illegal proceeds.
- The transaction is designed to evade Bank Secrecy Act rules, including reporting requirements.
- The transaction has no apparent lawful purpose, does not fit the customer's expected activity, and has no reasonable explanation after review.
A bank can file a voluntary SAR for suspicious activity that does not meet the mandatory threshold. The rule does not make every unusual transaction reportable. The institution must assess the available facts.
How banks identify unusual activity
The FFIEC examination manual says banks should use risk-based monitoring. Systems may produce alerts, but staff must decide whether the activity is suspicious and document that decision. The review can compare transactions with the customer's occupation, expected account activity, sources of funds, business type, location, and prior behavior.
Activity that may prompt review includes:
- cash deposits split into amounts intended to avoid a reporting threshold
- a sharp change from the account's normal activity
- payments with no clear connection to the customer's stated business
- transfers involving sanctioned parties or jurisdictions
- transactions linked to fraud, theft, money laundering, or unregistered money transmission
None of these facts proves a crime. Context determines whether the bank files.
SAR, CTR, and Form 8300 are different reports
A CTR is based on the amount and form of a transaction. A SAR is based on suspicious facts. A bank may need to file both. Form 8300 applies to qualifying cash received by a trade or business, and the IRS generally requires the business to give the named person a written statement by January 31 of the next year.
What a SAR contains
A SAR can identify the subject, accounts, dates, amounts, transaction methods, and affected institutions. Its narrative explains who was involved, what happened, when and where it happened, and why the filer considered it suspicious. The FFIEC SAR quality guidance tells banks to include information available from account opening and due diligence records.
The bank must retain the SAR and its supporting documentation for five years. It must provide the supporting records to FinCEN, law enforcement, or an authorized regulator on request.
The report stays confidential
Federal rules prohibit a bank, its directors, officers, employees, and agents from disclosing a SAR or any information that would reveal its existence. Government authorities also face disclosure limits. The rules still permit sharing with FinCEN, law enforcement, and authorized regulators.
This confidentiality means the customer has no ordinary process to inspect a SAR through the bank. The underlying account records remain separate from the SAR and may be available through other legal or customer-service processes.
Cryptocurrency does not create an automatic SAR
FinCEN's 2019 virtual-currency advisory lists facts that can indicate illicit activity, including links to darknet markets, unregistered peer-to-peer exchangers, money mules, and transactions that use mixing to conceal criminal proceeds. It does not say that every transfer to a self-custody wallet, privacy wallet, or exchange requires a SAR.
A regulated exchange or money transmitter can have its own SAR duties. Software that only lets a user hold keys does not become a SAR filer merely because it provides self-custody. The legal duties depend on what the operator does, not the label on the product.
Records Within the Customer's Control
- Keep accurate records
- Preserve invoices, contracts, tax records, and wallet transaction details that explain lawful transfers.
- Do not structure transactions
- Splitting cash or transfers to evade a reporting rule can itself create legal risk.
- Correct ordinary bank records
- If your address, occupation, or business information is wrong, ask the institution to correct those records. That does not reveal or amend a SAR.
Sources
- Electronic Code of Federal Regulations: 31 CFR 1020.320
- FFIEC BSA/AML Manual: Suspicious Activity Reporting Overview
- FinCEN: Bank Secrecy Act Data, Fiscal Year 2025
- IRS: Form 8300 and reporting cash payments over $10,000
- FinCEN Advisory FIN-2019-A003: Convertible Virtual Currency
Cunicula is editorially independent. Commercial disclosure.
Frequently Asked Questions
What triggers a Suspicious Activity Report (SAR)?
For banks, federal rules require a SAR when a transaction or attempted transaction involves at least $5,000 and the bank knows, suspects, or has reason to suspect illegal proceeds, evasion of Bank Secrecy Act rules, or activity with no apparent lawful purpose that is not expected for that customer. Banks may also file voluntary SARs below that threshold.
Can a bank tell me if it filed a SAR?
No. Federal rules prohibit a bank and its staff from disclosing a SAR or information that would reveal its existence to the person involved.
How many SARs are filed each year?
FinCEN reported about 4.7 million SAR filings in fiscal year 2025. Its public SAR Stats tool provides current filing data by industry and activity type.
Does a cryptocurrency transaction automatically trigger a SAR?
No. Cryptocurrency use alone is not the legal test. FinCEN guidance tells covered financial institutions to assess facts such as links to illicit activity, unregistered money transmission, darknet markets, mixers, transaction patterns, and the customer profile.
What is the difference between a SAR and a CTR?
A bank files a Currency Transaction Report for cash transactions over $10,000 in one business day. A SAR depends on suspicious facts and, for mandatory bank filings, generally has a $5,000 threshold. A bank may file both reports for the same activity.