Suspicious Activity Reporting (SAR) sits at the heart of modern anti-money laundering (AML) and counter-terrorist financing (CTF) frameworks. Every day, financial institutions across the world monitor vast volumes of transactions, customer interactions, and behavioural patterns, all with one objective in mind: identifying activity that may indicate financial crime.
When something appears unusual or inconsistent, institutions are required to escalate and, where appropriate, formally report their concerns to the relevant authorities. This process, while seemingly straightforward on paper, is in reality complex, highly judgment-based, and often misunderstood. In this blog article, we will look deeper into this process, so let’s start with the four most common questions.
What is a SAR and how does it differ from STR and CTR?
First let’s have a look at some of the terms that are frequently used:
A Suspicious Activity Report (SAR) is a formal report submitted by a financial institution when it detects behaviour or transactions that give rise to suspicion of money laundering, fraud, terrorist financing, or other financial crimes. Some countries have a minimum threshold for filing, for example in the United States, Suspicious Activity Reports (SARs) are generally filed for transactions aggregating to $5,000 or more ($2,000 for money services businesses) if the institution suspects money laundering or illegal activity.
In other countries there might be no minimal requirement, only a reasonable suspicion based on available information is enough (e.g., low amount is sent for terrorism-related purposes).
At its core, a SAR is not about proving wrongdoing. It is about raising a flag when something does not make sense. This distinction is critical. Financial institutions are not investigators or prosecutors; they are gatekeepers of the financial system, responsible for identifying risk and sharing intelligence.
In many jurisdictions outside the United States, the term Suspicious Transaction Report (STR) is used instead. While there are subtle differences in interpretation, in practice SAR and STR are largely interchangeable. STRs tend to focus more narrowly on specific transactions or attempted transactions, whereas SARs can encompass broader patterns of behaviour over time. However, both serve the same purpose: alerting authorities to potential financial crime.
Picture 1 – Article on the Coinbase fine back in 2025 related to the 2,708 STRs that took almost 3 years to complete the monitoring of impacted transactions (Source)
A Currency Transaction Report (CTR), on the other hand, operates on a completely different principle. Unlike SARs and STRs, which are driven by suspicion, CTRs are triggered purely by thresholds. For example, in the United States, any cash transaction exceeding $10,000 must be reported regardless of whether it appears suspicious. This makes CTRs a rule-based reporting mechanism, whereas SARs are risk-based and heavily reliant on human judgment. Understanding this distinction is important because it highlights the unique role SARs play. While CTRs generate large volumes of standardized data, SARs provide contextual, narrative-driven intelligence that is often far more valuable to investigators.
When must SAR reports be filed and to whom?
Financial institutions are required to submit SARs or STRs to their national Financial Intelligence Unit (FIU). These FIUs act as central hubs for collecting, analysing, and disseminating financial intelligence to law enforcement and other competent authorities. Each jurisdiction has its own reporting system and timelines, but there are common principles across most regulatory frameworks. Typically, a SAR must be filed within a defined period after suspicion is identified. In the United States, for example, institutions are expected to file within 30 days, although this can be extended if identifying a suspect proves difficult. In many European jurisdictions, the expectation is even stricter, with reporting required “without delay” once suspicion is formed.
Picture 2 – JPMorgan Bank fined for EUR 45M in November 2025 due to failure to submit reports of suspected money laundering in a timely manner between October 4, 2021, and September 30, 2022 (Source)
What actually triggers a SAR?
In practice, SARs can be triggered by a combination of automated alerts and human judgment. Transaction monitoring systems can generate alerts based on predefined rules or models, but these alerts are only the starting point. It is the responsibility of analysts to investigate further and determine whether suspicion exists. Same goes for the or watchlist screening when adverse media can be found for the existing customer that drastically changes the customer’s AML risk rating, therefore triggers can vary widely. Sometimes it is the nature of the transaction itself, such as rapid movement of funds through multiple accounts with no clear economic purpose. In other cases, it is the behaviour of the customer, such as reluctance to provide information or attempts to structure transactions in a way that avoids reporting thresholds. There are also situations where the trigger is contextual, such as transactions involving high-risk jurisdictions or industries known for money laundering vulnerabilities.
One of the key challenges here is that suspicious activity is not always obvious. Many legitimate transactions can appear unusual, and many illicit transactions are deliberately designed to look normal. This ambiguity is what makes SAR decision-making inherently complex
What happens after a SAR is filed?
From the perspective of a financial institution, filing a SAR is not the end of the process. Once a report is submitted, the institution typically continues to monitor the customer closely. Depending on the level of risk, it may also decide to restrict the account, the transaction or even terminate the relationship. In some jurisdictions, transactions may be delayed or temporarily blocked while awaiting guidance from the FIU, although this is not universally the case. It is important to understand that filing a SAR does not always automatically result in funds being frozen. This distinction can sometimes create tension within institutions, particularly when there is a strong suspicion of criminal activity but no immediate mechanism to stop the flow of funds.
From the FIU’s perspective, a SAR becomes part of a much larger dataset. Individual reports may not appear significant on their own, but when combined with reports from other institutions, patterns can begin to emerge. FIUs use advanced analytical tools to identify connections between seemingly unrelated entities, uncover networks, and detect emerging threats. Only a small proportion of SARs lead directly to investigations or enforcement actions. However, their value lies in aggregation. A single report might not trigger action, but it can contribute to a broader intelligence picture that ultimately leads to significant cases.
Picture 3 – article on the numbers presented in Estonia which indicates that 10 criminal proceedings were initiated based on information analyzed and forwarded by the FIU out of the total 11,055 STRs or 0.09% of the total reports due to reports derived from sectors where reporting quality is very low (Source)
How Financial Crime Typologies Differ Across Neighbouring Countries
One of the more overlooked aspects of financial crime risk is how significantly typologies can vary even between neighbouring countries. At first glance, countries that share borders, particularly within integrated regions such as the European Union, might be expected to face similar threats. In reality, geography, economic structure, regulatory focus, and even infrastructure create meaningful differences in how financial crime manifests. A country’s position in global trade routes, its proximity to high-risk jurisdictions, access to ports, and even its role as a transit corridor can all shape the dominant typologies observed by financial institutions and authorities. In these environments, typologies frequently involve rapid movement of funds, use of intermediaries, and links to transportation or freight-forwarding businesses.
In contrast, a neighbouring country with a more developed financial sector may experience a different set of risks. Here, the focus often shifts toward more sophisticated schemes, such as the use of shell companies, layered transactions through multiple financial instruments, and exploitation of investment platforms. The same criminal networks may operate across both countries, but they adapt their methods depending on the opportunities and controls present in each jurisdiction.
What makes this particularly challenging for financial institutions is that these differences are not always obvious. This is why a one-size-fits-all approach to transaction monitoring and SAR filing is rarely effective, therefore institutions need to calibrate their controls to reflect local realities, even within a broader regional strategy.
The complexity and challenges behind SAR filing
Despite its importance, SAR reporting is far from straightforward. Here are some of the challenges that that financial institutions usually face:
- High volume of alerts that institutions must process. Automated systems generate large numbers of false positives, requiring significant resources to investigate. This creates a constant tension between efficiency and thoroughness.
- High Complexity Cases can occur in various situations, for example where the beneficial ownership is not clear or a large customer network is identified.
- “Tipping off” – regulations strictly prohibit institutions from informing customers that a SAR has been filed or that they are under suspicion. This limits the ability of analysts to gather additional information and can make investigations more difficult. It also creates operational challenges when dealing with customers whose accounts are being reviewed or restricted.
- Subjectivity is another unavoidable factor. Different analysts may interpret the same information in different ways, leading to inconsistencies in reporting. This is compounded by the fact that financial crime typologies are constantly evolving, requiring ongoing training and adaptation of the compliance program.
- Data Quality is also a persistent issue. A SAR is only as good as the information it contains, yet institutions often struggle with incomplete or inconsistent data. Poor-quality reports reduce the usefulness of SARs for FIUs and can undermine the overall effectiveness of the system.
How to ensure an effective SAR
Given these challenges, the focus has increasingly shifted from quantity to quality. Regulators are placing greater emphasis on the usefulness of SARs rather than simply the number filed. An effective SAR is one that provides clear, concise, and actionable information.
This is where the concept of the “5Ws” becomes critical: who, what, when, where, and why. These five elements form the backbone of a strong SAR and ensure that the report can be easily understood and analysed:
| Question | Description |
|---|---|
| Who? | The “who” refers to the individuals or entities involved, including all relevant identification details. |
| What? | The “what” describes the activity itself, including transaction types, amounts, and identified patterns. |
| When? | The “when” establishes a clear timeline of events of how the activity occurred. |
| Where? | The “where” identifies the accounts, locations, and jurisdictions involved (e.g., where the funds came from and where they went). |
| Why? | The “why” is arguably the most important element, as it explains the reasoning behind the suspicion. The why should not be a universal phrase, like “this activity appears suspicious due to unusual transaction patterns”. Instead, it should focus on better questions, like what makes this activity suspicious? What happened, and why should the FIU care? |
A well-written SAR narrative ties all of these elements together into a coherent story. It should be chronological, fact-based, and clearly explain why the activity is considered suspicious, demonstrate a logical connection between the observed activity and the suspected risk. In many ways, the narrative is the most critical component of a SAR. It is the part that FIU analysts and investigators rely on to quickly understand the situation. A poorly written narrative can render an otherwise valid SAR ineffective, while a strong narrative can significantly enhance its value.
It is also important to avoid jargon that is used internally within the company and avoid speculation, sticking to facts and clearly explaining the reasoning behind any conclusions. For example, instead of vaguely stating that a customer conducted large transactions, a strong narrative would explain how those transactions deviate from the customer’s known profile, how the funds were moved, and why this pattern raises concerns. This level of detail allows FIUs to assess the report more effectively and, where appropriate, take further action.
Conclusions
SAR Reporting is a cornerstone of the global effort to combat financial crime. While the process may appear procedural, it is in reality a highly nuanced and judgment-driven activity that requires a combination of analytical skill, regulatory knowledge, and practical experience.
The effectiveness of SARs depends not just on identifying suspicious activity, but on communicating it clearly and accurately. It is a piece of intelligence. And like any form of intelligence, its value is determined by how well it is understood and how effectively it can be used. Therefore, the financial institutions that invest in strong processes, skilled analysts, and high-quality reporting will be better positioned to meet regulatory expectations and contribute meaningfully to the fight against financial crime.
Want to see how automated transaction monitoring and case management can support your SAR process? Get in touch with AMLYZE.
Mažvydas Miliauskas,
AML Risk & Assessments Lead at TransferGo
