What is a Suspicious Activity Report (SAR)? Complete Filing Guide for 2026
A Suspicious Activity Report (SAR) is the formal mechanism by which regulated firms report potential money laundering, terrorist financing, fraud, or other financial crime to a national financial intelligence unit. This guide explains exactly when a SAR must be filed, how the filing process works in major jurisdictions, what regulators expect from the underlying investigation, and how to design a SAR process that protects the firm and the analyst.
The SAR is the operational endpoint of the AML compliance programme. Customer onboarding, transaction monitoring, sanctions screening, and analyst investigation all exist to surface potential financial crime — and the SAR is the mechanism through which that surfaced suspicion is escalated to the authorities who can act on it.
The SAR process is also where the personal stakes are highest for compliance professionals. The decision to file (or not file) a SAR is the MLRO's personal regulatory responsibility. Doing it well requires not just the right systems but the right judgement, applied consistently across thousands of cases per year in larger institutions.
When a SAR Must Be Filed: The Legal Threshold
The legal threshold for filing a SAR is not "I am certain that money laundering is occurring." It is significantly lower than that — and getting the threshold right is fundamental to operating a SAR programme correctly.
- UK (POCA / Terrorism Act) — a SAR must be filed when the firm knows or suspects, or has reasonable grounds to know or suspect, that another person is engaged in money laundering or terrorist financing. The standard of "reasonable grounds to suspect" is objective: would a reasonable compliance professional in the same circumstances have suspected?
- US (BSA) — a SAR must be filed for transactions of USD 5,000 or more (USD 25,000 for transactions involving no identified suspect) where the firm knows, suspects, or has reason to suspect involvement in money laundering or violation of the BSA. Filing is also required for transactions that have no apparent lawful purpose or are not the kind in which the customer would normally be expected to engage.
- Singapore (CDSA) — a Suspicious Transaction Report (STR) must be filed where the firm knows or has reasonable grounds to suspect that property represents the proceeds of, or was used in connection with, drug trafficking or other serious offences.
- EU member states — the threshold is harmonised by AMLD provisions: knowing, suspecting, or having reasonable grounds to suspect money laundering or terrorist financing. National FIUs implement specific filing mechanics.
The Path from Alert to SAR
A SAR does not appear out of nowhere. It is the outcome of a structured investigation that begins with an alert (typically generated by transaction monitoring, sanctions screening, or staff escalation), proceeds through analyst investigation, escalates to MLRO review, and concludes either with a SAR filing or with a documented decision not to file.
Alert Generation
Alerts can come from automated monitoring systems (a transaction crosses a defined threshold or matches a defined typology), from sanctions or PEP screening (a customer or counterparty matches a watchlist entry), or from human staff (a relationship manager notices behaviour they consider unusual). All three are valid sources and all three must feed into the same investigation workflow.
Initial Triage
The alert is assigned to an analyst for triage. The triage step distinguishes alerts that warrant deeper investigation from alerts that can be closed at first review (the most common cause of which is false-positive sanctions matches against common names). Triage decisions and rationale must be documented — a closed alert that later turns out to have been a missed SAR will be examined by regulators.
Investigation
Where deeper investigation is warranted, the analyst pulls the customer's full profile, transaction history, and any prior alerts; reviews the specific behaviour that triggered the alert; assesses whether there is a legitimate explanation; and where appropriate, escalates internally to obtain additional information from the relationship manager or, in limited cases, from the customer directly. The investigation, the evidence reviewed, and the analyst's conclusions must all be documented in the case management system.
MLRO Decision
Where the investigation cannot exclude suspicion, the case escalates to the MLRO. The MLRO's decision — whether to file a SAR — is the personal regulatory responsibility that defines the role. The MLRO must document the decision and the rationale, including the reasoning if the decision is not to file. An MLRO who is overruled on a SAR decision by commercial management is a regulatory failure in itself.
Filing
Where the decision is to file, the SAR is submitted to the relevant FIU through the prescribed channel — the NCA SAR Online portal in the UK, FinCEN BSA E-Filing System in the US, the STRO online portal in Singapore. Each FIU has specific format requirements and the filing must be made within the regulatory deadline (typically 30 days from the initial detection of the relevant facts).
Tipping Off: The Rule You Cannot Break
Every SAR regime in every major jurisdiction includes a "tipping off" prohibition. Once a SAR has been filed (or is being prepared), the firm is legally prohibited from informing the customer that they are the subject of a SAR. The rationale is that if customers learn they are being reported, they will dissipate the proceeds of crime before law enforcement can act.
The tipping off prohibition extends beyond explicit disclosure. Asking the customer pointed questions about specific transactions — to the extent that a reasonable customer would infer a SAR is being prepared — can itself constitute tipping off. Compliance teams handling SAR cases must be trained on the boundary between legitimate due diligence enquiries and impermissible disclosure.
What Happens After a SAR Is Filed
Filing a SAR does not end the firm's obligations or terminate the relationship. The firm typically continues to operate the relationship while the FIU and law enforcement evaluate the report. In some cases, the FIU will issue a "consent" framework allowing specific transactions to proceed (or requiring them to be blocked); in other cases, the firm continues normal operation and supplements the original SAR with further reports as new information emerges.
The firm must also retain all records relating to the SAR — the original alert, the investigation file, the MLRO decision, and the SAR itself — for the regulatory retention period (typically five years from the filing or from the end of the relationship, whichever is later). These records are subject to subpoena and routinely examined during regulatory inspections.
Build Your SAR Process on a Platform Designed for It
One Constellation provides integrated alert generation, structured investigation workflows, MLRO review queues, and full audit-trail documentation — every step from initial alert to SAR filing captured in a single compliance environment.
