Suspicious Activity Reporting (SAR/STR): When to File and How
The Suspicious Activity Report is the regulated firm's formal channel for reporting suspected money laundering or terrorist financing to its national Financial Intelligence Unit. This guide explains what triggers the filing obligation, how the no-tipping-off rule works, and how filing mechanics differ across major FIUs including STRO Singapore, FinCEN, the NCA, and others.
SAR filing sits at the apex of the AML programme. Customer due diligence, risk rating, and transaction monitoring all exist primarily to surface activity that should be reported. A programme that does everything else well but fails at the SAR step has produced a great deal of operational documentation and contributed nothing to the financial crime intelligence picture.
Regulators have been increasingly direct about this. SAR filing rates that diverge sharply from peers, SAR quality that consistently scores poorly with the FIU, and SAR-decision documentation that does not explain the firm's reasoning are all flags supervisors specifically look for. Getting SAR filing right — both the decision to file and the substance of what is filed — is one of the highest-stakes operational disciplines in compliance.
What Triggers a Filing Obligation
The legal threshold for filing varies subtly between jurisdictions but converges on a similar concept: the firm must file when it knows, suspects, or has reasonable grounds for suspicion that funds or activity relate to money laundering, terrorism financing, or specified predicate offences.
Knowledge is the highest standard — the firm has actual knowledge of the unlawful origin or purpose of funds. Rare in practice; when present, filing is unambiguous.
Suspicion is a lower threshold and the most common in practice — the firm has more than a vague unease but less than confirmed proof. The standard test is whether the suspicion is genuine and rational, not whether it is provable.
Reasonable grounds for suspicion is lower still and is the threshold most jurisdictions actually apply. The test is objective: would a reasonable person in the firm's position, with the same information, have suspected ML/TF? If yes, the obligation arises whether or not the firm itself subjectively suspected.
Importantly, the firm is not required to be certain — it is required to report suspicion. Refusing to file because the firm cannot prove the underlying offence is a misunderstanding of the standard. The FIU's role is to investigate; the firm's role is to escalate suspicion.
The Legal Basis for SAR Filing
United Kingdom — POCA 2002 and TA 2000
The obligation to file SARs in the UK is established under the Proceeds of Crime Act 2002 (POCA) and the Terrorism Act 2000 (TA). Under POCA Section 330, an employee in the regulated sector commits an offence if they know or suspect — or have reasonable grounds to know or suspect — that another person is engaged in money laundering, and they do not disclose this to a Nominated Officer (MLRO) or to the NCA as soon as practicable. The MLRO is then required under Section 331 to pass the disclosure to the NCA if they know or suspect that the information relates to money laundering.
The standard is not certainty — it is suspicion. Suspicion is a lower threshold than belief and considerably lower than proof. If a compliance professional is asking themselves whether they should file, that question itself is often a signal that the suspicion threshold has been reached.
United States — Bank Secrecy Act
In the US, the SAR obligation is established under the Bank Secrecy Act and FinCEN's implementing regulations. Covered financial institutions are required to file a SAR when they know, suspect, or have reason to suspect that a transaction involves funds derived from illegal activity, is designed to evade BSA reporting requirements, lacks a lawful purpose or is not the type of transaction the customer would normally conduct, or involves the use of the institution to facilitate criminal activity.
The Internal SAR Process
A SAR is the output of a regulated firm's internal process for evaluating and escalating suspicion. The process must be documented, must be available to every employee with relevant knowledge, and must lead to a defined decision-maker — typically the MLRO.
Internal Disclosure
Any employee who forms suspicion must escalate it internally to the MLRO (or to the firm's designated disclosure officer). The escalation channel must be confidential, accessible, and explicitly protected against retaliation. Frontline staff, relationship managers, operations staff, and compliance analysts may all be the originator of an internal disclosure.
MLRO Review
The MLRO evaluates the disclosure against the legal threshold. The review considers the underlying activity, the customer's profile and history, any explanations the firm has obtained, and the broader context. The MLRO's analysis is documented in a structured case file — what was considered, what was concluded, what additional information was sought, and the rationale for the final decision.
Decision and Filing (or Not)
If the MLRO concludes the legal threshold is met, the SAR is filed with the relevant FIU. If the MLRO concludes it is not met, the case is closed with documented rationale. Either decision must be reviewable — a regulator examining the file two years later must be able to follow the reasoning. "Not filed" decisions are scrutinised as carefully as filed ones.
Post-Filing Actions
Filing a SAR does not automatically require exiting the relationship. The firm must consider whether to continue, restrict, or exit, balancing the suspicion against the no-tipping-off rule and any consent or no-consent indication from the FIU. In some jurisdictions and circumstances, the firm must request consent from the FIU before continuing the activity that triggered the SAR.
The No-Tipping-Off Rule
Every major AML regime prohibits the regulated firm from disclosing to the customer that a SAR has been filed, will be filed, or is under consideration. This is the no-tipping-off rule, and it is a criminal offence to breach it.
The rule is broader than "don't tell the customer." It extends to anyone outside the defined need-to-know circle within the firm and outside law-enforcement and FIU channels. Tipping off can happen through subtle cues: a relationship manager closing an account too abruptly, a customer-service representative declining to answer routine questions, a sudden change in tone of communications. Compliance training must address the practical operational behaviours that can breach the rule, not just the principle.
Where a SAR is filed but the relationship continues, special care is required. The firm must be able to communicate normally with the customer, decline transactions where required, and respond to enquiries — without giving any indication that suspicion has been formed or reported. This is one of the operationally hardest aspects of SAR handling and requires careful coordination between the MLRO, the relationship manager, and frontline staff.
Filing Mechanics by Jurisdiction
Every FATF jurisdiction has a designated FIU, and every FIU has a defined filing portal, format, and timeline. A firm operating cross-border must understand the filing requirements of each jurisdiction it operates in.
The filing requirements at the major FIUs:
- Singapore — STRO (Suspicious Transaction Reporting Office): STRs filed via the SONAR online portal; structured form fields; expectation of prompt filing measured in days from formation of suspicion.
- United States — FinCEN: SARs filed via the BSA E-Filing System; deadline 30 days from initial detection (60 days if no suspect identified).
- United Kingdom — NCA UK Financial Intelligence Unit: SARs filed via the NCA SAR Portal; separate Defence Against Money Laundering (DAML) regime for transactions requiring consent; the DAML decision is time-bound (notice + moratorium periods).
- European Union: Each member state operates its own FIU (TRACFIN in France, FIU-Netherlands, etc.); filing standards align under the EU AMLD; cross-border information sharing through the FIU.NET network.
- Australia — AUSTRAC: SMRs (Suspicious Matter Reports) filed via the AUSTRAC Online system; prompt filing required.
- Hong Kong — JFIU: STRs filed via the JFIU's e-reporting system; immediate filing required where suspicion is formed.
Defence Against Money Laundering (DAML): The UK Consent Regime
In the UK, a DAML request — also called a consent SAR — is filed when a firm has a suspicion that a proposed transaction involves criminal property but wishes to proceed with the transaction. By filing a DAML and receiving consent from the NCA (or being deemed to have consent through the NCA's failure to refuse within the statutory period), the firm obtains a legal defence against the principal money laundering offences under POCA.
The NCA has seven working days from receipt of a DAML to either grant or refuse consent. If it neither grants nor refuses within this period, consent is deemed granted. If the NCA refuses consent, the moratorium period gives law enforcement a further 31 calendar days to investigate and take action. During this period, the firm cannot proceed with the transaction without committing a criminal offence. If law enforcement needs more time, it can apply to the court to extend the moratorium in further 31-day periods, up to a maximum of 186 days in total, under the Criminal Finances Act 2017.
The DAML process has operational implications that must be managed carefully — particularly for investment managers and wealth managers handling large transactions where a 31-day moratorium could have significant client relationship and contractual consequences.
Writing a SAR That Is Actually Useful
The substance of the SAR — what is actually written in the narrative — determines whether the FIU can act on it. FIUs receive enormous volumes of SARs annually; poorly-written narratives that fail to communicate the suspicion clearly result in reports that effectively disappear into the queue.
A useful SAR narrative does five things: identifies the customer and relevant accounts; describes the specific activity that triggered the suspicion (dates, amounts, counterparties, transaction types); explains why the activity is suspicious in context (compared to the customer's expected behaviour, declared business, or known typologies); documents what the firm has done in response (further investigation, customer contact, monitoring intensification); and identifies any specific assistance the FIU could provide.
FIUs publish guidance on SAR quality and most run feedback programmes for filers. Reviewing the FIU's published guidance and incorporating it into the firm's internal SAR template materially improves filing quality.
What Happens After a SAR Is Filed
Filing a SAR does not end the firm's obligations or terminate the relationship. The firm typically continues to operate the relationship while the FIU and law enforcement evaluate the report. In some cases, the FIU will issue a "consent" framework allowing specific transactions to proceed (or requiring them to be blocked); in other cases, the firm continues normal operation and supplements the original SAR with further reports as new information emerges.
The firm must also retain all records relating to the SAR — the original alert, the investigation file, the MLRO decision, and the SAR itself — for the regulatory retention period (typically five years from the filing or from the end of the relationship, whichever is later). These records are subject to subpoena and routinely examined during regulatory inspections.
From Alert to SAR Without the Friction
One Constellation's compliance portal connects transaction monitoring alerts directly into MLRO case workflows, structured SAR drafting, and audit-ready filing records — for STRO, FinCEN, NCA, AUSTRAC, and other major FIUs.
