SAR (Suspicious Activity Report) is a confidential report that a bank, payment firm, crypto service provider or other regulated business must file with the national financial intelligence unit when it knows or suspects a customer's activity involves money laundering, terrorist financing or other crime: FinCEN in the US, the National Crime Agency in the UK. US banks file on transactions of at least $5,000, money services businesses from $2,000, within 30 calendar days of detection. UK firms that need to proceed with a suspect transaction request a defence against money laundering, which the NCA has seven working days to answer. Telling the customer is tipping off, a criminal offence. Buyers test alert volumes, filing times and backlogs.
When must a SAR be filed in the US
Under 31 CFR 1020.320, a bank must file when a transaction involves or aggregates at least $5,000 and it knows, suspects or has reason to suspect the funds derive from illegal activity, are structured to evade reporting, or have no apparent lawful purpose. Money services businesses face a lower threshold of $2,000 under 31 CFR 1022.320, which matters for remittance firms and MSBs.
The SAR is due within 30 calendar days of initial detection. If no suspect has been identified, a bank may take an extra 30 days, but never more than 60 days in total. A copy and all supporting documents must be kept for five years, and the SAR itself, including the fact that one exists, is confidential.
How SARs work in the UK
UK firms report through the NCA's online portal, usually via their MLRO. Where a firm needs to carry out a transaction it suspects involves criminal property, it asks for a defence against money laundering (DAML). The NCA has seven working days to respond; silence counts as deemed consent. If the NCA refuses, a 31-day moratorium follows, which a court can extend up to a maximum of six months in total.
An illustrative case: a payment institution sees a new corporate client receive €480,000 from 14 unrelated senders within a week and attempt to pay it all out to an exchange. Transaction monitoring flags it, the MLRO files a SAR with a DAML request on Monday, and the payout stays on hold. If the NCA has not replied by the following Wednesday, the firm may process it.
Tipping off
Telling the customer that a SAR has been filed, or is being considered, is a criminal offence under UK law (tipping off) and is prohibited by US confidentiality rules. Firms delaying a payment during a DAML period therefore give neutral explanations, which is a frequent source of customer complaints about accounts frozen "without reason".
SARs in a fintech acquisition
Buyers cannot see the SARs themselves, but they can and should test the system behind them. Due diligence asks how many alerts transaction monitoring generated, how many became SARs, average time from alert to filing, and whether any filings were late. A firm that filed almost no SARs against a high-risk customer base is a red flag for regulators reviewing the change in control, as is one with a backlog of uninvestigated alerts.