How to File a Suspicious Activity Report

You spotted something odd in an account. Here is the form to use, the fields that must be filled, the deadlines that run, and what happens after you hit submit.

Published	14 October 2026

You were reviewing an account and something did not add up. Now you have a task with a clock on it. This page walks through how to file a suspicious activity report. It covers the form, the deadlines, and what happens after you submit it.

What a suspicious activity report is and who files it

A suspicious activity report, or SAR, goes to FinCEN. A financial institution files one when it sees a transaction that may break a law or rule. § 1020.320 requires every bank to file a report of any suspicious transaction relevant to a possible violation of law or regulation. Money services businesses have their own rule in § 1022.320.

The rules differ by institution type. A bank reports under the suspicious activity report requirements for banks. A money transmitter reports under its own section.

The form: the BSAR and the BSA E-Filing System

The form is the BSAR, filed through the BSA E-Filing System. The FFIEC manual says the BSAR replaced FinCEN SAR-DI form TD F 90-22.47 and provides a uniform data collection format across multiple industries. One form now serves filers across multiple industries.

The form did not change the rules behind it. The FFIEC manual says the BSAR does not create or otherwise change existing statutory and regulatory expectations for banks. For banks, the statutory and regulatory expectations that applied before the BSAR still apply.

The system is strict about blank fields. The FFIEC manual says the BSA E-Filing System will not accept filings in which fields marked as critical are left blank. If you do not know an answer, say so. The FFIEC manual says the bank must either provide the requested information or check the unknown box that comes with each critical field.

What counts as a transaction and the thresholds that apply

The word transaction covers more than people expect. The FFIEC manual says a transaction includes a deposit, a withdrawal, a transfer between accounts, an exchange of currency, and an extension of credit.

The dollar line depends on who you are. § 1020.320 says a transaction requires reporting if it involves or aggregates at least $5,000 in funds or other assets. § 1022.320 requires a money services business to report a suspicious transaction that involves or aggregates at least $2,000. That section also sets a $5,000 reporting line for an issuer of money orders or traveler's checks using clearance records.

The word aggregates matters. Several small moves that fit a pattern can cross the line together. A transaction that was only attempted can be reported too. FinCEN's advisory says institutions may file a SAR no matter the amount involved, even if the transaction was only attempted. The advisory allows a report even where the rule does not demand one.

Filing deadlines: initial detection and the 30/60-day clock

The clock starts at initial detection. The FFIEC manual says the phrase initial detection should not be interpreted as meaning the moment a transaction is highlighted for review.

From there, the deadline is short. § 1022.320 requires a money services business to file each SAR no later than 30 calendar days after initial detection. Banks have their own limit in § 1020.320. § 1020.320 says reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. The FFIEC manual says if no suspect can be identified, the time period for filing a SAR is extended to 60 days.

Writing the narrative: complete, thorough and timely

The narrative is where the report lives or dies. The FFIEC manual says banks are required to file SARs that are complete, thorough, and timely. It also warns that wrong facts or a messy narrative may make further analysis difficult, if not impossible.

FinCEN's advisory says filers must give a clear, complete, and concise description of the activity, including what was unusual or irregular.

Calling law enforcement does not replace filing

A phone call feels like action, but it does not finish the job. The FFIEC manual says notifying law enforcement of a suspicious activity does not relieve a bank of its obligation to file a SAR. The FFIEC manual says a bank that calls the terrorist hot line must also file a SAR.

If you do call, the FFIEC manual says the right office is usually the local IRS Criminal Investigation Division or the FBI. Then file anyway.

The report is secret, and the secrecy is broad. The FFIEC manual says a SAR and any information that would reveal its existence are confidential, except as necessary to fulfill BSA obligations. The FFIEC manual says even the existence or non-existence of a SAR must be kept confidential. You cannot confirm or deny that a report exists. Not even to the customer.

There are narrow exceptions. § 1020.320 allows a bank to share the underlying facts, transactions, and documents behind a SAR with another financial institution preparing a joint SAR. It also allows sharing inside the bank's own corporate structure, for purposes consistent with the Bank Secrecy Act. FinCEN's advisory says institutions should consider filing a SAR jointly on shared suspicious activity with other involved financial institutions.

Keeping records: the five-year retention

Filing is not the last step. FinCEN's advisory says a financial institution must keep a copy of a SAR and its supporting documentation for five years from the filing date. The supporting documentation is kept along with the form itself.

The copy has to be reachable. FinCEN's advisory says financial institutions must provide a requested SAR and its supporting documentation to FinCEN or an appropriate law enforcement or supervisory agency.

What happens after you file

After you submit, the report sits with FinCEN, alongside the other filings covered by FinCEN reporting requirements.

Your job ends at reporting. The FFIEC manual says banks are not required to investigate or confirm the underlying crime, because investigation is the responsibility of law enforcement. You report what you saw. They decide what it means.

Two protections sit behind the filing. The FFIEC manual says federal law provides protection from civil liability for all reports of suspicious transactions made to appropriate authorities. FinCEN's advisory says statutorily defined financial institutions may voluntarily report suspicious transactions under the suspicious activity reporting safe harbor.

One gap to know. § 1020.320 says a bank is not required to file a SAR for a robbery or burglary reported to appropriate law enforcement authorities. And the stakes of getting the rest right are real. § 1020.320 says FinCEN or its delegatees examine banks for compliance with this section, and failure may violate the Bank Secrecy Act.