Suspicious Activity Reports at Banks

A bank's duty to report suspicious transactions under 31 CFR 1020.320, from the $5,000 threshold and the 60-day limit on delay to confidentiality and the safe harbor.

Published	14 October 2026

What a suspicious activity report is, in the BSA's terms

A suspicious activity report, or SAR, is the way a bank tells the government that a transaction may be tied to a crime. The FFIEC manual says suspicious activity reporting forms the cornerstone of the BSA reporting system. That is a strong word for a form, and it fits. The whole bank secrecy act reporting structure leans on banks noticing things and passing them on.

The report is not an accusation. It is a flag. The bank says what it saw. Someone else decides what to do about it.

The rule that requires banks to file: 31 CFR 1020.320

The duty sits in one section of the regulations. § 1020.320 requires every bank to file a report of any suspicious transaction relevant to a possible violation of law or regulation.

Two words carry weight there. The transaction must be suspicious, and it must be relevant to a possible violation. The bank does not need to know which law. The rule speaks of a possible violation, not a proven one.

The rule has teeth behind it. § 1020.320 says FinCEN or its delegatees examine banks for compliance with that section, and failure may violate the Bank Secrecy Act.

The $5,000 threshold and the 60-day limit

The dollar line for banks is set in the rule. § 1020.320 says a transaction requires reporting if it involves or aggregates at least $5,000 in funds or other assets.

Aggregates matters. Several small moves that add up can cross the line together. The FFIEC manual says banks must file a SAR for criminal violations aggregating $5,000 or more when a suspect can be identified.

Two facts set the outer limit. § 1020.320 says reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. The FFIEC manual says if no suspect can be identified, the time period for filing a SAR is extended to 60 days.

The steps of the filing itself are covered on the page about how to file a suspicious activity report.

What counts as a transaction

The word transaction is broader than many staff assume. The FFIEC manual says a transaction includes a deposit, a withdrawal, a transfer between accounts, an exchange of currency, and an extension of credit.

So a SAR is not only about cash going out a teller window. A loan can be the transaction. A transfer between accounts can be. The currency transaction report, or CTR, is a separate report.

Structuring as a reportable offence

Structuring gets its own attention. § 1010.100 says structuring includes breaking down a single sum of currency exceeding $10,000 into smaller sums. § 1010.314 says no person may structure or assist in structuring a transaction with one or more domestic financial institutions.

That is the offence. The bank's part is to notice it. The FFIEC manual says that when a bank suspects a person is structuring transactions to evade CTR filing, it must file a SAR.

The safe harbor and confidentiality of a SAR

Banks worry about being sued for pointing at a customer. The law answers that. The FFIEC manual says federal law provides protection from civil liability for all reports of suspicious transactions made to appropriate authorities. The FFIEC manual says the safe harbor applies to SARs filed within the required reporting thresholds and to SARs filed voluntarily below the threshold.

So the safe harbor also reaches a SAR filed voluntarily below the threshold.

Confidentiality runs the other way. The FFIEC manual says a bank and its people may not tell anyone involved in a reported transaction that it was reported. The FFIEC manual says a SAR and anything revealing a SAR exists are confidential except to meet BSA duties. The FFIEC manual says even the existence or non-existence of a SAR must be kept confidential.

That last part is strict. A bank cannot confirm that no SAR exists either.

What the bank must keep and who it may tell

The paperwork does not end at filing. The FFIEC manual says banks must keep copies of SARs and supporting documents for five years from the filing date.

Sharing has its own rules. The FFIEC manual says banks must give all documents supporting a SAR filing to FinCEN, law enforcement, or a federal banking agency when asked. The FFIEC manual says no legal process is needed to share supporting documents with those authorities.

Inside the bank, the circle is small. The FFIEC manual says banks must tell the board of directors or a board committee that SARs have been filed. § 1020.320 allows a bank to share a SAR within its own corporate structure for purposes consistent with the Bank Secrecy Act. The FFIEC manual says a SAR's underlying facts and supporting documents may be shared with another financial institution to prepare a joint SAR.

One thing a bank does not have to do. The FFIEC manual says banks are not required to investigate or confirm the underlying crime, because investigation is the responsibility of law enforcement.

How banks detect suspicious activity in the first place

A SAR starts somewhere. The FFIEC manual says suspicious activity monitoring and reporting are critical internal controls. The FFIEC manual says monitoring systems typically include employee identification or referrals, transaction-based manual systems, surveillance automated systems, or a combination of these.

Risk shapes the choice. The FFIEC manual says the sophistication of monitoring systems should be dictated by the bank's risk profile.

The standard is not perfection. The FFIEC manual says FinCEN and the federal banking agencies recognize that a bank cannot detect and report all potentially illicit transactions.

The BSAR form

A SAR is the form a US bank files under the BSA.

The US form itself has changed shape. The FFIEC manual says the BSAR replaced FinCEN SAR-DI form TD F 90-22.47 and provides a uniform data collection format across multiple industries. The FFIEC manual says the BSAR does not create or otherwise change existing statutory and regulatory expectations for banks.