A Suspicious Activity Report is the point where compliance work becomes real. Everything else — KYC, monitoring, screening — exists to help you recognise when one is needed.
This guide explains what a SAR is, when to file, and how to write one properly.
What a SAR is
A Suspicious Activity Report is a formal report a firm submits to its national Financial Intelligence Unit when it has reasonable grounds to suspect that funds are connected with criminal conduct.
You will also see the term STR — Suspicious Transaction Report. The names vary by country, and some jurisdictions use both for slightly different things, but the purpose is identical: passing intelligence to the authorities.
In India, reports go to FIU-IND. In the United States it is FinCEN. The UK has the National Crime Agency.
Importantly, a SAR is intelligence, not an accusation. You are not accusing anyone of a crime or starting a prosecution. You are telling the authorities that something looks unusual so they can analyse it alongside information from other sources.
When do you file one?
This is where most beginners get it wrong, so it is worth being precise.
The standard is reasonable suspicion — not proof.
You do not need to identify the underlying crime. You do not need evidence that would stand up in court. You do not need certainty. The test is whether there are grounds that would lead a reasonable person to suspect the funds may be connected to criminal activity.
If the bar were proof, almost nothing would ever be reported, and the entire system would fail.
What matters is that your suspicion is genuine and your reasoning is documented clearly.
Reasonable suspicion in practice
You have reasonable suspicion when the activity cannot be adequately explained by what you know about the customer.
If the transactions fit their profile, the counterparties make sense, and any documentation supports the explanation, you close the case with your reasoning recorded.
If there is no plausible explanation, or the explanation contradicts the evidence, or the customer's account of it does not hold up, you escalate.
What triggers a SAR
Reports commonly arise from:
- Monitoring alerts that could not be explained after investigation
- Screening hits where a customer matches a watchlist
- Staff observations — a branch employee noticing unusual behaviour
- Adverse media revealing something concerning about a customer
- Customer refusal to provide information, particularly alongside unusual activity
That last one surprises people. Refusing to explain a transaction is itself a red flag.
How the process works
Step 1 — Internal report. The analyst who spots the concern raises it internally, usually to a senior analyst and then to the MLRO (Money Laundering Reporting Officer).
Step 2 — Review. The MLRO assesses whether the suspicion meets the threshold. Not every internal report becomes an external one.
Step 3 — Filing. If it does, the firm files with the Financial Intelligence Unit within the regulatory deadline.
Step 4 — After. The relationship is usually monitored more closely. Filing a SAR does not automatically mean closing the account — and closing it too quickly can even harm an investigation.
Writing a strong SAR narrative
The narrative is the part that matters most, and the part people do worst.
Write it so that a reader with no prior knowledge of the case understands what happened. The person reading it at the FIU has never met your customer and has no access to your systems.
Cover the five basics:
- Who — the customer and the counterparties
- What — what actually happened, with amounts and dates
- When — the time period involved
- Where — where funds came from and went
- Why — why you found it suspicious
Practical rules
Use plain factual language. Avoid internal jargon, system names and abbreviations that mean nothing outside your firm.
Quantify. "Twelve cash deposits totalling ₹9.4 lakh between 3 and 19 March" is useful. "Multiple large deposits" is not.
Separate fact from assessment. State what the customer said, then state your view of it. Do not blend the two.
Avoid speculation. Do not guess at which crime it might be. Describe what you observed.
Tipping off — the serious mistake
You must never tell the customer that they have been reported, or that they are under investigation.
This is called tipping off, and it is a criminal offence in most jurisdictions — including for the individual employee, not just the firm. The reason is obvious: a warned subject can move funds and destroy evidence.
In practice this means:
- Never say a transaction was reported
- Never hint at it — no "compliance is looking at your account"
- If a customer asks why something is delayed, give a neutral answer such as "it is under standard internal review" and escalate
If you are unsure how to word something, ask your compliance team. This is not an area to improvise in.
Defensive SARs — why more is not better
A defensive SAR is one filed without genuine suspicion, purely to protect the firm in case something later goes wrong.
It is discouraged, and understandably so. Flooding the Financial Intelligence Unit with low-value reports makes it harder for them to identify the genuinely serious cases. It dilutes the signal that the whole system depends on.
Report what you genuinely suspect, with clear reasoning. Not everything that generated an alert.
Record keeping
Whether you file or close, document your assessment. Your case notes are the evidence that the decision was made properly, and regulators judge the work by what is written rather than what you remember.
FATF recommends retaining records for at least five years, and many jurisdictions require the same or longer.
The interview angle
If you are preparing for a compliance interview, expect at least one SAR question. The three that come up most:
"What is the standard for filing a SAR?" — Reasonable suspicion, not proof.
"What makes a good SAR narrative?" — Who, what, when, where and why, in plain factual language that a reader with no context can follow.
"What is tipping off?" — Warning the subject, directly or indirectly. A criminal offence.
Answer those three clearly and you will be ahead of most candidates.