Filing a SAR with FinCEN: BSA AML Compliance Guide 2026

The Suspicious Activity Report (SAR) is the primary tool for US financial institutions and other covered entities to report suspected money laundering, fraud, and terrorist financing to federal authorities. The obligation flows from the Bank Secrecy Act (BSA), 31 USC § 5318, implemented through FinCEN regulations at 31 CFR Parts 1010–1023. SARs are filed with the Financial Crimes Enforcement Network (FinCEN), a bureau of the US Treasury Department, via the BSA E-Filing system. This guide covers who must file, the 30-day deadline, Currency Transaction Reports (CTRs), the Corporate Transparency Act (CTA), and the penalties for non-compliance.

Regulatory disclaimer: This guide is for informational purposes only. BSA/AML regulations are subject to ongoing rulemaking. Consult qualified legal counsel for specific situations.

Who must file SARs under US federal law?

The BSA and FinCEN regulations require SAR filing by a broad set of financial institutions and designated non-financial businesses and professions (DNFBPs):

Non-bank mortgage lenders, housing GSEs, and virtual asset service providers (VASPs) are subject to rulemaking expected to finalize in 2026. The Anti-Money Laundering Act of 2020 (AMLA 2020) significantly strengthened FinCEN's mandate and resources, and expanded the definition of "financial institution" under the BSA.

State-chartered institutions must comply with both federal BSA rules and any state-specific AML regulations. New York's Department of Financial Services (DFS) Part 504 requires a transaction monitoring and watch-list filtering program for all regulated institutions — a requirement that goes beyond the federal baseline.

The SAR filing threshold and 30-day rule

A SAR must be filed within 30 calendar days of the date the financial institution initially detects a fact that may constitute grounds for filing. If the institution cannot identify a suspect at the time of initial detection, the deadline is extended to 60 calendar days.

The dollar thresholds vary by institution type:

• Banks: transactions totaling $5,000 or more involving a known suspect; $25,000 or more regardless of a suspect
• MSBs: $2,000 or more
• Casinos: $3,000 or more
• Broker-dealers: $5,000 or more

There is no minimum dollar threshold for transactions that involve terrorism financing, export control violations, or situations where the institution reasonably suspects a federal crime. FinCEN Guidance FIN-2007-G003 confirms that institutions should file regardless of dollar amount in such cases.

Currency Transaction Reports (CTRs)

Separate from SARs, the BSA requires banks and other financial institutions to file a Currency Transaction Report (CTR) for any cash transaction exceeding $10,000 (31 USC § 5313; 31 CFR § 1010.311). Multiple cash transactions by the same person totaling more than $10,000 in a single business day must also trigger a CTR.

Structuring transactions to avoid the $10,000 CTR threshold — called "smurfing" — is itself a federal crime under 31 USC § 5324, regardless of whether the underlying funds are legitimate.

How to file: FinCEN BSA E-Filing system

All SARs are submitted through FinCEN's BSA E-Filing System (bsaefiling.fincen.treas.gov). The system requires institutional enrollment and individual user credentials. Large institutions typically integrate their AML transaction monitoring systems directly with the BSA E-Filing API.

A complete SAR must include:

1. Subject information: full legal name, date of birth, SSN/EIN, address, occupation, and relationship to the filing institution
2. Suspicious activity information: the date(s), amount(s), and location(s) of the suspicious activity; the type of suspicious activity (structuring, money laundering, fraud, terrorist financing, etc.)
3. Narrative section: a clear, fact-based description of why the activity is suspicious — FinCEN's SAR Activity Review consistently identifies vague narratives as the most common quality deficiency
4. Supporting documentation references: note relevant account records, transaction histories, and KYC documents held on file (do not attach documents to the SAR itself)

After filing, the institution receives a BSA Identifier (BSA ID). This number must be retained and linked to the underlying case file.

Safe harbor from civil liability

31 USC § 5318(g)(3) provides a complete safe harbor from civil liability for any financial institution or employee that files a SAR in good faith. This protection applies even if the filing turns out to be erroneous, provided it was made without malice. The safe harbor also extends to the tipping-off prohibition: institutions must not notify the subject of a SAR or anyone else that a SAR has been filed.

The Corporate Transparency Act and beneficial ownership

Effective January 2024, the Corporate Transparency Act (CTA) (31 USC § 5336) requires most small US legal entities to report their beneficial ownership information (BOI) to FinCEN. This creates a new layer of customer due diligence: financial institutions must now verify that their business customers' BOI on file matches FinCEN's BOI database when performing enhanced due diligence.

The AMLA 2020 required FinCEN to establish the BOI database, which serves as a critical resource for law enforcement and financial institutions conducting KYC on business customers. Non-compliance with BOI reporting carries civil penalties of up to $591 per day and criminal penalties of up to $10,000 and two years' imprisonment.

Documentation and record retention

CheckFile supports over 3,200 document types across 32 jurisdictions, enabling US financial institutions and obliged entities to centralize AML evidence documentation with automated verification. The CheckFile KYC platform uses multi-layer analysis — structural, metadata, and cross-document coherence — to detect altered or inconsistent identity documents before they enter the CDD record.

Under 31 CFR § 1010.430, financial institutions must retain BSA records for five years from the date of the record or report. Records covered include SARs, CTRs, customer identification program (CIP) records, CDD records, and relevant transaction histories. Some regulators recommend retaining SAR-related records for longer given the statute of limitations on BSA violations.

According to the ACFE 2024 Report to the Nations, manual detection reaches only 37% of fraud cases with an average lag of 87 days. Automated document verification substantially improves the quality and speed of suspicious activity detection.

The AML red flags and suspicious activity indicators guide provides detailed typologies relevant to US financial institutions.

Penalties for non-compliance

Civil money penalties (CMPs) for BSA violations can be assessed by FinCEN, the OCC, the Federal Reserve, the FDIC, or the NCUA. Civil penalties for willful BSA violations can reach $1,000,000 per violation or twice the value of the transaction, whichever is greater. Regulatory agencies have assessed hundreds of millions of dollars in penalties against major US banks for systematic SAR failures.

Criminal penalties under 31 USC § 5322 carry up to 10 years' imprisonment for willful BSA violations, including failure to file SARs. Obstruction of a SAR investigation under 18 USC § 1519 adds further exposure.

Regulatory consequences include consent orders, requirements for independent compliance monitors, and — in severe cases — revocation of charters or licenses.

Frequently Asked Questions

What is the difference between a SAR and a CTR?

A Currency Transaction Report (CTR) is filed for any cash transaction above $10,000, regardless of suspicion. A Suspicious Activity Report (SAR) is filed when there is suspicion of money laundering, fraud, or terrorism financing, and it applies to any dollar amount above institution-specific thresholds. Both can apply to the same transaction — a $15,000 cash deposit from a known drug trafficker would require both a CTR and a SAR.

Can I verbally communicate a SAR to law enforcement instead of filing electronically?

No. Filing via BSA E-Filing is mandatory. Verbal notification does not satisfy BSA obligations. However, in emergencies — such as when law enforcement is actively investigating and requests immediate action — you may contact the relevant agency directly while simultaneously preparing the SAR for electronic filing.

Does filing a SAR mean I must close the customer's account?

Not automatically. The decision to close an account after filing a SAR depends on the institution's risk tolerance, legal counsel's guidance, and any law enforcement requests. Closing an account immediately after filing may itself constitute tipping-off if the customer deduces the reason. Many institutions maintain accounts under enhanced monitoring pending law enforcement guidance.

Are SARs confidential?

Yes. Under 31 USC § 5318(g)(2), the existence of a SAR — or the fact that it may be filed — cannot be disclosed to any person involved in the transaction. Violation of this confidentiality rule is a federal crime. SAR data is accessible only to law enforcement and supervisory agencies through FinCEN's secure systems.

How does FinCEN use SARs after they are filed?

FinCEN analysts review SARs, conduct pattern analysis, and disseminate financial intelligence to law enforcement at the federal, state, and local level, as well as to foreign FIUs via the Egmont Group network. Collectively, SARs have supported thousands of successful money laundering prosecutions and sanctions designations.