Suspicious Activity Reporting (SAR) Filing Guide

Overview

Suspicious Activity Reports (SARs) are the primary tool for financial institutions to report potential money laundering, fraud, terrorist financing, and other suspicious activity to FinCEN. For trading platforms classified as Money Services Businesses (MSBs), filing SARs is a mandatory obligation under the Bank Secrecy Act.

This guide covers when to file a SAR, how to identify red flags specific to trading platforms, filing procedures, and critical compliance considerations including the prohibition on "tipping off" customers.

⚠ Legal Consequences

Failing to file required SARs can result in severe civil and criminal penalties. Willful violations can lead to fines up to $250,000 per violation and criminal prosecution. Conversely, filing SARs in good faith provides safe harbor protection.

When to File a SAR

MSBs must file a SAR when they know, suspect, or have reason to suspect that a transaction:

Involves funds derived from illegal activity
Is designed to evade BSA requirements (e.g., structuring)
Has no business or apparent lawful purpose and the institution knows of no reasonable explanation after examining available facts
Involves use of the MSB to facilitate criminal activity

Dollar Thresholds

Scenario	Minimum Amount	Deadline
Suspicious activity with suspect	$2,000 or more	30 days from detection
Suspicious activity, no suspect	$2,000 or more	30 days from detection
Suspected terrorist financing	Any amount (no minimum)	30 days from detection
Unable to file within 30 days	$2,000 or more	60 days maximum (document delay)

💡 No Maximum

There is no upper threshold. Even transactions involving millions of dollars must be reported if they are suspicious. The $2,000 minimum is just the floor for mandatory reporting.

SAR Filing Decision Tree

Step 1: Does the transaction involve $2,000 or more?

(For terrorist financing, any amount requires reporting)

↓ YES

Step 2: Do I know, suspect, or have reason to suspect any of the following?

Funds derived from illegal activity
Transaction designed to evade BSA requirements
No business or lawful purpose (no reasonable explanation)
MSB used to facilitate criminal activity

↓ YES

⚠ FILE A SAR

You must file within 30 days (60 days maximum with documented justification). Begin investigation and documentation immediately.

NO at any step?

Continue monitoring. Document your decision not to file. Enhanced monitoring may be appropriate for borderline cases.

Red Flags for Trading Platforms

Trading platforms should be particularly alert to these patterns of suspicious activity:

Layering and Structuring

Structuring deposits or withdrawals - Breaking transactions into amounts just below $10,000 to avoid CTR reporting

Rapid movement of funds - Depositing funds and immediately withdrawing or transferring without trading activity

Round-tripping - Buying and immediately selling the same security repeatedly, especially at a loss

Wash trading - Trading between related accounts to create artificial volume or move money

Layering through complex trades - Multiple offsetting positions across different accounts or securities

Account Activity Red Flags

Dormant account suddenly active - Long-inactive account suddenly receiving large deposits

Multiple accounts, same beneficial owner - Customer opening numerous accounts with similar trading patterns

Third-party funding - Account funded by unrelated parties, especially from high-risk jurisdictions

Inconsistent with customer profile - Trading volume or sophistication incompatible with stated experience/income

Reluctance to provide information - Customer refuses to provide basic KYC information or provides suspicious documents

Geographic and Entity Risk Flags

High-risk jurisdictions - Transfers to/from countries on FATF non-compliant or OFAC sanctions lists

Shell companies - Entities with no apparent business purpose or operations

PEP involvement - Politically Exposed Persons conducting unusual transactions

Sanctioned entities - Any connection to OFAC SDN list or sanctioned countries

Crypto-Specific Red Flags

Mixing services or tumblers - Funds originating from known mixing services designed to obscure transaction trails

Dark web marketplaces - Addresses associated with illicit marketplaces or ransomware

Privacy coins - Heavy use of Monero, Zcash, or other privacy-focused cryptocurrencies

Unhosted wallet transfers - Large transfers to/from non-custodial wallets without clear business purpose

SAR Filing Process

SARs must be filed electronically through the BSA E-Filing System at bsaefiling.fincen.treas.gov.

Filing Timeline

Day 0: Initial Detection Activity is first identified as potentially suspicious. Document the date and circumstances of detection.

Days 1-15: Investigation Conduct internal investigation. Gather transaction records, customer communications, IP logs, and supporting documentation.

Days 16-25: SAR Preparation Complete FinCEN SAR form. Draft detailed narrative. Obtain necessary approvals from compliance officer.

Day 30: Filing Deadline Submit SAR through BSA E-Filing System. Save acknowledgment receipt. Update internal tracking systems.

Day 31+: Post-Filing Store SAR and supporting documentation securely (5-year retention). Continue monitoring account. Prepare for potential FinCEN follow-up.

⚠ Extension to 60 Days

If you cannot file within 30 days, you may have up to 60 days IF you document the reasons for the delay. However, 30 days should be the standard—delays must be exceptional and justified.

FinCEN SAR Form Completion

The FinCEN SAR (Form 111) requires detailed information across multiple sections:

Part I: Subject Information

Type of subject - Individual, entity, or unknown
Identifying information - Name, address, TIN/SSN, date of birth
Account information - Account numbers, types, and relationships
Contact information - Phone numbers, email addresses

Part II: Suspicious Activity Information

Date range - When suspicious activity occurred
Amount involved - Total dollar value
Type of suspicious activity - Check all applicable boxes (e.g., structuring, money laundering, terrorist financing)
Instruments involved - Wire transfers, ACH, crypto, securities, etc.

Part III: Information About Financial Institution

Your MSB information - Legal name, DBA, EIN, address
Filing institution details - Contact person, phone, email
Regulatory information - Type of financial institution, primary federal regulator

Part IV: Filing Institution Contact Information

Compliance officer contact
Alternate contact information

Part V: Suspicious Activity Information - Narrative

This is the most critical section. Your narrative should:

Describe the who, what, when, where, why, and how
Explain why the activity is suspicious - Don't just describe the transaction; explain the red flags
Include relevant timeline and transaction details
Describe your investigation - What steps did you take to investigate?
Be clear and concise - Use plain language, avoid jargon
Avoid conclusions - Report facts and suspicions, not legal conclusions ("This transaction may indicate structuring" not "This is money laundering")

💡 Narrative Best Practices

Write your narrative as if you're explaining the situation to a law enforcement officer who knows nothing about your platform. Provide context, but be concise. A good narrative is typically 1-2 pages.

Continuing Activity Reports

If suspicious activity continues after you've filed an initial SAR, you must file continuing activity reports.

When to File Continuing SARs

Same suspect, same type of activity - File every 90 days if activity continues
Material new information - File immediately if you discover significant new details about previously reported activity
Law enforcement request - File if requested by FinCEN or law enforcement

Continuing SAR Requirements

Check the "Continuing Activity Report" box on the SAR form
Reference the prior SAR filing number(s) and dates
Update date ranges and amounts to reflect new activity
Describe new activity and how it relates to prior reports

Prohibition on Tipping Off

This is one of the most serious SAR-related obligations. You cannot disclose to any person involved in the transaction that a SAR has been or will be filed.

⚠ Federal Crime: Tipping Off

Tipping off a customer about a SAR filing is a federal crime under 31 U.S.C. § 5318(g)(2). Penalties include fines and imprisonment. This applies even after the SAR is filed—you can NEVER tell the customer.

What You Cannot Do

Notify the customer that you filed or will file a SAR
Explain account closures or transaction denials by referencing SARs
Disclose SAR filings to third parties (except law enforcement or FinCEN)
Mention SARs in account notes visible to customer service representatives who might inadvertently disclose

How to Handle Customer Questions

If a customer asks why their account was closed or a transaction was denied:

Use generic language: "Based on our risk assessment and internal policies"
Do not reference BSA, AML, SARs, or suspicious activity
Do not provide specific reasons that would reveal SAR filing
Train customer service staff on appropriate responses

💡 Permissible Disclosures

You MAY disclose SAR information to: FinCEN, federal/state law enforcement, federal regulators, your legal counsel (under privilege), and external auditors conducting BSA audits (with confidentiality agreements).

FinCEN 314(a) Obligations

Section 314(a) of the USA PATRIOT Act requires financial institutions to search their records for accounts or transactions involving persons suspected of terrorist activity or money laundering when requested by FinCEN.

How 314(a) Works

FinCEN issues a request - Typically bi-weekly, listing names and identifying information of subjects
You search your records - Within 2 weeks, search for any matches in your customer database and transaction history
Report any matches - If you find a match, report to FinCEN through the 314(a) system
Document your search - Keep records of searches and results

Registration for 314(a)

MSBs must register to receive 314(a) requests through FinCEN's secure system. Registration requires:

Designation of a 314(a) contact person
Secure email for receiving requests
Acknowledgment of confidentiality obligations

⚠ Confidentiality

314(a) requests are HIGHLY CONFIDENTIAL. You cannot disclose the request to anyone (including the subject) except as necessary to conduct the search and report results.

Documentation Requirements

Proper documentation is essential for both compliance and safe harbor protection.

Required Documentation

Transaction records - All relevant transactions, including dates, amounts, accounts, and parties

Investigation notes - Document your investigation process, findings, and decision-making

Customer communications - Emails, chat logs, support tickets related to the activity

IP and device information - Login history, IP addresses, device fingerprints

KYC documentation - Customer identification documents, account opening forms

Supporting analysis - Charts, graphs, transaction flow diagrams

Filed SAR copy - Keep a copy of the filed SAR and filing acknowledgment

Internal approvals - Record of compliance officer review and approval

Retention Period

All SAR-related documentation must be retained for 5 years from the date of filing. This includes:

Original SAR and all supporting documentation
Investigation records and notes
Copies of transaction records
Any correspondence with law enforcement or FinCEN

Safe Harbor Protections

Filing a SAR in good faith provides important legal protections.

✅ Safe Harbor Benefits

Financial institutions and their employees are protected from civil liability for filing SARs in good faith, even if the report turns out to be incorrect. This protection applies to both the filing itself and any resulting account actions.

Safe Harbor Requirements

Good faith - You must genuinely believe the activity is suspicious based on available facts
Reasonable basis - Your suspicion must be based on objective red flags, not speculation
Timely filing - Must file within required deadlines
Accurate information - Provide truthful and complete information to the best of your knowledge

Protected Actions

Safe harbor protection extends to:

Filing the SAR itself
Denying transactions based on SAR-related suspicions
Closing or suspending accounts due to suspicious activity
Refusing to onboard customers who present red flags

💡 Document Your Rationale

To maximize safe harbor protection, thoroughly document your reasoning for filing (or not filing) a SAR. This creates a record showing you acted in good faith based on available information.

SAR Filing Best Practices

Prevention and Detection

Implement automated monitoring - Use transaction monitoring systems to flag potential red flags
Risk-based approach - Focus resources on higher-risk customers and transaction types
Regular pattern analysis - Review transaction patterns monthly to identify emerging schemes
Cross-reference external data - Use OFAC lists, adverse media, and sanctions databases

Investigation Process

Standardized procedures - Create written procedures for conducting SAR investigations
Escalation protocols - Define when analysts should escalate to compliance officers
Investigation templates - Use standardized templates to ensure consistent documentation
Independent review - Have a second person review SAR decisions for quality control

Quality Control

Narrative review - Have someone other than the writer review narratives for clarity and completeness
Accuracy checks - Verify all amounts, dates, and identifying information before filing
Attachment review - Ensure supporting documents are relevant and properly labeled
Timeliness tracking - Monitor filing deadlines and investigate any delays

Training and Culture

Regular SAR training - Train all relevant staff on red flags and filing procedures
Case studies - Use anonymized examples to illustrate suspicious activity patterns
Encourage reporting - Create a culture where staff feel comfortable escalating concerns
No retaliation - Protect employees who report suspicious activity from retaliation

Common SAR Filing Mistakes

Mistakes to Avoid

Mistake	Consequence	How to Avoid
Missing the deadline	Regulatory violations, potential penalties	Implement deadline tracking, set internal deadlines at 25 days
Vague narratives	Unusable for law enforcement, potential follow-up requests	Use specific facts, amounts, dates, and explain the suspicion clearly
Tipping off customers	Federal crime, severe penalties	Train staff extensively, use generic language for account actions
Incomplete information	SAR rejection or follow-up requests	Use checklists, conduct thorough investigations before filing
Filing too liberally	Wasted resources, dilution of meaningful reports	Conduct proper investigations, document rationale for each filing
Not filing when required	Regulatory violations, potential criminal liability	Use decision trees, consult compliance officer on borderline cases
Poor recordkeeping	Inability to respond to law enforcement, exam findings	Maintain organized SAR files with all supporting documentation

Implementation Checklist

Register for BSA E-Filing - Obtain credentials for your compliance officer
Develop SAR procedures - Create written policies for identifying, investigating, and filing SARs
Implement monitoring systems - Deploy automated transaction monitoring tools
Train your team - Conduct comprehensive SAR training for all relevant staff
Create investigation templates - Standardize your investigation and documentation processes
Establish deadline tracking - Set up systems to monitor filing deadlines
Register for 314(a) - Ensure you receive and respond to FinCEN information requests
Review and test - Conduct periodic testing of SAR identification and filing processes

⚠ When in Doubt, Consult

Borderline SAR decisions can be challenging. When uncertain, consult with your compliance officer, BSA/AML counsel, or outside experts. Document your decision-making process regardless of whether you file.

Disclaimer: This guide provides general information about SAR filing requirements for trading platforms. Requirements may vary based on your specific business model, jurisdiction, and regulatory classification. Consult with qualified BSA/AML counsel and FinCEN guidance for your specific situation. This is not legal advice.