Definition
Suspicious Activity Report (SAR)
A confidential report a financial institution files with FinCEN when it detects transactions that look like money laundering, fraud, or other illegal activity. A broker-dealer must file a SAR within 30 calendar days of detecting the activity if a suspect is identified, or within 60 calendar days if no suspect is identified. The dollar trigger is $5,000 or more when a suspect is identified and $25,000 or more when no suspect is identified, and insider abuse or employee violations have no minimum. The firm's 'no tip-off' rule strictly prohibits telling the customer that a SAR was filed.
A registered representative sees a client wire $4,500 to an offshore account on eight different days in one month with no clear investment purpose. The firm files a SAR with FinCEN because the aggregate suspicious activity is well above the $5,000 threshold, and the representative does not tell the client the SAR was filed.
Students often mix up the SAR thresholds ($5,000 with a suspect, $25,000 without) with the CTR threshold ($10,000 cash in one day). CTRs report a mechanical cash trigger and are not confidential; SARs report suspicion and are strictly confidential under the no tip-off rule.
How is Suspicious Activity Report (SAR) tested on the exam?
- Recognizing when a SAR is required based on the dollar trigger and whether a suspect is identified
- Applying the 30-day and 60-day filing deadlines
- Applying the no tip-off rule that prohibits telling the customer
- Distinguishing a SAR (suspicion) from a CTR (cash over $10,000)
- Knowing SARs are filed with FinCEN, not directly with the FBI or the SEC
Regulatory limits
Regulatory Limits
| Description | Limit | Notes |
|---|---|---|
| SAR dollar trigger, suspect identified | $5,000 or more | Aggregated suspicious activity, not a single transaction, can meet the trigger. |
| SAR dollar trigger, no suspect identified | $25,000 or more | Applies when the activity is suspicious but no specific suspect is known. |
| Insider abuse or employee violation | Any amount | No minimum dollar threshold applies. |
| Filing deadline, suspect identified | 30 calendar days after detection | - |
| Filing deadline, no suspect identified | 60 calendar days after detection | A 30-day initial period plus a 30-day extension while identifying the suspect. |
| SAR retention period | 5 years | Firms must retain the SAR and its supporting documents for five years. |
SAR = See, Aggregate, Report. See the suspicious pattern, aggregate the amounts, report to FinCEN within 30 days (60 if no suspect). Never tell the customer.
Practice questions
Test your understanding with the questions below. Pick an answer to reveal the explanation.
A branch manager sees a client make six wire transfers of $4,200 each to an offshore account in one month. The client refuses to explain the transfers. Which action best fits the AML rules?
B is correct. The aggregate suspicious activity is $25,200, well above the $5,000 SAR trigger for a case with a suspect identified. The firm files a SAR with FinCEN and the no tip-off rule prohibits telling the client. A is wrong because a CTR reports cash, not wire transfers. C violates the no tip-off rule. D applies the wrong threshold, because SARs aggregate suspicious activity.
The SIE and Series 65 exams both test the no tip-off rule and the fact that SAR thresholds aggregate related suspicious activity, not just one transaction.
A broker-dealer must file a Suspicious Activity Report with which agency?
B is correct. SARs are filed with FinCEN, a bureau of the U.S. Department of the Treasury. FinCEN then shares the report with law enforcement as needed. A, C, and D are not the direct filing recipient, even though FinCEN may share information with them.
A common exam distractor names the FBI or SEC as the filing recipient. FinCEN is the correct answer for both SARs and CTRs.
When must a SAR be filed if a broker-dealer identifies a suspect at the time it detects the suspicious activity?
B is correct. With a suspect identified, the filing deadline is 30 calendar days. Without a suspect, the firm has an additional 30-day extension, for a total of 60 calendar days. A is the CTR deadline. D is not a real rule.
Exams test 30 versus 60 calendar days directly. Memorize both numbers and which one applies with a suspect.
What concepts relate to Suspicious Activity Report (SAR)?
This term is part of this cluster :
Where does Suspicious Activity Report (SAR) appear on the Series 6 exam?
This term is tested in the following FINRA Series 6 topic areas: