Suspicious Activity Reporting: Getting It Right

Suspicious activity reporting is the compliance obligation that most directly connects regulated businesses to law enforcement. Getting it wrong — whether by over-reporting, under-reporting, or filing poorly constructed reports — undermines the entire framework.

In October 2025, five US federal agencies — the OCC, FinCEN, the Federal Reserve, the FDIC, and the NCUA — jointly issued updated FAQ guidance on SAR obligations. The guidance corrected several common misunderstandings that had been driving poor practice across the industry.

The most significant clarification: financial institutions are not required to file SARs for transactions at or near the USD 10,000 currency transaction reporting threshold solely because of the amount. SARs are required only when there is knowledge or suspicion that the transaction is designed to evade reporting requirements — structuring — or involves other illegal activity or money laundering. The amount alone is not a trigger. This matters because defensive over-filing — submitting SARs to avoid regulatory criticism rather than because genuine suspicion exists — floods Financial Intelligence Units with noise and dilutes the intelligence value of the reporting system.

Another critical clarification: there is no regulatory requirement to file continuing SARs at least every 90 days. The 120-day deadline applies to the initial SAR for an activity, not to renewals. Businesses that automatically re-file SARs on a rolling schedule to reset the clock are creating administrative burden without adding compliance value.

What makes a good SAR is straightforward in principle and difficult in practice. A good SAR includes complete subject information — all available identifying data, including aliases, dates of birth, passport numbers, and addresses. It uses accurate categorisation — choosing the right activity type rather than defaulting to vague categories. It provides a clear timeline — a chronological sequence of events with specific dates. It identifies specific red flags — not "suspicious activity occurred," but "customer withdrew £50,000 cash within 24 hours of receiving a wire transfer from an unknown entity." And it provides context — explaining why the activity is suspicious in relation to the customer's profile and the business's understanding of normal behaviour.

The narrative section is where most SARs fail. Examiners consistently identify weak narratives that omit the "five Ws" — who, what, when, where, and why — or that describe the activity without explaining why it is suspicious. A SAR narrative should read like a brief investigation summary, not a transaction log.

Effective SAR systems require clear policies defining SAR criteria and escalation, regular staff training on red flags and filing obligations, independent testing by internal audit, management oversight of SAR determinations, and technology capable of detecting and tracking suspicious patterns. The system must support the compliance officer, not replace their judgement.

At Kybri Consulting Limited, we help regulated businesses design and implement SAR frameworks that work — from detection and escalation through to filing quality, narrative construction, and regulatory examination readiness.