SAR (Suspicious Activity Report)

A Suspicious Activity Report is a regulatory filing that financial institutions including crypto exchanges and VASPs must submit to FinCEN when they detect transactions or patterns suggesting possible money laundering, terrorist financing, fraud, sanctions violations, or other financial crimes.

Under the Bank Secrecy Act, covered institutions must file SARs within 30 days of detecting suspicious activity involving $5,000 or more in potential money laundering or BSA violations, or $25,000 for other violations. SARs must describe the suspicious activity, parties involved, amounts, dates, and reasons for suspicion. Filing a SAR does not require certainty of criminal activity, only reasonable suspicion based on red flags and behavioral patterns. Institutions are legally prohibited from disclosing SAR filings to customers or external parties.

Crypto exchanges file thousands of SARs annually based on red flags including transactions involving known darknet markets or mixing services, rapid movement of funds through multiple wallets immediately after deposit, structuring to avoid reporting thresholds, inconsistency between stated business purpose and transaction patterns, and connections to sanctioned addresses. Blockchain analytics tools enable automated detection of suspicious patterns and risk scoring of wallet addresses and transaction chains. FinCEN expects robust transaction monitoring programs capable of detecting crypto-specific typologies including chain hopping, peel chains, and interactions with high-risk DeFi protocols.