What Is a Suspicious Activity Report?
A Suspicious Activity Report, known as a SAR, is the report of any suspicious transaction relevant to a possible violation of law or regulation that Section 1023.320 of Title 31 of the Code of Federal Regulations requires every broker or dealer in securities within the United States, called a broker-dealer for purposes of the section, to file with the Financial Crimes Enforcement Network, known as FinCEN, to the extent and in the manner required by the section.
FinCEN announced the final rule requiring brokers and dealers in securities to report suspicious activity on June 28, 2002, with an effective date of January 1, 2003. A broker-dealer may also file with FinCEN a report of any suspicious transaction that it believes is relevant to the possible violation of any law or regulation but whose reporting is not required by the section. Filing a report of a suspicious transaction does not relieve a broker-dealer from the responsibility of complying with any other reporting requirements imposed by the Securities and Exchange Commission, known as the SEC, or a self-regulatory organization.
When a Transaction Requires Reporting
Under Section 1023.320(a)(2), a transaction requires reporting if it is conducted or attempted by, at, or through a broker-dealer, it involves or aggregates funds or other assets of at least five thousand dollars, and the broker-dealer knows, suspects, or has reason to suspect that the transaction, or a pattern of transactions of which the transaction is a part, falls within one of four categories.
The first category is a transaction that involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity, including, without limitation, the ownership, nature, source, location, or control of such funds or assets, as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation.
The second category is a transaction that is designed, whether through structuring or other means, to evade any requirements of the chapter or of any other regulations promulgated under the Bank Secrecy Act, known as the BSA.
The third category is a transaction that has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, where the broker-dealer knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.
The fourth category is a transaction that involves use of the broker-dealer to facilitate criminal activity.
Which Broker-Dealer Reports
Under Section 1023.320(a)(3), the obligation to identify and properly and timely to report a suspicious transaction rests with each broker-dealer involved in the transaction, provided that no more than one report is required to be filed by the broker-dealers involved in a particular transaction, so long as the report filed contains all relevant facts.
Under Section 1023.320(b)(1), a suspicious transaction must be reported by completing a SAR, and collecting and maintaining supporting documentation as required by paragraph (d) of the section. Under Section 1023.320(b)(2), the SAR must be filed with FinCEN in a central location, to be determined by FinCEN, as indicated in the instructions to the SAR.
Time Limit for Filing
Under Section 1023.320(b)(3), a SAR must be filed no later than thirty calendar days after the date of the initial detection by the reporting broker-dealer of facts that may constitute a basis for filing a SAR under the section. If no suspect is identified on the date of such initial detection, a broker-dealer may delay filing a SAR for an additional thirty calendar days to identify a suspect, but in no case may reporting be delayed more than sixty calendar days after the date of such initial detection.
In situations involving violations that require immediate attention, such as terrorist financing or ongoing money laundering schemes, the broker-dealer must immediately notify by telephone an appropriate law enforcement authority in addition to filing timely a SAR.
Exceptions to Filing
Under Section 1023.320(c)(1), a broker-dealer is not required to file a SAR to report a robbery or burglary committed or attempted of the broker-dealer that is reported to appropriate law enforcement authorities, or lost, missing, counterfeit, or stolen securities with respect to which the broker-dealer files a report pursuant to the reporting requirements of 17 CFR 240.17f-1.
A broker-dealer is also not required to file a SAR to report a violation otherwise required to be reported under the section of any of the Federal securities laws or rules of a self-regulatory organization by the broker-dealer or any of its officers, directors, employees, or other registered representatives, other than a violation of 17 CFR 240.17a-8 or 17 CFR 405.4, so long as such violation is appropriately reported to the SEC or a self-regulatory organization.
Under Section 1023.320(c)(2), a broker-dealer may be required to demonstrate that it has relied on an exception in paragraph (c)(1), and must maintain records of its determinations to do so for the period specified in paragraph (d). To the extent that a Form RE-3, Form U-4, or Form U-5 concerning the transaction is filed consistent with the rules of the self-regulatory organization, a copy of that form will be a sufficient record for purposes of paragraph (c)(2).
Retention of Records
Under Section 1023.320(d), a broker-dealer must maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR. Supporting documentation must be identified as such and maintained by the broker-dealer, and is deemed to have been filed with the SAR.
Confidentiality of Suspicious Activity Reports
Under Section 1023.320(e)(1)(i), no broker-dealer, and no director, officer, employee, or agent of any broker-dealer, may disclose a SAR or any information that would reveal the existence of a SAR. Any broker-dealer, and any director, officer, employee, or agent of any broker-dealer that is subpoenaed or otherwise requested to disclose a SAR or any information that would reveal the existence of a SAR, must decline to produce the SAR or such information, citing the section and 31 U.S.C. 5318(g)(2)(A)(i), and must notify FinCEN of any such request and the response thereto.
Under Section 5318(g)(2)(A)(i) of Title 31 of the United States Code, neither the financial institution, director, officer, employee, or agent of such institution (whether or not any such person is still employed by the institution), may notify any person involved in the transaction that the transaction has been reported.
Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, the prohibition in Section 1023.320(e)(1) does not prohibit the disclosure of a SAR, or any information that would reveal the existence of a SAR, to FinCEN or any Federal, State, or local law enforcement agency, or any Federal regulatory authority that examines the broker-dealer for compliance with the BSA, or to any self-regulatory organization that examines the broker-dealer for compliance with the requirements of the section, upon the request of the SEC. It also does not prohibit the disclosure of the underlying facts, transactions, and documents upon which a SAR is based, including but not limited to, disclosures to another financial institution, or any director, officer, employee, or agent of a financial institution, for the preparation of a joint SAR, or in connection with certain employment references or termination notices, to the full extent authorized in 31 U.S.C. 5318(g)(2)(B).
The prohibition also does not prohibit the sharing by a broker-dealer, or any director, officer, employee, or agent of the broker-dealer, of a SAR, or any information that would reveal the existence of a SAR, within the broker-dealer's corporate organizational structure for purposes consistent with Title II of the BSA as determined by regulation or in guidance.
Protection From Liability
Under 31 U.S.C. 5318(g)(3)(A), any financial institution that makes a voluntary disclosure of any possible violation of law or regulation to a government agency or makes a disclosure pursuant to the subsection or any other authority, and any director, officer, employee, or agent of such institution who makes, or requires another to make any such disclosure, is not liable to any person under any law or regulation of the United States, any constitution, law, or regulation of any State or political subdivision of any State, or under any contract or other legally enforceable agreement, including any arbitration agreement, for such disclosure or for any failure to provide notice of such disclosure to the person who is the subject of such disclosure or any other person identified in the disclosure.
Red Flags That Prompt Review
Regulatory Notice 19-18 of the Financial Industry Regulatory Authority, known as FINRA, is headed FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting Obligations. It provides guidance to member firms regarding suspicious activity monitoring and reporting obligations under FINRA Rule 3310, headed Anti-Money Laundering Compliance Program. The Notice groups potential red flags in six categories: customer due diligence and interactions with customers, deposits of securities, securities trading, money movements, insurance products, and other potential red flags.
Among the potential red flags in customer due diligence and interactions with customers, the customer provides the firm with unusual or suspicious identification documents that cannot be readily verified or are inconsistent with other statements or documents that the customer has provided, the customer is reluctant or refuses to provide the firm with complete customer due diligence information as required by the firm's procedures, or the customer refuses to identify a legitimate source of funds or information is false, misleading or substantially incorrect.
Among the potential red flags in deposits of securities, a customer opens a new account and deposits physical certificates, or delivers in shares electronically, representing a large block of thinly traded or low-priced securities, or a customer has a pattern of depositing physical share certificates, or a pattern of delivering in shares electronically, immediately selling the shares and then wiring, or otherwise transferring out the proceeds of the sale or sales.
Among the potential red flags in securities trading, there is a sudden spike in investor demand for, coupled with a rising price in, a thinly traded or low-priced security, the customer's activity represents a significant proportion of the daily trading volume in a thinly traded or low-priced security, or a customer buys and sells securities with no discernable purpose or circumstances that appear unusual.
Among the potential red flags in money movements, the customer attempts or makes frequent or large deposits of currency, insists on dealing only in cash equivalents, or asks for exemptions from the firm's policies and procedures relating to the deposit of cash and cash equivalents, or the customer structures deposits, withdrawals or purchases of monetary instruments below a certain amount to avoid reporting or recordkeeping requirements, and may state directly that they are trying to avoid triggering a reporting obligation or to evade taxing authorities.
Among the other potential red flags, the customer exhibits unusual concern with the firm's compliance with government reporting requirements and the firm's anti-money laundering policies, the customer tries to persuade an employee not to file required reports or not to maintain the required records, or notifications received from the broker-dealer's clearing firm that the clearing firm had identified potentially suspicious activity in customer accounts.
The list in the Notice is not an exhaustive list and does not guarantee compliance with anti-money laundering program requirements or provide a safe harbor from regulatory responsibility. A red flag is not necessarily indicative of suspicious activity, and not every item identified in the Notice will be relevant for every broker-dealer.
FinCEN Clarifications on Structuring, Continuing Activity and Documentation
FinCEN issued four frequently asked questions regarding suspicious activity reporting on October 9, 2025. On structuring, the mere presence of a transaction or series of transactions by or on behalf of the same person at or near the ten thousand dollar threshold for a Currency Transaction Report is not information sufficient to require the filing of a SAR. Financial institutions are only required to file a SAR if the institution knows, suspects, or has reason to suspect that the transaction or series of transactions are designed to evade the reporting requirements for a Currency Transaction Report.
On continuing activity, a financial institution is not required to conduct a separate review, manual or otherwise, of a customer or account following the filing of a SAR to determine whether suspicious activity has continued. Financial institutions instead may rely on risk-based internal policies, procedures, and controls to monitor and report suspicious activity as appropriate, provided those internal policies, procedures, and controls are reasonably designed to identify and report such activity.
Subsequent FinCEN guidance advised financial institutions to file SARs for continuing activity after a ninety-day period with the filing deadline being one hundred twenty calendar days after the date of the previously related SAR filing. Financial institutions are not required to do so and may instead file SARs as appropriate in line with applicable timelines. There is no requirement or expectation under the BSA or its implementing regulations for a financial institution to document its decision not to file a SAR. FinCEN has previously encouraged, but not required, financial institutions to document the decision not to file a SAR.
Place in the Anti-Money Laundering Program
Under Rule 3310, each member develops and implements a written anti-money laundering program reasonably designed to achieve and monitor the member's compliance with the requirements of the BSA (31 U.S.C. 5311, et seq.), and the implementing regulations promulgated thereunder by the Department of the Treasury. The program must, at a minimum, establish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of transactions required under 31 U.S.C. 5318(g) and the implementing regulations thereunder.
A Currency Transaction Report is triggered by a transaction in currency of more than ten thousand dollars. A SAR requires that the broker-dealer knows, suspects, or has reason to suspect that the transaction falls within the categories listed in Section 1023.320(a)(2).
Exam Relevance
The Securities Industry Essentials examination content outline lists, under Topic 3.2.3, Anti-money Laundering (AML), the bullets Definition of money laundering, Stages of money laundering with structuring, layering, and placement named in parentheses, AML compliance program, Suspicious Activity Report (SAR), Currency Transaction Report (CTR), FinCEN, and Office of Foreign Asset Control (OFAC) and the Specially Designated Nationals and Blocked Persons (SDNs) List. Candidates should check the current outline before the examination.
Common Misunderstandings
A SAR is filed only when the amount exceeds ten thousand dollars. A transaction requires reporting if it involves or aggregates funds or other assets of at least five thousand dollars and the broker-dealer knows, suspects, or has reason to suspect that it falls within the listed categories.
A SAR requires proof of a crime. A transaction requires reporting when the broker-dealer knows, suspects, or has reason to suspect that the transaction, or a pattern of transactions of which it is a part, falls within the categories in Section 1023.320(a)(2).
Every transaction near ten thousand dollars requires a SAR. The mere presence of a transaction or series of transactions at or near the threshold is not information sufficient to require the filing of a SAR.
The thirty days run from the date of the transaction. A SAR must be filed no later than thirty calendar days after the date of the initial detection by the reporting broker-dealer of facts that may constitute a basis for filing a SAR.
The thirty-day period can never be extended. If no suspect is identified on the date of the initial detection, a broker-dealer may delay filing for an additional thirty calendar days to identify a suspect, but in no case more than sixty calendar days after the date of the initial detection.
A broker-dealer may tell the customer that a SAR was filed. No broker-dealer, and no director, officer, employee, or agent of any broker-dealer, may disclose a SAR or any information that would reveal the existence of a SAR, and under Section 5318(g)(2)(A)(i), neither the financial institution, director, officer, employee, or agent of such institution may notify any person involved in the transaction that the transaction has been reported.
Filing a SAR satisfies every other reporting duty. Filing a report of a suspicious transaction does not relieve a broker-dealer from the responsibility of complying with any other reporting requirements imposed by the SEC or a self-regulatory organization.
Every broker-dealer involved in a transaction must file its own report. No more than one report is required to be filed by the broker-dealers involved in a particular transaction, so long as the report filed contains all relevant facts.
A broker-dealer that files a SAR is liable to the customer. A financial institution that makes a voluntary disclosure of any possible violation of law or regulation to a government agency, or a disclosure pursuant to the subsection or any other authority, is not liable to any person under any law or regulation of the United States, any constitution, law, or regulation of any State or political subdivision of any State, or under any contract or other legally enforceable agreement, including any arbitration agreement, for the disclosure or for any failure to provide notice of the disclosure to the person who is the subject of the disclosure.
A decision not to file must be documented. There is no requirement or expectation under the BSA or its implementing regulations for a financial institution to document its decision not to file a SAR.
One red flag proves suspicious activity. A red flag is not necessarily indicative of suspicious activity.
Key Points to Retain
A SAR reports a suspicious transaction relevant to a possible violation of law or regulation, filed by a broker-dealer with FinCEN.
A transaction requires reporting if it is conducted or attempted by, at, or through a broker-dealer, involves or aggregates funds or other assets of at least five thousand dollars, and the broker-dealer knows, suspects, or has reason to suspect that it falls within one of the four categories.
A SAR must be filed no later than thirty calendar days after the date of the initial detection of facts that may constitute a basis for filing, with a delay of up to an additional thirty calendar days to identify a suspect and no more than sixty calendar days in all.
In situations involving violations that require immediate attention, the broker-dealer must immediately notify by telephone an appropriate law enforcement authority in addition to filing timely a SAR.
A broker-dealer must maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for five years from the date of filing the SAR.
No broker-dealer, and no director, officer, employee, or agent of any broker-dealer, may disclose a SAR or any information that would reveal the existence of a SAR.
Rule 3310 requires policies and procedures that can be reasonably expected to detect and cause the reporting of transactions required under 31 U.S.C. 5318(g).
