| Point | Detail |
|---|---|
| Point 1 | A Suspicious Activity Report, known as a SAR in the United States |
| Point 2 | Tipping off is the other side of SAR filing |
| Point 3 | The volume of SARs is large, and quality matters more than quantity |
Suspicious Activity Reports
What you will learn
Your objective. By the end of this lesson, you will be able to explain suspicious activity reports. A Suspicious Activity Report, known as a SAR in the United States and a Suspicious Transaction Report in many other countries, is the formal report a bank files with its national Financial Intelligence Unit when it.
Why it matters. For a BA, the requirements here cover the SAR workflow itself.
Chapter objective: Learner explains AML and KYC controls, including customer due diligence, transaction monitoring, and suspicious activity reporting, and identifies red flags in payment patterns. Learner practises this skill on realistic banking cases, explaining the reasoning clearly and using correct terminology throughout the work.
Key learning points
- Known as a SAR
- Activity has no apparent
- Tipping off
- Staff: trained to give neutral
- Vague report that says a transaction looked
- How a case moves from alert
Key terms
Regulatory comparison showing Suspicious Activity Reports.
Practise this lesson
Exercise
Handle the exception described in this lesson the way the lesson prescribes.
Use the exception type, the reason code and the recovery path in this lesson.
- What to do. State what happened, what the correct action is, what must not be done, and what the post-incident review should capture.
Correct result. The correct action is the one the lesson prescribes for this exception type, with the right reason code and the right message. The payment must not be resent without checking whether it already settled, because that creates a duplicate.
Why. An exception handled wrongly is worse than the exception itself. A duplicate payment is a loss, and an unlearned exception will happen again.
Check your understanding
Practice question
A customer opens an account with a passport that looks genuine, but the address proof is a handwritten note with no official stamp. What should the bank do under know your customer rules?
Takeaway and next step
What to remember
The system must also handle the ongoing monitoring of a customer after a report is filed, because the relationship may continue under closer watch.
Run the exception from this lesson and follow the investigation to its resolution.
Open the Exception Investigation Simulator →
Builds on "Transaction Monitoring".
Transcript and full text
Show transcript
A Suspicious Activity Report, known as a SAR in the United States and a Suspicious Transaction Report in many other countries, is the formal report a bank files with its national Financial Intelligence Unit when it suspects money laundering, terrorist financing or other financial crime. The decision to file is based on suspicion, not proof, and the bank does not need to know exactly what crime has happened. If the activity has no apparent lawful purpose, or it does not fit the customer's profile, that can be enough. Filing is a legal obligation, and failing to file when a bank should have filed is itself a serious regulatory breach. The report contains the customer details, the transactions involved, and the reasons for suspicion, written clearly enough for law enforcement to act on. Tipping off is the other side of SAR filing, and it is a rule every payment professional must understand. Once a bank has formed a suspicion or filed a report, it must not tell the customer that a report has been made or that an investigation is under way. This creates a genuine tension, because the customer may ask why their payment is delayed or their account is restricted. Staff are trained to give neutral explanations and to avoid saying anything that would reveal the suspicion. System design must support this, by separating the compliance case from the customer facing record, and by controlling who can see that a SAR exists. Access to SAR information is strictly limited, even inside the bank. The volume of SARs is large, and quality matters more than quantity. A vague report that says a transaction looked unusual is of little use to law enforcement, while a well written report that explains the pattern, the counterparties and the timeline can trigger a real investigation. Banks therefore invest in training analysts to write clear narratives and to attach the right evidence. For a BA, the requirements here cover the SAR workflow itself. How a case moves from alert to investigation to filing, who approves the filing, how the filing is submitted to the regulator, and how the bank tracks the outcome. The system must also handle the ongoing monitoring of a customer after a report is filed, because the relationship may continue under closer watch. The SAR narrative is the most important part of the suspicious activity report, because it is the part law enforcement reads. The narrative must describe the who, the what, the when, the where, the why, and the how, in that order. Who is the customer, what did they do, when did it happen, where did the money go, why is it suspicious, and how was it done. A narrative that says the customer sent 50,000 euros to a high-risk country is not enough. A narrative that says the customer, a retail account holder with a monthly income of 2,000 euros, sent 50,000 euros to a company in a high-risk jurisdiction, in five payments of 10,000 euros each, over three days, with no clear business reason, and the company has no website and no employees, is a narrative law enforcement can act on. The 30 day deadline for filing a SAR is a hard deadline, and the workflow must be built around it. The clock starts when the bank detects the suspicious activity, not when the investigation is complete. The investigation must therefore be time-boxed: the analyst has a defined number of days to gather evidence, the reviewer has a defined number of days to approve, and the filer has a defined number of days to submit. If the investigation cannot be completed in 30 days, the bank must file the SAR with the information it has, and can file a supplemental SAR later. A bank that misses the deadline is in breach, and the breach will be found in an examination. The no tipping off rule is the constraint that shapes the whole SAR workflow. The bank must not tell the customer that a SAR has been filed, or that they are under investigation, because that would be an offence. The customer must not be told why their payment was delayed, why their account was frozen, or why they were asked for additional information, if the reason is a SAR. The workflow must therefore separate the customer communication from the investigation, and the analyst must be trained to answer the customer's questions without revealing the SAR. A single slip, a single sentence that reveals the investigation, is a breach.
A Suspicious Activity Report, known as a SAR in the United States and a Suspicious Transaction Report in many other countries, is the formal report a bank files with its national Financial Intelligence Unit when it suspects money laundering, terrorist financing or other financial crime. The decision to file is based on suspicion, not proof, and the bank does not need to know exactly what crime has happened. If the activity has no apparent lawful purpose, or it does not fit the customer's profile, that can be enough. Filing is a legal obligation, and failing to file when a bank should have filed is itself a serious regulatory breach. The report contains the customer details, the transactions involved, and the reasons for suspicion, written clearly enough for law enforcement to act on.
Tipping off is the other side of SAR filing, and it is a rule every payment professional must understand. Once a bank has formed a suspicion or filed a report, it must not tell the customer that a report has been made or that an investigation is under way. This creates a genuine tension, because the customer may ask why their payment is delayed or their account is restricted. Staff are trained to give neutral explanations and to avoid saying anything that would reveal the suspicion. System design must support this, by separating the compliance case from the customer facing record, and by controlling who can see that a SAR exists. Access to SAR information is strictly limited, even inside the bank.
The volume of SARs is large, and quality matters more than quantity. A vague report that says a transaction looked unusual is of little use to law enforcement, while a well written report that explains the pattern, the counterparties and the timeline can trigger a real investigation. Banks therefore invest in training analysts to write clear narratives and to attach the right evidence. For a BA, the requirements here cover the SAR workflow itself. How a case moves from alert to investigation to filing, who approves the filing, how the filing is submitted to the regulator, and how the bank tracks the outcome. The system must also handle the ongoing monitoring of a customer after a report is filed, because the relationship may continue under closer watch.
The SAR narrative is the most important part of the suspicious activity report, because it is the part law enforcement reads. The narrative must describe the who, the what, the when, the where, the why, and the how, in that order. Who is the customer, what did they do, when did it happen, where did the money go, why is it suspicious, and how was it done. A narrative that says the customer sent 50,000 euros to a high-risk country is not enough. A narrative that says the customer, a retail account holder with a monthly income of 2,000 euros, sent 50,000 euros to a company in a high-risk jurisdiction, in five payments of 10,000 euros each, over three days, with no clear business reason, and the company has no website and no employees, is a narrative law enforcement can act on.
The 30 day deadline for filing a SAR is a hard deadline, and the workflow must be built around it. The clock starts when the bank detects the suspicious activity, not when the investigation is complete. The investigation must therefore be time-boxed: the analyst has a defined number of days to gather evidence, the reviewer has a defined number of days to approve, and the filer has a defined number of days to submit. If the investigation cannot be completed in 30 days, the bank must file the SAR with the information it has, and can file a supplemental SAR later. A bank that misses the deadline is in breach, and the breach will be found in an examination.
The no tipping off rule is the constraint that shapes the whole SAR workflow. The bank must not tell the customer that a SAR has been filed, or that they are under investigation, because that would be an offence. The customer must not be told why their payment was delayed, why their account was frozen, or why they were asked for additional information, if the reason is a SAR. The workflow must therefore separate the customer communication from the investigation, and the analyst must be trained to answer the customer's questions without revealing the SAR. A single slip, a single sentence that reveals the investigation, is a breach.
Full lesson text (all scenes)
Completing a lesson updates your progress dashboard on the homepage.
Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.