Anti-money laundering (AML) is the set of controls used to prevent, detect and report attempts to use the financial system to disguise criminal proceeds. A Suspicious Activity Report (SAR) is a confidential filing to the relevant authority that describes the activity and why the institution found it suspicious. For a bank's transaction-monitoring team, a change in who pays whom, or how quickly funds move on, can help prioritise cases for review. The filing decision depends on the facts and the applicable rule. FFIEC examination manual, Suspicious Activity Reporting · 31 CFR § 1020.320.
The Financial Action Task Force (FATF) sets international standards for customer due diligence and reporting suspicions to a financial intelligence unit. Each jurisdiction implements those standards through its own rules. This example follows a federally regulated U.S. bank applying the Bank Secrecy Act rules. FATF Recommendations 10 and 20, June 2026 · 31 CFR § 1020.210.
A kitchenware shop starts receiving unfamiliar payments
- Customer profile. The fictional shop normally receives domestic card settlements and pays known suppliers. The bank has verified the shop's identity. Its ongoing customer due diligence also records what the account is used for, which gives the monitoring team a baseline.
- Alert. Transfers start coming in from unfamiliar companies. Funds soon go out to new recipients, and the sequence repeats. The monitoring system flags the change in counterparties and timing. The alert identifies a change in the pattern even if total sales receipts stay steady.
- Investigation. An analyst checks the payment records against the shop's expected activity and looks for evidence of a business purpose. New wholesale customers and a distributor could explain the same pattern if orders and invoices match the parties, amounts and timing. In this case the shop says the transfers are for supplies, but the invoices it provides name different payees and the available records fail to explain the incoming funds.
- Escalation. The analyst sends the payment trail, the shop's explanation and the invoice discrepancies to the bank's designated reviewer. The reviewer applies the bank reporting rule to those facts. 31 CFR § 1020.210(a)(2)(v) · FFIEC examination manual, Managing Alerts and SAR Decision Making.
Both outcomes start with the same alert. The evidence the bank finds determines whether the case reaches a filing.
Under the U.S. bank reporting rule, the bank must file when activity conducted or attempted through the bank meets the amount requirement and the bank knows, suspects or has reason to suspect that one of the rule's listed grounds applies. One ground covers activity outside what the bank would expect from this customer when the available facts yield no reasonable explanation. In this case, assume the related transactions meet the amount requirement and the reviewer finds that ground met after reviewing the evidence. The bank files a SAR with the Financial Crimes Enforcement Network (FinCEN) on the basis of that suspicion and retains the report and supporting records. Law enforcement can investigate whether a crime occurred. 31 CFR § 1020.320(a), (b) and (d) · FFIEC examination manual, SAR Decision Making.
A bank can ask the shop about invoices or sources of funds while keeping the SAR and its existence confidential. In the alternative case where records corroborate the wholesale activity and the bank finds no other basis for filing, the bank can close the alert. FinCEN's 2025 guidance leaves documentation of a decision to forgo filing to the institution's internal process. FinCEN and banking agencies, September 2026 joint statement on SAR confidentiality · FinCEN and banking agencies, October 2025 SAR FAQs, question 4.
Sanctions screening asks whether a party or activity is subject to sanctions restrictions. This payment pattern can still warrant review with verified customer identity and no sanctions match. A monitoring team can count how many alerts led to a SAR to understand the review process. Measuring confirmed laundering would require separate evidence. OFAC FAQ 5, steps 3–5 · FFIEC examination manual, SAR Decision Making.
Sources
- Financial Action Task Force, The FATF Recommendations, amended June 2026. Recommendations 10 and 20 cover customer due diligence and reporting suspicious transactions.
- 31 CFR § 1020.210, Anti-money laundering program requirements for banks. Paragraph (a)(2)(v) covers the customer risk profile and ongoing monitoring.
- 31 CFR § 1020.320, Reports by banks of suspicious transactions. Paragraphs (a), (b), (d) and (e) cover reportable transactions, filing, retention and confidentiality.
- FFIEC, BSA/AML Examination Manual, Suspicious Activity Reporting. Identification of Unusual Activity, Managing Alerts and SAR Decision Making describe how banks assess alerts.
- FinCEN and the federal banking agencies, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements, October 2025. Question 4 addresses decisions to forgo a SAR.
- FinCEN and the federal banking agencies, Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers, September 2026. The statement distinguishes transaction facts that can be discussed from information revealing a SAR's existence.
- U.S. Treasury Office of Foreign Assets Control, FAQ 5. Steps 3–5 explain how a possible sanctions match is assessed and which restrictions may apply.