The SAR process: how to file a suspicious activity report, from alert to FIU

The quality of an SAR is often judged by the report itself. Yet, an SAR is really an outcome of a long, complex process. Most SARs therefore fail long before they are written or submitted. A decision taken too late. A closed alert that nobody explained. A follow-up that never happened.

The entire SAR process is a chain of seven steps. It's a path from an alert to a suspicious activity report filed with your financial intelligence unit (FIU). Each step has its own clock, its own evidence, and its own way to break.

Here is how to run every one of them, what EU and US rules actually require, and the practices that separate strong programs from busy ones.

The SAR process in seven steps:

1. Detect: surface unusual activity through rules, models, and people
2. Triage: prioritize, group, and assign alerts before the clock runs out
3. Investigate: build the case around the customer, not the alert
4. Decide: file, close, or escalate – and record why
5. Write and review: draft the report for an FIU analyst, then check it
6. File: submit on time, in your FIU's format, without tipping off the customer
7. After filing: answer FIU requests, watch for continuing activity, and feed the outcome back into detection

What is the SAR process, and who owns it?

A suspicious activity report is how a bank, payment firm, or other obliged entity tells the authorities that something doesn't add up. The EU's Anti-Money Laundering Regulation (AMLR) calls it a suspicious transaction report, and many European FIUs still say STR (see our goAML by country guide). Nevertheless, the purpose of an SAR and and STR is exactly the same.

The trigger is suspicion, not proof. Under Article 69(1) of the AMLR, you report when your institution "knows, suspects or has reasonable grounds to suspect" that funds or activities are linked to criminal activity or terrorist financing, "regardless of the amount involved".

You are not the investigator of the crime. You are its first, best-placed witness.

Ownership is just as clear. The AMLR (Art. 11(2)) makes the compliance officer "responsible for reporting suspicious transactions to the FIU". In the US, the Federal Financial Institutions Examination Council (FFIEC)’s BSA/AML Examination Manual splits the process into five components, from "[i]dentification or alert of unusual activity" to "[m]onitoring and SAR filing on continuing activity". The seven steps below map onto both.

The seven steps of the SAR process

Every step hands evidence to the next. That means if you lose it at one step, you'll have to rebuild it all over again, under deadline.

Step 1: Detect the alerts (that are worth reviewing)

Your detection method decides your volume. Broad scenarios flood the team with alerts that never become reports. The Wolfsberg Group, an association of global banks, recommends "a hybrid approach", essentially rules combined with AI.

Look beyond transactions, too. The AMLR (Art. 69(2) bases suspicion on "the characteristics of the customer and their counterparts, the size and nature of the transaction or activity" and more. Thus customer behavior is evidence.

For tuning your rules, see our guide to transaction monitoring.

Step 2: Triage before the clock runs out

The FFIEC treats "Managing alerts" as a component in its own right. And this is where time can quietly disappear.

In the US, a SAR is due "no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR" (see the Financial Crimes Enforcement Network (FinCEN) Guidance, p. 1). Initial detection is not "the moment a transaction is highlighted for review" (FFIEC). The clock starts when your review finds reportable facts. So your procedure must say exactly when that is.

The EU sets no day count. The AMLR (Art. 69(1)–(2)) asks you to report "promptly" and to "prioritise" your assessment by urgency and risk. Nevertheless, under AMLA’s draft standards, the average number of days between identifying a potential suspicious transaction and reporting it to the FIU is one of the data points supervisors will use to assess your institution’s or company’s risk profile.

So the best practice you can follow is this: group related alerts into one case, route cases by type or level, and set a time limit per queue. Our guide to case SLAs shows how.

Step 3: Investigate the customer, not the alert

One alert is a data point. The whole case is the customer.

Hence the best practice to follow here is to collect the profile and expected activity, the transactions, the counterparties, and any prior reports. Then contrast what happened with what was usual or normal prior to that. That contrast is your finding.

Our AML investigation guide covers the method in depth.

Step 4: Decide to file, close, or escalate

This is the key step the whole process exists for. Three things help you make the call.

1. The threshold: suspicion is enough. And yes, and a blocked payment can still be reportable: "All suspicious transactions, including attempted transactions [...] shall be reported" (AMLR Art. 69(1)). But: a pattern alone is not a suspicion. US agencies confirmed in October 2025 that transactions near the $10,000 cash reporting threshold are, on their own, "not information sufficient to require the filing of a SAR"
   ‍
2. The record: here the EU and the US differ clearly. The AMLR (Art. 77(1)(b)) requires a record of every assessment, "whether or not such assessment results in a suspicious transaction report being made to the FIU", kept for five years after the relationship ends (Art. 77(3)). In the US, "[t]here is no requirement or expectation under the BSA or its implementing regulations for a financial institution to document its decision not to file a SAR" (FAQs, Q4). So our best advice is: write it down anyway. In the same FAQ, US agencies note that "a short, concise statement" will usually suffice. But a closed alert without reasoning looks exactly like there was never a decision at all, potentially just a mistake or a lapse
   ‍
3. Avoid the practice of defensive filing: you may think that filing often will keep you safe – and the FIU will ultimately decide what’s worth the attention. However, the Wolfsberg Group does "not believe that the value being derived" from rising SAR volumes is "contributing proportionately to effective outcomes" (Part I). Defensive filing "serves as a deterrent to innovation" (Part II). A weak report costs the FIU as much as it costs you. Shifting that cost to the regulator hence will likely negatively impact your relationship with the authorities

Step 5: Write and review the report

The narrative is where the FIU first sees your case. FinCEN calls it "the only free text area for summarizing suspicious activity". They also warn that failing to explain what makes activity suspicious "undermines the very purpose of the SAR" (p. 1). So answer "who? what? when? where? and why?" (p. 3), add how, and structure it as "an introduction, a body, and a conclusion" (p. 7).

The UK FIU adds two rules worth borrowing: avoid jargon and acronyms, and end "with the intended action e.g. exiting relationship" (NCA Guidance, pp. 7–8). Then a second pair of eyes before anything leaves the building.

For the full method, read how to write a good SAR report.

Step 6: File on time, in the FIU's format

As we've seen, every FIU sets its own format. In the EU, your compliance officer files with the FIU of the Member State where you are established, often through goAML. In the US, SARs go through FinCEN's BSA E-Filing System, one by one or in XML batches. Even attachments differ: the UK FIU says "Do not send attachments" (p. 13), while FinCEN accepts one CSV file of transactions, "no larger than 1 MB" (FinCEN SAR XML User Guide, p. 139).

While you assess, hold the transaction. The AMLR (Art. 71(1)) says to refrain from transactions you know or suspect are linked to crime until you have reported, and lets you proceed after assessing the risk if the FIU sends no instruction "within 3 working days of submitting the report". If refraining is impossible or would frustrate the pursuit of the beneficiaries, carry it out and inform the FIU immediately after (Art. 71(2)). The US has no general hold rule. But "[f]or situations requiring immediate attention", you need to notify law enforcement by phone, on top of filing (FFIEC.

In the US, the 30 days can stretch to 60 when no suspect is identified. But "[i]n no case shall reporting be delayed more than 60 calendar days after the date of initial detection" (FinCEN Guidance, p. 1).

Above all, stay silent. You "shall not disclose to the customer concerned or to other third persons" that a report is being assessed or filed (Art. 73(1)). In the US, "[a] SAR and any information that would reveal the existence of a SAR, are confidential" (FFIEC). In return, an EU report made in good faith creates no liability "regardless of whether illegal activity actually occurred" (Art. 72).

Step 7: After filing

Filing is not the end of the case. Three things follow.

• Respond to follow-up FIU requests: in the EU, answer "within 5 working days", or faster if the FIU says so, "including to less than 24 hours" (Art. 69(1)). In the US, provide all supporting documentation on request (FFIEC)
• Continuing activity: since October 2025, US institutions no longer need a separate post-filing review (FAQs, Q2). If you follow FinCEN's continuing-activity guidance, the timeline runs: day 0 detection, day 30 first SAR, day 120 end of the 90-day period, day 150 follow-up SAR (Q3)
• The relationship and the rules: decide whether to keep, monitor, or exit the customer. Then feed the outcome back into your detection rules and risk scores

SAR deadlines at a glance

Five practices that separate strong SAR programs from the ones that are simply “busy”

1. Measure outcomes, not volume: more reports do not mean better results is the golden rule. Track how many alerts become cases, how many cases become reports, and what the FIU does with them

2. Start the clock deliberately: define in writing when detection happens. Then track every case against that moment, not against the day the alert fired

3. Decide in writing: record why you filed and why you didn't, with the evidence behind each call. In the EU, it's the law from 2027. Everywhere else, it's your best defense and top-notch prudence

4. Write for a stranger: the FIU analyst knows nothing about your customer, your products, or your internal codes. Write so they don't need to

5. Close the loop: every report should sharpen the rules that produced it. If a scenario never leads to a filing, retire it or refine it

How Marble runs the SAR process in one record

When detection, cases, and reports live in different tools, evidence breaks at every handoff. Marble automates the whole chain in one place. So every alert, note, and decision falls into place, always on the same record.

• Detect: scenarios run on your own data, with the rules you set
• Triage: alerts grouped into cases, routed to the right inbox, assigned automatically, and tracked against a time limit
• Investigate: an evidenced AI Review on every case with a summary, identified risks, a conclusion, and recommendations for your team to review
• Decide: close a case as a false positive, or classify it for a SAR in one click. It's always your team who calls the shots, never AI
• Write and review: AI drafts the structured fields and the narrative from the full case context. Once again, there is always a human in the loop: your analyst reviews, edits, and validates
• File: submit to your FIU with the click of a button. Track the SAR's status on the case. Let the outcome (as soon as it arrives) update the customer's risk score and future alerts
• Every step: an unalterable, timestamped audit trail and role-based access

The AI drafts. Your analyst decides. And the record your supervisor reviews is the record your team actually worked in. See how Marble automates reporting, or read how AI-assisted compliance reporting works in practice.

The strongest SAR programs aren't the ones that file the most. They are the ones that can show, for every alert, exactly why they did.

FAQ

How long do you have to file a SAR?
In the US, 30 calendar days from initial detection, or up to 60 if no suspect is identified. In the EU, the AMLR says "promptly" and sets no day count.

Is suspicion enough to file?
Yes. The AMLR test is "knows, suspects or has reasonable grounds to suspect". No proof required, and no minimum amount.

Do you have to document a decision not to file?
In the EU, yes: the AMLR requires a record of every assessment, whether or not it leads to a report. In the US, no, although a short statement is good practice.

Can you tell a customer you filed a SAR?
No. Tipping off the customer or any third party is prohibited in both the EU and the US.

Should you stop a suspicious transaction before reporting it?
ln the EU, yes – refrain until you have reported, unless that is impossible or would frustrate the investigation. You may proceed if the FIU gives no instruction within 3 working days.

Do you have to review a customer after filing a SAR?
In the US, a separate post-filing review is no longer required since October 2025. In practice, keep monitoring: continuing activity may need a follow-up report.