What is a suspicious activity report?

A suspicious activity report (SAR) is a confidential report a regulated firm sends to its national financial intelligence unit when it knows or suspects that a customer or transaction is linked to money laundering or terrorist financing. The FATF standard calls it a suspicious transaction report. An agent may draft one. A named person decides whether to file it.

Why do suspicious activity reports matter once agents act?

The SAR is the point where a firm's AML programme reaches the authorities. Everything before it, from due diligence to monitoring and investigation, exists partly to make sure the right suspicions are reported, with enough detail to be useful.

Agents make that preparation faster and more complete: they assemble the transactions, the parties, the timeline and the reasons. But filing is a legal judgement with personal accountability, usually held by the money laundering reporting officer. That is why an agent can draft a suspicious activity report but never file one.

How does a SAR come about in practice?

Most reports follow the same route:

1. Something raises a concern: an alert, a staff member's observation, an unusual request.
2. Internal report: the concern is passed to the reporting officer or their team.
3. Investigation: the team gathers facts to decide whether suspicion is reasonable.
4. Decision: the reporting officer decides whether to report externally.
5. Filing: the report goes to the financial intelligence unit, and the firm considers whether to continue the relationship.

Agents help with the third step and with drafting the fifth. A suspicious activity report drafting checklist sets out what a usable report contains.

An example of a drafted report

Take a small bank whose investigation team has concluded that a business customer's account is receiving cash deposits split across branches to stay under reporting thresholds. The agent drafts the report: who the customer is, the pattern of deposits with dates and amounts, why it appears structured, what the customer said when asked about the business, and what checks were done.

The reporting officer reads it, removes a speculative sentence about the customer's associates that the evidence does not support, adds context from a past report and files it. The final text, the agent's draft and the officer's changes are all on record. Our guide to drafting suspicious activity reports for review with an AI agent covers that workflow.

How is a SAR different from an internal suspicion report?

An internal suspicion report goes from a member of staff to the firm's reporting officer. It is how front-line suspicion reaches the person who decides. Staff are often required to make one, and doing so may fulfil their own legal duty.

A SAR goes from the firm to the authorities. Not every internal report becomes a SAR: the reporting officer may find an innocent explanation. An agent can raise or route internal reports, but it must never filter them out before a person sees them, and it must never treat its own draft as the filing decision.

Which terms sit next to the SAR?

• Tipping off: telling the subject that a report has been made or is being considered, which most regimes prohibit.
• Financial intelligence unit: the national body that receives reports.
• Whether an AI agent can file a suspicious activity report is answered in the same way across markets: no.
• Compliance agents work in the second line, preparing the case for the person who decides.