Suspicious Activity Reporting

SAR LEGAL FRAMEWORK (U.S.)

What makes activity "suspicious" is intentionally broad:

THE SUSPICION STANDARD

Legal standard:
"Knows, suspects, or has reason to suspect"

1. Transaction involves funds from illegal activity
2. Transaction designed to evade reporting requirements
3. Transaction lacks business or lawful purpose
4. Transaction using the institution to facilitate crime

- Activity that doesn't make sense
- Customer can't or won't explain
- Pattern matches known typologies
- Red flags present
- "Something isn't right"

- Proof of crime
- Certainty that activity is illegal
- Identification of specific crime
- Evidence beyond reasonable doubt

Key point:
SAR is a report of suspicion, not an accusation
Filer need not be certain
Reasonable suspicion is sufficient

Understanding the boundary:

WHEN NOT TO FILE A SAR

- Customer received inheritance (documented)
- Business had exceptional sales month (verifiable)
- Customer sold property (deed available)
- Reasonable explanation + documentation = often no SAR

- Cash business depositing cash
- International business wiring internationally
- Active trader trading actively
- Profile explains activity = often no SAR

- System flag, but investigation finds nothing
- Common name matches
- Geographic flag but customer actually elsewhere
- Investigation resolved = no SAR needed

- Why alert was reviewed
- What investigation found
- Rationale for not filing
- Creates audit trail

---

FinCEN has issued specific guidance on crypto-related suspicious activity:

FINCEN CRYPTO SAR GUIDANCE

- FIN-2019-A003: Advisory on Convertible Virtual Currency
- FIN-2021-A001: Ransomware and Virtual Currency
- Various red flag advisories

High-priority typologies:

1. Ransomware

2. Darknet marketplace

3. Mixing service usage

4. Peer-to-peer exchanger activity

5. Scam victim proceeds

CRYPTO-SPECIFIC RED FLAGS

SAR FORM STRUCTURE (FinCEN Form 111)

The narrative is where SAR quality is determined:

SAR NARRATIVE BEST PRACTICES

1. Summary statement (2-3 sentences)
2. Subject identification
3. Activity description (chronological)
4. Red flags observed
5. Investigation summary
6. Why activity is suspicious

- WHO: Subject(s) involved
- WHAT: Specific transactions/activity
- WHEN: Dates, times, sequence
- WHERE: Locations, jurisdictions
- WHY: Suspicious indicators
- HOW: Method/mechanism used

Example of GOOD narrative opening:
"This SAR reports suspected structuring activity by John Smith 
(DOB: 01/15/1980, SSN: XXX-XX-1234, Account #12345). Between 
March 1-15, 2025, Smith made 12 cash deposits totaling $114,500 
at various branch locations, with each deposit below the $10,000 
CTR threshold. Smith has no business justification for cash deposits, 
and when questioned, provided inconsistent explanations."

Example of BAD narrative:
"Customer made multiple deposits that seemed suspicious. 
Activity doesn't match profile. Filing SAR."

SAR FILING PROCESS

Timeline:
Day 0: Suspicious activity detected
Day 1-30: Investigation and filing
Day 30: SAR due (most cases)
Day 60: SAR due (if no suspect identified)
```

THE TIPPING OFF PROHIBITION

Legal prohibition:
31 USC 5318(g)(2)
"No financial institution... shall notify any person
involved in the transaction that the transaction has been
reported..."

SAR SAFE HARBOR

Legal protection:
31 USC 5318(g)(3)
Institution protected from liability for SAR filing

EU STR FRAMEWORK

UK SAR REGIME

SAR-RELATED ACCOUNT CLOSURES

The scenario:
Customer receives notice: "Account closed. Decision is final."
No explanation given.

CRYPTO EXCHANGE SAR PRACTICES

✅ SAR filing is mandatory when suspicion exists. Financial institutions must file SARs. Failure can result in penalties and regulatory action.

✅ Tipping off is prohibited and enforced. Institutions cannot tell customers about SAR filings. This explains unexplained account closures.

✅ SAR volumes are massive and growing. Over 4 million SARs filed annually in the US. Crypto SARs are a growing category.

✅ Safe harbor protects good-faith filers. Institutions are protected from customer lawsuits for good-faith SAR filings.

⚠️ SAR effectiveness. What percentage lead to action? Data is limited. Critics argue many are "defensive" filings.

⚠️ Optimal filing threshold. When should suspicion rise to SAR level? Standards are subjective.

⚠️ Privacy implications. Massive database raises civil liberties concerns.

🔴 "If I'm not doing anything wrong, I won't have a SAR filed." Unusual but legitimate activity can trigger SARs. SAR ≠ accusation.

🔴 "I can demand to know if a SAR was filed." You cannot. Tipping off prohibition means institution cannot tell you.

🔴 "A SAR means I'll be arrested." Most SARs don't lead to action. Filing is precautionary, not accusatory.

🔴 "Exchanges don't file SARs on customers." They do. It's legally required. Every major exchange has compliance team filing SARs.

SARs are the reporting mechanism that connects private sector compliance to government intelligence. They're filed when activity triggers suspicion—not proof of crime, just suspicion. The tipping off prohibition means you'll never know if one was filed on you. For legitimate users, the best defense is maintaining clear patterns, documenting large transactions, and avoiding behaviors that match suspicious typologies.

Assignment: Write a sample SAR narrative for a hypothetical crypto-specific suspicious activity scenario. This is for educational purposes only; real SARs are confidential government filings.

Requirements:

Part 1: Scenario Creation (100 words)

• A crypto exchange customer
• Specific transaction patterns
• Multiple red flags
• Enough detail to write a realistic narrative

Part 2: SAR Narrative (300-400 words)

• Summary statement
• Subject identification (use fictional name/details)
• Activity description (chronological)
• Red flags observed
• Investigation summary
• Why activity is suspicious

Follow the 5 W's + H structure.

Part 3: Filing Rationale (100-150 words)

• Why this activity meets the SAR filing standard

• What typology it matches

• What alternative explanations were considered

• Why those explanations are insufficient

• Professional narrative format

• Clear chronology

• Specific details (dates, amounts, patterns)

• Maximum 2 pages

• Narrative quality (30%): Is it well-written and clear?

• Typology accuracy (25%): Does it match known suspicious patterns?

• Completeness (25%): Are all required elements included?

• Professional standard (20%): Would it be useful to law enforcement?

Time investment: 2 hours
Value: Develops understanding of what institutions look for and how they document suspicion

For Next Lesson:
Lesson 6 provides a deep dive into Travel Rule implementation—the specific protocols, data requirements, and operational challenges for VASP-to-VASP information sharing. We'll examine how Travel Rule compliance actually works in practice and its implications for ODL corridors.

End of Lesson 5

Total words: ~4,800
Estimated completion time: 55 minutes reading + 2 hours for deliverable