US Money Transmitter Licensing
APPENDICES Appendix D

SAR Filing Decision Tree

Suspicious Activity Report (SAR) filing is where compliance theory meets practice. This appendix presents the decision logic you should use when deciding whether to file a SAR. The decision tree is presented as prose because real SAR decisions require judgment that algorithms cannot fully capture.

Initial Detection: Is There Suspicious Activity?

You've identified activity that might be suspicious. It could be from transaction monitoring (automated alert), manual review, customer complaint, or staff observation. First question: Is this actually suspicious?

Suspicious activity means a transaction or pattern of transactions that the institution knows, suspects, or has reason to suspect: - Involves money that is derived from illegal activity, or - Is intended to conceal or disguise the nature, source, location, ownership, or control of funds or assets, or - Is designed to evade any BSA requirement, or - Serves no apparent legitimate purpose and involves significant sums

Do not file a SAR for every unusual transaction. Unusual does not equal suspicious. A customer sending $15,000 to a beneficiary in another country is unusual only if they normally send smaller amounts. That might not be suspicious. A customer sending $15,000 in cash, in round amounts, to three different countries within one week, using different agent locations, might be structuring or sanctions evasion. That is suspicious.

Ask yourself: Why does this activity concern me? If your answer is vague ("it just seemed off"), it might not meet the SAR standard. If your answer is concrete ("customer is depositing cash daily in amounts just below $10,000, consistent with structuring"), it likely meets the standard.

Step 1: Gather Information and Investigate

Before deciding on a SAR, you should investigate. Investigation means:

Investigation might confirm the suspicious activity (yes, file a SAR) or might explain it away (no, do not file).

Example: Customer sends $8,000 remittance, unusual for them. Investigation reveals: (1) Customer's employer sent a bonus, confirmed by pay stub provided, (2) Customer's family member is traveling and needs cash, (3) Customer has sent periodic remittances to same beneficiary before. Result: Not suspicious, do not file SAR.

Counter-example: Customer sends three separate $9,000 remittances on consecutive days, all to different beneficiaries. Customer normally sends one remittance per month. Investigation reveals: (1) Customer refused to provide source of funds, (2) Customer's stated occupation is "wholesale distributor" but business records show they are unemployed, (3) Beneficiaries are in jurisdiction known for sanctions evasion. Result: Suspicious activity consistent with structuring and sanctions evasion, file SAR.

Step 2: Determine the Legal Basis for the SAR

Once you determine activity is suspicious, identify which of the four legal bases it falls under:

Basis 1: Money derived from illegal activity. The funds themselves are proceeds of crime. Examples: Customer depositing cash that is obviously from drug sales, customer sending funds that are clearly embezzled from an employer, customer receiving funds from a known criminal.

Basis 2: Intended to conceal or disguise. The transaction structure or method is designed to hide something about the money. Examples: Structuring (breaking large amounts into smaller amounts below reporting thresholds), round-dollar transactions, rapid movement of funds, use of multiple agents or entities, offshore routing for no apparent business reason.

Basis 3: Designed to evade BSA requirements. The activity is specifically structured to avoid triggering compliance obligations. Structuring is the primary example. Another example: Customer making multiple deposits to different customer names to avoid aggregation rules.

Basis 4: Serves no apparent legitimate purpose. The transaction makes no business sense. Examples: Customer receiving regular transfers from unrelated parties and immediately forwarding them abroad, customer buying and immediately reselling prepaid cards, customer exchanging currency repeatedly without apparent business purpose.

Most SARs will fit into one of these four categories. Some SARs fit multiple categories.

Step 3: Determine if You Have Sufficient Basis to File

You should only file a SAR if you have identified specific facts that support the suspicious activity conclusion. Do not file a SAR based on hunches or patterns that don't hold up to scrutiny.

Ask yourself: - Can I articulate the specific suspicious activity in writing? - Do I have facts (not assumptions) to support my conclusion? - Would a reasonable compliance professional, reviewing my facts, agree that the activity is suspicious? - Have I documented my investigation?

If you cannot answer yes to these questions, do not file the SAR.

Step 4: Determine if the Activity is Actually Illegal

This is a subtle point. You should file a SAR if activity is suspicious (meets the BSA definition) even if you're not certain it's illegal. However, if you determine the activity is clearly legal and not suspicious, do not file a SAR.

Example: Customer receives regular transfers that look like employment income. Investigation reveals customer is a 1099 contractor, customer's clients match the transfer sources, amount and frequency are consistent with described work. Conclusion: Legal business activity, do not file SAR.

Counter-example: Same customer, but investigation reveals customer has no actual clients, customers claim they never hired this person, transfers appear to be loans from a single source being cycled through multiple accounts. Conclusion: Possibly a money laundering scheme, file SAR.

Step 5: Determine if You're the Appropriate Filer

You should file a SAR if you are the financial institution that actually processed or could have detected the suspicious transaction. Do not file a SAR if another institution is obviously the appropriate filer.

Example: Customer uses your service to send a remittance. You have identified suspicious activity. You should file because you are the MSB that processed the transaction.

Counter-example: Customer receives funds at your service, but you find out those funds came from a bank wire that the bank should have reviewed and potentially filed on. You can file, but the bank is the primary responsible party.

In practice, if you have reasonable suspicion, you should file. Let FinCEN and law enforcement determine if multiple SARs are filed on the same activity.

Step 6: Confirm You Haven't Already Filed on This Activity

Check your SAR filing history. If you've already filed a SAR on this customer or transaction, do not file another unless: - Substantial new suspicious activity has been identified, or - Significant time has passed (e.g., you filed a SAR six months ago, new activity has emerged)

Multiple SARs on the same customer are appropriate if there is new suspicious activity, but do not file duplicates.

Step 7: Identify the Specific Transaction or Pattern

In the SAR, you must identify the specific transaction or pattern that triggered the report. You cannot file a SAR that says "customer seems suspicious." You must identify actual transactions.

Examples of appropriate identifications: - "Customer deposited cash totaling $47,000 across five separate transactions over 10 days, each deposit approximately $9,500, each deposit to a different beneficial recipient account." - "Customer received wire transfer of $150,000 from unknown source, no stated business purpose, and immediately wired $145,000 to account in United Arab Emirates." - "Customer conducted foreign currency exchange transactions totaling $200,000 over 30 days, all for same beneficiary, currencies included Iranian Rial, all transactions used separate agents in different locations."

Step 8: Prepare Your SAR Filing

Your SAR should include: - Your institution's information (name, address, regulatory body, contact information) - Filing institution's routing/transit number or equivalent identifier - Specific transaction information (date, amount, parties, account numbers, reference numbers) - Customer information (name, address, ID number, phone, email if available) - Narrative of the suspicious activity and basis for suspicion - How the activity relates to BSA requirements - What investigation you conducted - Your conclusion about likely illegal activity - Any connections to known illegal activity, terrorism, or sanctions violations - Whether you filed a CTR or OFAC report related to this activity

Step 9: Consider whether to Notify Law Enforcement

You may (not must) notify law enforcement of the suspicious activity. If you do: - Contact the relevant law enforcement (FBI, DEA, local police depending on suspected crime) - Provide the same information you included in the SAR - Do not mention to the customer that you've reported to law enforcement

Step 10: File the SAR Within the Deadline

SARs must be filed within 30 days of detection of suspicious activity. Do not wait. The 30-day period is mandatory.

File using FinCEN's Suspicious Activity Report System (SARS), available at fincen.gov. You will need your FinCEN MSB registration to access the system.

Step 11: Maintain SAR Records and Confidentiality

After filing, you must: - Keep a copy of the SAR you filed - Maintain all investigation documentation - Retain all records related to the SAR for at least five years - Do not disclose to the customer that you filed a SAR (confidentiality is mandatory) - Do not disclose to any third party that you filed (with limited exceptions for law enforcement or other financial institutions) - Do not mention the SAR in any communication with the customer

Violating SAR confidentiality is a violation and can result in penalties.

Common SAR Filing Mistakes

Need Help Navigating Money Transmitter Licensing?

Faisal Khan has spent 15+ years solving the exact problems covered in this book. If you are building a payment company, seeking licensing, or need a trusted advisor — reach out.

SPEAK WITH FAISAL KHAN