What Is SAR Filing in Crypto?

When a SAR Must Be Filed

In the US, the Bank Secrecy Act requires MSBs — including crypto payment gateways registered as MSBs — to file a Suspicious Activity Report with FinCEN when they know, suspect, or have reason to suspect that a transaction involves funds from illegal activity, is designed to evade reporting requirements, lacks a lawful purpose, or involves $2,000 or more and the MSB cannot identify a reasonable explanation for the activity. The $2,000 threshold applies to individual transactions; patterns of suspicious activity below this threshold that appear coordinated must also be reported.

In the EU, equivalent obligations under national AML laws and the Anti-Money Laundering Directive require CASPs to file suspicious transaction reports (STRs) with their national Financial Intelligence Unit (FIU) when they suspect money laundering or terrorist financing. Unlike the US system, EU filings often do not have a minimum monetary threshold — suspicion itself is sufficient to trigger the obligation.

Common Red Flags That Trigger SAR Consideration

●        Structuring: Multiple transactions just below reporting thresholds from the same customer or related customers within a short period, suggesting deliberate avoidance of reporting requirements.

●        Inconsistent business profile: A merchant whose crypto payment volume or customer geography is inconsistent with their stated business activity — for example, a small local services business receiving large international USDT payments.

●        High-risk wallet exposure: Transaction monitoring flags significant exposure to darknet markets, ransomware wallets, or sanctioned addresses in the blockchain analytics score.

●        Layering patterns: A customer who consistently receives crypto and immediately converts and withdraws to multiple different wallets without apparent commercial purpose.

●        Reluctance to provide KYB information: A merchant who is unusually reluctant to provide standard business verification documents, particularly around beneficial ownership.

●        Unusual geographic patterns: Payments originating from high-risk jurisdictions disproportionate to the merchant's stated customer base.

●        Rapid escalation in volume: A merchant whose transaction volume spikes dramatically without a credible business explanation.

The Tipping-Off Prohibition

Once a gateway has filed or is considering filing a SAR, it is legally prohibited from disclosing this fact to the subject of the report — the merchant or customer whose activity triggered the filing. This tipping-off prohibition extends to indirect disclosure: the gateway cannot take actions that would obviously signal to the subject that a SAR has been filed, such as suddenly freezing an account in a way that is clearly linked to the suspicious activity pattern.

In practice, gateways typically manage this by continuing normal service while a SAR is under review and filed, avoiding sudden account actions unless the risk of continued operation outweighs the disclosure risk. If account closure is necessary — for example, because the risk of processing further transactions is unacceptable — gateways cite generic terms of service violations rather than the specific suspicious activity. Legal counsel should be involved in any account closure that coincides with a SAR filing.

SAR Filing Process in the US

US SAR filings are submitted electronically through FinCEN's BSA E-Filing system using the FinCEN SAR form. The filing must be completed within 30 calendar days of the date the gateway initially detected the suspicious activity, or within 60 days if additional review time is needed to identify a subject. The SAR must describe the suspicious activity in sufficient detail to be meaningful to FinCEN analysts — vague descriptions like 'customer behaviour was unusual' without supporting facts are unhelpful and may result in the filing being deprioritised. SAR records must be maintained for 5 years from the filing date.

Compliance Note: This glossary entry is provided for general educational purposes only and does not constitute financial, investment, legal, or tax advice. Industry terminology may vary across jurisdictions and providers; definitions herein may not directly reflect the specific features, terms, or specifications of Finassets' services. For details on Finassets' offerings, please refer to official product documentation or contact our team directly.