Suspicious Activity Reporting and Record-Keeping

Introduction

Spotting suspicious activity is only half the job — the other half is reporting it to the right place. Suspicious Transaction Reports (STR) and Suspicious Activity Reports (SAR) are how evidence flows from institutions to financial intelligence units. This lesson covers what they are, when to file, and the record-keeping duties that support them.

What Is an STR/SAR?

An STR (Suspicious Transaction Report) — also called an SAR (Suspicious Activity Report) — is a report filed with the financial intelligence unit (FIU) when an institution has reason to suspect money laundering, terrorist financing, or another financial crime.

The type and name vary by jurisdiction (STR is common in Europe, SAR in the US and UK), but the principle is the same: tell the authorities about the suspicion.

When to File

You file when there's a reasonable suspicion — not proof, just grounds to suspect. Examples:

• A transaction with no obvious lawful purpose
• Structuring to avoid thresholds
• Activity inconsistent with the customer's known profile
• Sanctions or PEP-relevant red flags
• Rapid, unexplained movements of funds

The "No Tipping-Off" Rule

Tipping-off is warning a customer (or anyone) that they're the subject of a suspicion report or investigation. It's usually a criminal offense because it can destroy the investigation.

Practical consequences:

• Don't tell the customer why you're delaying or refusing a transaction
• Don't share that a report was filed
• Handle the report and any further activity discreetly, on a need-to-know basis

   Institution suspects  -->  report to FIU  -->  DO NOT tip off

The Reporting Flow

   Front-line staff spot red flags
        |
        v
   Report internally (internal suspicious transaction report)
        |
        v
   Compliance reviews & investigates
        |
        v
   Compliance files STR/SAR with the FIU
        |
        v
   FIU analyzes & shares with investigators

Record-Keeping Duties

Record-keeping is what makes the whole system auditable and enforceable. Obliged entities must:

• Keep identification and due diligence records (KYC/CDD files)
• Keep transaction records
• Keep records of screening and alert reviews
• Retain them for a statutory period — commonly five years (varies by jurisdiction), and longer where required for ongoing cases
• Make records available to authorities on request

   KYC/CDD records  -->  keep for 5+ years (per regime)
   Transaction records -->  keep for 5+ years
   Audit trail of decisions -->  keep for 5+ years

Why the Audit Trail Matters

If regulators or investigators ask "why did you clear this customer?" or "why did you file this report?", you need a documented trail: what you saw, how you assessed it, and what you did. A clean, well-kept audit trail is your defense and the institution's proof of a working program.

Real-World Example

A customer's account receives multiple rapid, overlapping transfers from several countries and immediately forwards them onward — with no economic reason for an ordinary person. The front-line officer logs an internal report, the compliance officer investigates, and the institution files an SAR with the FIU. The customer is never told. All records are filed for the statutory retention period.

Summary

• STR/SAR = the report of suspected money laundering/terrorist financing to the FIU
• File promptly on reasonable suspicion, not only on proof
• Never tip off the customer — it's usually a crime
• Keep KYC/CDD, transaction, and decision records for the statutory period
• A solid audit trail is your defense and proof of compliance

Next Lesson

Finally, let's see how it all connects to enforcement — Interpol, Red Notices, and the legal regimes in practice.