SAR Filing Reference

The Complete SAR Red Flags List

427+ verified BSA red flags organized by SAR checkbox category. Every red flag includes the exact SAR checkbox it maps to, the source document, and CFR citation.

FinCEN-verified sources
SAR checkbox mapping
CFR citations included
Full-text searchable
About These Red Flags

SAR Red Flags List: What Compliance Officers Need to Know

A Suspicious Activity Report (SAR) is the primary mechanism financial institutions use to report potentially illicit transactions to FinCEN. Filing a SAR requires identifying which of the 30+ SAR checkbox categories best describes the suspicious activity. The SAR red flags on this page are organized by those exact checkbox categories, making it easy for BSA officers and compliance staff to select the right classification.

The Bank Secrecy Act requires banks, MSBs, casinos, and other covered institutions to file SARs for transactions aggregating to $5,000 or more (or $2,000 for MSBs and casinos) when they know, suspect, or have reason to suspect the transaction involves illegal funds, is designed to evade BSA regulations, or has no apparent business or lawful purpose.

This page presents the complete SAR red flags list across all major categories: structuring, money laundering, wire transfer anomalies, cyber events, identity theft, beneficial ownership concerns, PEP transactions, human trafficking, terrorist financing, sanctions evasion, elder financial exploitation, and trade-based money laundering.

Featured Red Flags

427+ Verified BSA Red Flags

View All 427 in Library
CriticalMSB|structuring

Customer attempts to split a large cash transaction into multiple smaller transactions below the $3,000 recordkeeping threshold to avoid creating a paper trail.

FIN-2014-G001 MSB Expectations|Structuring
CriticalMSB|structuring

Multiple customers visit the same location in rapid succession and each conducts a cash transaction just below the reporting threshold, suggesting a coordinated structuring scheme.

FIN-2014-G001 MSB Expectations|Structuring
CriticalMSB|wire activity

Wire transfers sent to or received from high-risk jurisdictions known for money laundering, with no apparent business or family connection to those countries.

FIN-2022-RUSSIABIS Export Evasion|Wire transfer
CriticalMSB|identity/KYC

Customer provides identification that appears altered, forged, or inconsistent with the person presenting it, including mismatched photos or expired credentials.

FIN-2024-A001 Deepfake Fraud|Identity verification concerns
CriticalMSB|beneficial ownership

Corporate customer sends wires on behalf of undisclosed principals, or the stated beneficial owner is a nominee shareholder with no independent wealth or employment.

FIN-2024-A002 Israeli Settler Violence|Beneficial ownership
CriticalMSB|transaction monitoring

Transaction patterns show sudden and significant changes in volume, frequency, or typology that are inconsistent with the customer’s established activity profile.

FFIEC Exam Manual MSB Section|Transaction exceeds CTR threshold
CriticalMSB|customer behavior

Politically Exposed Person (PEP) or a close associate conducts large cash transactions that appear disproportionate to their known sources of income or legitimate wealth.

Kleptocracy Advisory|PEP concern
CriticalMSB|human trafficking

Multiple individuals use the same phone number or address to receive wire transfers, with none able to explain the source or purpose of the funds independently.

FIN-2018-A001 Human Trafficking|Human trafficking
CriticalMSB|terrorist financing

Funds are sent to or received from individuals, entities, or charities linked to designated terrorist organizations or individuals on OFAC SDN lists.

Hizballah Financing Alert|Terrorist financing
CriticalMSB|sanctions evasion

Customer uses virtual currency exchanges or mixers to obfuscate the origin or destination of funds, particularly involving sanctioned jurisdictions or SDN-listed individuals.

FIN-2022-RUSSIABIS Export Evasion|Sanctions evasion
CriticalMSB|cyber/fraud

Customer reports that their online account was compromised and unauthorized wire transfers were initiated, with rapid fund movement to overseas accounts.

FIN-2021-A001 Ransomware|Cyber event
CriticalMSB|cyber/fraud

Customer receives funds and is instructed to convert them to virtual currency and send to a specific wallet address as part of a job offer, romance scheme, or investment opportunity.

FIN-2021-A001 Ransomware|Cyber event
FAQ

Common Questions About SAR Red Flags List

What are the most common SAR red flags across all industries?

The most common SAR red flags include: structuring (transactions just below reporting thresholds), rapid inflow/outflow of funds with no legitimate business purpose, wires to or from high-risk jurisdictions, customers who refuse to provide identification, transactions inconsistent with the customer's known profile, beneficial ownership concealment, and funds traced to known criminal activity such as ransomware or drug trafficking.

How do I choose the right SAR checkbox for a red flag?

Each red flag in the Soflo AML Red Flag Library is tagged with the exact SAR checkbox it maps to. For example, a customer splitting cash transactions below the CTR threshold maps to the "Structuring" checkbox. A wire to a sanctioned jurisdiction maps to "Sanctions evasion." A compromised account with unauthorized withdrawals maps to "Cyber event." The library shows the checkbox, source document, and CFR citation for every red flag.

What is the SAR filing threshold for different institutions?

Banks must file SARs for suspicious transactions of $5,000 or more. MSBs, casinos, and card clubs must file for $2,000 or more. Insurance companies must file for $5,000 or more. Investment advisers must file for $5,000 or more. Mortgage companies must file for $5,000 or more. All institutions must file regardless of amount if the transaction involves terrorist financing or a federal crime.

Can I file a SAR for multiple red flags in one transaction?

Yes. FinCEN's SAR form allows you to select multiple checkbox categories for a single transaction. If a customer exhibits both structuring behavior and wires funds to a high-risk jurisdiction, you should check both "Structuring" and "Wire transfer" (or "Suspicious activity" if the wire itself is suspicious). Include all relevant red flags in the narrative section.

What happens if I don't file a SAR when I should?

Willful failure to file a required SAR is a federal criminal offense under 31 U.S.C. § 5318(g). Financial institutions and their employees can face civil money penalties of up to $25,000 per day per violation, regulatory enforcement actions, loss of charter or license, and in egregious cases, criminal prosecution. The DOJ has prosecuted both institutions and individual compliance officers for willful BSA violations.

AML Red Flag Library

Browse All 427+ SAR Red Flags by Category

Access the complete, searchable AML Red Flag Library with 427+ verified BSA red flags. Filter by SAR checkbox category, industry, risk level, and source document.

Talk with Us