The Complete SAR Red Flags List
427+ BSA red flags organized by SAR checkbox category. Each red flag includes the SAR checkbox it maps to, its source document, and its CFR citation.
SAR Red Flags List: What Compliance Officers Need to Know
SAR red flags are the indicators that may justify filing a Suspicious Activity Report, organized by the checkbox categories on the FinCEN SAR form. They include structuring, unusual wire activity, identity concerns, and activity with no apparent lawful purpose. A red flag does not obligate a filing on its own; the decision depends on the facts and the applicable threshold.
A Suspicious Activity Report (SAR) is the primary mechanism financial institutions use to report potentially illicit transactions to FinCEN. Filing a SAR requires identifying which of the 30+ SAR checkbox categories best describes the suspicious activity. The SAR red flags on this page are organized by those exact checkbox categories, making it easy for BSA officers and compliance staff to select the right classification.
The Bank Secrecy Act requires banks, MSBs, casinos, and other covered institutions to file SARs for transactions aggregating to $5,000 or more (or $2,000 for MSBs and casinos) when they know, suspect, or have reason to suspect the transaction involves illegal funds, is designed to evade BSA regulations, or has no apparent business or lawful purpose.
This page presents the complete SAR red flags list across all major categories: structuring, money laundering, wire transfer anomalies, cyber events, identity theft, beneficial ownership concerns, PEP transactions, human trafficking, terrorist financing, sanctions evasion, elder financial exploitation, and trade-based money laundering.
427+ BSA Red Flags
Customer attempts to split a large cash transaction into multiple smaller transactions below the $3,000 recordkeeping threshold to avoid creating a paper trail.
Multiple customers visit the same location in rapid succession and each conducts a cash transaction just below the reporting threshold, suggesting a coordinated structuring scheme.
Wire transfers sent to or received from high-risk jurisdictions known for money laundering, with no apparent business or family connection to those countries.
Customer provides identification that appears altered, forged, or inconsistent with the person presenting it, including mismatched photos or expired credentials.
Corporate customer sends wires on behalf of undisclosed principals, or the stated beneficial owner is a nominee shareholder with no independent wealth or employment.
Transaction patterns show sudden and significant changes in volume, frequency, or typology that are inconsistent with the customer’s established activity profile.
Politically Exposed Person (PEP) or a close associate conducts large cash transactions that appear disproportionate to their known sources of income or legitimate wealth.
Multiple individuals use the same phone number or address to receive wire transfers, with none able to explain the source or purpose of the funds independently.
Funds are sent to or received from individuals, entities, or charities linked to designated terrorist organizations or individuals on OFAC SDN lists.
Customer uses virtual currency exchanges or mixers to obfuscate the origin or destination of funds, particularly involving sanctioned jurisdictions or SDN-listed individuals.
Customer reports that their online account was compromised and unauthorized wire transfers were initiated, with rapid fund movement to overseas accounts.
Customer receives funds and is instructed to convert them to virtual currency and send to a specific wallet address as part of a job offer, romance scheme, or investment opportunity.
What to Do When a Red Flag Appears
Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.
- 1
Observe and record
Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.
- 2
Compare against the expected profile
Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.
- 3
Investigate before deciding
A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.
- 4
Escalate through your procedure
Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.
- 5
Document the decision and the reasoning
Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.
- 6
File a SAR when the facts support it
If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.
- 7
Retain records for the required period
Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.
This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.
More AML Red Flags by Industry
Common Questions About SAR Red Flags List
What are the most common SAR red flags across all industries?
The most common SAR red flags include: structuring (transactions just below reporting thresholds), rapid inflow/outflow of funds with no legitimate business purpose, wires to or from high-risk jurisdictions, customers who refuse to provide identification, transactions inconsistent with the customer's known profile, beneficial ownership concealment, and funds traced to known criminal activity such as ransomware or drug trafficking.
How do I choose the right SAR checkbox for a red flag?
Each red flag in the Soflo AML Red Flag Library is tagged with the exact SAR checkbox it maps to. For example, a customer splitting cash transactions below the CTR threshold maps to the "Structuring" checkbox. A wire to a sanctioned jurisdiction maps to "Sanctions evasion." A compromised account with unauthorized withdrawals maps to "Cyber event." The library shows the checkbox, source document, and CFR citation for every red flag.
What is the SAR filing threshold for different institutions?
Banks must file SARs for suspicious transactions of $5,000 or more. MSBs, casinos, and card clubs must file for $2,000 or more. Insurance companies must file for $5,000 or more. Investment advisers must file for $5,000 or more. Mortgage companies must file for $5,000 or more. All institutions must file regardless of amount if the transaction involves terrorist financing or a federal crime.
Can I file a SAR for multiple red flags in one transaction?
Yes. FinCEN's SAR form allows you to select multiple checkbox categories for a single transaction. If a customer exhibits both structuring behavior and wires funds to a high-risk jurisdiction, you should check both "Structuring" and "Wire transfer" (or "Suspicious activity" if the wire itself is suspicious). Include all relevant red flags in the narrative section.
What happens if I don't file a SAR when I should?
Willful failure to file a required SAR is a federal criminal offense under 31 U.S.C. § 5318(g). Financial institutions and their employees can face civil money penalties of up to $286,184 per willful violation, and some violations count separately for each day they continue (31 U.S.C. 5321; 31 CFR 1010.821, as adjusted January 2025). Regulatory enforcement actions, loss of charter or license, and in egregious cases, criminal prosecution are also possible. The DOJ has prosecuted both institutions and individual compliance officers for willful BSA violations.
More BSA Red Flags & Compliance Resources
BSA Red Flags List
427+ Bank Secrecy Act red flags covering every compliance category, industry, and risk level. Each flag cites a FinCEN, FFIEC, or federal so...
Money Laundering Red Flags
427+ money laundering indicators organized by the three stages: placement, layering, and integration. Each flag cites a FinCEN or federal so...
AML Red Flags by Industry
427+ BSA red flags organized by 13 regulated industries. Each entry is sourced from a FinCEN advisory, FFIEC manual, or federal regulation, ...
AML Red Flag Library
Browse all 427+ BSA red flags across 13 regulated industries. Searchable by keyword, filter by category, industry, or risk level.
Explore related AML-BSA compliance resources
Regulatory sources and guidance
Official Guidance
The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.
The FinCEN Suspicious Activity Report (SAR) page provides the electronic filing system, form instructions, filing deadlines (generally 30 days after initial detection, extendable to 60 days if no suspect is identified), and confidentiality rules that prohibit disclosing a SAR to the subject.
31 CFR § 1020.320 requires banks to file a Suspicious Activity Report (SAR) for transactions of $5,000 or more when the bank knows, suspects, or has reason to suspect the transaction involves funds from illegal activity, is designed to evade the BSA, or has no apparent lawful purpose. Structuring is a mandatory SAR trigger.
The FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual provides detailed examination procedures used by federal and state regulators to evaluate financial institution BSA/AML compliance programs across all four pillars: internal controls, independent testing, designated BSA officer, and training.
31 U.S.C. § 5324 makes it unlawful to structure, or attempt to structure, transactions to evade Bank Secrecy Act reporting requirements — including the $10,000 Currency Transaction Report threshold. Structuring is a crime even when the underlying funds are entirely legitimate.
Knowing the red flags is only part of an effective AML program
Choosing the correct SAR checkbox and narrative comes down to a documented, consistent decision process. Training your team on that process is one of the highest-value controls you can put in place.
Browse All 427+ SAR Red Flags by Category
Access the complete, searchable AML Red Flag Library with 427+ BSA red flags. Filter by SAR checkbox category, industry, risk level, and source document.