Skip to main content
FinCrime Institute
Category: Suspicious Activity Reporting

FinCEN SAR (Form 111)

Also known as: SAR, FinCEN Suspicious Activity Report, FinCEN Report 111, Form 111, Universal SAR
Simply put

A FinCEN SAR (Form 111) is a report that financial institutions in the United States use to flag transactions or activity they consider suspicious to the Financial Crimes Enforcement Network (FinCEN). It is filed electronically through the BSA E-Filing System rather than on paper. Filing a SAR reflects a suspicion that must be reported; it is not by itself a determination that a crime has occurred.

Formal definition

The FinCEN SAR (Form 111) is the standardized suspicious activity report filed by financial institutions under the U.S. Bank Secrecy Act framework administered by FinCEN. It is described as a "universal" SAR because it consolidates elements from the various legacy SAR forms that FinCEN previously issued for different types of filers. Since April 1, 2013, financial institutions have been required to use the new FinCEN reports, which are available only electronically through the BSA E-Filing System (where the form is also identified as FinCEN Report 111). Aggregate data drawn from filed Form 111 reports is compiled by FinCEN in its SAR Stats (formerly "By the Numbers") publications. Exact filing obligations, thresholds, timing, and the categories of obliged filers should be confirmed against the applicable BSA regulations and FinCEN guidance, and a filing constitutes a report of suspicion rather than proof of criminal wrongdoing.

Why it matters

The FinCEN SAR (Form 111) is a foundational element of the U.S. Bank Secrecy Act reporting framework. It serves as the standardized channel through which financial institutions communicate suspicions of potentially illicit activity to FinCEN, feeding intelligence that law enforcement and regulators may draw upon. For compliance teams, the SAR is often the tangible output of the wider transaction monitoring, investigation, and escalation processes that sit at the core of an AML program. A filing reflects a reasonable suspicion that must be reported; it is not, by itself, a determination that a crime has occurred, and this distinction matters both legally and operationally.

Because the Form 111 is described as a "universal" SAR that consolidates elements from the various legacy SAR forms FinCEN previously issued for different types of filers, it also represents an effort to standardize reporting across a diverse population of obliged institutions. Since April 1, 2013, financial institutions have been required to use the new FinCEN reports, which are available only electronically through the BSA E-Filing System. This shift to mandatory e-filing changed the operational mechanics of reporting and underpins the aggregate data FinCEN compiles.

The data drawn from filed Form 111 reports is compiled by FinCEN in its SAR Stats publications (formerly titled "By the Numbers"), which illustrates how individual filings contribute to a broader picture used for analysis and policy. For practitioners, understanding the SAR's role helps clarify that the quality, timeliness, and accuracy of each filing carries consequences beyond a single institution. Exact filing obligations, thresholds, timing, and the categories of obliged filers should be confirmed against the applicable BSA regulations and FinCEN guidance, as these details are not established by the form itself.

Who it's relevant to

BSA/AML Compliance Officers
Compliance officers at U.S. financial institutions are responsible for the processes that lead to a SAR determination and for ensuring filings are made accurately through the BSA E-Filing System. They should treat Form 111 as the standardized reporting output while confirming the specific triggers, timing, and filer categories against applicable BSA regulations and FinCEN guidance.
Financial Intelligence and Investigations Analysts
Analysts who investigate alerts and prepare the narrative and structured data within a SAR rely on the Form 111 as the vehicle for documenting suspicion. They should be mindful that a filing reports a suspicion and does not establish that a crime has occurred.
SAR Operations and E-Filing Teams
Teams that manage electronic submissions need to understand that the FinCEN SAR is available only electronically through the BSA E-Filing System, where it is identified as FinCEN Report 111, and that the universal form consolidates elements from prior legacy SAR forms.
AML Risk and Data Professionals
Risk and data professionals interested in trends can reference FinCEN's SAR Stats (formerly "By the Numbers"), which compiles numerical data gathered from filed Form 111 reports, while recognizing that aggregate filing data reflects reported suspicion rather than confirmed wrongdoing.

Inside SAR

Filing Institution Information
Details identifying the obliged entity submitting the report, including its name, type of financial institution, regulator, and contact information for the filing party. This establishes which entity within the BSA framework is discharging its reporting obligation.
Subject Information
Identifying details about the individual(s) or entity(ies) involved in the suspicious activity, which may include names, addresses, identification numbers, dates of birth, occupation, and account relationships. Where a subject cannot be identified, the form generally allows filers to indicate that identifying information is unknown rather than fabricating detail.
Suspicious Activity Characterization
Structured fields categorizing the type of suspicious activity observed (for example, structuring, fraud, money laundering, or terrorist financing indicators). These are selection fields intended to classify the reported conduct and should not be read as a legal determination that a crime occurred.
Financial Instrument and Transaction Details
Information on the amounts, dates, account numbers, and instruments or products involved in the activity being reported, providing FinCEN and law enforcement with the transactional context of the concern.
Narrative Section
A free-text account describing who, what, when, where, why, and how the activity was identified as suspicious. The narrative is typically regarded as the most critical component, as it explains the basis for suspicion in a clear, chronological, and fact-based manner.
Filing Metadata and Deadlines
Administrative elements such as the type of filing (initial, correction, or continuing activity) and adherence to the filing timeframes set under FinCEN rules. Exact deadlines and thresholds should be confirmed against the applicable BSA regulations, as these are prescribed by rule.

Common questions

Answers to the questions practitioners most commonly ask about SAR.

Does filing a SAR mean the financial institution has determined that a crime occurred?
No. A SAR (filed on FinCEN Form 111) is a report of activity that a financial institution knows, suspects, or has reason to suspect may involve suspicious or potentially illicit conduct, or that has no apparent lawful purpose. It is a compliance filing reflecting suspicion, not a legal finding of wrongdoing. The determination that a crime occurred rests with law enforcement and, ultimately, the courts. A filed SAR does not establish criminal liability on the part of the subject, and institutions generally file based on a reasonable suspicion standard rather than proof.
Is a SAR the same thing as a Suspicious Transaction Report (STR) used in other countries?
They serve a comparable function but are not identical, and terminology varies by jurisdiction. In the United States, the Bank Secrecy Act and FinCEN rules use the term Suspicious Activity Report, filed on FinCEN Form 111. Many other jurisdictions, consistent with the FATF Recommendations, use the term Suspicious Transaction Report or a similar designation, and the triggering criteria, filing thresholds, obliged entities, and destination Financial Intelligence Unit can differ. The specific form, standard, and obligations should be confirmed against the applicable regime rather than assumed to match the US SAR framework.
Which entities are required to file a FinCEN SAR, and how do I confirm my obligation?
SAR filing obligations under the Bank Secrecy Act and FinCEN rules apply to specified categories of financial institutions and other obliged entities, and the precise scope, applicable thresholds, and filing triggers can differ by institution type. Because coverage and monetary thresholds vary and are subject to change, whether your organization is a covered filer and under what conditions should be confirmed against the specific FinCEN regulations applicable to your institution type.
What are the confidentiality constraints once a SAR is filed?
SARs are generally subject to strict confidentiality provisions under the Bank Secrecy Act and FinCEN rules. As a rule, an institution and its personnel are prohibited from disclosing to the subject, or to others not authorized to know, that a SAR has been filed or the information contained in it. Permissible internal sharing and disclosures to appropriate authorities are typically defined by the applicable rules. Because the exact prohibitions, exceptions, and safe harbor provisions are set by regulation, the specific requirements should be confirmed against the governing FinCEN provisions.
How does an institution decide whether activity meets the threshold to file, versus documenting a no-file decision?
The decision generally rests on whether the institution knows, suspects, or has reason to suspect that a transaction or pattern of activity is suspicious, meets the applicable criteria, and, where relevant, satisfies applicable monetary thresholds. This is a risk-based determination typically supported by investigation and analysis. Where a review concludes that filing is not warranted, institutions commonly document the rationale for that no-file decision as part of their recordkeeping. The relevant criteria and any dollar thresholds should be confirmed against the applicable FinCEN rules, as they can vary by institution type.
What timing and continuing-activity considerations apply to SAR filings?
FinCEN rules generally establish deadlines for filing a SAR after the date of initial detection of facts that may constitute a basis for filing, and they typically address how to handle ongoing or continuing suspicious activity, which may call for supplemental or continuing SAR filings. Because the exact filing deadlines and continuing-activity review intervals are set by regulation and can vary, the precise timeframes should be confirmed against the applicable FinCEN provisions rather than assumed.

Common misconceptions

Filing a SAR means the institution has determined that a crime was committed.
A SAR is a compliance report of suspicion, not a finding of guilt. It is filed when activity is known, suspected, or has no apparent lawful purpose based on the institution's assessment. The filing does not establish wrongdoing; that determination rests with law enforcement and, ultimately, the courts.
A SAR and an STR are the same thing under different names.
In the US, the report filed with FinCEN is a Suspicious Activity Report (SAR), while many other jurisdictions use the term Suspicious Transaction Report (STR), often filed with a national Financial Intelligence Unit. Although conceptually related and both reflecting FATF's suspicious reporting standard, the forms, triggers, scope, and filing bodies differ by regime, so they should not be treated as interchangeable.
The FinCEN SAR (Form 111) applies uniformly to every business or person handling money.
The SAR obligation applies to specific categories of BSA-regulated financial institutions, and reporting triggers and thresholds vary by institution type. Entities outside the defined scope of the BSA and FinCEN rules are not subject to the same Form 111 obligation, and applicable requirements should be confirmed against the relevant regulation.

Best practices

Prioritize a clear, complete, and chronological narrative that explains the specific basis for suspicion, addressing who, what, when, where, why, and how, since the narrative is generally the most important part of the report.
Where subject identifying information is unavailable, indicate that it is unknown rather than fabricating details, and include all information the institution does hold.
Confirm applicable filing deadlines, thresholds, and triggers against current FinCEN rules and the BSA before relying on any specific timeframe, as these are prescribed by regulation and should not be assumed.
Select suspicious activity characterization fields accurately to reflect the observed conduct, while framing the filing as a report of suspicion rather than a conclusion that a crime occurred.
Maintain confidentiality of the SAR and observe applicable prohibitions on disclosure (tipping-off) consistent with BSA requirements.
Use initial, corrected, and continuing activity filing types appropriately, and document the institution's internal rationale and supporting records to support consistency and auditability of filing decisions.