Transaction Monitoring, Suspicious Activity Detection, and Reporting (SARs/STRs)
What the exam tests
This domain tests how institutions detect, investigate and report suspicious activity. Expect questions on monitoring scenarios, alert triage, red flags, SAR/STR timing, confidentiality and continuing activity.
Core rules and concepts
- Monitoring can be rules-based (thresholds, velocity, geography, counterparty) or behaviour-based (deviation from expected profile). Effective monitoring is risk-based, documented and tuned to reduce false positives without losing coverage.
- Red flags include structuring, rapid movement of funds, round-dollar transactions, unrelated third-party counterparties, high-risk jurisdictions, cash-intensive business activity inconsistent with the customer profile, and sudden changes in transaction volume.
- A SAR (US) or STR (EU/UK) is filed with the FIU when the institution knows, suspects or has reason to suspect that a transaction involves criminal proceeds or is linked to terrorist financing. In the US, a SAR is generally due within 30 calendar days of initial detection, extendable to 60 if no suspect is identified. Continuing activity may require a follow-up SAR, often within 120 days.
- Confidentiality: the institution must not tip off the customer. SARs are exempt from certain disclosure requirements but may be shared with regulators and law enforcement under specific rules.
- Safe harbour: good-faith reporting is generally protected from civil liability, but the institution must still document its investigation.
Worked example
A retail customer receives 20 small wires from unrelated individuals in three days, then withdraws most of the balance in cash. The monitoring alert triggers on velocity and counterparty diversity. The investigator reviews the customer profile: a student with no business rationale. Open-source checks show the customer advertises money transfer services on social media. The pattern is consistent with unlicensed money transmission and possible layering. The bank should escalate, file a SAR, and consider exiting the relationship. The reasoning: the activity is inconsistent with the profile, involves multiple unrelated counterparties, and has no apparent economic purpose.
Traps that cost marks
Do not file a SAR for every alert as a defensive measure; document why an alert is closed. Do not miss the 30-day clock by waiting for a perfect case. Do not tip off the customer. Do not treat a single large transaction as suspicious without context. Do not forget continuing activity reports.