What is suspicious activity report (SAR)?

A confidential filing a regulated financial firm submits to its national authority when a transaction has indicators of possible criminal activity.

In the United States these go to the Financial Crimes Enforcement Network under the Bank Secrecy Act. Firms are forbidden from telling the customer a report was filed, which is why an account can be frozen or closed with no explanation offered. A report is a referral, not an accusation, and most lead nowhere. Exchanges file them routinely as part of their compliance obligations. See aml and kyt.

This is the single best explanation for a category of exchange experience that otherwise looks arbitrary: the frozen withdrawal with no reason given and a support team that will not elaborate.

How it works

A registered money services business, which is how most United States crypto exchanges are classified, must file a report when it knows or suspects that a transaction involving at least $2,000 has no apparent lawful purpose, is designed to evade reporting requirements, or otherwise looks like it involves funds from illegal activity (source: 31 CFR 1022.320). The filing deadline is 30 calendar days from initial detection, with a limited extension where no suspect has been identified.

Two features shape the customer experience.

Confidentiality is a legal obligation, not a customer service choice. United States law prohibits the firm from notifying the person involved that a report was filed (source: 31 U.S.C. 5318(g)(2)). A support agent who says only that the account is under review may be following that rule rather than stonewalling.

A report is a referral. Filing one means a firm saw indicators worth reporting. It is not a finding of wrongdoing, most reports lead to nothing, and firms file defensively because the penalty for under-filing is far worse than the cost of over-filing.

Equivalent regimes exist elsewhere under different names, generally reporting to a national financial intelligence unit, with the same tipping-off prohibition.

Example

Illustrative. A customer deposits, buys, and withdraws to an external wallet within an hour, repeats it several times in a week, and the destination addresses have no prior relationship to the account. To a monitoring system this pattern resembles layering, regardless of the customer's actual reason. The exchange freezes the withdrawal, files a report, and tells the customer only that the account is under review. No accusation has been made and nothing has been proven. The customer's funds are held while the process runs, and the process has no published clock.

Why it matters when you buy

Account freezes are a real operational risk of using any regulated venue, and they are not distributed evenly. The exchange pages cover each venue's regulatory posture, the guide on exchange freezes covers what to do when one happens, and the guide on what identity verification involves covers the checks that precede it.

Related terms

• aml — the framework this belongs to
• kyt — the monitoring that generates the alert
• kyc — the identity record behind the file
• travel rule — the related information-sharing rule
• chain analysis — how flows are traced
• ofac screening — the sanctions check run alongside

Questions

Will I be told if a report is filed on me?

No. The firm is legally prohibited from telling you in the United States and under equivalent rules elsewhere. Silence about the reason is the expected behavior, not a sign of anything specific.

Does a report mean I did something wrong?

No. It records that a firm saw indicators worth reporting to an authority. Most filings result in no action against anyone.

How long can funds be held?

There is no published customer-facing timetable, and it varies with the firm and the authority. Documented, calm responses to information requests are the only lever a customer has.