The SAR threshold for an unknown suspect is $25,000: a bank must file on a known or suspected federal criminal violation committed against it or through it that aggregates $25,000 or more "even though there is no substantial basis for identifying a possible suspect". When a suspect can be identified, the threshold for the same kind of violation is $5,000, and for insider abuse there is no minimum at all. Money laundering, structuring and other attempts to evade the Bank Secrecy Act follow a separate rule, $5,000 whether or not anyone is identified, and money services businesses file from $2,000. An unknown suspect also changes the clock: the bank may take 30 more days to identify one, but never more than 60 days from the determination. Botminds' SAR Narrative & Filing applies both: it marks unknown subject details as unknown rather than guessing them, and counts each case on the right clock.
The rule citations are to FinCEN's regulation, 31 CFR 1020.320, and the OCC's, 12 CFR 21.11; the Federal Reserve, FDIC and NCUA rules are parallel. Product examples use a fictional sample bank, Tessaly Community Bank.
Which SAR threshold applies: a decision tree for banks
1
Is an insider a suspect?
A director, officer, employee, agent or other institution-affiliated party, with a substantial basis for identifying them.
Yes: file at any amount. No joint SAR; the board notice skips the insider.
No: go to 2.
2
Could it be money laundering, BSA evasion such as structuring, a transaction with no apparent lawful purpose, or the bank used to facilitate a crime?
Yes, and $5,000 or more: file, whether or not a suspect is known.
No: go to 3.
3
Is it a federal criminal violation against the bank or through it, such as fraud?
Suspect identified, $5,000 or more: file.
No suspect identified, $25,000 or more: file.
No suspect, under $25,000: not required; a voluntary SAR is protected.
4
Then the clock
30 calendar days from the determination; if no suspect was identified that day, up to 30 more to identify one, never past day 60. Urgent cases: telephone law enforcement as well.
What is the SAR threshold for an unknown suspect?
$25,000, for federal criminal violations. The OCC's rule, matched by the other banking agencies, requires a SAR for "violations aggregating $25,000 or more regardless of potential suspects": any known or suspected federal criminal violation "committed or attempted against the bank or involving a transaction or transactions conducted through the bank and involving or aggregating $25,000 or more in funds or other assets where the bank believes that it was either an actual or potential victim", or "was used to facilitate a criminal transaction, even though there is no substantial basis for identifying a possible suspect or group of suspects" (12 CFR 21.11(c)(3)).
The phrase that decides it is "substantial basis for identifying a possible suspect". A name on a counterfeit check is not always one; an account holder whose account received the proceeds often is. Typical unknown-suspect cases are account takeovers and counterfeit or altered checks where the person behind them is not identified, and the $25,000 threshold keeps small, untraceable losses off the SAR system unless something else makes them reportable.
The unknown-suspect threshold does not apply to money laundering or BSA evasion. Those are reportable from $5,000 if the bank knows, suspects, or has reason to suspect the activity, with or without a suspect. A run of structured cash deposits by people the bank cannot identify is a $5,000 case, not a $25,000 one.
What is the SAR threshold for a known suspect?
$5,000. The banking agencies' rules require a SAR for "violations aggregating $5,000 or more where a suspect can be identified", when "the bank has a substantial basis for identifying a possible suspect or group of suspects" (12 CFR 21.11(c)(2)). If the suspect has used an alias, the bank must report "the true identity of the suspect or group of suspects, as well as alias identifiers, such as drivers' license or social security numbers, addresses and telephone numbers".
The amount is an aggregate: the funds or assets involved in the violation or pattern of violations, not a single transaction. Several smaller items that are part of one scheme count together. FinCEN's instructions apply the same logic to the amount the SAR reports, Item 29, which aggregates all amounts "even when the amounts involve different transaction types, such as when some are deposits and some are withdrawals" (FinCEN SAR Filing Instructions, April 2026).
SAR thresholds for banks and MSBs, by trigger and rule
| Trigger | Threshold | Suspect needed? | Rule |
|---|---|---|---|
| Insider abuse | Any amount | An insider with a substantial basis | 12 CFR 21.11(c)(1) and parallels |
| Criminal violation, suspect identified | $5,000 | Yes | 12 CFR 21.11(c)(2) and parallels |
| Criminal violation, no suspect identified | $25,000 | No | 12 CFR 21.11(c)(3) and parallels |
| Money laundering, BSA evasion, no lawful purpose, facilitating crime | $5,000 | No | 31 CFR 1020.320(a)(2); 12 CFR 21.11(c)(4) |
| Money services business, same triggers | $2,000 | No | 31 CFR 1022.320(a)(2) |
| MSB issuer reviewing money order or traveler's check clearance records | $5,000 | No | 31 CFR 1022.320(a)(3) |
| Anything below these, if the bank chooses | None | No | Voluntary SAR; safe harbor applies |
What is the SAR threshold for insider abuse?
There is none: insider abuse is reportable in any amount. FinCEN's filing instructions describe the trigger as a known or suspected federal criminal violation where "the bank has a substantial basis for identifying one of its directors, officers, employees, agents or other institution-affiliated parties as having committed or aided in the commission of a criminal act regardless of the amount involved in the violation" (FinCEN SAR Filing Instructions, 5.4).
Insider cases change the filing in two more ways. A SAR whose subject is a director, employee, officer or owner of the filer or a would-be joint filer cannot be filed jointly; "separate FinCEN SARs must be filed by each institution". And the board notice changes: where the suspect is a director or executive officer, the OCC's rule says the bank "may not notify the suspect" and "shall notify all directors who are not suspects" (12 CFR 21.11).
Is there a SAR threshold for money laundering?
Yes: $5,000 for banks, whether or not a suspect is known. FinCEN's rule requires reporting of a transaction "conducted or attempted by, at, or through the bank" that "involves or aggregates at least $5,000 in funds or other assets" where the bank "knows, suspects, or has reason to suspect" that it involves funds from illegal activity or an attempt to disguise them, is designed to evade BSA requirements, has no business or apparent lawful purpose, or involves use of the bank to facilitate criminal activity (31 CFR 1020.320(a)(2)).
Structuring sits inside the second trigger, and the crime itself has no threshold. Under 31 U.S.C. 5324 no person may structure transactions to evade currency reporting (31 U.S.C. 5324), and FinCEN's definition covers transactions "in any amount". The $5,000 is the reporting threshold for the bank, not a floor under the offence. Since the October 2025 interagency FAQs, a bank needs a reason to suspect intent to evade, not just amounts near $10,000, before it files.
Four SAR thresholds side by side
What is the SAR threshold for money services businesses?
$2,000. A money services business must report a transaction that "involves or aggregates funds or other assets of at least $2,000" where it knows, suspects or has reason to suspect the same kinds of activity as a bank (31 CFR 1022.320(a)(2)). One exception raises it: an issuer of money orders or traveler's checks that finds the activity only by reviewing clearance records reports from $5,000.
The difference matters to banks that serve money services businesses or sponsor fintech programs. The MSB files on its own customers from $2,000; the bank files on what it sees from its own thresholds, and an MSB's filing does not replace the bank's.
Can you file a SAR below the threshold?
Yes. The instructions say "financial institutions may also file with FinCEN a report of any suspicious transaction that it believes is relevant to the possible violation of any law or regulation but whose reporting is not required" (FinCEN SAR Filing Instructions, 5.5), and the examination manual says the safe harbor from civil liability "applies to SARs filed within the required reporting thresholds as well as to SARs filed voluntarily on any activity below the threshold" (FFIEC manual).
Voluntary is not the same as automatic. A SAR below the threshold should carry the same narrative quality as any other, and a habit of filing on everything that cannot be cleared is its own problem, discussed in what a defensive SAR is, and who it protects. Three things do not lower the obligation: a CTR exemption does not relieve a bank of filing SARs on an exempt customer (31 CFR 1020.315(h)); a law enforcement request to keep an account open does not either (FinCEN, FIN-2007-G002); and a robbery or burglary reported to law enforcement is one of the few listed exceptions, not a model for others.
How the unknown-suspect clock works
The bank has 30 calendar days from the determination, and when no suspect was identified on that date, "a bank may delay filing a SAR for an additional 30 calendar days to identify a suspect. In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction" (31 CFR 1020.320(b)(3)). The extra days have one purpose; a bank that uses them should be trying to identify the suspect, and should file as soon as it does or as soon as it concludes it cannot.
Thirty days with a suspect, up to sixty without one
- Investigate, write, review, sign, fileDay 0–30
- No extension
- Same workDay 0–30
- Only to identify a suspectDay 30–60
On the form, an unknown subject is recorded honestly. FinCEN's instructions say that if all subjects are unknown, the filer completes a single Part I record marked to show that all critical subject information is unavailable, leaves those items blank, and records "the nature of the unknown subject(s) in Part V". Where some subjects are known and others are not, each known subject gets a Part I record and the unknown ones are described in the narrative.
Every SAR on its own clock: thirty days, or sixty with no subject yet
Before concluding that a SAR is not required
- Aggregate the whole pattern
Thresholds apply to the funds involved in the violation or pattern, not to one transaction.
- Ask whether an insider is involved
If so, there is no minimum, and the filing and board notice change.
- Test for money laundering or BSA evasion
Those are $5,000 cases whether or not anyone is identified.
- Decide what "suspect identified" means here
A substantial basis for identifying a possible suspect, not certainty.
- Check for an exemption trap
CTR exemptions and keep-open requests do not remove the SAR duty.
- Consider a voluntary SAR
Protected by the safe harbor, and worth it where the information is useful.
- Note the reason
Not required since the October 2025 FAQs, but a short statement helps the next reviewer.
Where SAR Narrative & Filing applies the thresholds
The decision to file stays with the bank. Once it is made, the solution handles what the threshold decision implies. Every open case shows its clock, 30 days, or 60 when no suspect has been identified, with the due date and the bank's escalation days. The FinCEN field mapper fills subject fields only from a source; in the sample case no document held Lena Treloar's TIN or date of birth, so it checked "unknown" for both and left the narrative to say what the bank knew of her. The QC checker tests that every subject named in the narrative appears in Part I with an identifier or "unknown" checked.
The 60-day rule is fixed in the solution; the escalation days are the bank's settings. For the full hand-off chain the clock governs, see the SAR filing process, who waits on whom.
Subjects as BSA E-Filing will receive them, unknowns marked
Questions people ask
What is the SAR reporting threshold in the United States?
For banks, $5,000 for money laundering, BSA evasion and criminal violations with an identified suspect, $25,000 for criminal violations with no identified suspect, and any amount for insider abuse. Money services businesses file from $2,000. All are aggregates of the funds or assets involved.
Is the SAR threshold $2,000 or $5,000?
It depends on the filer. $2,000 is the threshold for money services businesses under 31 CFR 1022.320; banks file from $5,000 under 31 CFR 1020.320 and their banking agency's rule, with the higher $25,000 threshold for criminal violations where no suspect can be identified.
Do SAR thresholds change with inflation?
Not automatically. The AML Act of 2020 directed Treasury to review whether the SAR and CTR dollar thresholds "should be adjusted" and to re-evaluate them at least every five years for ten years. No rule changing the bank SAR thresholds had been published as of October 2026.
How long do you have to file a SAR when the suspect is unknown?
Up to 60 calendar days from the determination: the usual 30, plus up to 30 more to identify a suspect. The extension is only for identifying a suspect, and filing may never be delayed beyond day 60.
Does the unknown-suspect threshold apply to structuring?
No. Structuring is BSA evasion, reportable from $5,000 whether or not the people making the deposits are identified. The $25,000 threshold applies to criminal violations such as fraud against the bank where no suspect can be identified.
Do you file a SAR for a robbery?
Not if the robbery or burglary was reported to the appropriate law enforcement authorities; FinCEN's instructions list it as an exception for banks. Related suspicious activity that is not the robbery itself is judged on its own thresholds.