A defensive SAR is a suspicious activity report filed mainly to protect the filing institution, because not filing might be criticized, rather than because the bank has formed a reason to suspect and has information useful to law enforcement. It is not a term in the regulations; it is how practitioners and the Wolfsberg Group, a standard-setting association of global banks, describe a filing culture in which every alert that cannot be fully cleared becomes a SAR. Such reports protect the filer from one risk and do little for the investigators who read them. The October 2025 interagency SAR FAQs removed two of the habits that fed defensive filing. The rest depends on each bank being able to show why it filed, which is what Botminds' SAR Narrative & Filing makes visible sentence by sentence.
Research and regulator figures on this page are linked where they appear; product examples use a fictional sample bank, Tessaly Community Bank.
Fewer than one in six reports forwarded: Germany's financial intelligence unit, 2022
Germany: 337,186 reports received
- Forwarded to law enforcement · 15.3%
- Not forwarded · 84.7%
What is a defensive SAR?
A defensive SAR is filed to close off the filer's risk rather than to report a suspicion the bank has actually formed. The Wolfsberg Group describes how it arises: institutions report "potentially suspicious activity in all cases where red flags and typologies potentially indicative of financial crime have alerted and in which the legitimacy of the underlying transactions could not be fully verified", which "has resulted in FIs gradually reducing the threshold for filing" (Wolfsberg Group, 2024). Its conclusion is the sentence most often quoted on the subject.
A "defensive" SAR/STR filing may eliminate the regulatory risk for an FI as a result of not filing a SAR/STR but is unlikely to provide useful information to law enforcement.
The Wolfsberg Group, Statement on Effective Monitoring for Suspicious Activity, Part I (2024)
The tell is in the narrative. A SAR filed because the bank suspects something says what and why: the customer asked how to avoid a report, the money left as fast as it came, the business described at opening does not use cash. A defensive SAR says the alert fired and the activity could not be explained, and stops. The rule itself sets a higher bar than that habit: a bank files when it "knows, suspects, or has reason to suspect" one of the listed kinds of activity, and an alert that could not be cleared is a reason to look, not yet a reason to suspect.
Why do banks file defensive SARs?
Because the two errors carry different penalties. A SAR that should have been filed and was not can appear in a consent order; Bank of America's October 2026 order records a lookback that found close to 8,900 SARs it had failed to identify and file, covering activity of nearly $4 billion, and a $1.2 billion penalty (FinCEN Consent Order 2026-03). A SAR filed without good reason costs analyst hours and nothing else. Faced with that asymmetry, many programs lean toward filing.
The Wolfsberg Group adds a second cause: programs built mainly to meet supervisory expectations and show technical compliance, down to making sure no past suspicious activity ever goes unreported (the guide to false positive rates shows what that aim does to alert volumes). Some of those expectations were never rules. Until October 2025 many banks filed on cash near $10,000 by default and refiled every 90 days on every subject, practices the interagency FAQs have now said are not required. The examination manual had long said the decision is "an inherently subjective judgment" and that a bank with an established, followed process "should not be criticized for the failure to file a SAR unless the failure is significant or accompanied by evidence of bad faith" (FFIEC manual, SAR Decision Making). That protection depends on a process the bank can show.
Two SARs on the same alert
A defensive SAR: The alert could not be cleared, and not filing felt riskier.
A SAR with a reason: The bank formed a reason to suspect, and can say what it is.
A defensive SAR: Restates the alert rule: deposits below $10,000 over 15 days.
A SAR with a reason: Names the evidence: a question about reporting, a split deposit, cash twelve times expected activity.
A defensive SAR: The filer, from criticism for not filing.
A SAR with a reason: The public, by giving investigators something to act on.
A defensive SAR: Analyst hours, plus dilution of the reports investigators search.
A SAR with a reason: The same hours, spent on information with a use.
A defensive SAR: Rarely; not filing feels exposed.
A SAR with a reason: With a short reason, under a process examiners can test.
Do more SARs mean more prosecutions?
Not reliably, on the evidence available. The most direct test is a 2026 peer-reviewed study of European countries' suspicious transaction reports and money laundering convictions. In simple models, report volumes appeared positively associated with later convictions, but "the association weakens and becomes insignificant when we control for both country-specific and common time effects", and the authors caution "against assuming that STR volumes, by themselves, are reliable indicators of future money-laundering convictions" (Jensen, Hansen and Rose, European Journal on Criminal Policy and Research, 2026). The data are European, not American.
The deeper problem is measurement. Levi, Reuter and Halliday, in a widely cited 2018 article, found that almost nobody had tried to evaluate whether AML measures achieve what they are for, and noted there are no credible estimates of the amount laundered, so a reduction in it "is not a plausible outcome measure" (Crime, Law and Social Change, 2018). Volume is easy to count. Value is not, which is how volume became the measure.
What the evidence says about SAR volume and value
| Source | Finding | Scope |
|---|---|---|
| Wolfsberg Group, 2024 | Volumes rose; "no reliable evidence" of a proportionate increase in highly useful information | Global banks' view |
| Jensen, Hansen and Rose, 2026 | Report volumes not a reliable predictor of later money laundering convictions | European countries, peer reviewed |
| Levi, Reuter and Halliday, 2018 | AML has had minimal outcome evaluation; no credible estimates of amounts laundered | International, peer reviewed |
| GAO-22-105242, 2022 | FinCEN cannot give comprehensive feedback; agencies largely do not track how they use reports | United States |
| FinCEN Year in Review, FY 2025 | 63.9 million searches of BSA data; 11.7% of new IRS-CI investigations began from a BSA filing | United States |
How does law enforcement use SARs?
Mostly by searching them, and the searching is heavy. FinCEN reports that in fiscal 2025 authorized users ran over 2.52 million searches through BSA Search, 464 agencies have access, and integrated federal partners ran over 61 million more, for a total of "63.9M total searches" (FinCEN Year in Review, FY 2025). A SAR may never open a case and still be found in the middle of one, which is why a precise name, account number and key term matter more than volume.
Some reports do start cases. FinCEN's review relays IRS Criminal Investigation's figures: in fiscal 2025, "11.7% of all investigations opened by IRS-CI originated from a BSA filing, with 89.3% of these cases initiated from a SAR", and IRS-CI searched BSA data in 94% of its cases. The FBI reports thousands of subjects tied to BSA reports.
FBI investigative subjects tied to BSA reports, fiscal 2025
What banks rarely get is feedback on their own SARs. GAO found in 2022 that FinCEN gets little data from law enforcement on how it uses BSA reports, because most agencies do not collect it, and so cannot give banks full feedback on whether their reports were useful (GAO-22-105242; the guide to the alert-to-SAR ratio shows what that gap does to measurement). Without that signal, the safest-looking choice for each analyst is to file.
Is defensive SAR filing a problem?
Yes, for the filer as well as for law enforcement, though not filing is the larger risk. Defensive SARs cost hours: FinCEN's paperwork estimate is about two hours of filer time per SAR before any investigation, and every report filed for comfort is two hours not spent on a case with a real reason. They dilute: an investigator searching a name finds the useful report among the reflexive ones. And they defend less than they seem to. A SAR whose narrative only restates an alert is a weak SAR, and the manual expects a narrative to set out the full extent and nature of the suspicious activity.
The opposite failure is worse. The enforcement record is full of SARs not filed, or filed months late, and none of it involves a bank penalized for filing too many. The goal is not fewer SARs. It is SARs whose reasons are written down, and decisions not to file that rest on a process the bank follows.
What did FinCEN say about near-threshold cash SARs?
That the amount alone is not enough. Question 1 of the October 9, 2025 interagency FAQs says a transaction or series at or near the $10,000 CTR threshold is not by itself information sufficient to require a SAR; the bank must know, suspect or have reason to suspect the transactions were designed to evade reporting. For a bank that filed whenever a near-threshold alert fired, the FAQ takes away the reflex without weakening the rule against structuring. The October 2025 SAR FAQs covers the answer in full, with the other three changes.
The reason for suspicion, one click from its evidence
How can a bank reduce low-value SARs without missing real ones?
By making the reason for each decision visible and measuring what the SARs contain, not how many there are. The AML Act of 2020 already points that way: SARs "shall be guided by the compliance program of a covered financial institution with respect to the Bank Secrecy Act, including the risk assessment processes of the covered institution" (AML Act of 2020, §6202), and FinCEN's national AML/CFT priorities, still the June 2021 list of corruption, cybercrime, terrorist financing, fraud, transnational criminal organizations, drug trafficking, human trafficking and smuggling, and proliferation financing, say where useful information is most wanted (FinCEN, 2021).
In practice that means a few disciplines. Require every narrative to say why the bank suspects, beyond the alert, and return the ones that do not. Let the decision maker record a short reason not to file, which the October 2025 FAQs say will usually suffice. Track quality markers rather than counts, as set out in the SAR quality scoring sheet. And feed what the bank learns back into monitoring: the Wolfsberg Group suggests institutions use "the demonstrated value of SARs/STRs filed when deciding whether to continue or stop certain suspicious activity monitoring routines", while testing any routine they switch off to make sure no material risk is left uncovered.
How SAR Narrative & Filing makes the reason visible
The solution does not decide whether to file, and it does not try to reduce the number of SARs. It makes the reason for each one inspectable. Every sentence of the narrative is labelled with the question it answers, and a coverage line counts the sentences that answer why; in the sample case three do, citing the teller's note, the cash against expected activity and the missing invoices. The QC checker's structuring check asks for evidence of intent, citing the October 2025 FAQs, and the reviewer can return a SAR whose basis for suspicion is not shown.
Decisions not to file are recorded too: the BSA officer can decide not to file with a reason code, which leaves the short statement the FAQs describe. And the board report shows SARs by month and kind of activity, so a committee can see whether the mix matches the bank's risk assessment, with no subject or case named.
SARs counted by kind of activity, for the board
Questions people ask
What is a defensive SAR filing?
The practice of filing a SAR whenever an alert cannot be fully cleared, to avoid criticism for not filing, rather than because the bank has a reason to suspect. The Wolfsberg Group says such filing may remove the filer's regulatory risk but is unlikely to give law enforcement useful information.
Can a bank be penalized for filing too many SARs?
The enforcement record shows penalties for SARs not filed or filed late, not for filing too many. The costs of over-filing are hours, weaker narratives and dilution of the database, and the October 2025 FAQs signal that the agencies want resources focused on reports of value.
Are defensive SARs protected by the safe harbor?
The safe harbor in 31 U.S.C. 5318(g)(3) protects disclosures of possible violations to the authorities, including voluntary SARs below the thresholds. It protects the bank from civil liability to any person; it does not make a SAR without a stated reason useful, or a weak narrative acceptable to an examiner.
How many SARs are filed each year?
About 4.8 million in fiscal 2025 across all filer types, according to FinCEN, up from 4.3 million in fiscal 2022. FinCEN does not publish how many were useful, and GAO has found it cannot give filers comprehensive feedback.
Should a bank document why it did not file a SAR?
It is not required: the October 2025 FAQs say there is no requirement or expectation to document a decision not to file. A short statement of the reason is still good practice, and it is what lets a bank show that its decisions follow a process rather than a fear of criticism.
Is a defensive SAR the same as a voluntary SAR?
No. A voluntary SAR is one filed below the mandatory thresholds, by choice, and FinCEN's instructions invite them where the bank believes the activity is relevant to a possible violation. "Defensive" describes the motive, filing to protect the bank, and a defensive SAR can be above or below a threshold.