Suspicious activity reports: A guide for fund compliance

Author: The Carta Team
Read time: 12 minutes
Published date: July 9, 2026

Learn what SARs are, when you need to file one, what to include in it, and how to build SAR procedures into your fund’s compliance workflow.

Contents

• What is a suspicious activity report?
• How SARs fit into your AML program
• What triggers a suspicious activity report?
• Who is required to file a SAR?
• What information is included in a SAR?
• How to file a suspicious activity report
• What happens after you file a SAR?
• SAR confidentiality rules
• Penalties for non-compliance
• How to detect and report suspicious activity
• SAR best practices for fund managers
• Staying compliant with SAR requirements
• Streamlining compliance with Carta

What is a suspicious activity report?

A suspicious activity report (SAR) is a confidential document that a financial institution files with FinCEN when it detects activity that may indicate money laundering, fraud, terrorist financing, or other financial crimes and illegal activity. Filing a SAR does not mean a crime occurred—it means the activity raised enough concern to warrant review by federal authorities. In 2025, financial institutions filed more than 4.1 million SARs.

How SARs fit into your AML program

SARs are one component of a broader AML and KYC framework. Your AML program includes several interconnected elements:

• Know your customer (KYC): Verify investor identities and collect baseline information at onboarding.
• Transaction monitoring: Flag unusual activity patterns that deviate from an investor's expected behavior.
• Customer due diligence (CDD) and enhanced due diligence (EDD): Assess risk levels for each investor, with deeper review for high-risk profiles.
• SAR filing: Report suspicious activity to FinCEN when monitoring surfaces concerns.
• Record retention: Maintain SAR records and supporting documentation for five years.

What triggers a suspicious activity report?

SAR filing is triggered by specific scenarios defined by federal regulators. Here are some categories of triggers:

Insider abuse

Any employee or official at a financial institution who misuses their position for financial gain triggers a mandatory SAR filing.

Transaction thresholds

Two primary dollar thresholds determine when a SAR is required:

Red flags in fund operations

Here are some suspicious activity patterns:

• Wire transfers from high-risk jurisdictions.
• Inconsistent subscription or redemption patterns.
• Structuring transactions to avoid reporting thresholds.

Who is required to file a SAR?

Under the Bank Secrecy Act, financial institutions such as banks, credit unions, and fund managers must file SARs when suspicious activity occurs.

SAR obligations for fund managers

Fund managers must implement a formal AML program with written policies and procedures. They are required to file SARs during investor onboarding, capital calls, or managing transactions.

What information is included in a SAR?

Every SAR must answer:

1. Subject information: Names, addresses, Social Security numbers, etc.
2. Suspicious activity details: Specifics about flagged activity.
3. Financial institution information: Institution name, address, and identification.
4. Contact information: Person responsible for filing.
5. Narrative description: Explanation of why the activity is suspicious.

How to file a suspicious activity report

You must file a SAR within 30 calendar days of detecting suspicious activity. The BSA E-Filing System is used for electronic submissions.

What happens after you file a SAR?

Once you submit a SAR, FinCEN analyzes the report and shares relevant information with law enforcement agencies.

SAR confidentiality rules

Federal law strictly prohibits disclosing SAR filings to the subject or any unauthorized party. Violating SAR confidentiality is a federal offense.

Penalties for non-compliance

Failing to file required SARs can result in civil penalties, criminal penalties, and regulatory restrictions.

How to detect and report suspicious activity

Automated transaction monitoring systems and staff training are crucial in identifying suspicious activities.

SAR best practices for fund managers

1. Implement transaction monitoring tools.
2. Train your team on specific red flags.
3. File promptly upon confirming suspicious activity.
4. Write clear narratives.
5. Integrate SAR procedures into KYC and AML compliance programs.
6. Conduct periodic independent testing of your AML program.

Staying compliant with SAR requirements

Maintain practices such as filing within 30 days and retaining SAR records for five years. Integrate compliance awareness into your fund operations.

Streamlining compliance with Carta

Carta's fund administration platform consolidates compliance tools and fund management responsibilities.