Most money transfer operators know they must report suspicion. Where they slip is the path in between: a trigger nobody reads for three days, a narrative rebuilt from memory, a customer service reply that tips someone off. This guide follows one remittance case from the first risk trigger to the filed report, and sets out who owns each step and how long it should take.
It is written for MLROs, compliance heads and operations leads at licensed operators. It is not legal advice. Deadlines below are from the regulators' own rules; confirm what applies to your licence with your adviser.
What a SAR is, and how long you have
A suspicious activity report is a confidential report to your country's financial intelligence unit that a transaction or pattern may involve money laundering, terrorist financing or other crime. It does not accuse anyone. You report the suspicion; you do not have to prove the crime. Names differ by country, and so do the deadlines.
| Country | Report | Deadline | Notes |
|---|---|---|---|
| United States (FinCEN) | SAR | 30 calendar days from initial detection | Money services businesses: transactions involving or aggregating at least $2,000. No extension in the MSB rule. Keep records five years. Filed through BSA E-Filing. |
| United Kingdom (NCA) | SAR | As soon as practicable | Filed through the NCA's SAR Portal. If a suspected transaction must go ahead, a Defence Against Money Laundering (DAML) request may be needed. |
| Australia (AUSTRAC) | Suspicious matter report (SMR) | 3 business days after forming the suspicion; 24 hours if it relates to terrorism financing | The tightest clock here. Internal review has to be fast. |
| Canada (FINTRAC) | Suspicious transaction report (STR) | As soon as practicable after the suspicion is established | No monetary threshold. Any delay needs a reasonable explanation. |
Tipping off: in the UK, disclosing that a SAR has been made in a way likely to prejudice an investigation is a criminal offence under the Proceeds of Crime Act 2002, with up to two years' imprisonment; prejudicing an investigation carries up to five. US rules also keep SARs confidential. Support staff must never tell a customer that a report is being considered.
What usually starts a remittance case
In remittance, suspicion rarely comes from one transfer. It comes from a change against the customer's own pattern.
| Red flag | What you see |
|---|---|
| Sudden change in volume | A small, regular sender starts sending several times their usual amount |
| Splitting | Several transfers just under a limit or document tier, close together |
| New recipients in a burst | Money spread across unrelated recipients the customer has never paid before |
| Many ways to pay | Several cards or bank accounts used in a short window, or payment details shared with other customers |
| Mismatch with profile | Amounts out of line with the stated occupation, income or purpose |
| Evasive answers | Reluctance to explain source of funds or relationship to the recipient, once asked |
One case, from trigger to filed report
An illustrative case at a UK operator. The customer has sent about £150 a month to one recipient for two years.
| When | What happens | Who |
|---|---|---|
| Days 1 to 9 | The customer sends five transfers of £1,400 to £1,800 to four new recipients, paid from three different cards. | Customer |
| Day 9, transfer six | Risk rules fire on transaction frequency and volume, linked transaction patterns and multiple payment methods. The risk score lands in the High band, so the transfer stops Under Review instead of going to payout. | Platform |
| Day 9, within 4 hours | An analyst opens the customer's risk page. Each trigger explains itself in plain language and links to the transfers and cards that tripped it. The analyst adds the earlier five transfers to the picture and escalates to the MLRO. | Analyst |
| Day 10 | Normal due diligence: the customer is asked for source of funds and their relationship to the recipients, in the same words used for any customer at this level. Nothing is said about a report. | Compliance |
| Day 12 | The customer sends a payslip for a salary that does not explain £8,000 in nine days, and cannot say how they know two of the recipients. The MLRO forms the suspicion and decides to report. | MLRO |
| Day 13 | The MLRO writes the narrative from the case file and files the SAR. The held transfer stays held; the MLRO takes advice on whether a DAML is needed before anything is released. | MLRO |
| After filing | The SAR is recorded against the customer, so their later transfers carry that history into the risk rules. The decision, its reasons and the evidence stay on file. | Platform, MLRO |
Two points matter for the clock. In the US the 30 days run from initial detection, which here is day 9, not day 12. In Australia the 3 business days run from forming the suspicion, which is why an operator under AUSTRAC needs the analyst and MLRO steps measured in hours.
A strong narrative for this case says who (customer, four recipients, three cards), what (six transfers totalling about £9,600 in nine days against a history of £150 a month), how it was found (risk rules on frequency, linked patterns and payment methods), what the customer said, and why that did not resolve the concern. Plain facts, in order, without speculation dressed as fact.
Doing it with RemitSo
The case above runs on records the platform already keeps, so the MLRO reads the case rather than rebuilding it.
- 47 ready-made risk indicators you combine into your own rules, including transaction frequency and volume, frequent transfers to the same recipient, linked transaction patterns, multiple payment methods and payment details reused across customers. Risky transfers wait for a person; everything else flows on its own.
- Risk score bands (Low, Medium, High, Critical). At or above your installation's threshold, transfers stop Under Review.
- Risk triggers that read as a case file: each check that fired explains itself in plain language, links to the records that tripped it and keeps the evidence. Risk Radar shows the evaluated indicators and outcomes.
- Suspicious Activity Reports generated, managed and submitted from the console, with risk indicators for an internal SAR filed, reported or not reported, so a customer's history follows them.
- Sanctions screening of every sender and recipient against 8 lists loaded nightly, with every screening and each officer's decision kept.
- A searchable, plain-language audit log of who changed what, and when.
- Roles for every page and action, so only the people you choose can see risk pages and SARs.
Your MLRO still forms the suspicion, writes the narrative and decides whether and when to report. For running cases end to end, see AML investigation and case management and building risk rules safely.
A one-page internal SAR workflow
The internal time limits below are suggestions to adapt to your regulator and volume. Write yours down; an examiner will ask what they are and whether you meet them.
| Step | Owner | Internal time limit | Record kept |
|---|---|---|---|
| 1. Trigger raised | Platform or front-line staff | Immediate | Rule that fired, transfer held |
| 2. First review | Compliance analyst | Same working day | Notes, linked records, decision to escalate or close with reason |
| 3. Information request | Compliance | Within 1 working day | Standard due diligence wording; no mention of a report |
| 4. Decision | MLRO or deputy | US: well inside 30 days. UK and Canada: promptly. Australia: within 3 business days of suspicion | Decision to report or not, with reasons |
| 5. Filing | MLRO | Same day as the decision | Copy of the report, submission reference |
| 6. Held transfer | MLRO with adviser | Before any release | Release or refusal, and on what basis |
| 7. Retention | Compliance | Five years minimum in the US | Report, evidence, decision trail |
Useful habit: record decisions not to file as well. FinCEN's October 2025 FAQs say the BSA does not require it, but a recorded reason is what explains a closed alert to an examiner later.
Where SAR programmes usually fail
- Slow first review. A trigger left for days eats the filing window before the MLRO sees it.
- Boilerplate narratives. "Activity appeared unusual" gives the analyst at the intelligence unit nothing to act on.
- Accidental tipping off. A helpful support agent explaining why a transfer is held. Give support a fixed script.
- No decision trail. If you cannot show how a case went from trigger to decision, the filing is hard to defend.
- Stale training. Staff who know red flags from a slide but not from your own corridors.
Two recent rule points are worth knowing. FinCEN's October 2025 FAQs say a transaction near the $10,000 currency transaction report threshold does not by itself require a SAR, and that a separate review after each SAR to check whether activity continued is not required. In the UK, since 31 July 2025 the threshold in section 339A of the Proceeds of Crime Act 2002 is £3,000, below which a payment institution can carry out a transaction in operating a customer's account without first seeking a DAML; the duty to report is unchanged.
Sources
- 31 CFR 1022.320, Reports by money services businesses of suspicious transactions (threshold, 30-day deadline, five-year retention, confidentiality)
- FinCEN, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements (October 2025)
- National Crime Agency, Suspicious Activity Reports (UKFIU and the SAR Portal)
- The Proceeds of Crime (Money Laundering) (Threshold Amount) (Amendment) Order 2025
- Proceeds of Crime Act 2002, section 333A (tipping off) and section 342 (prejudicing an investigation)
- AUSTRAC, Suspicious matter reports (24 hours for terrorism financing; 3 business days otherwise)
- FINTRAC, Reporting suspicious transactions to FINTRAC (as soon as practicable; no monetary threshold)
Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.
Frequently asked questions
How long does a US money transmitter have to file a SAR?
No later than 30 calendar days after initial detection of facts that may be a basis for filing. The MSB rule, 31 CFR 1022.320, has no extension, and covers transactions involving or aggregating at least $2,000.
What are the deadlines in Australia and Canada?
AUSTRAC requires a suspicious matter report within 3 business days of forming the suspicion, or 24 hours if it relates to terrorism financing. FINTRAC requires a suspicious transaction report as soon as practicable, with no monetary threshold.
When does the clock start?
In the US, at initial detection, not when the investigation ends. In Australia, when the suspicion is formed. Either way, a slow first review uses up time you need later.
Can we ask the customer questions without tipping them off?
Yes, if you use the same due diligence wording you would use for any customer at that level. Never say or hint that a report is being considered.
Does RemitSo file the SAR for us?
No. RemitSo holds the risk triggers, evidence and decisions, and SARs are generated, managed and submitted from the console. Your MLRO forms the suspicion, writes the narrative and decides whether to report.
How long must SAR records be kept?
In the US, five years from filing for a money services business, including supporting documents. Check your own regulator's period if you operate elsewhere.