Crypto glossary
Suspicious activity report (SAR)
A suspicious activity report (SAR) is a confidential filing banks and crypto firms must send to financial intelligence units on possibly illicit activity.
When a regulated firm suspects that a transaction involves money laundering, terrorist financing, fraud or sanctions evasion, it must report it to the national financial intelligence unit. In the US, banks and money services businesses, including crypto exchanges, file SARs with FinCEN; in Spain, obliged entities send suspicious transaction reports to SEPBLAC; and under MiCA and EU AML rules, CASPs have the same duty in each member state. Firms must also keep the report confidential: tipping off the customer is generally illegal.
Triggers in crypto include deposits from high-risk addresses flagged by screening tools, rapid movement of funds with no clear purpose, structuring to avoid thresholds, inconsistent customer explanations and exposure to scams or darknet markets. Reports feed law enforcement investigations and can lead to asset freezes.
For users, the confidentiality rule explains why an exchange may restrict an account while refusing to say why. Firms often reach the conclusion that the relationship should end, and closure notices typically give no detail.
Example
An exchange notices that a new account receives deposits from dozens of unrelated wallets and immediately withdraws to a mixer. It files a report with the financial intelligence unit and freezes the account without telling the customer why.