Suppressed Suspicious Activity Reports and Broken Escalations: When Suspicion Never Reaches Authorities

Bank failure to file suspicious activity reports can begin with a warning the bank’s own staff already raised. An investigator identifies the transactions, explains the concern and sends it upward. Management closes accounts but leaves the reporting undone, or limits the alerts to what the existing staff can handle. For the analyst who watched that happen, the question reaches beyond the customer’s money. It includes who saw the warning, who controlled the decision and what happened to the finding.

What Is the Threshold for SAR Reporting?

Banks generally must report conducted or attempted transactions involving at least $5,000 in aggregate when they know, suspect or have reason to suspect illicit funds, evasion of Bank Secrecy Act requirements, or specified unexplained activity. The suspicious activity report threshold for covered money services business activity is generally $2,000. Casinos and card clubs use the bank amount with qualifying suspicion.

The Financial Crimes Enforcement Network’s October 2025 reporting FAQ connects suspected cash-reporting evasion to the purpose and pattern of the transactions.

Cash-Reporting Evasion and Suspicious Activity

A currency transaction report records qualifying cash activity over $10,000, with applicable aggregation. A suspicious activity report describes activity meeting the relevant suspicion standard and threshold. An investigator examining payments broken into smaller amounts is examining the purpose and pattern of those payments, including whether they were designed to evade cash reporting.

What Are the Requirements for a Bank to File a Suspicious Activity Report?

A bank generally must file a suspicious activity report within 30 calendar days after detecting facts that support a report. If no suspect has been identified, the bank can take additional time to identify one, up to 60 days total from that detection.

For an analyst, the significant sequence is the detection, investigation, escalation, filing decision and completed report. The dates and decisions along that sequence explain where the warning stopped.

When Bank Managers Prevent Suspicious Activity Escalation

When bank managers prevent suspicious activity escalation, employee evidence can connect the original concern to the decision that stopped it. An investigator may know what was escalated. A monitoring engineer may know which transactions the system excluded. A manager may know why resources or exceptions were approved. Those roles see different parts of the same reporting failure.

In its consent order concerning UBS Financial Services, the Financial Crimes Enforcement Network required a review of whether second-level investigations actually addressed the concerns first-level reviewers raised. An escalation has to carry the actual concern into the next review.

The October 2025 FAQ allows institutions to rely on reasonably designed, risk-based controls to identify and report continuing suspicious activity. The question for a suppressed escalation is what the institution did with the activity it actually identified.

MoneyGram Kept the Agents Its Fraud Staff Wanted Gone

Under its deferred prosecution agreement, MoneyGram admitted aiding and abetting wire fraud and failing to maintain an effective anti-money laundering program. Its fraud staff recommended terminating agents, and managers rejected those recommendations. The Justice Department’s account of the criminal case described a failure inside the business: fraud and anti-money laundering information did not flow adequately, and MoneyGram did not file suspicious activity reports on agents known to be involved in fraud.

A remittance network connects the accepting agent, the transfer company, its banking arrangements, payout agents and the recipient. Information about the customer, payment and complaint can arrive through different parts of that network. The principal’s internal departments have to connect what the network already knows.

At MoneyGram, the detection had happened. Staff had identified agents they wanted removed. The institution retained the channel through which the scam proceeds moved while the reporting failure kept information from authorities. Scam victims paid for those decisions. For someone working in fraud operations, the rejected recommendation and the broken handoff to anti-money laundering staff belong in the same account of what happened.

When an AML Investigation Closure Rationale Contradicts Transaction Records

When an AML investigation closure rationale contradicts transaction records, the useful comparison is between the concern raised and the explanation used to close it. UBS Financial Services provides a concrete example of an institution closing alerts without resolving the monitoring gap they exposed.

In its civil consent order, the broker-dealer admitted that a manual report intended for commodities accounts sometimes captured foreign currency wires for other account types. Staff closed those alerts on the grounds that the report had generated them in error or that they fell outside the manual control’s scope. UBS did not confirm that another process properly monitored those wires.

The transactions had surfaced. The account category became the reason to stop looking at them. That is the distinction an employee who knows the systems can explain: why an alert appeared, what the reviewer dismissed and whether anyone followed the transaction into the process supposedly responsible for it.

The order also described a coding problem that systematically understated foreign currency wire values. Staff discovered that earlier reports were affected but took no immediate steps to escalate the issue or establish how many transactions had been missed.

Later, the firm’s model-performance reports identified no problems even though no group had responsibility for testing the full path from original wire data into the monitoring system. A reassuring report about the model left the missing data out of view.

Where a closure explanation exists, we examine it alongside the transactions, system coverage and escalation history.

U.S. Bank Capped Alerts and Stopped Testing

Alert limits tied to staffing, employee concerns left uninvestigated and testing abandoned after it finds missed suspicious activity are concrete red flags for AML transaction monitoring. U.S. Bancorp admitted those practices in the statement of facts accompanying its deferred prosecution agreement.

According to the Justice Department’s account of those admissions, U.S. Bank capped alerts according to staffing and resources. Testing of transactions below those limits repeatedly identified activity that warranted suspicious activity reports. Anti-money laundering employees requested more resources and lower thresholds. The bank stopped the testing instead. The test had found exactly what it was meant to find.

The bank also processed Western Union transfers for non-customers outside its monitoring systems. Even specific transactions flagged by employees went uninvestigated. The frontline warning and the automated system’s coverage were separate opportunities to catch the same problem. Both failed.

In another part of the admitted conduct, an investigator reviewed accounts used by a payday lending business and reported concerns about shell companies. U.S. Bank closed the accounts held in the names of purportedly tribal-owned companies but failed to file a suspicious activity report. It left the customer’s other accounts open and opened new ones. The account closures gave the institution an action it could point to while the customer continued using the bank.

What Consequences May a Bank Face for Failing to File a Required Suspicious Activity Report?

Civil enforcement can require payment and correction of reporting failures. In U.S. Bank’s case, the Financial Crimes Enforcement Network’s agreement required $70 million for civil Bank Secrecy Act violations, after the bank had limited monitoring to match its resources. The separate UBS order required an independent review of past foreign currency wire activity and filings for transactions identified as requiring reports. The institution’s response reaches back to the transactions its original process missed.

Binance Preserved Access While Reporting Failed

In its guilty plea, Binance admitted conduct that joined customer access, inadequate controls and missing suspicious activity reports. The exchange used email-only onboarding, retained U.S. business while publicly claiming to exclude it, coached valuable users to use offshore entities and failed to file suspicious activity reports. The Justice Department’s announcement of the guilty plea describes the admitted reporting failures.

Binance admitted in the plea that it announced mandatory customer verification in August 2021, but unverified trading continued until May 2022. The announcement and the actual access controls told different stories. The Justice Department reported that Binance admitted prioritizing growth and profits over compliance with U.S. law.

For an exchange insider, the customer account and internal ledger can add facts that a public blockchain transfer cannot supply on its own. They can connect movement of funds to the customer credited inside the exchange. Screening decisions and escalation histories add what the business knew and how it responded. Binance’s case makes those internal choices central to the reporting failure.

A Filed SAR Can Still Leave the Story Out

A report can reach the Financial Crimes Enforcement Network while omitting the information that makes the activity intelligible. Its guidance on complete suspicious activity report narratives identifies who, what, when, where, why and how as the essential account. It connects the source and use of funds, accounts, locations, transaction dates and the reasons the activity was unusual for the customer. The guidance explains why individual transaction dates and amounts matter: a single total obscures the movement of funds.

The UBS order shows the consequence. UBS filed reports about a customer’s wire activity that left out a purported Mexican fruit and vegetable business involved in the transfers. The agency found that the beneficiary actually served as a vehicle for political campaign financing, and that omitting the purported farm limited the reports’ usefulness to law enforcement.

In another example, delayed investigation left UBS unable to identify the originator of an incoming wire. The eventual report was both late and incomplete. Quality review has to reach the facts carried into the report, as well as whether a filing occurred.

SAR Filing Totals Do Not Measure Reporting Quality

Annual suspicious activity report filings reached 3.6 million in 2022, up from 1.7 million in 2014, according to Anti-Money Laundering: Opportunities for Improvement, a 2024 white paper from the Wharton Initiative on Financial Policy and Regulation. The paper explains why a rising total leaves an important question unanswered:

The paper also describes government survey findings that investigators use Bank Secrecy Act reports to start and assist investigations. It locates a basic strength of the system in the different information and expertise held by private institutions and public authorities.

That makes the internal handoff consequential. The analyst knows the account history. The institution controls what reaches the government. Our question is whether the warning survived that journey with its meaning intact. An annual filing total cannot answer it.

Confidentiality and the Whistleblower Case

Banks generally must retain suspicious activity reports and their supporting records for five years from filing. SAR confidentiality and the treatment of underlying transaction records are issues we work through with you and anti-money laundering whistleblower counsel.

FinCEN’s whistleblower program covers qualifying Bank Secrecy Act violations and provides qualifying whistleblowers collectively 10% to 30% of eligible collections from covered actions exceeding $1 million. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We assess the conduct and the appropriate whistleblower program with you.

When You Know Where the Warning Stopped

If your investigation reached a manager and the concern disappeared without an answer, speak with our whistleblower experts about the decision that stopped it. We turn your firsthand knowledge of the transactions, internal choices and reporting failures into your strongest anti-money laundering whistleblower case. We stay beside you throughout the process and bring in anti-money laundering whistleblower lawyers who know institutional reporting failures.