Not all unusual activity is suspicious — and the distinction matters legally. This guide explains the difference, how to document your decisions, and when you're required to file a SAR.
Unusual Activity vs Suspicious Activity — What Fintechs Need to Know
One of the most common questions compliance teams at fintechs face: Is this transaction unusual, or is it suspicious?
The distinction matters more than most people realize. Unusual activity triggers a closer look. Suspicious activity may trigger a legal obligation to file a Suspicious Activity Report (SAR). Getting this wrong — in either direction — creates regulatory risk.
What Is Unusual Activity?
Unusual activity is any transaction or customer behavior that deviates from what you'd normally expect — either from that specific customer's established pattern, or from the general profile of similar customers.
Examples of unusual activity: a customer who normally deposits $500 per week suddenly deposits $15,000; a business account receiving wire transfers from 12 different countries in a week; a customer who hasn't used their account in a year suddenly initiates a large ACH transfer; multiple small deposits across different branches on the same day.
Unusual activity is not automatically illegal, and it is not automatically reportable. Many unusual transactions have completely legitimate explanations — a bonus payment, an inheritance, a business expansion.
What Is Suspicious Activity?
Suspicious activity is activity that, after review, gives you reason to believe that a transaction may involve the proceeds of a crime, may be designed to evade BSA reporting requirements, lacks a lawful purpose, or is otherwise suspicious based on the circumstances.
Under the Bank Secrecy Act, financial institutions are required to file a SAR when they know, suspect, or have reason to suspect that a transaction meets the reporting threshold and involves funds from criminal activity, an attempt to evade BSA requirements (such as structuring), a lack of any apparent lawful purpose, or use of the institution to facilitate criminal activity.
The key word is "reason to suspect." You don't need certainty — you need reasonable suspicion based on the facts available.
The Critical Difference
The pathway from unusual to suspicious runs through investigation. When you identify unusual activity, you investigate. If that investigation uncovers a legitimate explanation, the activity remains unusual — no SAR required. If the investigation cannot resolve the suspicion, the activity becomes suspicious — and SAR filing may be required.
The "No Action" Trap
One of the most common compliance mistakes is identifying unusual activity and taking no action — no investigation, no documentation, no decision.
This is dangerous for two reasons. First, if the activity later turns out to be criminal, regulators will look at whether you had an obligation to investigate and file a SAR. If your transaction monitoring flagged the activity but your team ignored it, that's a significant compliance failure. Second, even when you investigate and decide not to file, you must document your reasoning.
Documenting Your Decisions
Whether you file a SAR or not, every flagged unusual activity should be documented with: what triggered the review, what the review consisted of, what the customer's profile and history showed, the conclusion reached with the reasoning, and who made the decision and when.
The Five W's Framework
The FFIEC BSA/AML Examination Manual recommends using a "five W's" framework when evaluating potentially suspicious activity: Who is conducting the transaction? What is the nature of the transaction? When is the transaction occurring? Where is the money going or coming from? Why does the transaction appear unusual?
Frequently Asked Questions
Do I have to investigate every unusual transaction?
Not every single deviation requires a full investigation, but your transaction monitoring system should flag transactions that meet certain risk thresholds, and those flags should be investigated.
Can I contact the customer to ask about a suspicious transaction?
You can contact a customer to resolve an alert in many cases, but you cannot tip them off that you've filed or are considering filing a SAR. The tipping-off prohibition is strict.
Is there a deadline to file a SAR?
Yes. SARs must be filed within 30 calendar days of when the suspicious activity is detected (or 60 days if no suspect can be identified).
What if I'm not sure whether to file?
When in doubt, file. The safe harbor protects you for good-faith filings. Failing to file when you should have is far more consequential than filing when you didn't have to.
This article is for educational purposes only and does not constitute legal or compliance advice. Regulations vary by jurisdiction and change frequently. Consult a qualified compliance professional or legal counsel for guidance specific to your business.
