What Is Suspicious Activity in Banking? Red Flags Explained

Suspicious activity in banking is a term of art — it does not mean any unusual transaction, and it does not require certainty that a crime has occurred. Understanding precisely what "suspicious activity" means in the BSA compliance context is essential for building an effective detection and reporting program.

The Legal Definition

Under the Bank Secrecy Act, covered financial institutions must file SAR filing obligations arise when they know, suspect, or have reason to suspect that a transaction involves funds derived from illegal activity, is designed to evade BSA reporting requirements, has no apparent lawful purpose and cannot be reasonably explained, or involves use of the institution to facilitate criminal activity.

The legal standard is suspicion — reasonable grounds to suspect — not certainty. You do not need to know that a crime occurred. You need a documented, reasonable basis to suspect it might have.

What Makes Activity Suspicious

Activity becomes suspicious when it is inconsistent with what you know about the customer and their legitimate financial behavior, when it cannot be explained by any plausible legitimate purpose after investigation, or when it matches known typologies for money laundering, fraud, structuring, or other financial crime.

Suspicious activity is typically identified through three channels: automated transaction monitoring alerts, manual referrals from compliance or customer-facing staff, and law enforcement requests or information.

Common Categories of Suspicious Activity

Structuring — deliberately conducting transactions in amounts specifically designed to avoid regulatory reporting thresholds. A customer who consistently makes cash deposits of $9,700 when they know the $10,000 CTR threshold applies is structuring — and structuring is itself a federal crime regardless of whether the underlying funds are legitimate.

Layering — rapidly moving funds through multiple accounts or institutions to obscure their origin. Rapid round-trips — funds arriving and departing in the same short period — are a classic layering indicator.

Placement activity — introducing illegally obtained cash into the financial system, often through deposits structured to avoid CTR requirements.

Trade-based money laundering — using commercial transactions, typically involving over- or under-invoicing of goods, to move value across borders.

Fraud-related activity — use of the account for check fraud, wire fraud, account takeover, or synthetic identity schemes. For a comprehensive overview of AML red flags by category, see our dedicated guide.

The Difference Between Unusual and Suspicious

Not every unusual transaction is suspicious. A customer who normally makes three small transfers per month and suddenly makes one large transfer may be making a legitimate down payment on a home — unusual but explainable. A customer who suddenly begins making dozens of small transfers to unrelated recipients in rapid succession, after years of low-volume personal use, is displaying a pattern that warrants investigation.

The investigation step — reviewing unusual activity in context and attempting to identify a legitimate explanation — is what converts unusual activity into suspicious activity requiring reporting.

Frequently Asked Questions

Must every flagged transaction be investigated before filing a SAR?

Yes. The BSA requires that a SAR be filed when an institution knows, suspects, or has reason to suspect suspicious activity — implying that a judgment has been made. That judgment requires investigation. Filing SARs automatically for every flagged transaction without investigation is not appropriate and produces low-quality filings.

How ComplyOne Helps

ComplyOne helps fintechs build programs that correctly identify suspicious activity, investigate it appropriately, and file SARs accurately and on time — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.