PREPARATION GUIDELINES FOR
SUSPICIOUS ACTIVITY REPORT FORM (SAR)
July 2003 (Revised 11/28/06)
This guidance is provided to assist financial institutions in preparing the revised Suspicious
Activity Report (SAR), effective July 2003 and supercedes guidance previously provided in June
Dates - Whenever dates are requested, they should be entered using the format “mm/dd/yyyy,”
where “mm” is the month, “dd” is the day, and “yyyy” is the year. Zero (0) should precede any
single digit number. If the month or day is not available or unknown, enter zeros in the space for
“mm” and “dd.” For example, 01/00/2003 indicates an unknown day in January 2003.
Numbers - Wherever information about monetary amounts is requested, the amounts should be
entered using the format “$0,000,000”. (Round UP, to the nearest whole dollar.) All amounts
should be reported in US Dollars (USD). (Revised 11/27/06)
Item 1 - Corrects Prior Report - If you are correcting a previously filed report, check the box at
the top of the report (line 1). Complete the report in its entirety and include the corrected
information in the applicable boxes. Then describe the changes that are being made in Part V,
(Suspicious Activity Information Explanation/Description), line k.
PART I -- REPORTING FINANCIAL INSTITUTION INFORMATION
Item 2 - Name of Financial Institution - You should enter the full legal [Trade] name of the
financial institution (FI).
Item 3 - EIN - Enter the FI’s nine digit Employer Identification Number without any alpha
characters or other substitutes.
Item 4 - Address of Financial Institution - Enter the street address of the FI shown in
Item 2. A Post Office (P.O.) Box number should be used only if there is no street address.
Item 5 - Primary Federal Regulator - Box a, b, c, d or e must always be marked to reflect the
reporting financial institution’s primary federal regulator.
Item 6 - City - Enter the city where the FI is located.
Item 7 - State - Use the U.S. Postal Service’s two letter state abbreviation.
Item 8 - Zip Code - Enter the zip code that corresponds with the address shown in Items 6 and 7.
The first five digits are mandatory beginning from the left. If the last four digits are known,
Item 9 - Address of Branch Office(s) where activity occurred - If the location of the suspicious
activity is different from that provided in Item 4, enter the street address of the branch or office
where the activity occurred. A P.O. Box number may be used only if there is no street address.
Otherwise, leave Item 9 blank. If the suspicious activity occurred at more than one branch,
check the box indicating multiple branches, and include this information in Part V, Suspicious
Activity Information Explanation/Description.
Item 10 - City - Enter the city where the branch shown in Item 9 is located.
Item 11 - State - Use the U.S. Postal Service’s two letter state abbreviation.
Item 12 - Zip Code - Enter the zip code that corresponds with the address shown in Item 9. The
first five digits are mandatory beginning from the left. If the last four digits are known, please
Item 13 - Date Closed - If the FI has closed, enter the date of closure by using the method for
entering dates described at the beginning of these Guidelines. [mm/dd/yyyy]
Item 14 - Account Number(s) affected - Enter the numbers of any account(s) that were affected
by the suspicious activity. If more than four accounts are affected, provide the additional
account numbers in Part V. If no account is affected, leave Item 14 blank. For each account
listed indicate by checking the appropriate box whether the account is still open or has been
PART II -- SUSPECT INFORMATION
If no information about the Suspect is available, check the box “Suspect Information
Unavailable”. This will alert the law enforcement and regulatory users of the SAR
database that this information has not been inadvertently omitted.
Items 15, 16 and 17 - Name of Individual or Entity - If the suspicious activity involves an
individual, enter his or her last name in Item 15, first name in Item 16 and middle initial in Item
17. If there is no middle initial, leave Item 17 blank. If an organization (entity) is involved in
the suspicious activity, enter its name in Item 15 and leave Items 16 and 17 blank. If the FI has
knowledge of a separate “doing business as” name, enter the individual or organization’s name
in Part V, the Narrative, followed by the phrase “DBA.” and the name of the business. (Revised
For example, John R. Smith DBA Smith Auto Sales or Johnson Enterprises DBA PJ’s Pizzeria.
If more than one Part II is necessary, attach additional copies of page 1 to report the additional
suspects. If both formal and alias names are established, enter the full legal name in Items 15, 16
and 17 and the alias name(s) in Part V.
Item 18 - Address - Enter the permanent street address to include any apartment or suite
numbers of the person identified in Items 15, 16 and 17. A Post Office Box should only be used
if there is no street address. If the individual or organization is from a foreign country, enter the
foreign country address.
Item 19 - SSN, EIN or TIN - If an individual is shown in Items 15-17, enter his or her Social
Security Number (SSN) or Taxpayer Identification Number (TIN). If an organization is shown,
enter its Employer Identification Number (EIN).
Items 20, 21 and 22 - City, State, Zip Code - Enter the city in which the person shown in Items
15, 16 and 17 resides or in which the organization is located. Enter the state or territory in Item
21 and the Zip code in Item 22. The first five digits are mandatory beginning from the left. If the
last four digits are known, please include. If the address is from a foreign country, provide the
street address, city, province, or state and postal code (if known).
Item 23 - Country – (Other than U.S.) Enter the two digit country code that corresponds to the
information in Items 20, 21 and 22. (Revised 11/28/06)
Item 24 - Telephone Number - Enter the home telephone number, including the area code for the
individual entered in Items 15 - 17.
Item 25 - Telephone Number - Enter the business telephone number, including area code of the
individual or organization entered in Items 15 - 17.
Item 26 - Occupation/Type of Business - Fully identify the occupation, profession or business of
the person on whose behalf the transaction(s) was conducted. For example, secretary, shoe
salesman, carpenter, attorney, housewife, restaurant owner, liquor store clerk, etc. Do not use
non-specific terms such as merchant, self-employed, businessman, etc.
Item 27 - Date of Birth - If an individual is named in Items 15 - 17, enter his or her date
of birth by using the method for entering dates described at the beginning of these Guidelines.
Item 28 - Admission/Confession - If the suspect made an admission or confession, check box a.
If not, check box b.
Item 29 - Forms of Identification for Suspect - Check appropriate box for the form of
identification provided by the suspect and use the lines provided to give specific data such as
driver’s license or passport number and issuing authority.
For box d, “other,” provide a brief explanation in the space provided. If more space is required,
enter the information in Part V.
Item 30 - Relationship to Financial Institution - Check each box that identifies the suspect
relationship with the FI. More than one box may be checked. If the “other” box is checked,
provide a brief explanation on the adjacent blank space. If more space is required, enter the
information in Part V.
Item 31 - Is the relationship an insider relationship? – If the suspect is an insider relationship,
check box a., otherwise, check box b. If the relationship is an insider relationship indicate if the
suspect is still employed, suspended, terminated or has resigned by checking box c, d, e or f.
Item 32 – Date of Suspension, Termination, Resignation - Enter the date the suspect was
suspended, terminated or resigned by using the method for entering dates described at the
beginning of these Guidelines. [mm/dd/yyyy]
PART III -- SUSPICIOUS ACTIVITY INFORMATION
Item 33 - Date or date range of suspicious activity - Enter the first known date of suspicious
activity and the last date of related suspicious activity. If only one date applies, include this date
in the From field using the instructions at the beginning of these Guidelines. If multiple or
related activity is conducted by the individual during the reporting period, the FI may report all
activity on one SAR. Enter the date of the initial activity in the From field and the last
occurrence date in the To field. (The first known date is a mandatory field.) [mm/dd/yyyy]
Item 34 - Dollar amount involved - Enter the dollar amount involved in the suspicious activity.
If less than a full dollar is involved, round it to the next highest dollar.
An aggregated total of all transactions for multiple or related suspicious activities by the same
individual or organization within the same reporting period may be shown in this field. The
break- out of this total may then be listed in Part V.
Item 35 - Summary characterization of suspicious activity - Check all box(es) which identify the
suspicious activity. More than one box may be checked. If “other” is checked, enter a brief
explanation in the space provided. Do not use this space in lieu of a full description of the
activity in Part V, Suspicious Activity Information Explanation/Description. (This is a
Item 36 - Amount of loss prior to recovery - If the Financial Institution has lost funds or assets,
enter the dollar value prior to any recovery.
Item 37 - Dollar amount of recovery - If funds or assets are recovered by the FI, enter
the dollar value of the recovery. Use whole dollars only, rounding up to the next
Item 38 - Has the suspicious activity had a material impact on or otherwise affected the financial
soundness of the institution? - Check box a or box b, as appropriate.
Item 39 - Has the institution’s bonding company been notified? - Check box a. or b. as
Items 40, 41, 42, 43, 44 – If the violation requires immediate attention contact appropriate law
enforcement agencies. Check appropriate box(es) to indicate which law enforcement agencies
have been advised by telephone, written communication or otherwise. List the name of the
person(s) contacted, and telephone number(s) in Items 41-44. CONTACT WITH LAW
ENFORCEMENT AGENCIES DOES NOT ELIMINATE THE REQUIREMENT TO
FILE THE SAR.
PART IV – CONTACT FOR ASSISTANCE
Items 45, 46, and 47 - Contact Person’s Name - Enter the name of the person who can be
contacted for additional information. It would be extremely helpful if the individual identified in
this section has specific knowledge of the underlying facts.
Item 48 - Title/Occupation - Enter the contact person’s title or occupation.
Item 49 - Phone Number - Enter a phone number, including area code, where the contact person
can be reached.
Item 50 – Date Prepared - Enter the date the SAR was prepared in the format described at the
beginning of this Guidance. [mm/dd/yyyy]
Item 51 - Agency - If the SAR is not being filed by the financial institution, enter the name of
the government agency or organization.
PART V -- SUSPICIOUS ACTIVITY INFORMATION EXPLANATION/DESCRIPTION
As stated in Part V of the SAR, this section of the report is critical. The care with which it is
written may determine whether or not the described conduct and its possible criminal nature are
clearly understood. Provide a complete chronological account of what is unusual, irregular or
suspicious about the transaction. The narrative should include the material indicated in Part V
but you should also include any other information that you believe is necessary to better enable
investigators to understand the transaction you are reporting. If necessary, continue the narrative
on a copy of this page of the SAR. Remember that any supporting documentation such as
spreadsheets, photocopies of canceled checks or other documents, surveillance photos, etc.,
must be retained at the financial institution. Indicate in Part V what documentation is being retained.
These FinCEN Guidelines can be found at the following link: http://www.fincen.gov/forms/files/sarguidelinesv4.pdf