A Suspicious Transaction Report (STR) is a formal report filed when a bank, payment firm, broker, insurer, or other regulated entity sees activity that may involve money laundering, terrorist financing, fraud, sanctions evasion, or another financial crime. It is a cornerstone of anti-money laundering and counter-terrorist financing controls, but it is often misunderstood: an STR is not proof of crime, not a public accusation, and usually not something the customer is told about. This tutorial explains the term from basics to professional practice, including process, regulation, red flags, use cases, and common mistakes.

1. Term Overview

• Official Term: Suspicious Transaction Report
• Common Synonyms: STR; suspicious activity report (SAR) in some jurisdictions; suspicious matter report in some regulatory systems
• Alternate Spellings / Variants: Suspicious-Transaction-Report
• Domain / Subdomain: Finance / Banking, Treasury, and Payments
• One-line definition: A Suspicious Transaction Report is a formal report submitted by a regulated entity when a transaction or activity appears suspicious enough to suggest possible financial crime.
• Plain-English definition: If a bank or payment company sees money moving in a way that does not make sense and may be linked to illegal activity, it may send an STR to the appropriate authority.
• Why this term matters:
  STRs help financial systems detect and disrupt:
• money laundering
• terrorist financing
• fraud and mule account activity
• sanctions evasion
• corruption and bribery
• tax crime and other predicate offenses, where applicable

Important: An STR is based on suspicion, not certainty. The filing entity does not need to prove a crime before reporting.

2. Core Meaning

At its core, a Suspicious Transaction Report exists because financial institutions sit at key points where money enters, moves through, and exits the financial system. Criminals also need these same channels. That creates a basic problem: legitimate and illegitimate funds can look similar unless institutions actively review behavior, context, and patterns.

What it is

An STR is a formal escalation from internal suspicion to external reporting. It tells the relevant authority, usually a Financial Intelligence Unit (FIU) or equivalent body, that a transaction, attempted transaction, or pattern of behavior may be suspicious.

Why it exists

It exists to make the financial system less usable for criminal activity. Without suspicious transaction reporting:

• illicit funds could move more freely
• criminal networks could hide behind normal banking behavior
• regulators and law enforcement would lose a major source of financial intelligence
• institutions would miss an important control against abuse of their products

What problem it solves

It addresses the gap between:

• unusual activity and
• activity that may indicate financial crime

Many transactions are unusual but innocent. The STR framework creates a structured way to review facts, form a reasonable suspicion, and report the matter.

Who uses it

STRs are used by regulated entities such as:

• banks
• payment companies
• money service businesses
• broker-dealers and securities firms
• insurers in some jurisdictions
• fintechs and digital asset service providers in some regimes
• designated professionals where AML laws apply

Where it appears in practice

In day-to-day operations, STRs appear in:

• transaction monitoring teams
• AML investigations units
• branch escalation procedures
• payments screening workflows
• correspondent banking reviews
• trade finance controls
• compliance case management systems
• regulatory examinations and audits

3. Detailed Definition

Formal definition

A Suspicious Transaction Report is a report made by a regulated entity to the competent authority when it knows, suspects, or has reasonable grounds to suspect that funds, transactions, attempted transactions, or related activities may be connected to money laundering, terrorist financing, fraud, sanctions evasion, or other financial crime under applicable law.

Technical definition

Technically, an STR is an AML/CFT reporting output produced after:

1. detection of unusual or risk-indicating behavior,
2. internal investigation,
3. documented suspicion assessment, and
4. a decision to report to an FIU or equivalent authority.

It is part of the broader control environment that includes:

• customer due diligence (CDD)
• enhanced due diligence (EDD)
• sanctions screening
• transaction monitoring
• case investigation
• recordkeeping
• governance and audit

Operational definition

Operationally, an STR is:

• not the alert itself,
• not just a red flag,
• not a customer complaint,
• not a fraud loss report,
• but the formal external report filed after review.

In practice, an institution may go through this sequence:

1. transaction monitoring alert appears
2. analyst reviews account history
3. supporting documents or explanations are checked
4. suspicion remains or strengthens
5. case is approved for reporting
6. STR is filed
7. account is monitored further, restricted, or exited depending on policy and law

Context-specific definitions

In banking and payments

An STR usually refers to a report about suspicious fund movement, customer behavior, account usage, payment routing, structuring, pass-through activity, or unexplained transactions.

In treasury and correspondent banking

The concern often involves:

• nested relationships
• high-risk corridors
• unusual liquidity flows
• shell company structures
• trade-based laundering indicators
• unusual wire transfer behavior

In securities and brokerage

The same AML concept applies, but the suspicious behavior may involve:

• liquidations followed by fast transfers
• movement between brokerage and bank accounts
• unusual funding and withdrawal patterns
• apparent layering through market activity

In insurance

The suspicious behavior may involve:

• large premium payments inconsistent with profile
• early policy surrender
• third-party funding
• use of insurance products as value-transfer tools

Across geographies

The concept is global, but terminology varies:

• STR is common in many countries.
• SAR is more common in the United States and the United Kingdom.
• Some securities professionals may confuse this with STOR (Suspicious Transaction and Order Report), which relates to market abuse rather than AML. They are not the same.

4. Etymology / Origin / Historical Background

The term comes from two ideas:

• suspicious transaction: a financial event that appears potentially illicit
• report: a formal communication to an authority

Origin of the term

The idea emerged from anti-money laundering regulation as governments recognized that banks and financial intermediaries were in a position to detect abnormal movement of funds.

Historical development

Early financial crime controls focused heavily on recordkeeping and cash reporting. Over time, regulators realized that criminals could avoid simple cash thresholds by structuring, layering, using intermediaries, or moving funds electronically. This led to the broader concept of reporting transactions based on suspicion, not just size.

How usage changed over time

Usage evolved in several ways:

• from cash-only concerns to all transaction types
• from domestic banking to cross-border networks
• from manual review to automated monitoring
• from money laundering only to wider AML/CFT concerns
• from isolated reporting to integrated case management, analytics, and typology-based monitoring

Important milestones

Key global developments include:

• the rise of AML frameworks in the late 20th century
• creation and expansion of Financial Intelligence Units
• FATF recommendations shaping international standards
• post-9/11 expansion of focus to terrorist financing
• growth of digital payments, fintech, and crypto-related monitoring
• stronger beneficial ownership, sanctions, and cross-border information-sharing frameworks

5. Conceptual Breakdown

5.1 Trigger or basis of suspicion

• Meaning: The event, pattern, or fact that causes concern.
• Role: Starts the review process.
• Interactions: Often comes from monitoring rules, employee escalation, sanctions hits, adverse media, or customer behavior.
• Practical importance: Weak triggers miss criminal activity; overly broad triggers create false positives.

Examples: – repeated cash deposits just below reporting thresholds – multiple incoming transfers followed by immediate withdrawals – activity inconsistent with customer profile – unexplained third-party payments

5.2 Customer profile and expected behavior

• Meaning: The “normal” baseline for the customer.
• Role: Helps determine whether activity is unusual or suspicious.
• Interactions: Built from KYC, occupation, geography, business model, expected turnover, and source of funds.
• Practical importance: The same transaction may be normal for one customer and suspicious for another.

Example: – daily cash deposits may be normal for a restaurant – the same pattern may be suspicious for a salaried employee with no cash-based business

5.3 Transaction details

• Meaning: The actual movement of funds or value.
• Role: Provides the factual basis for analysis.
• Interactions: Includes amount, frequency, counterparty, channel, geography, timing, and purpose.
• Practical importance: Good STRs describe not just the transaction, but the pattern and why it matters.

5.4 Investigation and evidence gathering

• Meaning: Internal review to determine whether suspicion is reasonable.
• Role: Separates routine anomalies from reportable concerns.
• Interactions: May involve account history, linked parties, prior alerts, device/IP data in fintech, trade documents, customer explanations, and external intelligence.
• Practical importance: Poor investigation leads to weak or defensive filing.

5.5 Narrative and rationale

• Meaning: The written explanation of why the institution is suspicious.
• Role: Makes the STR useful to FIUs and law enforcement.
• Interactions: Connects facts, timeline, parties, and red flags into a coherent story.
• Practical importance: A low-quality narrative can make a valid STR much less useful.

A strong narrative answers: – what happened – who was involved – why it is suspicious – what the institution did – what pattern or typology it resembles

5.6 Reporting destination

• Meaning: The authority that receives the report.
• Role: Ensures suspicious matters reach the official intelligence or enforcement channel.
• Interactions: Usually an FIU, sometimes through jurisdiction-specific portals.
• Practical importance: Filing to the wrong channel or in the wrong format can create compliance failures.

5.7 Confidentiality and tipping-off restrictions

• Meaning: Institutions usually cannot tell the customer that an STR has been filed.
• Role: Protects investigations and prevents evasion.
• Interactions: Affects front-line staff, relationship managers, and customer communication.
• Practical importance: Mishandling communication can create legal and regulatory exposure.

Caution: If a customer asks why an account is under review, staff should follow approved scripts and internal escalation procedures. They should not speculate or disclose STR activity.

5.8 Post-filing actions

• Meaning: What happens after the STR is filed.
• Role: Maintains ongoing control.
• Interactions: May include monitoring, restrictions, account closure, enhanced review, or supplemental reporting, depending on law and risk.
• Practical importance: Filing an STR does not end the institution’s responsibilities.

6. Related Terms and Distinctions

Related Term	Relationship to Main Term	Key Difference	Common Confusion
Suspicious Activity Report (SAR)	Often the functional equivalent of an STR in some jurisdictions	SAR may cover broader “activity,” not just a transaction, and is the more common term in places like the US and UK	People assume STR and SAR are always legally identical everywhere
Currency Transaction Report (CTR) / Cash Transaction Report	Separate regulatory report	CTR is generally threshold-based; STR is suspicion-based	Many think large value automatically means STR
AML Alert	Upstream detection event	An alert is internal; an STR is the external formal report	People confuse alerts with filed reports
Customer Due Diligence (CDD)	Foundational control that supports STR decisions	CDD collects identity and profile data; STR reports suspicious behavior	Some think good CDD eliminates the need for STRs
Enhanced Due Diligence (EDD)	Deeper review for higher-risk customers	EDD is pre- or ongoing review; STR is event-driven reporting	EDD is not itself a suspicious transaction filing
Sanctions Screening Alert	Compliance alert related to sanctioned names or countries	A sanctions hit may or may not lead to an STR depending on facts and law	Teams sometimes treat sanctions screening and AML reporting as identical
Fraud Report	Internal or external fraud notification	Fraud reports focus on scam or loss issues; STRs focus on suspicious financial activity and AML/CFT implications	Not all fraud cases generate STRs, and not all STRs involve customer loss
Unusual Transaction Report / Internal Escalation Memo	Often an internal document in some firms	Internal escalation is not the statutory filing itself	Internal labels vary across institutions
Financial Intelligence Unit (FIU)	Usual recipient of STRs	The FIU receives and analyzes reports; it is not the report itself	Some learners use FIU and STR interchangeably
STOR (Suspicious Transaction and Order Report)	Different concept in securities market abuse regulation	STOR is about insider dealing or market manipulation concerns	“Suspicious transaction report” is sometimes confused with STOR in capital markets

7. Where It Is Used

Banking and payments

This is the primary environment for STR use. Banks, payment firms, remittance providers, and digital wallet platforms rely on STR processes to report suspicious fund movement.

Treasury and correspondent banking

STR concepts are very relevant in:

• correspondent banking
• cross-border wires
• nested payment relationships
• cash management services
• international trade payment flows

Securities and brokerage

Used where brokerage accounts, funding sources, withdrawals, or linked bank activity raise AML concerns.

Insurance

Relevant where insurance products can be misused for placement, layering, or value transfer.

Policy and regulation

STRs are central to:

• AML/CFT supervision
• FIU analysis
• national risk assessment
• law enforcement intelligence
• prudential expectations around governance and controls

Business operations

Operationally, STRs appear in:

• compliance teams
• monitoring systems
• investigations units
• branch escalation workflows
• management reporting
• internal audit reviews

Accounting

This term is not a core accounting measurement term. However, accountants and auditors in regulated entities may encounter STR-related controls, evidence trails, and governance reviews. In some jurisdictions, certain professional firms also have AML reporting obligations.

Stock market and investing

STRs are not a valuation ratio or market indicator. Their relevance to investors is indirect, such as when AML failures, enforcement actions, remediation costs, or governance concerns affect listed financial institutions.

Economics and research

Researchers and policymakers may use aggregated suspicious transaction data to study financial crime patterns, mule networks, trade-based laundering typologies, or regional risk trends. Individual STRs, however, are generally confidential.

8. Use Cases

8.1 Structured cash deposits at a retail bank

• Who is using it: Bank AML investigations team
• Objective: Detect possible structuring to avoid cash reporting thresholds
• How the term is applied: The bank sees multiple deposits just below a threshold over several days and investigates whether the customer is intentionally splitting cash
• Expected outcome: If suspicion remains after review, an STR is filed and the account may be monitored more closely
• Risks / limitations: Some cash-heavy businesses operate with irregular patterns; false positives are possible without profile context

8.2 Mule account detection in a payment fintech

• Who is using it: Fintech compliance and transaction monitoring team
• Objective: Identify accounts receiving many third-party transfers and rapidly cashing out
• How the term is applied: Alerts identify unusual velocity, linked devices, and pass-through behavior; investigators determine whether the account is being used as a mule
• Expected outcome: STR filing, account restrictions where permitted, and rule tuning
• Risks / limitations: Fast-growing legitimate gig-economy or reseller accounts may resemble mule patterns unless onboarding data is strong

8.3 Trade finance mismatch review

• Who is using it: Bank trade finance compliance unit
• Objective: Detect over-invoicing, under-invoicing, phantom shipments, or circular trade payments
• How the term is applied: The institution compares invoices, shipping documents, counterparties, and payment behavior
• Expected outcome: Suspicious cases are reported and escalated internally
• Risks / limitations: Trade finance is document-heavy and complex; proving suspicion requires care and expertise

8.4 Broker-dealer monitoring of unusual funding and withdrawals

• Who is using it: Brokerage AML team
• Objective: Identify accounts possibly being used to layer funds through securities activity
• How the term is applied: The firm reviews rapid in-and-out cash movements, unusual liquidations, and transfers inconsistent with investment behavior
• Expected outcome: STR or SAR equivalent filing, enhanced due diligence, or account review
• Risks / limitations: Active traders and institutional clients may have high-volume legitimate movement

8.5 Insurance policy misuse

• Who is using it: Insurer compliance unit
• Objective: Identify possible laundering via high-value premiums and early surrender
• How the term is applied: A customer funds a policy through third parties and seeks early payout despite penalty
• Expected outcome: Suspicion is documented and reported if warranted
• Risks / limitations: Wealth planning activity can look unusual without full context

8.6 Correspondent banking review

• Who is using it: International bank financial crime team
• Objective: Monitor risk in cross-border payment corridors and nested relationships
• How the term is applied: The bank detects unusual flows through respondent accounts, high-risk geography exposure, or opaque originator/beneficiary information
• Expected outcome: STR filing, relationship review, corridor restrictions, or exits from risky business
• Risks / limitations: Cross-border payments may lack complete data, creating both blind spots and false alarms

9. Real-World Scenarios

A. Beginner scenario

• Background: A student account suddenly receives many small transfers from unrelated people.
• Problem: The account holder says friends are “sending money,” but the pattern looks like collection activity.
• Application of the term: The bank reviews the account, sees rapid outgoing transfers and ATM withdrawals, and considers mule-account risk.
• Decision taken: The case is escalated, and an STR is filed because the behavior is inconsistent with the customer profile and lacks a credible explanation.
• Result: The institution increases monitoring and may restrict activity depending on policy.
• Lesson learned: Suspicion depends on context, not just on transaction size.

B. Business scenario

• Background: A payment processor onboards an online merchant claiming to sell low-cost accessories.
• Problem: The merchant suddenly processes large ticket values and sends funds to unrelated overseas beneficiaries.
• Application of the term: Compliance reviews onboarding data, payment flows, chargeback patterns, and beneficial ownership inconsistencies.
• Decision taken: The firm files an STR and freezes settlement where allowed by law and contract.
• Result: Further exposure is reduced, and onboarding controls are tightened.
• Lesson learned: Merchant acquiring risk and AML risk often overlap.

C. Investor / market scenario

• Background: A listed bank reports higher AML compliance costs and a spike in internal suspicious activity escalations.
• Problem: Investors wonder whether higher reporting means the bank is riskier or simply has stronger controls.
• Application of the term: Analysts distinguish between raw STR/SAR volume and control quality.
• Decision taken: The investor focuses on enforcement history, control remediation, governance, and loss trends rather than headline report counts alone.
• Result: The investor forms a more nuanced risk view.
• Lesson learned: More STRs do not automatically mean worse conduct; sometimes they mean better detection.

D. Policy / government / regulatory scenario

• Background: A national FIU observes a sharp rise in reports involving social-engineering scams and mule networks.
• Problem: Banks and fintechs are detecting cases inconsistently.
• Application of the term: The FIU analyzes aggregated STRs and issues typology guidance to reporting entities.
• Decision taken: Regulators ask firms to strengthen transaction monitoring rules and customer education.
• Result: Detection becomes more standardized across institutions.
• Lesson learned: STRs are not only compliance documents; they are policy intelligence inputs.

E. Advanced professional scenario

• Background: A correspondent bank detects repeated high-value cross-border transfers through several small companies with shared addresses and common directors.
• Problem: Each entity looks modest in isolation, but network analysis suggests layering and trade-based laundering.
• Application of the term: Investigators map counterparties, examine invoice values, review shipping inconsistencies, and compare flow patterns across accounts.
• Decision taken: The bank files multiple related STRs, escalates to senior compliance governance, and reviews whether to exit the respondent relationship.
• Result: The suspicious network is contained and the bank reduces exposure to opaque cross-border flows.
• Lesson learned: Advanced STR work often depends on link analysis, not single-account review.

10. Worked Examples

10.1 Simple conceptual example

A customer deposits cash three times in one week. Is that suspicious?

Not necessarily.

To decide, the institution asks:

• What is the customer’s occupation or business?
• Is cash activity normal for that customer?
• Are the deposits timed just below a reporting threshold?
• Are the funds then moved out quickly?
• Is the explanation credible and documented?

If the customer runs a convenience store, this may be normal. If the customer is a salaried office worker with no cash-based business and immediately wires the money away, suspicion increases.

10.2 Practical business example

A remittance company notices that one customer account:

• receives funds from 17 unrelated senders,
• sends money to two foreign beneficiaries within hours,
• shows device overlap with three already-restricted accounts.

The compliance team reviews:

1. onboarding data
2. linked accounts
3. source of funds
4. transaction timing
5. geographic risk

The customer cannot provide a coherent explanation. The institution documents the case and files an STR.

10.3 Numerical example

Assume a firm uses an illustrative internal alert score, not a legal formula:

• Customer risk score: 0 to 25
• Geography risk score: 0 to 20
• Product/channel risk score: 0 to 15
• Behavioral anomaly score: 0 to 30
• Adverse information score: 0 to 10

Internal escalation threshold: 60 points or more triggers mandatory case escalation for human review.

A new wallet customer has the following profile:

• Customer risk = 18
• Geography risk = 12
• Product/channel risk = 10
• Behavioral anomaly = 24
• Adverse information = 6

Step 1: Add the components

Risk Score = 18 + 12 + 10 + 24 + 6

Step 2: Calculate total

Risk Score = 70

Step 3: Compare to threshold

70 > 60, so the case must be escalated.

Now add a simple transaction velocity review:

• Expected monthly incoming volume based on onboarding = 40,000
• Actual incoming volume in first 10 days = 180,000

Velocity Ratio = Actual Volume / Expected Volume
Velocity Ratio = 180,000 / 40,000 = 4.5

Interpretation:

• risk score is high
• velocity is 4.5 times expected
• activity is inconsistent with profile

This does not automatically prove crime, but it strongly supports investigation and possible STR filing if suspicion remains after review.

10.4 Advanced example

A trade finance client imports low-value consumer goods. Suddenly the bank sees:

• invoices with values far above market norms
• repeated amendments to shipping terms
• payments routed through unrelated intermediaries
• beneficiary companies sharing directors with the importer

No single document proves wrongdoing. But taken together, the pattern suggests possible trade-based money laundering. The bank prepares a detailed narrative linking the document anomalies, ownership overlap, and payment routing, then files an STR.

11. Formula / Model / Methodology

There is no universal statutory formula for deciding whether to file a Suspicious Transaction Report. The legal standard is usually based on suspicion, reasonable grounds, or equivalent language under local law. However, institutions commonly use internal models and decision frameworks to triage cases.

11.1 Formula name: Illustrative STR Triage Risk Score

Formula:

Risk Score = C + G + P + B + A

Where:

• C = Customer risk score
• G = Geography risk score
• P = Product/channel risk score
• B = Behavioral anomaly score
• A = Adverse information score

11.2 Meaning of each variable

Variable	Meaning	Example considerations
C	Customer risk	occupation, ownership opacity, PEP exposure, expected activity
G	Geography risk	high-risk corridors, sanctioned regions, secrecy risks
P	Product/channel risk	cash-intensive product, remote onboarding, cross-border wallet, correspondent channel
B	Behavioral anomaly	velocity spikes, pass-through activity, structuring, dormancy break
A	Adverse information	negative news, law enforcement inquiry, linked suspicious accounts

11.3 Interpretation

A higher score means the case deserves greater scrutiny.

An example internal framework might be:

• 0 to 39: low priority review
• 40 to 59: analyst review required
• 60 and above: escalate for full AML investigation

Important: This is only an internal screening tool. It is not a legal substitute for judgment, facts, or narrative analysis.

11.4 Sample calculation

Suppose:

• C = 20
• G = 15
• P = 8
• B = 22
• A = 4

Then:

Risk Score = 20 + 15 + 8 + 22 + 4 = 69

Interpretation:

• The case exceeds the internal escalation threshold.
• Investigators should gather supporting facts.
• If suspicion remains after review, an STR may be filed.

11.5 Common mistakes

• treating the score as automatic proof of suspicion
• double-counting the same fact in multiple variables
• ignoring a legitimate explanation
• using stale customer profile data
• assuming low score means no risk
• failing to document why a high-score case was closed or reported

11.6 Limitations

• models can be biased by bad data
• thresholds vary by institution
• criminals adapt faster than static rules
• a mathematically high score may still be explainable
• a low score may still hide serious risk if the narrative is strong

11.7 Practical methodology when no formula applies

A strong STR decision method is often:

1. Detect unusual activity
2. Compare with customer profile
3. Investigate linked facts and explanations
4. Assess whether suspicion is reasonable
5. Document rationale clearly
6. Report if required
7. Monitor after filing

A useful memory line is:

Unusual + unexplained + risk indicators = possible STR case

12. Algorithms / Analytical Patterns / Decision Logic

12.1 Rules-based transaction monitoring

• What it is: Predefined scenarios such as structuring, rapid movement, or threshold proximity
• Why it matters: Easy to implement and auditable
• When to use it: Baseline AML monitoring programs
• Limitations: High false positives; criminals can adapt to known rules

12.2 Peer-group or expected-profile deviation analysis

• What it is: Compares customer behavior against expected activity or similar customer groups
• Why it matters: Detects behavior that is unusual for that customer type
• When to use it: Business accounts, merchant acquiring, consumer wallets
• Limitations: Weak onboarding data can distort the baseline

12.3 Velocity and flow analysis

• What it is: Measures speed and volume of incoming and outgoing funds
• Why it matters: Useful for pass-through activity, mule accounts, and layering
• When to use it: Payments, fintech, remittances, digital channels
• Limitations: Seasonal businesses or viral growth can look suspicious

12.4 Network and link analysis

• What it is: Maps shared addresses, directors, devices, beneficiaries, or counterparties
• Why it matters: Finds hidden relationships across multiple accounts
• When to use it: Correspondent banking, trade finance, mule rings, organized fraud
• Limitations: Data quality and entity resolution errors can mislead investigators

12.5 Anomaly detection and machine learning

• What it is: Statistical or AI models that flag behavior not seen in normal patterns
• Why it matters: Can surface risks not captured by static rules
• When to use it: Large-scale, data-rich environments
• Limitations: Explainability, bias, validation burden, regulator expectations

12.6 Adverse media and external intelligence matching

• What it is: Screening customers and linked entities against negative news or investigative signals
• Why it matters: Adds context beyond transaction data
• When to use it: Higher-risk onboarding and investigations
• Limitations: Name matching errors, stale articles, low-quality sources

12.7 Decision framework for filing

A common decision logic is:

1. Is the activity unusual?
2. Is it inconsistent with profile or business purpose?
3. Is there a credible explanation?
4. Are there one or more financial crime indicators?
5. Does suspicion remain after review?

If the answer to the last question is yes, the case moves toward STR filing under applicable law and internal governance.

13. Regulatory / Government / Policy Context

Suspicious transaction reporting is heavily shaped by AML/CFT regulation. Exact rules differ by jurisdiction, institution type, and regulator, so firms should verify current requirements directly with applicable laws, FIU guidance, and supervisory expectations.

13.1 Global principles

Globally, suspicious transaction reporting is a core AML/CFT expectation. Common features include:

• reporting to an FIU or equivalent body
• risk-based monitoring and investigation
• confidentiality of reports
• prohibition or restriction on tipping off
• record retention
• internal controls, training, and audit
• senior management and board governance expectations

13.2 Jurisdictional overview

Geography	Common term	Typical recipient	Core point	What to verify locally
International / FATF-aligned systems	STR or equivalent	FIU	Suspicion-based reporting is a global AML/CFT standard	filing timelines, scope, and reportable events
United States	SAR more commonly used	FinCEN	Equivalent functional concept; sector-specific rules apply	current thresholds, sector rules, deadlines, continuing report requirements
India	STR	FIU-IND	Suspicious transaction reporting is a key part of the PMLA framework	current reporting format, timelines, attempted transaction treatment, sector obligations
European Union	STR or local equivalent	National FIUs	AML directives set broad expectations; member-state implementation varies	local legal wording, portals, confidentiality rules
United Kingdom	SAR more commonly used	National Crime Agency	Similar suspicious reporting concept under UK law	consent/DAML-related issues, timing, reporting procedures

13.3 Central bank and prudential relevance

Central banks and prudential supervisors may not always receive