SAR vs STR: what's the difference between them?
You've got a notification sitting on your desk. Your client's actions appear quite out of order. You do know you must file a report, but is it a SAR or an STR?
If you operate across several jurisdictions, then this quickly becomes confusing. Vendor glossaries offer conflicting definitions. A few even place countries under the wrong term.
The truth has two levels of complexity.
This article explains the difference between SAR and STR, what each report entails, why the terminology is split, how the UAE handles them separately, and how to decide which report to submit.
SAR vs STR: Key Takeaways |
|
|
|
|
|
|
What is the difference between a SAR and an STR?
The main difference between a SAR (Suspicious Activity Report) and an STR (Suspicious Transaction Report) lies in their scope and the specific trigger behind the report.
Choose an STR when your suspicion is directly related to a specific transaction.
On the other hand, a SAR is used when there simply isn't a transaction involved at all, like during your initial client assessment because of some unusual customer behaviour.
So the correct answer hinges on where you're making the report from.
What is a Suspicious Activity Report (SAR)?
A SAR is the name given in the United States and the United Kingdom for this core requirement. The designation reflects a broader area of focus: "suspicious activities" rather than only "transactions."
In the United States, SARs are filed with the Financial Crimes Enforcement Network (FinCEN) under the Bank Secrecy Act. Financial institutions have 30 calendar days to file from the date of initial detection. If no individual is suspected of committing a crime, the reporting deadline can be extended to up to 60 days.
All commercial banks must report transactions above $5,000, and money laundering businesses must report transactions above $2,000. No thresholds apply in cases suspected of terrorism financing.
Read more about: Bank risk assessment
What is a Suspicious Transaction Report (STR)?
STR (Suspicious Transaction Report) focuses narrowly on specific financial transactions that raise red flags (such as large, complex cross-border wire transfers or structured cash deposits below a threshold).
It is the standard term used across the EU, UK, UAE, Singapore, and most international FATF jurisdictions.
Why do some countries say SAR and others STR?
The difference between SAR and STR is historical rather than logical. As anti-money laundering frameworks were introduced in various countries, they chose different terminology, and this has been retained.
FATF and most FIUs: STR
FATF uses transaction-based language, and most countries follow its lead. Canada’s FINTRAC and India’s FIU-IND both use the term STR, even though several of our vendors’ glossaries describe them as SARs.
Always verify with your local FIU instead of looking at a glossary for details.
United States and United Kingdom: SAR
Although countries use different names, all based on the concept of ‘suspicious activities’, the requirement remains the same: notify the Financial Intelligence Unit (FIU), keep the matter confidential and refrain from informing the customer.
Other names for the same report (SMR, UTR)
In Australia, it has another name. Suspicious Matter Reports (SMRs) are filed with AUSTRAC.
Some jurisdictions also require reporting for transactions that don't raise suspicions of illicit activity but still need to be highlighted through Unusual Transaction Reports (UTRs).
Jurisdiction | Term used | Who receives it | Legal basis | Filing timing |
FATF standard | STR | National FIU | Recommendation 20 | Promptly |
UAE | STR and SAR | UAEFIU via goAML | Federal Decree-Law No. 10/2025; Cabinet Decision No. 134/2025 | Without any delay |
Saudi Arabia | STR | SAFIU | AML Law (Royal Decree M/20) | Per SAFIU guidance |
United States | SAR | FinCEN | Bank Secrecy Act | 30 days; 60 max |
United Kingdom | SAR | UKFIU (NCA) | POCA 2002; Terrorism Act 2000 | As soon as practicable |
European Union | STR | FIU of each member state | EU AML framework | Promptly |
Multi-Jurisdiction Compliance
Looking for advanced AML compliance software to ensure your business is fully compliant across regions? azakaw allows you to use regulator-specific templates or create your own rules and workflows.
Are SAR and STR different reports in the UAE?
Yes, the UAE is one jurisdiction that breaks from this general trend.
According to the CBUAE’s guidelines on suspicious transaction reporting, suspicious activities involving transactions should be reported as STRs, whereas suspicious activities involving non-transactions should be reported as SARs.
Both need to be submitted to the UAE FIU through goAML.
The applicable legal framework comprises Federal Decree- Law No. 10/2025 and Cabinet Decision No. 134/2025. Although some available guidelines still reference the previous 2018 legislation and the 2019 cabinet decision, confirm which one the source refers to.
In short, according to UAE guidelines, there is a difference between SAR and STR is based on whether a transaction took place.
STR: when the suspicion involves a transaction
If a transaction was carried out, or if you suspect an attempt was made, and you believe it could be linked to proceeds of crime or terrorist financing, report it as a STR (Suspicious Transaction Report).
Businesses regulated by the Central Bank of the UAE, ADGM Financial Services Regulatory Authority (FSRA), Dubai Financial Services Authority (DFSA), and financial businesses supervised by the Ministry of Economy must file STRs through the goAML platform.
SAR: when there is no transaction
When you suspect suspicious activity based on actions performed and no transaction is involved, submit a Suspicious Activity Report (SAR).
Factors indicating suspicious activity include negative information that emerges during customer onboarding, unusual behaviour during customer due diligence, or unfavourable screening results that raise concerns before establishing any business relationship.
Related content: How does transaction monitoring work?
What about attempted transactions?
This clears up a misunderstanding in some of our publication summaries.
The UAE’s federal definition of a suspicious transaction includes both completed and attempted transactions. Consequently, any attempted transaction falls under the definition of an STR and cannot be reported as a SAR just because it was unsuccessful.
If you are unsure about how to deal with a particular case, please refer to the UAE Financial Intelligence Unit’s guidance notes on goAML report types!
goAML offers several types of reports beyond these two. Based on your license category and activities, you may need to file:
Dealers in Precious Metals and Stones Reports (DPMSR) for cash or wire transfers exceeding AED 55,000.
Real Estate Activity Reports (REAR) for eligible property transactions.
High Risk Country Reports (HRC) whenever an individual or organisation interacts with countries identified as being at high risk.
Partial Name Match Reports (PNMR) in situations where a person's name is mentioned in a sanctions or terrorist financing list.
Funds Freeze Reports (FFR) and Additional Information Files (AIF) provide supplementary information to a previously submitted report.
These are transaction-based and event-driven reports. They are not based on any suspicion of money laundering activities, and they should not replace the submission of a Suspicious Transaction Report (STR) or Suspicious Activity Report (SAR) if there is suspicion of any financial crimes.
Read also: UAE AML regulations
Which term applies in the rest of the GCC?
Saudi Arabia uses STR reporting terms. Reports are submitted to the Saudi Arabian Financial Intelligence Unit (SAFIU), an entity governed by the State Security Presidency, with the Saudi Central Bank (SAMA) acting as the principal AML supervisory authority for banks and payment services providers.
However, do not assume the UAE's simple 2-report framework applies to Bahrain, Qatar, Oman and Kuwait. Each has its own Financial Intelligence Unit (FIU), its own reporting platform setup, and jargon.
Before submitting any reports in these countries, contact their respective local FIU/AML Supervisor to understand:
The local reporting terminology being used
The types of reports that can be generated via their reporting portal
Periodicity (cutoff cycle/multiple frequency)
When to use SAR or STR in UAE?
These illustrative scenarios show how the UAE approach works in practice. They are examples only, not enforcement cases, and a red flag is never proof of a crime.
A customer makes a transfer that deviates significantly from their pattern of financial dealings, without any compelling commercial reason: STR, as the transaction is involved.
Prospective client refuses to disclose details of the source of funds during the onboarding process and decides not to create any account: SAR, since no financial transaction occurred.
Fake identity documents are submitted at the account opening, which leads to account rejection.
Customer breaks down a payment into smaller amounts, each one less than the required reporting threshold, as transactions raise concerns of suspicious activity.
Negative media reports emerge regarding a recently identified beneficial owner during ongoing Customer Due Diligence review procedures, although no transaction activity related to the concerned media report exists; an SAR needs to be filed.
An attempt is made to carry out a transaction, but our system flags it due to suspicions: STRs for attempted transactions are included within the suspicious transaction category.
TIP: Learn what you need to know about Smurfing in money laundering
What do SARs and STRs have in common?
They have much more in common than they differ. Regardless of what your jurisdiction calls it, the underlying responsibilities are very similar.
Based on suspicion, without any minimum amount: the trigger is reasonable grounds to suspect, not the transaction amount
Submitted to the FIU and not to the Police or your Supervisor
Kept confidential: revealing to the customer or any other individual that a report has been filed is a criminal offence in many jurisdictions
Time-sensitive: whether the relevant standard is "without undue delay", "as soon as possible" or 30 days, failing to complete the task within the designated timeframe amounts to a breach of AML rules
Relevant documentation is to be maintained: details of the report filed, supporting evidence and documentation required to back up the findings
One key similarity is that the Money Laundering Reporting Officer (MLRO) or the compliance department handles both, not the employee who identified the issue.
No Effort Transaction Monitoring
Stay ahead of risks with an intelligent Transaction Monitoring System that detects, prevents, and resolves suspicious activity in real time.
How to decide which report to file
Here is an example of how the process works:
A transaction monitoring system alert triggers, or an employee flags a matter to the MLRO. Reporting to the MLRO constitutes a separate step from submitting any external filing.
The MLRO reviews the case, collects any additional required evidence, and decides whether there are reasonable grounds to suspect criminal activity. If no suspicious activity is detected, record all relevant details and the reasons for this conclusion.
Should there be reasonable reasons to suspect any money laundering activities, find out if any transaction was involved, undertaken or attempted. If yes, submit an STR (Suspicious Transaction Report). If the Suspicion raised is purely related to Behaviour and does not involve any financial transaction, submit a SAR (Suspicious Activity Report).
File the appropriate report type through goAML without any undue delay. Outside of the UAE, use the terminology employed by your local Financial Intelligence Unit (FIU).
Maintain copies of all reports filed, details of the investigation conducted and relevant supporting material. Continue to monitor the customer and maintain absolute confidentiality about the report filed.
The effectiveness of any report filed depends on the quality of the alert, the investigation conducted, and the documentation available to support the report. However, correctly identifying the report type can still improve an inadequate investigation.
AML tools come into play here. Azakaw offers KYC and KYB customer onboarding, AML screening, transaction monitoring and case management, with complete audit records for all actions taken, giving the MLRO the tools to make and defend first submissions.
Related content: How to report money laundering
Frequently asked questions
Is a SAR the same as an STR?
In many countries, yes. These two terms describe the same obligation under different names. However, in the UAE, they provide for two types of disclosures that can be made via GoAML; STRs relate to suspicious transactions, and SARs relate to circumstances where there are suspicions of illegal activities but no transaction exists.
Please check your jurisdiction's requirements to avoid confusion about the responses below.
Does FATF use SAR or STR?
FATF refers to STRs. Recommendation 20 is captioned "Reporting of suspicious transactions " and recommends prompt notification to the FIU when there are reasons to suspect proceeds of a criminal offence or any act of terrorist financing.
FATF provides guidelines, not laws, and each country incorporates them into its own legal system using the terminology it deems appropriate.
Is there a minimum amount for filing an STR or a SAR?
No. Both are based on suspicion, not thresholds. The UAE requires all suspicious transactions to be reported, regardless of the amount. SARs in the United States are subject to certain monetary thresholds for specific financial institutions; however, no thresholds apply when suspicion of terrorist financing exists.
Separate threshold-based reports such as CTRs involve a separate set of legal obligations.
What is the difference between a SAR and a CTR?
The Currency Transaction Report is based on thresholds and is filed automatically. In the United States, all banks must submit a CTR for cash transactions exceeding $10,000, regardless of suspicion. A Suspicious Activity Report (SAR) is based on suspicion and is not automatically filed. A single financial transaction can trigger both: a CTR for cross-border transactions and an SAR for suspicious activity.
Can you tell a customer that an STR or SAR has been filed?
Tipping off is strictly prohibited and is considered a crime in most jurisdictions, including the UAE, UK and US. This extends beyond the customer to all parties outside the approved internal control chain.
If a customer inquires directly about this matter, your company's policy should clearly state how to handle such requests without revealing any information.
What happens after an STR or SAR is filed?
The Financial Intelligence Unit (FIU) reviews the submitted reports along with other available information. It may seek additional details or distribute the information to enforcement agencies.
You will not receive any information about the outcome of the case. Your duty to monitor continues; you must update the customer's risk score and submit further reports if you identify any new suspicious activities.
Who decides whether to file: the employee or the MLRO?
This decision is taken by the Money Laundering Reporting Officer (MLRO) or the Compliance Officer. Staff members can raise internal alerts when they suspect something is amiss; this is an internal flagging mechanism, not a report to be submitted to authorities.
The MLRO investigates to determine whether there are reasonable grounds to suspect money laundering and decides whether to file an external report. Both actions need to be documented separately.
Conclusion
The clearest answer to "SAR vs STR" is that it depends on where you are. In several countries, both terms refer to a single reporting requirement.
In the UAE, however, these are two separate reports, which explains the discrepancies in some commonly available summaries on this topic.
However, both types of reports share the same fundamentals: reasonable grounds to suspect, no minimum amount required, submitted to the FIU without delay, kept confidential and supported by adequate documentation to withstand questions or requests from relevant authorities for several months.
If your team spends a lot of time deciding which type of report to submit rather than investigating the root cause of your suspicions, the problem may originate higher up, such as inadequate alert systems, poor data documentation and inadequate onboarding and monitoring systems.
Get More Time for the Important Decisions
STR or SAR? Which one should you choose? When and how to file these reports? Choose azakaw and get the answers to these questions!
STR vs SAR: The differences
Related articles
Disclaimer
This article provides general information and does not constitute legal, regulatory or compliance advice. It provides information regarding the obligation to submit reports and highlights the differences in reporting requirements across countries based on our understanding at the time of publication, and given that laws and regulations are constantly changing.
