SAR, STR, CTR: what's the difference?

Banks, cryptocurrency platforms, and fintech companies encounter suspicious transactions on a daily basis. A mistake in assessment or the submission of an incorrect report can result in a business losing its license. Filing SAR, STR, and CTR reports is not a formality – it's a legal obligation that comes with real administrative and even criminal liability. But what’s the difference between SAR, STR, and CTR reports? When should each one be submitted? In this article, we explain how to correctly identify the type of report, what criteria regulators use, and how to avoid falling into the risk zone under the AML reporting rules applicable in 2026.

The role of SAR, STR, and CTR in the AML system

The financial monitoring and anti-money laundering (AML/CFT) system is based not only on technical controls but also on consistent regulatory reporting. SAR, STR, and CTR are among the key AML reporting types used to help financial intelligence units (FIUs), tax authorities, and law enforcement agencies detect suspicious activity, monitor large cash movements, and identify potential financial crime schemes.

The purpose of these reports is to create an informational trail that FIUs can use to launch investigations. CTR reports are usually filed automatically when a cash transaction exceeds a legal threshold. SAR and STR reports are submitted when there is suspicion of unusual or potentially illegal activity. However, terminology, filing triggers, and reporting procedures differ between jurisdictions.

According to FinCEN data for fiscal year 2025:

• Approximately 4.8 million SARs were filed;
• 5 million CTRs;
• 8 million FBARs (Foreign Bank and Financial Accounts Reports);
• Approximately 420,400 Form 8300 filings for cash payments over $10,000 received in a trade or business;
• 132,400 CMIRs (Reports of International Transportation of Currency or Monetary Instruments).

These figures show the scale of the reporting system and its importance as both a preventive and analytical tool. Correctly identifying and filing the appropriate report is not just a legal requirement – it helps businesses meet their AML compliance obligations and reduce regulatory risk.

What is a SAR (Suspicious Activity Report)?

A SAR is a report about suspicious client activity that is submitted to a Financial Intelligence Unit (FIU) when there are reasonable grounds to suspect money laundering, terrorist financing, sanctions evasion, or other financial crime. It does not require proof that a crime has occurred — reasonable suspicion may be sufficient to trigger a reporting obligation under the applicable AML regime. A SAR can relate to many types of activity, from large unexplained transfers to attempts to bypass identity verification.

While the filing format and requirements vary by jurisdiction, a SAR usually contains:

• Client or counterparty identification data
• Description of suspicious activity
• Details of transactions and any related parties
• Date, time, and source of the suspicion
• Internal actions taken, where applicable
• Documents related to the internal review
• Contact details of the person responsible for the report

Important! Employees must not inform the client that a SAR has been filed. Doing so may constitute tipping off, which can result in criminal or regulatory consequences in many jurisdictions.

When must a SAR be filed?

Understanding when to file a SAR is essential for MLROs and compliance teams. A SAR may be required in situations such as:

1. The client refuses to complete KYC or presents false or suspicious documents
2. The client's transactions do not match their profile or have no apparent economic purpose
3. There are signs of structuring or unexplained use of offshore companies
4. The client or transaction is linked to a high-risk or sanctioned jurisdiction or a sanctioned person
5. The client attempts to conceal the true beneficial owner or the purpose of a transaction

Once filed, the SAR is reviewed by the relevant FIU and may contribute to further analysis or a formal investigation.

What is STR (Suspicious Transaction Report)?

STR is a report filed when a specific suspicious transaction is detected. In jurisdictions that use STR terminology, the report is typically linked to a particular financial action: a transfer, cash withdrawal, account deposit, asset exchange, cryptocurrency purchase, or another transaction that raises suspicion.

The distinction between a Suspicious Activity Report vs Suspicious Transaction Report is not universal and depends on the applicable AML framework. Some jurisdictions primarily use SAR terminology, while others require STRs for suspicious transactions. In practice, both mechanisms are designed to ensure that potentially suspicious financial activity is reported to the relevant Financial Intelligence Unit (FIU).

The format of an STR may vary by country, but it generally contains:

• Sender and recipient details
• Amount, currency, and date of the transaction
• Method of execution (online, via exchange, in cash, etc.)
• Suspicious indicators and the reasons for concern
• Documents related to the internal review
• Details of the responsible employee and date of submission

Important! If needed, the STR may be accompanied by attachments – copies of documents, screenshots of messages, client requests, and other supporting evidence.

When is an STR filed?

A Suspicious Transaction Report may be required in the following cases:

• The amount, method, or structure of the transaction does not match the client’s usual behavior
• The transaction involves persons or jurisdictions associated with a high level of risk
• The client attempts to bypass limits by splitting one amount into several smaller transfers
• The transaction appears overly complex, lacks a clear economic purpose, or involves sanctioned persons or jurisdictions

The report is submitted to the relevant national FIU and may lead to further analysis or investigation. Filing procedures differ by jurisdiction and are generally carried out through secure regulatory reporting systems.

What is a CTR (Currency Transaction Report)?

A CTR is a report on large cash transactions that is filed when the amount exceeds a legally established threshold. Unlike SARs and STRs, a CTR does not require suspicion of illegal activity: the reporting obligation is generally triggered by the amount and type of transaction.

In the United States, financial institutions must file a Currency Transaction Report for cash transactions exceeding $10,000 conducted by or on behalf of one person during a single business day. Multiple cash transactions must also be aggregated when the institution knows they are conducted by or on behalf of the same person and together exceed the reporting threshold.

A CTR typically includes:

• Client identification data
• Amount and currency of the transaction
• Type of transaction, such as a deposit, withdrawal, or currency exchange
• Date and location of the transaction
• Information about the person conducting the transaction and, where applicable, the person or entity on whose behalf it was conducted

Important! A CTR does not mean that the client or transaction is considered suspicious. However, attempts to structure cash transactions into smaller amounts to avoid the currency transaction report threshold may themselves raise suspicion and trigger additional AML review or a SAR filing.

When must a CTR be filed?

Under the U.S. Bank Secrecy Act, a CTR is generally required when cash transactions exceed $10,000 in one business day, either through a single transaction or through multiple transactions that must be aggregated.

Reporting thresholds and mechanisms differ in other jurisdictions. Therefore, businesses operating internationally should not assume that the U.S. CTR framework applies directly in the EU, the UK, or other markets.

SAR, STR and crypto reporting under EU AML rules in 2026

EU AML rules are undergoing a major transition. Directive (EU) 2024/1640, often referred to as AMLD6, entered into force in 2024, but Member States generally have until 10 July 2027 to transpose its provisions. Until then, existing national AML frameworks continue to govern suspicious activity and transaction reporting, while businesses prepare for the new EU-wide regime.

For crypto businesses, MiCA requirements now operate alongside AML/CFT obligations. The maximum MiCA transitional period for previously operating crypto-asset service providers expired on 1 July 2026. After that date, unauthorised CASPs cannot continue providing crypto-asset services in the EU unless they fall within another permitted legal basis.

MiCA does not replace suspicious activity reporting requirements. Crypto-asset service providers must still maintain customer due diligence, transaction monitoring, sanctions screening, and internal escalation procedures under the applicable AML framework. Where suspicious activity or transactions are identified, the relevant SAR or STR mechanism must be followed in accordance with national law.

SAR vs STR vs CTR: comparison table

Although all three reports form part of the financial monitoring and AML framework, their purpose, trigger, and filing requirements differ. The exact terminology and procedures depend on the jurisdiction, but the table below summarises the main distinctions:

How Key2Law helps companies manage AML reporting risks

Correct SAR, STR, and CTR reporting requires more than knowing the basic definitions. Businesses need clear internal procedures, trained compliance teams, reliable transaction monitoring, and a reporting framework adapted to the jurisdictions in which they operate. Key2Law team supports banks, fintech companies, crypto businesses, payment institutions, and other regulated entities in building and maintaining effective AML/CFT compliance systems.

The Key2Law team can help with:

• Assessing applicable SAR, STR, and CTR reporting obligations;
• Developing and reviewing internal AML/CFT policies and reporting procedures;
• Setting up escalation and reporting workflows for compliance teams and MLROs;
• Reviewing KYC, transaction monitoring, and sanctions screening processes;
• Supporting businesses with regulatory compliance under MiCA and other relevant frameworks;
• Assisting with AML-related requirements for bank account opening and ongoing banking relationships;
• Providing broader business support for regulated companies operating across multiple jurisdictions.

Errors in financial reporting can lead to regulatory scrutiny, financial penalties, and reputational damage. If your company needs help reviewing its AML reporting procedures, preparing internal policies, or ensuring that its compliance framework meets current regulatory expectations, contact Key2Law. Our team will assess your business model, identify reporting risks, and help build a practical compliance structure tailored to your operations.

FAQ about SAR, STR, and CTR reports

What is the difference between SAR and STR?

A SAR generally relates to suspicious activity or patterns of behaviour, while an STR focuses on a specific suspicious transaction. However, the terminology is jurisdiction-specific: some AML regimes use SAR, others use STR, and in certain cases the terms serve very similar reporting purposes.

What is the difference between SAR, STR, and CTR?

SAR and STR reports are triggered by suspicion, while a CTR is generally triggered by a cash transaction exceeding a prescribed reporting threshold. A CTR does not by itself mean that the transaction is suspicious.

When should a SAR be filed?

A SAR may be required when a regulated business identifies activity that may indicate money laundering, terrorist financing, sanctions evasion, fraud, structuring, concealment of beneficial ownership, or another financial crime. The exact filing trigger and deadline depend on the applicable jurisdiction.

What is the currency transaction report threshold?

In the United States, financial institutions generally must file a CTR when cash transactions exceed $10,000 in one business day. Multiple transactions may need to be aggregated if they are conducted by or on behalf of the same person.

Do crypto companies have to file SARs or STRs?

Crypto businesses may be subject to suspicious activity or transaction reporting requirements when they fall within the relevant AML/CFT framework. In the EU, crypto-asset service providers must combine MiCA compliance with applicable AML obligations, including customer due diligence, transaction monitoring, and suspicious activity reporting.