Difference Between SAR and CTR: A Compliance Guide

Someone who is new to bank compliance will describe the difference a SAR from a CTR as, "One's for suspicious activity, and one's for big cash." This statement is not wrong. It is just not enough to keep an institution out of trouble. Both reports trace back to the same 1970 statute and the following regulations, the Bank Secrecy Act, and both land in the same place. It is FinCEN's BSA E-Filing System, which has been the only accepted channel since July 2012 (77 Fed. Reg. 12367). Also in April 2013, the legacy forms stopped being accepted and the current Forms 111/112 became mandatory. After that, these reports stop resembling each other.

A Currency Transaction Report (FinCEN Form 112) is arithmetic. More than $10,000 in cash moves by or on behalf of one person in a single day, whether in one transaction or several that add up, and the report is due within 15 calendar days. No suspicion needed, no discretion, no secrecy. FinCEN even publishes a customer-facing pamphlet explaining why the teller is asking for a social security number and a driver's license. 

A Suspicious Activity Report (FinCEN Form 111) is a judgment. It is triggered when an institution like a bank knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose. On top of that test, banks work on three floors: Insider abuse in any amount, criminal violations of $5,000 or more when a suspect can be named, and $25,000 or more when one can't. The clock runs 30 calendar days from initial detection, stretching to 60 if you're still working out who did it. A SAR is confidential. Under 31 U.S.C. 5318(g)(2), you cannot tell anyone involved in the transaction that it was reported. 

The volume gap fills in the rest. In FY2024 institutions filed roughly 20.5 million CTRs, about 56,160 a day, against 4.7 million SARs. SAR filings then hit above 4.1 million in 2025. 

Getting it wrong is expensive. FinCEN's record $1.3 billion penalty against TD Bank rested partly on CTRs that were late and sometimes misleading and on thousands of suspicious transactions worth about $1.5 billion that were never reported at all. 

None of it is frozen, either. The $10,000 trigger hasn't been touched since 1972; the STREAMLINE Act (S. 3017) would lift it to $30,000 and raise SAR thresholds to $3,000 and $10,000, with a House companion (H.R. 1799) carrying the CTR piece, named the Financial Reporting Threshold Modernization Act. A geographic targeting order already pulls the trigger down to $1,000 for certain money services businesses near the southwest border. This guide covers where the two split, where they overlap, and where teams get caught out. 

The following topics are going to be covered in this article;

• Quick Definitions: SAR and CTR at a Glance
• Side-by-Side Comparison Table
• When to File a SAR, a CTR, Both, or Neither: Practical Scenarios
• Common Mistakes Compliance Teams Make
• How SAR and CTR Connect to Your AML Program
• How Sanction Scanner Helps

1. Quick Definitions: SAR and CTR at a Glance

Before the comparison means anything, both reports need pinning down in plain terms. Neither definition is complicated. The complications arrive later, when you try to apply them to a real customer on a real Tuesday.

Suspicious Activity Report(SAR)

A SAR is a report a financial institution files with FinCEN when it spots activity that may involve money laundering, fraud, terrorist financing, or other financial crime. It runs on judgment. The legal test is whether the institution knows, suspects, or has reason to suspect, which means a person has to look at the facts and make a call.

No dollar figure fires a SAR by itself. Dollar amounts do appear in the rules, but they act as floors rather than triggers: Banks report criminal violations of $5,000 or more when a suspect can be identified, $25,000 or more when one can't, and insider abuse in any amount whatsoever. Money services businesses start at $2,000. Crossing those lines doesn't oblige you to file. Suspicion does. Filed on FinCEN Form 111. Roughly 4.7 million were filed in FY2024.

Currency Transaction Report(CTR)

A CTR is a report a financial institution files with FinCEN for cash transactions over $10,000 conducted by or on behalf of one person in a single business day, whether that's one withdrawal or five deposits that add up. It runs on arithmetic. Nobody needs to believe the customer is doing anything wrong, and in the vast majority of cases nobody does.

Watch the wording, though: More than $10,000. A flat $10,000 deposit is not reportable. $10,000.01 is. Filed on FinCEN Form 112. Roughly 20.5 million were filed in FY2024, more than four CTRs for every SAR.

In short, a CTR reports large cash regardless of suspicion. A SAR reports suspicion regardless of the size or the form of the transaction.

2. Side-by-Side Comparison Table

Two reports, one statute, one filing system, almost nothing else in common. The following table compares these two reports, SAR and CTR, side-by-side:

Table 1: Side by Side Comparison Table: SAR vs. CTR 

A few important aspects to clarify are as follows: 

• The $10,000 line means more than, not at least. A flat $10,000 deposit is not reportable. A penny over is.
• Neither the $10,000 line nor the 15-day clock is universal right now. A geographic targeting order (GTO) lets FinCEN impose extra reporting on institutions in a named area, for up to 180 days at a time, renewable (31 U.S.C. 5326(a); 31 CFR 1010.370). The current southwest border GTO runs March 7 to September 2, 2026 and covers MSBs in listed counties and ZIP codes across Arizona, California, New Mexico, and Texas. They file a CTR on cash of $1,000 or more, but no more than $10,000 and they get 30 days rather than 15. 
• The penalty numbers move. They come from the inflation table at 31 CFR 1010.821, and the amounts above have been in force since January 17, 2025. The Office of Management and Budget (OMB) canceled the 2026 adjustment, so the 2025 figures still stand.

3. When to File a SAR, a CTR, Both, or Neither: Practical Scenarios

The rules are simple on paper. The trouble starts when a real customer does something that half-fits two categories.

Scenario 1: CTR only. A restaurant customer, ten years on the books, deposits $15,000 in cash from the weekend's takings. Amount, timing, and pattern all match the profile. File the CTR. No SAR. Worth knowing that, a customer like this may qualify as a Phase II exempt person under 31 CFR 1020.315, which removes the CTR obligation entirely. It never removes the SAR obligation.

Scenario 2: SAR only. A customer wires $8,000 to a beneficiary in a high-risk jurisdiction. No prior international activity, no explanation that fits. No CTR, because a wire is not a transaction in currency and $8,000 wouldn't reach the line anyway. But $8,000 clears the $5,000 SAR floor, and the suspicion is real. File the SAR.

Scenario 3: Both. $25,000 in cash into a student account with no known business. The bundling is inconsistent, and the customer turns evasive about the source. File the CTR because the arithmetic says so. File the SAR because the facts support it. Neither substitutes for the other. Different rules, different clocks, and different files.

Scenario 4: Neither. A $3,000 wire to a child's college account. Not currency, nowhere near $10,000, nothing unusual. No filing. The overwhelming majority of activity lands here, which is the whole point of having thresholds.

Scenario 5: Structuring. SAR, no CTR. Three $3,200 cash deposits at three branches in one day. All domestic branches count as one bank for aggregation, so the day totals $9,600, and no CTR is owed. The pattern is the tell. FinCEN's structuring definition says outright that the transactions need not exceed $10,000 at any single institution on any single day. $9,600 clears the $5,000 SAR floor. File the SAR.

Scenario 6: Aggregation. CTR required. A $6,000 cash deposit in the morning and a $5,000 cash deposit in the afternoon. No single transaction exceeds the threshold, but the total cash deposits for the day amount to $11,000, which does exceed the limit. File the CTR. A SAR follows only if the pattern looks engineered.

The netting trap. Change Scenario 6 slightly: $6,000 cash deposit in the morning, $5,000 cash withdrawal in the afternoon. Total cash handled, $11,000. CTR? No. Cash-in and cash-out aggregate separately and never offset. Cash in is $6,000, and cash out is $5,000; neither crosses $10,000. FinCEN's CTR FAQ puts it plainly. Debits add to debits, credits add to credits, and institutions should not reconcile one against the other.

Here is a practical scenarios table for when to file a SAR or CTR, both, or neither:

Table 2: Practical Scenarios for When to File a SAR, a CTR, Both, or Neither

4. Common Mistakes Compliance Teams Make

The common mistakes compliance teams make are as follows: 

1. Filing a SAR when only a CTR is owed. A customer deposits $12,000 in cash. The profile fits, the source is obvious, and nothing is off. Some teams file a SAR anyway because they mentally equate "large" with "suspicious." It isn't. This transaction is a CTR and nothing else. Treasury has a name for the habit now, "defensive filing," and the SAR FAQs, published on October 9, 2025, say it plainly: Absent knowledge, suspicion, or reason to suspect, no SAR is required. If the deposit is also suspicious, file both. Neither report covers for the other.
2. Not aggregating cash for CTR purposes. Three deposits of $4,000 each made in one day total $12,000, which requires a CTR. All domestic branches count as a single bank. Many institutions miss this requirement because transactions are processed at different branches, terminals, ATMs, a night drop, or an armored car. Night and weekend deposits are treated as received the next business day. This issue is not a niche failure. The U.S. Government Accountability Office(GAO) reported in 2024 that filers found FinCEN's aggregation requirements unclear, and FinCEN agreed to simplify them.
3. Tipping off. The prohibition is wider than most frontline training conveys. It covers the SAR and any information that would reveal that one exists. Closure letters citing "regulatory requirements" are the classic trap. If you're subpoenaed for a SAR, you decline, cite 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN. Sharing within the corporate structure, with FinCEN and law enforcement, and with affiliates subject to a SAR rule is permitted. CTRs carry no equivalent restriction.
4. Missing the deadline, or misreading which clock is running. CTR: 15 calendar days from the transaction. SAR: 30 calendar days from initial detection, not the transaction date. The clock does not start when the monitoring system generates an alert. Per the FFIEC manual, the clock starts when the institution, during review or otherwise, knows or has reason to suspect. Teams that start the clock at the alert file too early and waste analyst capacity. Teams whose reviews never quite conclude file too late and get cited. 
5. Thin or formulaic narratives. The narrative is the only field that explains the activity, which is why FinCEN marks it critical. Cover who, what, when, where, why, and how. Provide individual dates and amounts, not just a total. Say what you reviewed and why you landed where you did. The framework sits in FFIEC Appendix L, which points to FinCEN's filing checklist and its guidance on common SAR errors. Appendix L also notes that narratives are subjective and examiners generally should not criticize your reading of the facts.
6. Reading $5,000 as a floor on individual transactions. It isn't. The rule says "involves or aggregates at least $5,000." Twelve $600 deposits get there. Insider abuse carries no threshold at all. FinCEN accepts voluntary SARs at any amount, with the same safe harbor attached.
7. "No CTR, so no problem." Structuring is a federal crime under 31 U.S.C. 5324 whether or not a CTR ever gets triggered, and the SAR reports the attempt. But the inverse is now an error too. Since October 2025, FinCEN and the banking agencies have stated that transactions at or near $10,000 are not by themselves enough to require a SAR. What's required is knowing, suspecting, or having reason to suspect an intent to evade. Rules that auto-file on near-threshold patterns are manufacturing noise. FinCEN's own 2025 data makes the point: “Transactions below the CTR threshold” was the third most-filed SAR category for banks, savings associations, and credit unions, at 8.65%. 

One policy check worth running this quarter: If your procedures still mandate a review after every SAR filing or a memo for every decision not to file, they're out of date. The October 2025 FAQs removed both.

5. How SAR and CTR Connect to Your AML Program

Neither report is a standalone chore. Both are outputs. When a filing goes wrong, the cause usually sits upstream in a control that failed quietly weeks earlier, which is why examiners rarely stop at the filing itself.

Monitoring produces the SAR. No alert, no investigation, no filing. The chain breaks at the first link far more often than the last. TD Bank added no new monitoring scenarios for years, so roughly 92% of its transaction volume, about $18.3 trillion between January 2018 and April 2024, was never monitored at all. Part of its $1.3 billion penalty traced to that, not to analysts who couldn't write. The questions that decide whether the system works: Are your rules calibrated to your actual risk or to a vendor default, and do alerts route to someone with authority to close them? This system is what Sanction Scanner's Transaction Monitoring module is built for, with a configurable rule catalog and real-time alerting rather than end-of-day batch review.

Note the October 2025 shift here. FinCEN now says activity at or near $10,000 is not suspicious on its own. Rules that alert on every $9,500 deposit produce volume, not intelligence. Recalibration is a live task.

Cash handling procedures generate the data that feeds CTR filing. Aggregation is the failure point; it represents a data problem that must be addressed before it becomes a compliance issue. Deposits arriving through branches, ATMs, night drops, and armored cars all have to resolve to one person across one business day, with cash-in and cash-out tallied separately and never netted. An institution that can't reliably join those records will miss filings regardless of how well its policy reads. Automated CTR filing reduces manual errors. Sanction Scanner's reporting capabilities become handy at this point. 

Risk profiles feed both. A high-risk customer's $10,000 cash deposit is still just a CTR. What changes is the scrutiny around it. A low-risk retail customer and a high-scoring customer on geography, sector, and PEP exposure warrant different attention for the same deposit. That's the job of Sanction Scanner's Customer Risk Assessment, and its real value is that the score can drive monitoring rules directly. So, risk rating and alert threshold aren't two systems that never speak. 

The BSA officer owns both. One of the program pillars, and the first person examiners ask for. The proposed rule would standardize the title as AML/CFT Officer and, implementing the Anti-Money Laundering Act of 2020, require that officer to be located in the United States, while still permitting some AML/CFT functions to be performed abroad.

Examiners test both differently. For SARs, the FFIEC manual directs examiners to evaluate your identification and reporting process, then review individual filing decisions to see whether the process actually works. For CTRs, examiners sample large currency transactions to verify that the filings were completed and that the aggregation captured all necessary information. Judgment quality on the SAR side, aggregation completeness on the CTR side, and timeliness on both. 

Where the program is heading matters. FinCEN's April 2026 program rule proposal would assess institutions on whether their AML programs are effective rather than on how much paper they generate, with only significant or systemic implementation failures warranting enforcement. Comments closed June 9, 2026, and the Federal Reserve, which sat out the April rulemaking, issued its own proposal on July 7, 2026. Under that standard, your SARs and CTRs stop being a compliance record and become a readout of whether the program underneath them works.

6. How Sanction Scanner Helps

The filing is the last step. All factors that determine the correctness of the process are addressed earlier, during the detection and investigation phases.

The alerts generated by Sanction Scanner's Transaction Monitoring serve as the basis for SAR decisions. Rules are configurable rather than fixed, so detection logic can follow your typologies instead of a vendor's defaults, with rule-based and AI engines running together against behavioural profiles and peer group comparisons. Case management documents investigations, and the audit trail provides examiner-ready records. Three pieces matter most for the obligations covered in this guide:

• Case management. Alerts become cases with assignment, escalation, and documented findings, and related hits on the same customer roll into one case rather than multiplying across queues. This process is the layer that turns "the system flagged something" into "we reviewed it and decided". This is where the 30-day SAR clock actually starts.
• Audit trail and rule register. Every action logged. Every rule is captured with its rationale, calibration, and change history. Examiners reviewing individual SAR decisions require this specific information: Not only the details of what you filed, but also the process you followed and the reasons for closing each case.

Sanction Scanner's monitoring can also include cash threshold rules for CTR awareness as in “flag aggregated cash transactions approaching $10K”. 

On cash, two rule types are worth running side by side. One catches same-day currency crossing $10,000 across branches and channels, which supports CTR completeness. The other flags sub-threshold cash patterns for structuring reviews. The second produces an alert for an analyst, not a filing. FinCEN has been explicit that near-threshold activity on its own doesn't require a SAR.

Sources

[1] Financial Crimes Enforcement Network. FinCEN Year in Review for FY 2024. 2025.

[2] Financial Crimes Enforcement Network, Federal Reserve, FDIC, NCUA, and OCC. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements. 2025.

[3] Financial Crimes Enforcement Network. FinCEN Assesses Record $1.3 Billion Penalty against TD Bank. 2024.

[4] eCFR, U.S. Code of Federal Regulations. 31 CFR 1010.821: Penalty Adjustment and Table. 2025.

[5] Financial Crimes Enforcement Network. Frequently Asked Questions: Geographic Targeting Order Imposing Additional Recordkeeping and Reporting Requirements on Certain Money Services Businesses Along the Southwest Border. 2026.

[6] U.S. Senate Committee on Banking, Housing, and Urban Affairs. STREAMLINE Act (S. 3017). 2025.

[7] eCFR, U.S. Code of Federal Regulations. 31 CFR 1020.320: Reports by Banks of Suspicious Transactions. 2025.