US rules for detecting, escalating, filing and retaining reports on suspicious transactions. Its scope covers suspicious and attempted transactions.

The main requirements are to file SARs within prescribed timing, protect confidentiality and maintain supporting documentation.

The preventive framework connects an institution's understanding of its customers to its understanding of their activity. Identification establishes who the customer is; beneficial-ownership analysis identifies the people behind a legal entity; risk assessment informs the level of attention; and ongoing monitoring looks for activity inconsistent with the known relationship. These functions reinforce each other rather than operating as independent checks.

An unusual transaction is a signal for assessment, not an automatic conclusion that a crime has occurred. Investigation brings together transaction history, the customer's explanation, counterparties and other relevant information. Record keeping makes those decisions reconstructable and supports the authority's ability to follow the movement of funds. Suspicious-activity reporting and routine threshold reports serve different purposes and can have different triggers.

In a payment operation, the framework affects onboarding, changes to customer information, transaction review, escalation and retention. Sanctions screening remains a related but distinct control: a sanctions prohibition can require a different response from an AML suspicion. The specific reporting authority, legal triggers and treatment of customer communications come from the applicable instrument and its implementing rules.

The instrument also addresses reporting and evidence: file SARs electronically and retain reports and evidence for the required period.