A Suspicious Activity Report, or SAR, is filed with a country's Financial Intelligence Unit whenever an alert uncovers activity that needs to be reported. Some jurisdictions use the term Suspicious Transaction Report, or STR, instead. Flagright supports generating, validating, submitting, and tracking these reports across many jurisdictions, including the United States, Lithuania, and Canada, among others.

Which jurisdictions are available to a given customer is configured in the super admin panel, based on where that customer's legal entities operate and where their business takes place, since a company reports to the FIU local to its own operations. This is documented in the customer's master service agreement.

How a report actually reaches the FIU depends on the jurisdiction. Some FIUs support fully automated filing, meaning a report created in Flagright is delivered straight to the FIU through a direct connection and the response is handled inside the console. Others provide no automated route at all, in which case Flagright builds the report to match that FIU's own template so it can be exported and uploaded manually.

A SAR is generated from an alert raised during case management, and the console prefills as much of the draft as possible from data already on file.

Case Management with the All Alerts tab active. Each row is an alert; clicking the Alert ID in the first column opens its Case Details page.

Once a transaction is selected, Generate Report and Escalate appear at the bottom right of the panel.

The Generate Report window, with a jurisdiction and report type selected and ready to generate.

Report type options depend on the jurisdiction chosen. Lithuania offers STR and CTR rather than SAR.

Every generated report is organized into three sections.

General Details also captures filing specific context, such as who the filing institution and financial institution are, and how this report relates to prior activity: whether it is the initial report for that entity, a continuation of activity reported earlier (some jurisdictions expect a new report on ongoing activity every 90 days), a correction to a previously filed report, or a joint report covering multiple entities. Exactly which of these options appear, and what is required for each, varies significantly by jurisdiction.

Inside General Details: filing type indicators (Continuing activity, Corrects prior report, Initial report, Joint report) and the Narrative field with its Add Activity Narrative Information action.

Much of a draft report is filled in automatically so an analyst does not have to reenter the same information for every filing.

Every report needs information about the person or entity being reported, referred to as the subject. Not every customer has complete information about their subject, sometimes because the subject is a business, and sometimes because only limited data is available in the first place. Flagright builds conditional logic into these fields based on what information is actually available, and individual fields can be marked as unknown when the information cannot be provided. Credit union servicers, for example, often deal directly with end customers they know very little about, so they will frequently report those entities as unknown.

The narrative is one of the most detailed parts of any SAR, describing what happened and why it is being reported. Flagright's generative AI can draft this narrative directly from the associated case, the user's profile, and the report's selected transactions. If a customer has its own narrative template, the AI can populate that template instead of a default one. A built in narrative checklist keeps the draft aligned with what the FIU expects, since FIUs such as FinCEN publish their own guidance on what a narrative should contain and how it should be structured.

Attachment requirements differ by jurisdiction. A FinCEN filing, for example, typically expects a single CSV file listing every transaction involved in the suspicious activity. For FinCEN specifically, the console only allows one attachment per SAR; uploading a new attachment replaces the previous one rather than adding to it. A FinTrack filing instead expects each transaction to be entered as its own separate record rather than bundled into one CSV.

The Validate feature checks a draft report and lists every issue that needs to be resolved before it can be submitted. This matters because, in most workflows, an analyst prepares the report while a manager or BSA officer reviews and submits it. Analysts can run Validate themselves before handing a report off, so the reviewer is not the first person to discover missing information. All mandatory fields are checked automatically, and any field left empty is marked in red so an incomplete report cannot be submitted.

A missing required entry, such as a suspicion that has not been filled in, is flagged as an Invalid field until it is completed.

Once submitted, a report moves through a defined set of statuses so its progress with the FIU can be tracked from inside the console.

For jurisdictions filed automatically through a direct connection to the FIU, status updates happen on their own and cannot be changed manually. For jurisdictions without that connectivity, such as Malaysia and Lithuania, status can be updated manually, with comments, to keep the record in sync with how the filing is actually progressing outside the system. FinCEN and FinTrack also support a resubmission flow: if a submission is rejected, a new report can be created that copies over the same details, ready to submit again.

Every SAR that has been generated is listed in the SAR section of the side navbar. Each report shows a status of Draft while still being prepared, or Complete once finished. Opening a report shows its full timeline, including every status it has moved through, and lets a user retrieve all of its details, including any attachments, with one click.

The SAR section, listing every generated report with its status, who created it, and when it was last updated.

FIUs update their guidance periodically, for example FinCEN moving from version 1.6 to version 1.7. These changes do not happen often, but when a major version introduces new requirements, the logic behind a jurisdiction's SAR form may need to be updated to match it. FIUs typically give advance notice before a new version takes effect, so teams working directly with customers need to stay aware of upcoming guidance changes.

The following capabilities are in progress and not yet available in the console.