Suspicious transaction reporting obligations

Monitoring, screening and investigation all lead to one decision: whether to tell the authorities. The suspicious transaction report (STR) is the point where a crypto-asset service provider's private knowledge becomes financial intelligence that others can act on, and a failure to file is one of the most common findings in public enforcement actions against exchanges. A compliance officer must know exactly when the duty arises, how fast it must be met, and what it forbids afterwards.

The obligation in the FATF standard

The duty comes from Recommendation 20 (Reporting of suspicious transactions). If a financial institution "suspects or has reasonable grounds to suspect" that funds are the proceeds of a criminal activity, or are related to terrorist financing, it must be required by law to report its suspicions promptly to the financial intelligence unit (FIU). Recommendation 15 and its Interpretive Note extend the preventive measures of Recommendations 10 to 21 to virtual asset service providers (VASPs), so the same duty applies to an exchange, a custodian or a broker.

The Interpretive Note to Recommendation 20 adds four points that matter in practice:

• "Criminal activity" means all criminal acts that would be a predicate offense for money laundering in the country, or at a minimum the offenses required by Recommendation 3. Countries are strongly encouraged to use the broad version.
• Terrorist financing covers the financing of terrorist acts, terrorist organizations and individual terrorists, even without a link to a specific act.
• All suspicious transactions, including attempted transactions, must be reported regardless of amount.
• The obligation must be a direct mandatory obligation. "Indirect reporting", where firms report only because they fear prosecution for laundering, is not acceptable.

The term varies: some jurisdictions call the report a suspicious activity report (SAR), and others use "unusual transaction report". National rules also differ on filing deadlines, report formats, thresholds for related reports and whether the firm must wait for consent before proceeding, so a multi-country firm maps each one. This lesson teaches the common core.

The suspicion threshold

Recommendation 20 sets two triggers. The first, suspicion, is subjective: the person actually suspects. The second, reasonable grounds to suspect, is objective: a competent professional with the same facts would have suspected, whether or not the employee did. Ignoring an alert does not avoid the duty.

Suspicion is a low bar: more than vague unease, but far below proof or even belief on the balance of probabilities. The reporter does not need to know which crime produced the funds or hold evidence that would convince a court; it passes on a reasoned concern, and deciding guilt is for the authorities.

A single red flag is usually not suspicion by itself. A red flag starts an inquiry (see the lesson Alert triage and investigation); suspicion is the conclusion of that inquiry when the facts are not reasonably explained.

A decision not to file is still a decision, and an examiner will ask to see the reasoning.

Attempted transactions and rejected business

Because the standard covers attempts, the duty does not depend on whether the money moved. For a crypto business, common attempted-activity reports include:

• a prospective customer who abandons onboarding when asked for source-of-funds evidence, after depositing from a high-risk address;
• a withdrawal blocked because the destination is attributed to a fraud or darknet service;
• an inbound transfer the firm rejects or returns because the Travel Rule data are false (see the lesson Travel Rule operations and exceptions).

Blocking a transaction is a control; it does not replace the report. The FIU wants to know who tried what, from where and with which addresses, because the same actor may succeed elsewhere.

Sanctions are a separate track. Funds linked to a designated person must be frozen and reported to the competent authority under the sanctions regime (see the lesson Wallet and transaction screening). Many firms also file an STR when the facts suggest evasion or other crime, but the two are different obligations, often with different recipients.

Filing promptly

The standard says "promptly" without a number, and national deadlines vary. What is universal is when the clock starts: when suspicion is formed, or should reasonably have been formed, not when the alert was generated and not when the investigation was finally written up. A backlog of unreviewed alerts that hides reportable activity is itself a reporting failure.

Most firms run two stages:

1. Internal report. Any employee who suspects reports to the compliance officer or MLRO, usually through the case-management system. Staff discharge their personal duty this way and should not investigate alone or discuss the case with the customer.
2. Decision and external report. The MLRO, or a delegated team, reviews the internal report, decides whether the threshold is met, and files with the FIU. The decision, the date it was made and the reasons are recorded, whether or not a report is filed.

A firm active in several countries must decide where to file. A useful principle comes from the wire-transfer standard: a money or value transfer service that controls both the ordering and the beneficiary side of a transfer must consider the information from both sides and file in every country affected. A VASP in the same position can apply the same logic. Each local duty is met through the local FIU.

Financial intelligence units and the Egmont Group

Recommendation 29 requires every country to have an FIU that serves as the national center for receiving and analyzing STRs and other relevant information, and for disseminating the results. Its Interpretive Note describes two kinds of analysis: operational analysis, which follows specific targets and links, and strategic analysis, which identifies trends and patterns. The FIU must be able to obtain additional information from reporting entities, must be operationally independent, and disseminates selectively to the authorities that can act.

FIUs follow administrative, law-enforcement, judicial or hybrid models; the model affects how quickly an STR reaches investigators and how feedback is given.

The Egmont Group, created in 1995, is the international forum of FIUs, and its members cover most of the world's jurisdictions. Members exchange information on request and spontaneously through the Egmont Secure Web, under the Egmont Principles for Information Exchange, and the Interpretive Note to Recommendation 29 says an FIU should apply for membership. For a VASP this explains a key point: a report filed in one country can reach a foreign FIU through FIU-to-FIU exchange. The firm itself files only with the FIUs to which it owes a duty.

Tipping-off, confidentiality and safe harbor

Recommendation 21 has two halves. Financial institutions, their directors, officers and employees must be:

• protected by law from criminal and civil liability for breaching any confidentiality restriction, if they report their suspicions in good faith to the FIU, even if they did not know precisely what the underlying crime was and regardless of whether illegal activity actually occurred (the safe harbor);
• prohibited from disclosing that an STR or related information is being or has been filed (tipping-off).

Since a November 2017 revision, Recommendation 21 states that these provisions are not intended to inhibit information sharing within a financial group under Recommendation 18, a point covered in the lesson Record keeping, data protection and information sharing.

Operational consequences:

• Front-line and support staff use neutral scripts ("your transaction is under review") and never mention reports, suspicion or the FIU.
• Asking the customer for information before forming suspicion is normal due diligence; once a report is planned, questions must not reveal it.
• Access to the STR register and case notes is restricted to those who need it.
• Customer data-access requests and disputes are handled without disclosing a report.
• Exiting a customer after a report must not reveal the reason (see the lesson Ongoing due diligence and exits).

The safe harbor protects good-faith reporting, not failure: it offers no defense for a report that was never filed or was filed long after suspicion arose.

Exam focus: the wording of Recommendation 20 (suspects or has reasonable grounds to suspect; report promptly to the FIU); the Interpretive Note points (broad predicate offenses, terrorist financing without a specific act, attempted transactions regardless of amount, direct mandatory obligation); suspicion as a low, partly objective threshold that needs no proof of the predicate crime; why a blocked or rejected transaction can still need a report, and how sanctions freeze reports differ; when the "promptly" clock starts and why no-file decisions are documented; FIU functions under R.29 and the role of the Egmont Group; the two halves of R.21 (safe harbor for good-faith reports and the tipping-off prohibition) and their operational consequences.