Filing obligations attach above dollar thresholds that vary by institution type, generally within 30 days of detection. Reports include a narrative describing the pattern, which is the part investigators actually use.
SARs are strictly confidential. A firm may not tell the customer a report was filed, and that prohibition is why account restrictions are sometimes explained vaguely or not at all. Firms receive a safe harbour from liability for filing in good faith.
Common securities triggers include patterns resembling market-manipulation or wash-trading, rapid movement of funds in and out with minimal trading, and third-party transfers inconsistent with the account profile.
Related: bank-secrecy-act, fincen, currency-transaction-report, customer-due-diligence, anti-money-laundering