Last reviewed: 16 September 2026

Home › The Library › Mortgage fraud SAR reporting requirements

Suspicious Activity Reports and mortgage fraud, explained

This one runs in a different direction from most of what we cover: it's not a protection owed to a borrower, it's a federal reporting duty owed by the lender and originator themselves, to the government, about suspected fraud — including fraud a loan officer might spot in a borrower's own file, or in a colleague's.

Banks already had this; non-banks got it in 2012

Insured banks and credit unions have had Bank Secrecy Act suspicious activity reporting duties for decades. The Financial Crimes Enforcement Network (FinCEN) closed a real gap in February 2012 by extending the same basic framework to non-bank residential mortgage lenders and originators (RMLOs) — independent mortgage companies and brokers that had never carried a BSA reporting obligation before. The rule took effect April 16, 2012, with a compliance date of August 13, 2012, requiring every RMLO to establish a written anti-money-laundering program with a designated compliance officer, ongoing training, and independent testing.

The actual filing trigger

Under 31 CFR § 1029.320, an RMLO must file a Suspicious Activity Report on any transaction, or attempted transaction, conducted by, at, or through the company that involves or aggregates at least $5,000 and that the company knows, suspects, or has reason to suspect involves fraud, has no apparent lawful business purpose, or is designed to evade any requirement of the Bank Secrecy Act. A completed SAR has to be filed with FinCEN within 30 calendar days of the date the company first detected facts that may support filing — extendable to 60 days total if no specific suspect has yet been identified.

The confidentiality rule almost nobody expects

Federal law prohibits an RMLO (or any of its employees) from disclosing to the subject of a SAR, or to anyone else involved in the underlying transaction, that a report was filed at all — a strict, statutory non-disclosure requirement, not a discretionary courtesy. Records related to any SAR filed must be kept for five years from the filing date.

What this means for a borrower

You will generally never be told a SAR was or wasn't filed on your own transaction, and that silence isn't evasive — it's the law working as designed. What this reporting duty is not is a substitute for the licensing, disciplinary, and complaint checks covered elsewhere in our standard; a SAR filing obligation running in the background doesn't change what NMLS Consumer Access or your state regulator can independently tell you about a specific originator.