Are Crypto Exchanges Required to File Suspicious Activity Reports?

Short answer: often, yes. In the United States, a crypto exchange that qualifies as a money services business (MSB) generally has anti-money-laundering duties under the Bank Secrecy Act (BSA). Those duties can include filing suspicious activity reports (SARs) with the Financial Crimes Enforcement Network (FinCEN).

But “crypto exchange” is a business description, not a legal classification. The answer depends on what the company actually does, how it handles customer funds or digital assets, and which laws apply to its activities. The details matter for founders, compliance teams, investors, and anyone considering reporting suspected wrongdoing.

The clickbait version—and the real answer

You may see headlines implying that every crypto platform must file a SAR for every questionable transaction. That is not the rule. A covered business must report activity that meets the applicable legal standard; it does not file a report every time a transaction looks unusual at first glance.

Here is the catch: an exchange cannot avoid compliance just by calling itself a technology company, a marketplace, or a software provider. Regulators look at what the business does in practice. A company that accepts and transmits convertible virtual currency (CVC), for example, may be treated as a money transmitter—and therefore as an MSB—under federal rules.

When a crypto exchange may be an MSB

FinCEN’s rules generally treat a person or business that accepts and transmits value, including CVC, as a money transmitter unless an exception applies. A crypto exchange that swaps customer fiat currency for crypto, crypto for fiat, or one type of crypto for another may fall within that framework, depending on its precise role and business model.

That analysis is not automatic. A business that only provides software, without accepting or transmitting funds or value, may be treated differently from a platform that controls customer assets or executes transfers. Other facts can matter too: who has custody, who initiates transactions, whether the company acts for customers, and whether an exemption applies.

Being classified as an MSB can bring several obligations, including federal registration with FinCEN, an AML program, recordkeeping, and reporting. State money-transmission licensing may also be relevant. Federal MSB status does not settle every state-law question.

What are the SAR filing obligations?

A SAR is a report submitted to FinCEN about a transaction or attempted transaction that a covered financial institution knows, suspects, or has reason to suspect involves unlawful activity, is designed to evade BSA requirements, or lacks an apparent lawful purpose after considering the available facts. The report gives authorities information to assess potential financial crime. It is not a court finding, and filing one does not prove that a customer committed a crime.

For MSBs, the federal SAR rules generally apply when a transaction or related transactions involve at least $2,000 in funds or other assets and the business knows, suspects, or has reason to suspect suspicious activity. The rule covers transactions that are conducted or attempted. It is not limited to completed transfers.

Generally, an MSB must file within 30 days after the initial detection of facts that may support a SAR. If the suspect is not identified at that point, the rules allow additional time to identify the suspect, subject to the applicable deadline. For continuing suspicious activity, a business generally must review the case and file a continuing report at least every 90 days when warranted.

These are general federal rules, not a complete checklist for every exchange. Different types of covered institutions can face different thresholds or requirements. A crypto business should identify its exact regulatory classification before building its reporting process around a rule that applies to another type of institution.

What counts as suspicious activity in crypto?

Suspicion should come from facts and context, not from a single keyword or a customer’s use of crypto. Examples that may warrant review include:

• Transfers that appear structured to avoid reporting or recordkeeping requirements.
• Rapid movement of funds through several wallets or accounts without a clear business purpose.
• Transactions involving wallets or entities linked to sanctions evasion, fraud, ransomware, or other suspected illicit activity.
• Customer activity that conflicts sharply with the information the customer provided or with the expected use of the account.
• Attempts to conceal who controls a wallet or where funds came from, when considered alongside other risk indicators.

No one item automatically requires a SAR. A legitimate customer may use privacy tools, move assets quickly, or transact across borders. A strong review considers the full pattern: customer information, transaction history, counterparties, blockchain analytics, and explanations that can be reasonably verified.

AML program standards: more than a written policy

An MSB’s AML program must be designed for the risks of its actual products, customers, delivery channels, and locations. A policy copied from another company is not enough. FinCEN’s rules require key program elements, including a system of internal controls, a designated compliance officer, employee training, and independent review or testing.

In practice, a crypto exchange should be able to explain how it identifies suspicious patterns, who investigates alerts, how decisions are documented, and who has authority to approve a SAR. It also needs a process for filing on time and protecting the confidentiality of reports.

A Click for more info SAR is confidential. A business generally must not tell the person involved that a SAR was filed, and it must protect the report and related information as required by law. That does not mean staff can never discuss a case internally. Access should be controlled and limited to people with a legitimate compliance or legal need.

MSBs generally must keep copies of filed SARs and supporting documentation for five years. Supporting documentation can be important: it gives investigators the underlying facts behind a report and helps the business explain why it made its decision.

The BSA covers far more than banks

The name “Bank Secrecy Act” can create the wrong impression. The BSA framework applies to multiple kinds of financial institutions, including MSBs. That means covered crypto exchanges can have reporting and AML duties even if they are not banks and do not hold a banking charter.

This is a practical point for entrepreneurs. A product team may think it is building a trading interface. Regulators may focus on whether the company accepts, controls, exchanges, or transmits customer value. The legal analysis follows the activity, not the company’s preferred label.

That does not mean every crypto company has identical obligations. A custodial exchange, a software developer, a peer-to-peer marketplace, and a protocol developer can present different facts. The business should map its functions and customer flows rather than rely on broad claims such as “crypto is unregulated” or “we are only a platform.”

Whistleblower awards are real—but not fast

There is a related question for employees and other people who learn about possible BSA violations: can reporting information to the government lead to an award? FinCEN’s whistleblower program provides a statutory route for eligible people to submit original information about certain violations.

AMLA created the framework, and later legislation addressed funding for awards. Under the statutory structure, eligible whistleblowers may receive 10% to 30% of monetary sanctions collected in qualifying cases, subject to legal requirements. That range is not a promised payout. Awards are discretionary and depend on factors such as the value of the information, its contribution to enforcement, and whether money is actually collected.

There is also a threshold: the award framework generally applies when the relevant monetary sanctions exceed $1 million. A tip that prompts an investigation does not, by itself, guarantee a successful enforcement action, a collection, or an award.

And timing can be lengthy. The government may need to assess the information, investigate, bring a case, resolve it, and collect sanctions before an award decision can be made. “Whistleblower award available” does not mean “payment soon.” People considering a submission should preserve relevant records lawfully, avoid taking or disclosing material they are not entitled to access, and understand the program’s submission rules before acting.

Can social media help identify suspicious activity?

Platforms such as Facebook may contain public posts, business pages, or user-provided information that helps a company understand a customer or investigate a lead. But a social media post is not proof of a crime. It can be false, outdated, or attached to the wrong person.

Compliance teams should use social media information carefully, document its source, and corroborate material facts through appropriate records. Do not make a SAR decision based solely on a person’s posts, identity, political views, or association with a group.

For startup and business context, Tycoonstory.com may be useful as a general reference point for entrepreneurs. It is not a substitute for FinCEN rules, official guidance, or a reliable legal analysis of a particular exchange’s activities. The same distinction applies to Facebook: a platform can help surface information, but it does not determine whether a business has a filing obligation.

Questions a crypto exchange should answer

Before deciding whether it has SAR filing obligations, an exchange should be able to answer practical questions such as:

1. Do we accept, exchange, hold, or transmit customer funds or convertible virtual currency?
2. Are we an MSB under the facts of our business model, and have we addressed registration and any state licensing requirements?
3. What transaction threshold and filing deadline apply to our institution type?
4. How do we detect activity that is conducted or attempted, including activity spread across multiple transactions?
5. Who reviews alerts, documents the decision, files reports, and manages continuing activity reviews?
6. How do we protect SAR confidentiality and retain the reports and supporting records?

These are better questions than “Are we a crypto company, so are we exempt?” The answer depends on the work bsa whistleblower retaliation protection the company performs.

Bottom line

A crypto exchange that qualifies as an MSB will generally have BSA obligations that can include filing SARs with FinCEN. The business must assess suspicious activity under the rules that apply to its institution type, meet filing deadlines, protect report confidentiality, and maintain an AML program suited to its risks.

The key distinction is between a business label and the underlying activity. Map how customer value moves through the product, identify the company’s regulatory status, and build controls around that reality. And for anyone considering a whistleblower submission, remember: awards are legally available in qualifying cases, but they are discretionary, tied to enforcement outcomes, and rarely quick.