Casino SAR Requirements: FinCEN Rules for Casinos

Under the casino suspicious activity report requirements in 31 CFR 1021.320, a US casino must file a suspicious activity report (SAR) with FinCEN when a transaction conducted or attempted by, at or through the casino involves or aggregates at least $5,000 and the casino knows, suspects or has reason to suspect it falls into one of four suspicious categories. The SAR is due within 30 calendar days of initial detection, with a hard ceiling of 60 days.

This guide reads the regulation paragraph by paragraph and then compares the US SAR with the US currency transaction report (CTR) and Canada's suspicious transaction report (STR). Source: 31 CFR 1021.320 - suspicious activity reports by casinos, opened on 11 November 2026. Cornell LII lists amendments through 2016 and shows no current-through date, so confirm the wording on eCFR or with FinCEN before relying on it. The audience is US-regulated casinos and teams serving both the US and Canadian markets. This guide does not say whether any online operator is a "casino" under the US definitions, and it is not legal advice: confirm with counsel and current FinCEN guidance.

Casino suspicious activity reports: what US rules require

Section 1021.320(a)(1) says every casino shall file with FinCEN a report of any suspicious transaction relevant to a possible violation of law or regulation. It also lets a casino report a suspicious transaction it believes is relevant to a possible violation even when the section does not require the report. SAR decisions depend on good customer data; our guide to KYC providers for iGaming operators covers the identity side of that.

The four triggers in 31 CFR 1021.320(a)(2)

A transaction requires reporting when it is conducted or attempted by, at or through the casino, involves or aggregates at least $5,000, and the casino knows, suspects or has reason to suspect that the transaction, or a pattern of transactions it is part of, falls into one of four categories. The amount alone never triggers a SAR; the suspicion category does.

Funds from illegal activity

The first category covers transactions that involve funds derived from illegal activity, or are intended or conducted to hide or disguise such funds or assets, including their ownership, nature, source, location or control, as part of a plan to violate or evade federal law or avoid a federal reporting requirement. This is the classic money laundering limb.

Structuring and BSA evasion

The second category covers transactions designed, whether through structuring or other means, to evade requirements of the chapter or other Bank Secrecy Act regulations. It is the paragraph that ties suspicion to the reporting rules: the concern is activity designed to evade them.

No apparent lawful purpose

The third category covers a transaction that has no business or apparent lawful purpose, or is not the sort the particular customer would normally be expected to engage in, where the casino knows of no reasonable explanation after examining the available facts, including the background and possible purpose. The final clause matters operationally: it expects the casino to look at the facts before deciding.

Using the casino to facilitate crime

The fourth category covers a transaction that involves use of the casino to facilitate criminal activity.

A hypothetical illustration, not drawn from any real case: a patron's pattern of several smaller transactions in one visit that together reach $6,000 is measured by its aggregate against the $5,000 amount, but it is reportable only if the casino also meets the knowledge standard and one of the four categories. Counsel should confirm how aggregation applies to your own facts.

Deadlines: 30 days, the 60-day ceiling and the robbery exception

Paragraph (b)(3) sets the clock. A SAR must be filed no later than 30 calendar days after the date of the casino's initial detection of facts that may constitute a basis for filing. The clock starts at detection, not when someone decides to file. If no suspect is identified on that date, the casino may delay filing for an additional 30 calendar days to identify one, but never more than 60 calendar days after initial detection.

Where a violation needs immediate attention, such as an ongoing money laundering scheme, (b)(3) also requires the casino to notify an appropriate law enforcement authority by telephone immediately, in addition to filing a timely SAR. Paragraph (c) is a narrow exception: no SAR is required for a robbery or burglary, committed or attempted, that is reported to appropriate law enforcement authorities.

Confidentiality, joint SARs and record retention

No tipping off

Under (e)(1), no casino, and no director, officer, employee or agent of a casino, may disclose a SAR or any information that would reveal its existence. If a casino is subpoenaed or otherwise asked to disclose a SAR, it must decline, citing the section and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and its response. Disclosures to FinCEN, law enforcement and regulators that examine the casino for Bank Secrecy Act compliance are allowed, provided no person involved in the reported transaction is notified that it has been reported.

Joint filing

The permitted disclosures include sharing the underlying facts, transactions and documents with another financial institution for a joint SAR, again provided no person involved in the transaction is notified. Paragraph (f) protects a casino and its people from liability for voluntary disclosures and for disclosures made under the section, including jointly with another institution, to the extent provided by 31 U.S.C. 5318(g)(3).

Five-year retention

Paragraph (d) requires the casino to keep a copy of each SAR and the original or business-record equivalent of supporting documentation for five years from the date of filing. Supporting documentation must be identified as such, is deemed filed with the SAR, and must be made available on request to FinCEN, federal, state or local law enforcement, and the casino's examining regulators. Paragraph (g) adds that casinos are examined for compliance and that failure to meet the section may be a violation of the Bank Secrecy Act.

SAR vs CTR: why $10,000 cash and suspicion are separate

A SAR and a currency transaction report are different obligations. Under 31 CFR 1021.311, each casino must report each transaction in currency, involving either cash in or cash out, of more than $10,000. Cash in includes chip purchases, front money deposits and payments on markers; cash out includes redemptions of chips, front money withdrawals and the cashing of checks. The CTR is triggered by amount and currency alone. A SAR is triggered by suspicion plus at least $5,000 and need not involve cash at all.

So one event can need one report, both, or neither. A routine $12,000 cash chip purchase is a CTR event without suspicion. A $6,000 non-cash transaction that meets a suspicious category is a SAR event without a CTR.

US SAR vs Canada's STR: a side-by-side

Teams that serve both markets often assume the two suspicion reports are the same. They are not. FINTRAC's suspicious transaction guidance sets reasonable grounds to suspect as the threshold, with no monetary threshold, and says to submit the report as soon as practicable after completing measures that establish those grounds. It also requires keeping a copy for at least 5 years after the report is sent. See our guide to suspicious transaction reports under FINTRAC for the Canadian how-to, and our piece on large cash transaction reports for Canadian casinos for the cash side.

The practical difference: the US sets a dollar floor and a fixed outer deadline, while Canada has no floor and no fixed day count in the guidance read for this article. A group program should document both rather than force one workflow onto the other.

Building the alert-to-SAR escalation workflow

The regulation tells you what must be filed and when, not how to organise your internal queue. The steps below are an operational suggestion, not a rule. Pair them with your AML compliance program for online casinos and your transaction monitoring in iGaming design.

1. Stamp the detection date. Record the date facts that may form a basis for a SAR were first detected, because (b)(3) counts from it.
2. Aggregate and assess. Note the transaction amounts, the pattern, and whether the total involves or aggregates at least $5,000.
3. Map to a category. Record which of the four (a)(2) categories applies, or why none does, and what facts were examined.
4. Decide and sign off. Log the decision, the person who made it and the rationale, including a decision not to file.
5. Escalate urgent matters. If the facts need immediate attention, note the telephone notification to law enforcement required by (b)(3).
6. File and retain. Store the SAR and supporting documentation, clearly labelled, for five years from filing.
7. Control access. Limit who can see SAR existence, consistent with the confidentiality rule.

Responsible gambling and legal note

This is a B2B compliance explainer for people who work in or advise regulated gambling businesses. It does not encourage play. Gambling is for adults only, 18 or 21 depending on where local law applies, and it is entertainment rather than income. Nothing here suggests any outcome is guaranteed. Operators' own responsible-gambling and self-exclusion duties apply. Nothing on this page is legal advice; confirm with counsel and current FinCEN guidance.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles