Managing Suspicious Activity Reports (SAR)

Once a case is closed as SAR, Corsa automatically creates a draft SAR filing pre-linked to that case. Use the endpoints on this page to fill out the filing, sign off each section, and advance it through its lifecycle until it is submitted to your regulator. Full API endpoint details are available in the API Reference (requires API credentials).

SAR Lifecycle

DRAFT → IN_REVIEW → FILED

Status	Description
`DRAFT`	Created automatically when a case is closed as SAR. Fill out the report fields and sign off sections before advancing.
`IN_REVIEW`	All sections have been reviewed. The report is ready for final sign-off before filing.
`FILED`	The SAR has been submitted. Most fields can no longer be changed.

Call POST /v1/sar/{id}/submit to advance from DRAFT to IN_REVIEW, and again to advance from IN_REVIEW to FILED.

Update a SAR

Endpoint: PUT /v1/sar/{id}/update Fill in or update the report fields. Most fields can be updated freely while the SAR is in DRAFT or IN_REVIEW status. Fields marked “cannot be changed once FILED” lock after submission.

PUT /v1/sar/sar_abc123def456/update
Content-Type: application/json

{
  "referenceId": "SAR-2024-001234",
  "filingType": "SAR",
  "priority": "HIGH",
  "suspicionCategory": "STRUCTURING",
  "regulator": "FINCEN",
  "totalValueInFiat": 125000.50,
  "baseCurrency": "USD",
  "jurisdiction": "US",
  "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days to avoid CTR reporting thresholds.",
  "narrative": "Between January 1 and January 31, 2024, the subject...",
  "typologyTags": ["structuring", "smurfing"],
  "geographiesInvolved": ["US"],
  "lawEnforcementInquiry": false
}

const sar = await fetch(
  `${BASE_URL}/v1/sar/sar_abc123def456/update`,
  {
    method: "PUT",
    headers: {
      Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      referenceId: "SAR-2024-001234",
      filingType: "SAR",
      priority: "HIGH",
      suspicionCategory: "STRUCTURING",
      regulator: "FINCEN",
      totalValueInFiat: 125000.50,
      baseCurrency: "USD",
      jurisdiction: "US",
      summary: "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
      narrative: "Between January 1 and January 31, 2024, the subject...",
      typologyTags: ["structuring", "smurfing"],
      geographiesInvolved: ["US"],
      lawEnforcementInquiry: false,
    }),
  }
);
const updated = await sar.json();

import httpx

resp = httpx.put(
    "https://api.corsa.finance/v1/sar/sar_abc123def456/update",
    headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
    json={
        "referenceId": "SAR-2024-001234",
        "filingType": "SAR",
        "priority": "HIGH",
        "suspicionCategory": "STRUCTURING",
        "regulator": "FINCEN",
        "totalValueInFiat": 125000.50,
        "baseCurrency": "USD",
        "jurisdiction": "US",
        "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
        "narrative": "Between January 1 and January 31, 2024, the subject...",
        "typologyTags": ["structuring", "smurfing"],
        "geographiesInvolved": ["US"],
        "lawEnforcementInquiry": False,
    },
)
sar = resp.json()

Request Fields

Field	Description
`referenceId`	External or human-facing reference ID for the report (e.g. `SAR-2024-001234`). Max 255 characters.
`filingType`	Type of regulatory filing: `SAR`, `STR`, `UAR`, or `OTHER`.
`priority`	Report priority: `LOW`, `MEDIUM`, or `HIGH`.
`suspicionCategory`	Category of suspicious activity. See Suspicion categories below.
`regulator`	Regulator the report is filed with: `FINCEN`, `OTHER`, or `NA`.
`totalValueInFiat`	Total reported transaction value. Cannot be changed once the SAR is `FILED`.
`baseCurrency`	ISO currency code for `totalValueInFiat` (e.g. `USD`). Cannot be changed once `FILED`.
`jurisdiction`	Reporting jurisdiction (e.g. `US`). Max 100 characters.
`summary`	Short summary of the suspicious activity. Max 2,000 characters.
`narrative`	Full narrative section of the report. Max 20,000 characters.
`typologyTags`	User-defined typology tags for categorizing the activity (e.g. `["structuring", "smurfing"]`). Max 50 tags.
`geographiesInvolved`	ISO 3166-1 alpha-2 country codes for countries involved (e.g. `["US", "PA"]`). Max 100 entries.
`lawEnforcementInquiry`	`true` if there is an associated law enforcement inquiry.
`assigneeId`	Corsa user ID of the analyst responsible for this filing.

Suspicion categories

Value	Description
`STRUCTURING`	Structuring or smurfing to avoid reporting thresholds
`TERRORIST_FINANCING`	Suspected terrorist financing activity
`FRAUD`	Suspected fraud
`MONEY_LAUNDERING`	General money laundering activity
`GAMING_ACTIVITIES`	Gaming-related suspicious activity
`IDENTIFICATION_DOCUMENTATION`	Issues with identity documentation
`CYBER_EVENT`	Cybercrime or cyber-enabled activity
`MORTGAGE_FRAUD`	Mortgage-related fraud
`INSURANCE`	Insurance-related suspicious activity
`SECURITIES_FUTURES_OPTIONS`	Securities, futures, or options fraud
`OTHER_SUSPICIOUS_ACTIVITIES`	Suspicious activity not covered by other categories
`OTHER`	Other

Sign Off a Section

Endpoint: PUT /v1/sar/{id}/section-review SARs are divided into sections that must be individually reviewed and signed off before the filing can be submitted. Sign off a section to mark it as complete, or reopen it to make additional changes.

Section	Description
`SUBJECTS`	Subjects of the report (individuals or entities involved)
`ACTIVITY`	Details of the suspicious activity
`INSTITUTION`	Information about the reporting institution’s branch or office
`FILING_INSTITUTION`	Contact information for the filing institution
`NARRATIVE`	Full narrative and typology description

# Sign off the NARRATIVE section
PUT /v1/sar/sar_abc123def456/section-review
Content-Type: application/json

{
  "section": "NARRATIVE",
  "reviewed": true
}

# Reopen a previously signed-off section
PUT /v1/sar/sar_abc123def456/section-review
Content-Type: application/json

{
  "section": "NARRATIVE",
  "reviewed": false
}

// Sign off the NARRATIVE section
const sar = await fetch(
  `${BASE_URL}/v1/sar/sar_abc123def456/section-review`,
  {
    method: "PUT",
    headers: {
      Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      section: "NARRATIVE",
      reviewed: true,
    }),
  }
);
const updated = await sar.json();

import httpx

resp = httpx.put(
    "https://api.corsa.finance/v1/sar/sar_abc123def456/section-review",
    headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
    json={"section": "NARRATIVE", "reviewed": True},
)
sar = resp.json()

Request Fields

Field	Required	Description
`section`	Yes	The section to sign off or reopen: `SUBJECTS`, `ACTIVITY`, `INSTITUTION`, `FILING_INSTITUTION`, or `NARRATIVE`.
`reviewed`	Yes	`true` to sign off the section; `false` to reopen it and clear the existing sign-off.

Advance the SAR Lifecycle

Endpoint: POST /v1/sar/{id}/submit Advances the SAR to the next status in its lifecycle. Call this endpoint twice to take a SAR from DRAFT to FILED:

First call: DRAFT → IN_REVIEW
Second call: IN_REVIEW → FILED

POST /v1/sar/sar_abc123def456/submit

const sar = await fetch(
  `${BASE_URL}/v1/sar/sar_abc123def456/submit`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
    },
  }
);
const advanced = await sar.json();

import httpx

resp = httpx.post(
    "https://api.corsa.finance/v1/sar/sar_abc123def456/submit",
    headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
)
sar = resp.json()

Once a SAR is FILED, monetary fields (totalValueInFiat, baseCurrency) cannot be changed. Verify all report data before submitting.

SAR Response Object

{
  "id": "sar_abc123def456",
  "referenceId": "SAR-2024-001234",
  "status": "DRAFT",
  "filingType": "SAR",
  "priority": "HIGH",
  "suspicionCategory": "STRUCTURING",
  "regulator": "FINCEN",
  "totalValueInFiat": 125000.50,
  "baseCurrency": "USD",
  "jurisdiction": "US",
  "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
  "typologyTags": ["structuring", "smurfing"],
  "geographiesInvolved": ["US"],
  "lawEnforcementInquiry": false,
  "createdAt": "2024-01-15T10:00:00Z",
  "updatedAt": "2024-01-15T16:30:00Z"
}

Data Ingestion

Managing Suspicious Activity Reports (SAR)

SAR Lifecycle

Update a SAR

Request Fields

Suspicion categories

Sign Off a Section

Request Fields

Advance the SAR Lifecycle

SAR Response Object

What’s Next?

Managing Alerts & Cases

Managing Attachments

​SAR Lifecycle

​Update a SAR

​Request Fields

​Suspicion categories

​Sign Off a Section

​Request Fields

​Advance the SAR Lifecycle

​SAR Response Object

​What’s Next?

Managing Alerts & Cases

Managing Attachments

SAR Lifecycle

Update a SAR

Request Fields

Suspicion categories

Sign Off a Section

Request Fields

Advance the SAR Lifecycle

SAR Response Object

What’s Next?