SARs must be filed when a business or financial institution detects activities that are out of the ordinary and appear suspicious. These can include unusual transactions, inconsistencies in customer behavior, or other indicators of potential illegal activities. For instance, large cash deposits that don’t align with a customer’s profile or sudden changes in transaction patterns can be red flags.