FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
FinCEN’s October 2021 trend analysis showed that suspicious activity reports can map a criminal economy, but only when filers record cyber indicators in usable form. That choice, made at the investigator’s desk, decides the data’s value inside the bank too.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On October 15, 2021, the Financial Crimes Enforcement Network published a financial trend analysis of ransomware based on suspicious activity reports filed under the Bank Secrecy Act. It reported that ransomware-related SARs filed in the first half of 2021 described about $590 million in suspicious activity, more than the roughly $416 million reported for all of 2020. The analysis identified dozens of ransomware variants named in filings, found bitcoin to be the most common payment method, and described indicators filers had supplied, including wallet addresses. Earlier that week, the White House convened more than 30 countries for a virtual meeting on countering ransomware. The analysis followed FinCEN’s updated ransomware advisory of September 21, 2021, which asked institutions to include specific cyber indicators in their filings.
Suspicious activity reports are usually discussed as an obligation: a filing due within set deadlines, with a narrative that will satisfy an examiner. FinCEN’s October 2021 analysis used them as something else. It aggregated hundreds of filings into a picture of who was being paid, how and through which channels. That only worked because some filers had written their reports in a form a machine could join. Earlier in this series we looked at the sanctions side of ransom payments; this article is about the data. We take it in three parts: what made the aggregate useful, what limited it, and what an institution controls in its own records.
What made the aggregate useful
The analysis depended on specific, structured details. Wallet addresses, variant names, transaction hashes and dates can be matched across reports from different institutions. A single bank sees one customer wiring funds to an exchange. FinCEN, with reports from many filers, could see the same addresses recurring, the same intermediaries and the rough scale of payments. The September advisory had asked for exactly these indicators, and the October analysis was the first visible return on that request.
The second ingredient was overlap. A ransom payment often touches several regulated parties: the victim’s bank, a negotiation or incident response firm that makes the payment, and the exchange that receives it. Each may file. Linked properly, overlapping reports give a fuller view than any one of them, and they help separate one large payment reported three times from three separate payments. Linking works only if each filer uses identifiers consistently, such as the full wallet address rather than a truncated one, or the variant’s common name rather than an internal nickname.
What limited it
SAR data reflects what institutions noticed and chose to report. A rise in filings can mean more attacks, better detection, or more attention after an advisory. FinCEN described its figures as reported suspicious activity, not a census of ransom payments, and that caution matters for anyone citing them. Payments made outside the regulated system, or by victims whose banks did not recognize the pattern, never appear.
Timing is a further constraint. A SAR is generally due within 30 days of initial detection, and analysis of a half-year of filings takes months more. By the time an aggregate is published, the groups it describes may have rebranded or dispersed. The aggregate is therefore better at showing structure, such as which exchanges and intermediaries recur, than at giving early warning about a live campaign. Institutions that want early warning need their own internal view, built from the same fields, refreshed daily rather than twice a year.
Narrative quality was the other limit. Much of a SAR’s value sits in free text, and free text aggregates poorly. A narrative that says “customer sent funds related to a cyber incident” contributes almost nothing. One that names the variant, gives the address and amount, and states whether the payment went through a third-party negotiator contributes a lot. Investigators are rarely trained to write for aggregation. Their quality reviews tend to check whether the filing is defensible to an examiner, not whether it is useful to an analyst.
What an institution controls in its own records
The structured details that made FinCEN’s analysis possible are just as useful inside the bank. An institution that captures wallet addresses, variant names and counterparties in discrete fields can search its own history when a new advisory arrives. It can link a new alert to an earlier case. It can tell its board how often customers have paid ransoms, through which channels, and whether any of its commercial clients are repeat victims. That last point matters for credit risk as well as fraud, since a business hit twice is a weaker borrower.
Getting there is a data-model change, not an analytics project. Case management systems need fields for cyber indicators, with validation so an address is stored in full and in the right format. Investigators need a short controlled vocabulary for variants and payment routes, maintained by the financial intelligence unit and updated when advisories change. Investigation templates should mirror the indicators regulators have asked for, so details are captured once and flow to both the filing and the internal record.
Two constraints shape the design. SAR information is confidential by law, and even its existence cannot be disclosed outside narrow channels. Internal reuse therefore needs role-based access, logging and a clear purpose, reviewed with counsel. The second constraint is organizational. Indicators of compromise usually sit with the security team, while payment details sit with financial crime. When a customer, or the institution itself, is extorted, each team holds half the case. A standing exchange between the two, with agreed fields and a named contact on each side, closes that gap without exposing SAR content beyond those entitled to see it.
A simple test shows whether the work is done. When FinCEN or another regulator publishes a new ransomware advisory, ask the financial intelligence unit to answer its key questions from internal records: how many customers paid, to which addresses, through which intermediaries. If the answer takes an afternoon, the institution has turned a filing duty into a monitoring capability. If it takes weeks of reading narratives, the data model needs work.
With hindsight
FinCEN continued the series. A November 2022 analysis put ransomware-related activity reported for 2021 at close to $1.2 billion, while noting that reporting patterns had shifted. Blockchain analytics firms’ public estimates of ransomware payments tracked broadly similar trends, then showed declines in later years as more victims refused to pay and law enforcement disrupted major groups. The core finding of October 2021 held: the financial system’s reporting data is one of the few sources that sees payments directly, and its value depends on what filers record. Structured cyber fields in case management systems have become more common at larger institutions, and joint work between fraud, anti-money laundering and security teams is now a standard expectation. Smaller institutions still vary widely in whether their filings can be reused, inside or outside their walls.