SAR Filing in Multiple EU Jurisdictions: One Case, Many FIUs

VOVE ID helps payments and BaaS teams preserve identity, business, screening and decision evidence in markets where one suspicious pattern crosses several borders. On paper the case is one report. In practice the customer, merchant, branch, account and transaction chain can point to several national FIUs. This is exactly where teams either duplicate work or assume the first report ends the analysis.

The short answer

An EU cross-border case does not automatically require the same obliged entity to file identical reports with every FIU touched by the facts. The reporting destination normally follows the entity's establishment and applicable national law, while FIUs exchange cross-border information; branches, establishments, group entities and local obligations can change the route.

Why one case can involve several FIUs

The first control is not "send everywhere." It is "map why each jurisdiction is relevant." A case can involve the home state of the obliged entity, a branch or group entity, the customer's establishment, a merchant location, the payment account and the destination of funds.

Under the current EU framework, obliged entities report suspicion promptly to the FIU in the Member State where they are established. The forthcoming EU AML Regulation, which generally applies from 10 July 2027, keeps that establishment-based reporting logic. The new FIU Directive then requires an FIU that receives a report concerning another Member State to forward the report or relevant information promptly to that other FIU.

This means one thing: cross-border coordination is built into the FIU network, but the obliged entity still needs a defensible jurisdiction analysis. A branch, separately obliged group entity or local rule can create an additional reporting step. A merchant's location alone does not prove that an identical second filing is required.

For a full breakdown of AML program obligations, see our AML Requirements Explained 2026.

FIU-by-FIU differences: the same evidence, different submission process

National reporting channels do not behave like one EU form. Portals, schemas, urgency flags, attachment rules, transaction fields and feedback processes differ. Teams therefore need one canonical case record and a controlled transformation into the format accepted by the relevant FIU.

The canonical record should keep:

• the subject and related parties;
• the transactions and accounts in scope;
• the reason for suspicion and detection source;
• the chronology of events and review actions;
• the jurisdictions considered and why;
• the evidence supplied with each report;
• filing references, timestamps and follow-up requests.

The narrative can change to meet a national template. The underlying facts, identifiers and decision history should not drift between versions.

Cross-border reporting starts with one evidence record; jurisdiction mapping determines which reporting and cooperation routes apply.

A realistic SAR failure: when the case map stops at Lithuania

A Lithuanian EMI investigates a payment chain involving a Polish merchant. The compliance team records a Lithuanian customer account, a Polish merchant and settlement account, repeated payments inconsistent with the stated business model, and device and beneficiary links across both markets.

The team sends its report through the Lithuanian process and marks the case "filed." It does not record why Poland is relevant, whether a Polish establishment or separately obliged entity is involved, or which evidence should travel with any cross-border referral.

Later, the Polish FIU requests context through the FIU cooperation channel. The source case contains no clean merchant chronology and no stable snapshot of the supporting KYB evidence. Reviewers rebuild the file from exports, messages and screenshots.

The failure is not automatically "one Polish report was missing." The failure is that the team treated submission as the end of the control. It never completed the jurisdiction analysis or preserved a reusable cross-border case file.

How VOVE ID supports one controlled case record

VOVE ID keeps verified identity, company, UBO, screening and reviewer evidence connected to the customer record. That gives the reporting team a consistent factual base before it applies its own FIU-routing policy and national submission process.

The operating model is:

• resolve every person and entity in the case;
• preserve the alert, transactions, evidence and decision chronology;
• map establishments, branches, group entities and affected jurisdictions;
• let the MLRO or legal owner decide the reporting route;
• generate controlled case outputs without changing source facts;
• record submission references, FIU requests and subsequent decisions.

VOVE ID does not replace the institution's legal determination or national FIU portal. It makes the identity and case evidence easier to retrieve, review and defend.

Practical cross-border SAR checklist

Detection

• Record the trigger, affected transactions and reason for suspicion.
• Resolve customers, merchants, UBOs and counterparties before routing.
• Preserve the evidence snapshot used for the decision.

FIU mapping

• Identify the reporting entity's establishment, branches and group roles.
• Map each jurisdiction to a concrete legal or operational connection.
• Confirm national rules and filing channels with qualified counsel or the FIU.

Filing

• Keep one canonical case ID across every output.
• Reconcile facts and transaction totals before submission.
• Record filing references, timestamps, acknowledgements and follow-up requests.
• Restrict access and prevent prohibited disclosure to the subject.

Q&A

Must a fintech file the same SAR with every EU FIU touched by a transaction?

Not by default. The reporting route usually follows the establishment of the obliged entity, while FIUs exchange cross-border information. Branches, local establishments, group structures and national law can create additional duties, so the route needs a documented case-specific assessment.

Can a group submit one report for all of its EU entities?

A shared investigation can support several entities, but it does not erase each entity's obligations. Define which entity detected the suspicion, which entities are obliged, who files, and how each filing reference returns to the master case.

What should remain identical across FIU submissions?

Core identities, transactions, dates, source evidence and the case chronology should remain consistent. National templates can change structure and required fields, but they should not create conflicting facts.

When is a cross-border case complete?

Not when the first portal confirms receipt. It is complete when the jurisdiction decision, submission evidence, restrictions, follow-up requests and resulting customer controls are recorded.

Conclusion

Cross-border SAR work is not a copy-and-paste exercise. It is one investigation with a controlled evidence record and a reporting map that reflects establishments, obligations and FIU cooperation. Teams need to separate "jurisdiction touched by the facts" from "jurisdiction requiring a direct filing." Detection, FIU mapping and filing are one workflow.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.