Writing an Effective SAR Narrative *(OUTLINE + BULLET BODY)*

Most Suspicious Activity Reports are never read by a human investigator. The ones that get acted on are the ones where the narrative tells a clear, complete story in plain language — who did what, when, where, and why it looks like a crime. A brilliant investigation with a vague narrative is a wasted SAR. FinCEN itself calls the narrative the most important part of the report. By the end of this lecture, you'll be able to structure one that an overworked agent can read in two minutes and immediately understand.

- FinCEN guidance (notably the **SAR Activity Review** and SAR narrative guidance) describes the narrative as the **single most important part of the SAR** — it's where the institution **explains the suspicion** that the structured data fields can't capture. - Its audience is **law enforcement and FinCEN analysts** who may have **no other context.** The narrative must stand alone: clear, chronological, factual, and complete. - A good narrative determines whether a SAR becomes an **investigative lead** or gets lost in the millions filed each year. Quality, not volume, is what makes a SAR useful.

- **Who** — identify the **subject(s)**: names, account numbers, identifiers, occupation/business, relationships among parties, and their **role** (sender, receiver, beneficiary, conductor). Be specific. - **What** — describe the **suspicious activity and instruments**: transaction types (cash, wires, monetary instruments), the **typology** it resembles (structuring, funnel account, pass-through), and the **total dollar amount** involved. - **When** — the **time period and dates**, in **chronological order**; note patterns (e.g., deposits every few days just under $10,000). - **Where** — the **locations/branches, accounts, and jurisdictions** involved, including any high-risk geographies. - **Why** — the **reason it is suspicious**: how the activity **departs from the customer's expected profile** or matches a known red flag/typology. This is the analytical heart of the narrative. - **How** — the **mechanics**: exactly how the activity was conducted and how funds moved through accounts/instruments/institutions. - Practical form: a strong narrative is usually **introduction (who/what summary) → body (chronological detail) → conclusion (why suspicious + actions taken, e.g., account closed, monitoring continued).** Write in **plain English, full names spelled out, no internal jargon or unexplained codes.**

- **Do NOT attach** supporting documents to the filed SAR. Instead, **identify** them in the narrative and **retain them separately** for **5 years**, available to FinCEN/law enforcement **on request without a subpoena** (31 CFR 1020.320). - Typical support: **account statements, transaction records, wire details, copies of monetary instruments, KYC/CDD documents, and correspondence.** - The narrative should **reference** what supporting documentation exists so an investigator knows what to request — but the report itself stays a clean summary.

- **Too vague / conclusory** — "the activity was suspicious" without the supporting facts. State the **specific facts** that make it suspicious. - **Omitting the "why"** — listing transactions but never explaining how they deviate from the expected profile or which red flag they hit. - **Missing key data** — leaving out amounts, dates, account numbers, or full subject identifiers. - **Jargon and unexplained codes/abbreviations** — internal system terms a reader outside the institution can't decode. - **Including SAR-confidentiality breaches** — don't reference the SAR itself in customer communications; and remember **tipping-off** — the narrative is confidential and must not be disclosed to the subject. - **Copy-paste / template narratives** that don't actually describe *this* case — and disorganized, non-chronological storytelling. - **Editorializing** — keep it **objective and factual**; report what was observed, not speculation about guilt.

- **File within 30 calendar days** of **initial detection** of facts that may constitute a basis for filing (31 CFR 1020.320 for banks). - If **no suspect is identified** on the date of detection, the institution may take an **additional 30 days** to identify one — but must file **no later than 60 calendar days** after initial detection. - **MSB SAR threshold** is **$2,000+** (vs. banks' $5,000 with an identified suspect / $25,000 regardless of suspect). - **Continuing activity:** review ongoing suspicious activity and, where appropriate, file a **continuing SAR** — common practice is roughly **every 90 days** while the activity persists. - **E-filing:** SARs are filed electronically through the **FinCEN BSA E-Filing System**; the narrative field has a character limit, so write **concisely and completely.**

So a SAR narrative is a story with a job. Its purpose is to explain the suspicion to a reader who has no other context, so you build it around the five W's plus how — who the subjects are, what they did, when and where, why it's suspicious against their profile, and how the money actually moved — in plain English, chronologically, with every amount and identifier. Identify your supporting documents but don't attach them; retain them five years. Dodge the classic mistakes: vagueness, no "why," jargon, and editorializing. And never miss the clock: thirty days from detection, sixty if you're still hunting for a suspect. Next, we stay in Domain 5 and turn to the more mechanical reports — CTR filing and exemptions, the funds-transfer Travel Rule, and the recordkeeping retention periods that tie the whole reporting regime together.