Skip to main content

Lesson 04 of 8

Structuring the Narrative: Introduction, Body, Conclusion

5 min read · SAR

Turn six elements into one readable story. Open to orient the reader, tell the body chronologically with the money flow woven in, and close by stating the suspicion plainly — all in self-contained plain English.

Structure is a courtesy to your reader

  • Same facts, two orders — one is readable, one isn't
  • FinCEN guidance recommends a clear introduction, body, conclusion
  • Chronological order beats stream-of-consciousness
  • Structure is how you make six elements flow as one story

You now have the six elements. This lecture is about the order you put them in, because the same facts arranged two different ways produce one narrative a reader glides through and one they have to fight. Structure is a courtesy to the person reading under time pressure.

FinCEN's narrative guidance recommends organizing a SAR narrative with a clear opening, a chronological body, and a conclusion, and that simple shape does an enormous amount of work. It tells the reader up front what they're looking at, walks them through the activity in the order it happened, and closes by stating the suspicion plainly. Your goal is for someone with zero prior context to read top to bottom, once, and understand the whole thing.

Let's build that shape.

The introduction: orient the reader fast

  • One or two sentences: who, the institution's relationship, and the gist
  • State the type of suspicious activity and the total amount
  • Give the time period at a glance
  • The reader should know the whole picture before the details

Start with a short introduction, one or two sentences that orient the reader before any detail. Name the subject, state the institution's relationship to them, identify the kind of suspicious activity, and give the headline numbers: the total amount and the time period. Something like, this SAR is filed on a long-time business-checking customer for apparent structuring of cash deposits totaling roughly eighty-five thousand dollars over a three-month period.

In one breath the reader knows who, what, how much, and when. That framing is a gift, because everything that follows now has a place to land. Without it, the reader assembles the picture only at the very end, after wading through transactions they couldn't yet interpret.

Tell them the destination before you start the journey.

The body: chronological and concrete

  • Walk the activity in the order it happened
  • Group related transactions; give dates and amounts
  • Weave in the how — the money flow — as you go
  • Anchor every claim to a specific transaction or document

The body is where the activity gets told in full, and the default order is chronological. Walk the reader through what happened in the sequence it happened, grouping related transactions so the pattern is visible, and giving real dates and amounts rather than vague approximations. As you move through the timeline, weave in the how, the mechanics of how funds moved from one account or instrument to the next, so the money flow is traceable as the story unfolds.

The discipline here is to anchor every statement to something specific: a transaction, a date, a document. Avoid summarizing in conclusions the reader can't check. Instead of the customer engaged in suspicious wire activity, write between March third and March twenty-first the customer sent six wires of nine thousand five hundred dollars each to the same beneficiary in country X.

The second sentence the reader can verify; the first they just have to trust.

The conclusion: state the suspicion plainly

  • Close by naming the suspicion and why it rose to a SAR
  • Tie the facts back to the red flags and the missing lawful purpose
  • Note any law-enforcement contact or related filings if applicable
  • Don't introduce new facts in the conclusion

Close with a short conclusion that states the suspicion plainly. This is where the why lands with full force: tie the facts you've just laid out back to the red flags and to the absence of a legitimate explanation, and say in so many words why the institution determined the activity warranted a SAR. If there's relevant context, prior law-enforcement contact, a related earlier filing, or that the customer was unable to explain the activity when asked, note it here.

One caution: the conclusion summarizes, it doesn't surprise. Don't introduce a brand-new fact in the last sentence that the body never mentioned. The reader should finish the conclusion feeling that it confirms what the body already showed them, not that the real story was hiding at the end.

Write so a stranger can follow it

  • Plain English first; define acronyms and jargon on first use
  • Spell out internal codes, product names, and abbreviations
  • Keep the narrative self-contained — no 'see attached'
  • Supporting documents stay in the file, not pasted into the narrative

Two style rules tie the structure together. First, write in plain English and define anything a stranger wouldn't know. Your institution's internal product codes, system names, and abbreviations mean nothing to an outside investigator, so spell them out the first time.

The narrative should read clearly to someone who has never seen your bank, your customer, or your systems. Second, keep the narrative self-contained. A reader should not have to chase down attachments or other records to understand it; references like see attached documentation break that.

Supporting documents, statements, copies of items, internal notes, belong in the institution's file and are produced on request, but the narrative itself has to stand on its own two feet. If your draft only makes sense to someone who already works where you work, it isn't finished.

Recap and next

  • Introduction orients; body tells it chronologically; conclusion states the suspicion
  • Anchor every claim to a specific fact
  • Plain English, defined terms, self-contained
  • Next — the failures reviewers flag, and the fix for each

Recapping the shape of a strong narrative. Open with a short introduction that gives who, what, how much, and when in a sentence or two. Tell the body chronologically, grouping related transactions, weaving in the money flow, and anchoring every claim to a specific fact a reader could check.

Close with a conclusion that states the suspicion plainly and adds no new surprises. Throughout, write in plain English, define your jargon, and keep the narrative self-contained so it stands alone, with supporting documents living in the file rather than pasted into the text. That structure turns six elements into one readable story.

In the next lecture, we look at exactly what goes wrong, the specific failures reviewers and FinCEN flag most often, and the concrete fix for each.

Sources

  • FinCEN, Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative (FIN-2003-G002)
  • FinCEN SAR (FinCEN Report 111) filed via the BSA E-Filing System
  • FFIEC BSA/AML Examination Manual — Suspicious Activity Reporting

Test your knowledge

A few SAR questions on this material — pick an answer to see the explanation.

  1. Q1. Which of the following is a common, correctable defect that makes a SAR narrative incomplete or insufficient?

  2. Q2. During a SAR investigation, which action would violate the tipping-off prohibition?

  3. Q3. A reviewer worries that filing a SAR in good faith could expose the institution to a defamation or breach-of-confidentiality lawsuit from the customer if the suspicion turns out to be unfounded. What protection applies?

  4. Q4. What is the SAR filing threshold for a money services business (MSB) when a transaction involves a suspect?

Ready to practice?

Put this lesson to work on real SAR questions.

Drill the full SAR bank →