The Five Essential Elements: Who, What, When, Where, Why — Plus How

This is the heart of SAR writing, so we'll spend a full lecture on it. FinCEN's published guidance on preparing a complete and sufficient narrative, the document compliance professionals know as F-I-N two-thousand-three dash G-zero-zero-two, frames the narrative around five essential elements: who, what, when, where, and why. To those five we add a sixth that good writers never skip, the how.

Together, who, what, when, where, why, and how are the questions a reader brings to your narrative. A sufficient narrative answers all of them. And the single most common gap a reviewer finds is not bad writing, it's a missing element, a narrative that names the suspect and the amount but never says when, or describes the pattern but never explains why it's suspicious.

Let's take them one at a time.

Start with who and what. Who is everyone relevant: the subject or subjects of the report, their accounts, and any related parties, identified clearly, full names, account numbers, and how each person connects to the activity. Don't make the reader guess whether two names are the same person or how an account relates to your customer.

What is the suspicious activity itself, described in concrete terms. Not the customer engaged in unusual activity, which says nothing, but the specific behavior: a series of cash deposits just under ten thousand dollars, wires to a high-risk jurisdiction with no business rationale, rapid movement of funds in and immediately out. Name the instruments, the transaction types, and the pattern.

Who and what together establish the basic facts, and if either is vague, everything after it floats.

Next, when and where. When is the timeline: the dates of the transactions and the period the activity spans. A reader should be able to reconstruct the sequence of events from your narrative alone, so give real dates and make the chronology clear, because suspicion often lives in timing, deposits that cluster right after a large wire, or activity that spikes and then goes quiet.

Where is location in every sense that matters: the branches or channels used, the cities, and the jurisdictions the money touched. Geography frequently carries the suspicion itself. Funds routed through a high-risk corridor, an account opened in one state but operated entirely from another, transactions concentrated at a branch far from where the customer lives.

When and where turn a list of transactions into a story a reader can follow and place in the world.

Now the element that weak narratives most often leave out: why. Why is the reason this activity rose to the level of a SAR, the suspicion stated explicitly. It is not enough to lay out transactions and trust the reader to draw the conclusion you drew.

You have to connect the facts to the red flags and to the absence of a legitimate explanation. The deposits are suspicious because they sit just below the reporting threshold and are inconsistent with the customer's stated retail business. The wires are suspicious because the customer has no known commercial ties to the destination country and offered no business rationale when asked.

Spell out the so what. The reader was not in the room when your suspicion formed; the narrative is where you hand it to them. A narrative that describes activity but never says why it's suspicious is the classic insufficient SAR.

Finally, the sixth element, the how, which is what separates an adequate narrative from an actionable one. How is the mechanics: the method the subject used and the path the money took, step by step. How did the funds enter the institution, how did they move once inside, and how did they leave.

Cash in at one branch, consolidated into a single account, then wired out in round amounts to a third party. The how is what lets an investigator follow the money and connect it to activity at other institutions, which is the whole point of a SAR. A narrative can name the who, the what, the when, the where, and even the why, and still be only half useful if a reader finishes it unable to trace how the money actually moved.

If you can't follow the money in your own draft, neither can the person who receives it. Make the mechanics explicit.

Recapping the core of the craft. A sufficient SAR narrative answers six questions: who, what, when, where, and why, from FinCEN's narrative guidance, plus how, the practical sixth. Who and what set the facts, when and where give the timeline and the geography, why states the suspicion explicitly so the reader doesn't have to guess, and how traces the money so an investigator can act.

The two most often shortchanged are why and how, the very two that make a narrative useful, so check for them deliberately. Before you draft, extract each element from your fact pattern and confirm you actually have it. In the next lecture, we take these six elements and put them in order, structuring the narrative into an introduction, a body, and a conclusion a reviewer can pass on the first read.