16.2 Writing Effective SAR and STR Narratives
Key Takeaways
FinCEN's 2003 narrative guidance asks filers to cover who, what, when, where, why and how in a clear, complete and chronological narrative.
A strong narrative opens with a summary of the suspicious activity, gives the facts chronologically, and closes with the actions the institution took.
Narratives should include identifiers such as account numbers, amounts, dates, counterparties, IP addresses, device data and blockchain transaction hashes where relevant.
UK filers use NCA glossary codes such as XXS99XX to flag a request for a defence against money laundering.
CAFCA sub-topic 4.4 includes best practices for writing SARs and STRs. Analysts at the FIU and in law enforcement read thousands of reports. A clear narrative gets used, while a vague one gets ignored. In the US, FinCEN's guidance on preparing a complete and sufficient SAR narrative (2003) remains the standard reference.
The five Ws and how
| Question | What to include |
|---|---|
| Who is conducting the activity? | Subjects' names, dates of birth, addresses, identification numbers, account numbers, occupation or business, relationship to the institution; counterparties and their banks or VASPs |
| What happened? | Instruments and methods (P2P, ACH, wire, card, crypto); products used |
| When did it occur? | Start and end dates; dates of key transactions; the date of initial detection |
| Where did it happen? | Branches or channels, countries, IP locations, receiving institutions, wallet addresses |
| Why is it suspicious? | The red flags, how the activity departs from the expected profile, the typology it fits, and the customer's explanation and why it did not resolve the concern |
| How was it done? | The mechanics: how funds entered, moved and left; the links between accounts; device or login patterns |
A three-part structure
- Introduction: one paragraph summarising the suspicious activity, the subjects, the total amount, the period, why it is suspicious, and any prior related SARs (by reference number). Include advisory key terms, such as FIN-2023-PIGBUTCHERING, in field 2 and the narrative where FinCEN requests them.
- Body: a chronological account of the activity and the investigation. Cover the flow of funds, counterparties, patterns and amounts, technical indicators (IPs, device IDs, transaction hashes, wallet addresses), RFIs and responses, and open-source findings that support the suspicion.
- Conclusion: the actions taken or planned (account restricted or closed, law enforcement contacted, funds frozen), whether supporting documentation is available, and a contact point.
FinCEN's electronic SAR accepts a single CSV attachment for tabular transaction data. The narrative must still explain the activity, so do not write only "see attachment".
Before and after
Weak: "Customer had unusual activity. Many transfers in and out. Possible money laundering. Account closed."
Strong: "Between 2 and 9 June 2026, Jane Doe (DOB 1 Feb 2004; account 1234) received 23 P2P credits totalling US$16,480 from 19 unrelated individuals in four states. Within an average of 18 minutes of each credit, she sent the funds by push-to-card to two cards issued to third parties, leaving a closing balance of US$12. Three senders filed scam complaints describing a fake rental listing. The device used to log in (device ID ABC…) was also used on accounts 5678 and 9012, which were opened in other names during the same week. When asked about the payments, Ms Doe said she was 'helping a friend with rent collection' but could not name the friend or provide any documents. The pattern is consistent with a funnel account receiving scam proceeds. The account was restricted on 10 June and will be closed. Supporting documentation is available on request."
Style rules
- Be concise but complete. Include every fact a reader needs and nothing irrelevant.
- Use plain language. Spell out internal codes and abbreviations, and do not name systems the reader will not recognise.
- Be objective. Describe behaviour and facts. Avoid speculation and loaded language, and never refer to protected characteristics unless they are directly relevant (for example, elder exploitation).
- Be precise. Give exact amounts, dates and identifiers, consistent with the structured fields of the form.
- Explain the conclusion. Say clearly why the facts are suspicious. Do not assume the reader will infer it.
- Do not copy and paste templates that do not fit the case.
Jurisdiction notes
- United Kingdom: the NCA publishes guidance on SAR quality and glossary codes that help it route reports. For example, XXS99XX marks a request for a defence against money laundering. A DAML request must clearly describe the criminal property, the proposed transaction and the reasons for suspicion.
- Other FIUs: many use structured goAML forms with a free-text section. The same five-Ws discipline applies.
Realistic exam scenario
A reviewer returns a draft SAR because it lists 60 transactions in a table but never explains what links them or why they are suspicious. The analyst should add an introduction summarising the scheme and a body that explains the funnel pattern, the counterparties and the evidence. The conclusion should note the restriction placed on the account, and the transaction table should be kept as supporting material.
Common exam traps
- "See attached" narratives.
- Omitting why the activity is suspicious, leaving only a list of transactions.
- Including irrelevant personal details or speculation.
- Leaving out advisory key terms that FinCEN has requested.
Which element does FinCEN guidance say a SAR narrative must clearly explain, beyond listing transactions?
The names and job titles of every employee who reviewed the alert
The institution's quarterly profit and the account's fee income
Why the activity is suspicious, including red flags and how it departs from the profile
The analyst's personal opinion of the customer's character and lifestyle
What is the best structure for a SAR narrative?
A transaction table with no explanatory text, attached as a CSV
A summary introduction, a chronological body, and a conclusion on actions taken
A copy of the alert rule logic and the scenario thresholds that fired
A conclusion only, kept to one sentence to save the reader's time
A UK firm submits a SAR that requests a defence against money laundering for a pending payment. What should it include to help the NCA route the request?
Glossary code XXS99XX plus a clear description of the property, the transaction and the suspicion
Only the customer's name and account number, to keep it brief
A request for the customer to countersign the SAR before it is sent
A copy of the firm's AML policy and its latest risk assessment
Sections you finish are checked off in the contents.