Documentation and Evidence Quality
Key Takeaways
- The SAR narrative is the heart of the report — it must answer who, what, when, where, why, and how in clear, factual language.
- Good documentation is contemporaneous, objective, source-cited, and free of speculation or conclusions of law.
- Supporting documentation must be retained for 5 years and provided to FinCEN or law enforcement on request — but not attached to the SAR itself.
- Poor narratives (vague, jargon-heavy, missing dollar amounts or dates) are a leading cause of low-value SAR filings.
Why Documentation Quality Matters
A Suspicious Activity Report (SAR) is only as valuable as the facts and narrative behind it. The Financial Crimes Enforcement Network (FinCEN) and law-enforcement analysts read thousands of filings; a vague report buries the signal. The CAMS exam treats evidence quality and the SAR narrative as core investigator skills, because a defensible file protects the institution and a clear narrative makes the report actionable.
The SAR Narrative: Five W's and How
The narrative is the heart of the SAR. It should be written in plain English and answer the classic questions:
| Element | What to capture |
|---|---|
| Who | Subjects, account holders, beneficial owners, counterparties |
| What | The suspicious activity and why it is suspicious |
| When | Specific dates and the time span of the activity |
| Where | Branches, jurisdictions, accounts, instruments involved |
| Why | The articulable basis for suspicion (typology, deviation from profile) |
| How | The mechanics — cash, wires, structuring, third parties |
Always quantify: state exact dollar amounts, transaction counts, and date ranges. "Customer made nine cash deposits totaling $84,600 between March 3 and March 7 across three branches" is far stronger than "customer made several large deposits recently."
Hallmarks of High-Quality Evidence
- Contemporaneous. Record findings as the work is done; memory and reconstruction weaken reliability.
- Objective and factual. Describe what was observed; avoid speculation, emotion, or legal conclusions such as "the customer is a money launderer." State facts that support suspicion.
- Source-cited. Note where each fact came from — internal system, registry, court record, adverse media — with retrieval dates.
- Complete and self-contained. A reader with no prior context should understand the case from the narrative alone.
- Free of unexplained jargon and acronyms. Spell terms out; analysts outside the institution must follow it.
Worked Example: Weak vs. Strong
Weak: "Customer's activity looked off and seemed like laundering, so we filed." This states a legal conclusion, gives no amounts, dates, or mechanism, and is not actionable.
Strong: "Between 03/03/2026 and 03/07/2026, the customer deposited cash in nine transactions totaling $84,600 at three branches, each between $9,200 and $9,800 — amounts consistently below the $10,000 CTR threshold. Stated occupation (part-time tutor) does not support this volume. No legitimate source of funds was provided. Activity is consistent with structuring." This is factual, quantified, sourced, and immediately useful.
Retention and the Supporting File
The institution must retain the SAR and all supporting documentation for five years from the filing date and make it available to FinCEN or law enforcement upon request. A key exam point: do not attach supporting documents to the SAR; reference them in the narrative and hold them in the case file. Supporting documentation includes transaction records, account-opening files, internal memos, and the investigator's notes.
Structuring the Narrative
FinCEN guidance favors a logical narrative structure. A reliable template:
- Introduction — who is filing, what type of activity, the total amount, and the date range.
- Body — a chronological account of the activity with specific transactions, amounts, dates, and parties.
- Conclusion — why the activity is suspicious (the typology and the deviation from expected profile) and any action taken.
Write in the past tense, third person, and active voice. Define every entity on first mention and avoid internal codes the reader cannot decode.
Documenting the No-File Decision
The exam stresses that closing a case without filing also requires documentation. A clear, contemporaneous rationale — "the large deposit was a documented inheritance supported by a probate record" — protects the institution if the activity is later questioned. Undocumented closures are an audit and examination red flag, because they suggest decisions were not risk-based.
A Quality Checklist
Before a SAR leaves the queue, an investigator should confirm:
- Every dollar amount, date, and transaction count is specific and accurate.
- The narrative names all subjects and counterparties and their roles.
- The basis for suspicion is stated as fact, not as a legal conclusion.
- Sources for external facts are identified.
- The narrative is self-contained and readable by an outside analyst.
- Acronyms are spelled out on first use.
- Supporting documents are retained, not attached.
Why Quality Drives Value
Law enforcement prioritizes actionable filings. A 2019-era FinCEN advisory theme that the exam echoes is that vague, formulaic SARs waste analyst time and obscure genuine threats. A precise narrative — quantified, sourced, and typology-aware — increases the chance the report supports an investigation or asset seizure. Quality documentation is therefore not bureaucratic overhead; it is the deliverable that gives the entire investigation its public-protection value, and it is the single artifact an examiner reviews to judge whether the program's investigations are effective.
Common Traps
- Conclusions instead of facts. Write what supports suspicion, not a verdict.
- Omitting amounts and dates. Numbers make a narrative actionable.
- Attaching files to the SAR. Keep them in the case file; provide on request.
- Backdating or editing notes. Documentation must be contemporaneous and tamper-evident to remain credible in an examination or court.
Which SAR narrative best meets the standard for evidence quality?
How should an institution handle the documents that support a filed SAR?