How to Write a SAR Narrative

10/10/2026

The SAR narrative is the part of a suspicious activity report that does the work. The structured fields tell a database who and how much; the narrative tells an investigator what happened and why it matters. FinCEN's own filing instructions put it plainly: the care with which the narrative is completed may determine whether the activity and its possible criminal nature are clearly understood.

It is also the part most often written badly. Narratives that list transactions without saying why they are suspicious, that rely on internal codes, or that say "see attached" are common, and they turn a valid filing into a report nobody can use. This guide covers how to write a SAR narrative that stands on its own: the structure FinCEN recommends, the specific content its filing instructions call for, and side-by-side weak and strong examples.

For when a SAR is required and how fast, see our article on how to file a SAR. This one is about the writing.

Who reads the narrative, and why that shapes it

Write for the actual reader. A SAR narrative is read by someone at a law enforcement agency or regulator who:

Has no access to your systems. They cannot look up the account, see the alert, or read your case notes.
Does not know your bank's vocabulary. Your product names, transaction codes, alert scenario numbers and internal abbreviations mean nothing to them.
May be reading it months or years later, often because they searched a name and your SAR came up among several others.
Is deciding whether to spend time on it. A clear narrative gets used; an unclear one gets skipped.

Every rule that follows comes from this. If a narrative only makes sense with the case file open beside it, it is not finished.

The structure: who, what, when, where, why and how

FinCEN's guidance on preparing SAR narratives identifies five essential elements, who, what, when, where and why, and adds that the method of operation, how, is also important and should be included. It suggests organizing the narrative into an introduction, a body and a conclusion, written in a concise, chronological format.

The five Ws and the H

Who is conducting the suspicious activity?

Name every subject and give the identifying detail you have: address, date of birth, identification, occupation or line of business, relationship to the bank, and accounts. Describe the role each person played. For businesses, describe what the business says it does. If a subject is an employee or other insider, say so and explain how their position relates to the activity.

What instruments or mechanisms were used?

Cash, checks, wires, ACH, cards, cashier's checks, money orders, loans, safe deposit access, online banking. Give account numbers, including accounts at other institutions where known, and describe the flow of funds.

When did it happen?

Give the date the activity started, the dates of key transactions, and whether it is ongoing. For a pattern, give the date range and the totals.

Where did it happen?

Branches, ATMs, channels, cities and countries. For wires and transfers, the originating and receiving institutions and their locations.

Why is it suspicious?

This is the heart of the narrative and the part most often left out. State what the bank expected from this customer and how the activity differs, and say plainly what you suspect, such as structuring, funnel account activity, elder financial exploitation, or a business that appears to be a front. Do not leave the reader to infer it.

How did it occur?

Describe the mechanics: how money came in, moved, and left. If the activity appears to be layering, describe the layers. If a scam, describe the scheme.

Introduction, body and conclusion

FinCEN's narrative guidance suggests what each section can contain. Adapted for a bank:

Introduction. One short paragraph stating the purpose of the SAR and the type of suspicious activity; any prior SARs on the same subject or related subjects, with their dates and why they were filed; whether the matter relates to OFAC-sanctioned persons or other government lists; your internal case number, so investigators can reference it when they call; and a summary of the red flags. The guidance says the red-flag summary can go in either the introduction or the conclusion.

Body. The detail: facts about each party; the accounts and transactions, ideally showing where funds came from and where they went, in chronological order with dates and amounts; larger volumes broken into categories of credits and debits; transactor and beneficiary details; relationships among the parties; how cash transactions were conducted and at which branches; and any statements the subject made.

Conclusion. What the bank did or will do (for example, closing the account or continuing to monitor), other contacts at the bank if different from the contact listed on the form, a description of additional records available to law enforcement on request, and the names of any law enforcement personnel already involved.

What FinCEN's filing instructions add

FinCEN's electronic filing instructions for the narrative section include a checklist that goes beyond the five Ws. Points that matter most for banks:

Narratives must be in English.
Describe the conduct chronologically when it involves multiple instances or more than one day.
Say whether transactions were completed or only attempted.
Explain who benefited, and how, financially or otherwise.
Describe any admission or explanation the subject or anyone else gave, including to whom and when.
Indicate whether the activity is isolated or related to other activity.
Describe evidence of cover-up or attempts to deceive examiners or others.
Describe all supporting documentation, retain it for five years, and do not send it with the SAR.
Provide victim information only when needed to understand the activity, and do not list victims as subjects.
Include bank policies or practices only if necessary to understand the activity.
Do not include legal disclaimers.
For a corrected or amended report, describe the corrections or amendments at the beginning.
For a continuing report, describe the activity for the period the report covers and include from prior narratives only what is needed to understand it. Never paste entire prior narratives.
Where a form field could not hold all the data, put the rest in the narrative, referenced to the item number.

The narrative field has a character limit, so long transaction lists do not belong in it. FinCEN allows one attachment per SAR: a Microsoft Excel-compatible CSV file of no more than 1 megabyte, intended for tabular data such as transaction records too numerous for the narrative. Its contents must be described in the narrative. Nothing else is attached.

Advisory key terms

When a FinCEN advisory covers the activity you are reporting, the advisory usually asks filers to include a specific key term in the SAR so FinCEN can find related filings. For example, FinCEN's June 2022 advisory on elder financial exploitation asks filers to include the key term "EFE FIN-2022-A002" in SAR field 2, the filing institution note field, and to check the elder financial exploitation box. Check the advisory itself for exactly where its key term goes; it is easy to miss and costs nothing to include.

Writing rules that make the difference

Lead with the point. The first two sentences should tell the reader what you are reporting and why. If they read nothing else, they should know whether this concerns them.

Make it standalone. No "see attached," no "as described in the alert," no "the customer's usual pattern" without stating what the pattern is. FinCEN's narrative guidance specifically tells filers not to use "see attached."

Quantify. "Numerous large cash deposits" is a description. "Fourteen cash deposits between $8,400 and $9,800, totaling $127,300, at four branches over nineteen days" is evidence.

State the expected activity, then the deviation. This is what converts a list of transactions into suspicion. "At account opening the customer described a home-based bookkeeping business expecting about $3,000 a month in check deposits; since March the account has received $41,000 in cash."

Spell out everything. Expand abbreviations, describe products in plain words, and name systems if you must refer to them at all.

Use names and roles consistently. Introduce "John Doe (Subject 1)" once and then use the same reference throughout.

Say what you do not know. If the source of funds is unknown, say so. If a plausible innocent explanation exists but could not be verified, say that too. Calibrated narratives are more credible, not less.

Keep opinion and fact distinct. "The teller observed that a second man stood beside the customer and answered questions for her" is a fact. "The bank believes the customer may be under the influence of a third party" is a conclusion, clearly labeled as such.

Do not speculate about guilt. You are reporting suspicion. Avoid words like "laundered" or "stole" unless the facts establish them; "appears to" and "is consistent with" are accurate.

Proofread the numbers. A total that does not match its components undermines the whole narrative.

Weak vs strong: three examples

The following narratives are fictional and illustrative. Names, amounts and places are invented and do not describe any real customer or bank.

Example 1: structuring

Weak:

Customer made multiple cash deposits under $10K. Alert SCN-04 fired. Activity is unusual for customer. See case file 2026-118.

What is wrong: no subject detail, no dates or totals, an internal alert code, a reference to a file the reader cannot see, and no explanation of why it is suspicious.

Strong:

This SAR reports suspected structuring of cash deposits by John Doe (Subject 1), owner of Doe Landscaping LLC (Subject 2), to avoid currency transaction reporting. Bank case number 2026-118.

Between June 2 and June 20, Subject 1 made 11 cash deposits into Subject 2's business checking account ending 4471, each between $8,500 and $9,900, totaling $103,600, at the Main Street, Elm Avenue and Route 9 branches. On June 2 Subject 1 presented $14,000 in cash at Main Street, asked the teller whether a deposit over $10,000 would be "reported to the government," and on being told it would, deposited $9,000 and left with the remainder. He deposited $5,000 at the Elm Avenue branch about two hours later.

At account opening in 2024, Subject 2 described seasonal landscaping work with expected monthly deposits of $15,000 to $20,000, mostly by check. Before June, cash deposits averaged under $2,000 a month and no single cash deposit exceeded $3,000. The June deposits were followed within two business days by wires totaling $96,000 to an account at another U.S. bank in the name of an unrelated company.

The bank suspects the deposits were structured to evade CTR filing, based on the customer's inquiry and reduction of the June 2 deposit, the split deposits across branches the same day, and the sudden change from the account's historical pattern. The source of the cash is unknown. The bank continues to monitor the account. Teller notes and branch surveillance images are retained and available on request.

Example 2: suspected elder financial exploitation

Weak:

Elderly customer withdrew large amounts. Possible exploitation. Branch staff concerned.

Strong:

This SAR reports suspected elder financial exploitation of Mary Roe, age 84, a customer since 1991, by Robert Poe (Subject 1), who has described himself to branch staff as her "financial helper."

From August 4 to September 12, Ms. Roe's savings account ending 2209 recorded seven in-branch cash withdrawals totaling $38,500 and two cashier's checks totaling $22,000 payable to Poe Home Services, an entity not previously associated with her accounts. Before August, her only regular withdrawals were about $1,200 a month for household expenses. Subject 1 accompanied her on each visit and answered the teller's questions. On August 28, when the teller asked Ms. Roe directly about the purpose of a $9,000 withdrawal, she said she "didn't know" and looked to Subject 1, who said it was for roof repairs. On September 12 Ms. Roe told a branch manager she was "not sure where the money had gone."

The bank suspects Subject 1 is exploiting Ms. Roe, based on the sudden change in activity, his control of the transactions, her inability to explain them, and payments to an entity linked to him. Information about Ms. Roe is provided to describe the activity; she is not a subject of this report.

In this example the filer would also enter the advisory key term in field 2 and check the elder financial exploitation box, as the 2022 advisory asks, and would list Ms. Roe as a victim in the narrative only, not as a subject.

Example 3: a continuing activity report

Weak:

Continuing activity. See prior SAR. Same pattern continued.

Strong:

This is a continuing activity report on cash structuring by John Doe (Subject 1) and Doe Landscaping LLC (Subject 2), previously reported in a SAR filed July 3 (BSA ID on file). It covers July 4 through October 1.

During this period Subject 1 made 23 cash deposits into account ending 4471, each between $8,000 and $9,950, totaling $214,700, at the same three branches. Wires out to the same unrelated company totaled $198,000. Cumulative cash deposits across both reports total $318,300. No new explanation has been offered by the customer. Supporting records are retained.

The continuing report gives the reader only what is needed from the prior filing and spends its words on the new period, as FinCEN's instructions ask.

A pre-filing review checklist

Before a narrative goes out, a second reader should be able to answer yes to each of these without opening the case file:

Can I tell in the first two sentences what is being reported and why?
Is every subject identified with the detail the bank has, and their role clear?
Are dates, amounts, accounts, instruments and locations stated, and do the totals add up?
Is the expected activity stated, and the deviation from it explained?
Is the reason for suspicion stated explicitly?
Is it clear whether transactions were completed or attempted, and who benefited?
Are prior SARs referenced?
Are any applicable advisory key terms included where the advisory specifies?
Is the narrative free of internal codes, unexplained abbreviations, "see attached" and legal disclaimers?
Is supporting documentation described, and any CSV attachment's contents explained?

Sampling filed narratives each quarter and reading them cold, as an outside investigator would, is one of the fastest ways to raise quality across a BSA team.

Getting the facts right before you write

A strong narrative depends on a strong investigation. The analyst has to have pulled the full history, compared it with the customer profile, looked at related parties, and talked to the frontline staff who saw the activity. Our list of money laundering red flags is a useful prompt for what to look for, and our article on elder financial exploitation covers that specific typology, including what branch staff should observe and record.

Training for SAR writers

SAR writing is a skill that improves with practice and feedback. Our SARs and Information Sharing course is built around suspicious activity reporting, and the suspicious activity reporting topic page lists related options for analysts and investigators. For a full grounding in the program the SAR sits within, see the Certificate in BSA and AML Compliance.

Next step

Pull three of your bank's recent narratives, run them through the checklist above, and use what you find to focus your team's training in SARs and Information Sharing.

Frequently Asked Questions

What is a SAR narrative?

The SAR narrative is the free-text section of a suspicious activity report where the filer explains, in plain English, what happened and why the bank considers it suspicious. It supplements the structured fields that identify subjects, accounts and amounts. FinCEN's filing instructions call it critical to understanding the activity, and it is usually the part law enforcement relies on most when deciding whether a SAR is relevant to an investigation.

What should a SAR narrative include?

It should cover who conducted the activity, what instruments and mechanisms were used, when and where it happened, why it is suspicious, and how it was carried out. FinCEN also asks filers to say whether transactions were completed or attempted, who benefited, any explanations given by the subject, whether the activity is isolated or related to other activity, and what supporting documentation the bank holds. Prior SARs on the same subject should be referenced.

How long should a SAR narrative be?

As long as it needs to be to stand on its own, and no longer. A simple case may need a few paragraphs; a complex one may need much more. The narrative field has a character limit, so long transaction lists should go in the single CSV attachment FinCEN allows, with its contents described in the narrative. Length matters less than whether a reader without access to the bank's systems can follow it.

Can I attach documents to a SAR?

Only one attachment is allowed: a Microsoft Excel-compatible CSV file of no more than 1 megabyte, typically used for transaction data too lengthy for the narrative. Its contents must be described in the narrative. All other supporting documentation, such as account statements, images or surveillance footage, stays with the bank for five years and is made available to law enforcement or regulators on request.

What are common SAR narrative mistakes?

The most common are listing transactions without explaining why they are suspicious, using internal alert codes or abbreviations, writing "see attached" or referring to files the reader cannot see, omitting the customer's expected activity, leaving out dates and totals, and pasting entire prior narratives into continuing reports. Including legal disclaimers and listing victims as subjects are also errors FinCEN's instructions specifically address.

How do you write a continuing activity SAR narrative?

Identify it as a continuing report, reference the prior SAR and its date, and state the period the new report covers. Then describe the activity during that period with dates, amounts and any changes in pattern, and give the cumulative total across all related reports. FinCEN's instructions say to include only as much from prior narratives as is needed to understand the activity and never to repeat them in full.