Skip to main content

Looking for Valuant? You are in the right place!

Valuant is now Abrigo, giving you a single source to Manage Risk and Drive Growth

Make yourself at home – we hope you enjoy your new web experience.

Looking for DiCOM? You are in the right place!

DiCOM Software is now part of Abrigo, giving you a single source to Manage Risk and Drive Growth. Make yourself at home – we hope you enjoy your new web experience.

Looking for TPG Software? You are in the right place!

TPG Software is now part of Abrigo. You can continue to count on the world-class Investment Accounting software and services you’ve come to expect, plus all that Abrigo has to offer.

Make yourself at home – we hope you enjoy being part of our community.

AML/CFT AML Training SAR

Mastering SAR narratives: Examples & best practices

Jessica Corey, CAMS
Terri Luttrell, CAMS-Audit, CFCS
October 18, 2024
Read Time: 0 min
sar narrative

Effective SAR narratives don't just happen

Suspicious activity report writing is a skill that needs development. Effective SARs are created through conscious effort and diligence. Learn industry best practices for writing compelling SAR narratives to support your AML/CFT efforts.

The importance of being comprehensive 

Back in elementary school, most of us were taught that a good story includes the who, what, where, when, why, and how of the events it describes. However, when AML/CFT professionals sit down to write a good SAR narrative for a suspicious activity report, the task can seem overwhelming. How can financial institutions utilize these storytelling principles in their SAR narrative writing to produce clear reports?

The FFIEC BSA Examination Manual states that the SAR reporting “forms the cornerstone of the BSA reporting system. It is critical to the United States' ability to utilize financial information to combat terrorism, terrorist financing, money laundering, and other financial crimes.”

The care with which the SAR is written may make the difference in whether law enforcement clearly understands the described conduct and its possible criminal nature. Thus, failing to explain the factors that make a transaction or activity suspicious can undermine the purpose of the SAR. Information provided in SARs allows FinCEN and federal banking agencies to identify emerging trends and patterns associated with financial crimes.

Download a checklist for writing SAR narratives

DOWNLOAD

Industry data

SAR statistics show a continued increase in reporting by traditional financial institutions, with 3.8 million SARs filed in 2023, compared to 839 thousand in 2014. With this volume, it is imperative that the writing quickly draws the attention of the audience, primarily law enforcement.

There is no denying that you are also writing SARs for to satisfy your examiners. Common mistakes leading to regulatory criticism include:

  • Inadequate narratives, including lack of specificity in the description of the activity
  • Lack of explanation of WHY the activity is suspicious
  • Inadequate staff training
  • Failure to report suspicious activity
  • Missed deadlines

How to structure a narrative

The following prompts can help organize your SAR narrative following the approach of describing the who, what, where, when, why, and how:

  • Who conducted the activity? Describe any details not outlined in Part 1 of the SAR.
  • What specifically happened to help determine a SAR filing? Describe transactions, interactions, or activities that led to the SAR filing decision.
  • Where did the activity take place? State the branch and location address of where the action took place.
  • When did the activity occur? Clearly state if this was a one-time occurrence or a pattern of activity, including a clear timeline.
  • Why is the SAR being filed? As briefly as possible, describe why the activity is considered potentially suspicious.
  • How did the activity occur? Describe the transactions or how the pattern emerged.

The first section of the narrative should be where you draw the reader’s attention to the suspicious activity. It is unnecessary to start any narrative with the financial institution’s history, what alert number triggered the investigation, or anything else that is not about the potential activity in question. Provide information about the financial institution’s business policies and practices only if necessary for a complete understanding of the suspicious activity.

Be concise when relaying transaction details – it is okay to summarize many of the transactions in your SAR and provide more specifics about each transaction in the transaction attachments or supporting documents. Be sure to state in the closing paragraph that any supporting documents are available for review upon request from law enforcement. Retain the documentation for five years in case it is requested.

Information contained in SARs

A well-prepared SAR provides a comprehensive view of the activity in question, helping law enforcement and regulatory agencies understand the full context and severity of the potential threat. At a high level, a SAR typically includes three key types of information: identifying details, background context, and transaction data.

Including these elements in a structured and organized way ensures that the SAR is compliant and actionable. When investigators can quickly understand who is involved, what occurred, and why it’s considered suspicious, they are better equipped to respond appropriately.

Identifying information

This section captures the personal and business identifiers of the individual(s) or entity(ies) involved. Common data points include names, addresses, phone numbers, Social Security Numbers (SSNs), account numbers, and any known aliases. Collecting complete and accurate identification is essential to support follow-up investigations and prevent repeat suspicious activity.

Background and Context

A strong SAR goes beyond the “what” and provides the “why.” This portion outlines the filer’s rationale for deeming the activity suspicious. It may include behavioral red flags, explanations of how the activity deviates from expected customer behavior, or details about the institution’s internal review process. This narrative context allows law enforcement to assess the risk level more effectively.

Transaction Details

Perhaps the most data-rich portion of the SAR, this section includes specific information on the transactions involved. This can include transaction amounts, dates, account types, the method of transfer (e.g., wire, check, cash), and geographic locations. Institutions are encouraged to present these details in a clear, chronological format to help paint a full picture of the activity under review.

Knowing your audience

Remember, it is not your objective to prove that illegal activity occurred but to outline why it is considered suspicious. Consider whether a person reading the narrative could clearly understand the activity that happened and why it triggered alarm bells. The “why” description is most effective in the opening paragraph to quickly establish why the SAR was filed in the first place.

It is essential to remember your audience when writing your SAR narrative. The point of a SAR is to alert law enforcement to suspicious activity, so law enforcement should be your key audience. While regulators can penalize institutions for poor SARs, and their opinions significantly impact your financial institution, it is best to write SARs as if speaking to law enforcement. That means avoiding financial institution acronyms and other industry jargon that law enforcement officials may not be familiar with.

Here are a few more considerations for your SAR narrative writing:

  • Remember that information provided in other sections of the SAR does not need to be repeated in the narrative unless it is necessary to provide a clear and complete description of the suspicious activity.
  • If you need to submit a corrected or amended report, complete the report with whatever corrections or amendments were required. Describe the modifications or amendments at the beginning of the narrative and be as precise as possible.
  • If applicable – be proactive and contact local law enforcement, especially if you are filing a susceptible type of SAR, such as potential terrorist financing activity.
  • Remember to utilize the FinCEN keyword requests in the narrative. Keyword analysis has allowed FinCEN and law enforcement to map trends and commonalities in SAR narratives.
  • Continuing activity SAR narratives: When filing a continuing SAR, address and identify the previous SAR dates with a concise overview of the activity filed on those SARs. This is especially important if the current SAR filing is not for the same reason/activities as previous SAR filings. You do not have to include the entire narratives of the prior SARs.
  • Be sure to keep up to date with FinCEN regulations and guidance.
  • Lastly, open a line of communication with your regulator or auditor and keep them informed on your SAR narrative practices. They may be able to help craft better language or help with a narrative template to ensure your continued success. Building those relationships is critical to developing a sound AML/CFT program. Indicate if there is any litigation related to the activity by specifying the name of the litigation and the court where the action is pending.

Staffing for better SAR writing

Proper staffing ensures regulatory deadlines are met while SAR quality stays intact. If your financial institution is struggling with backfills or other staffing challenges, Abrigo Advisory Services stands ready to help you with your SAR filings. Advisory services can help financial institutions work through a backlog of alerts or cases, write SAR narratives, create a SAR narrative template that works for your institution, or draft policies and procedures for your alert-case-SAR triage workflow. 

Financial institutions spend significant hours crafting SARs, and lightening the load on staff can lead to more thorough SAR writing and a higher likelihood of law enforcement noticing your efforts.

Save time by direct filing your SARs and CTRs with FinCEN.

Learn More
Whitepaper

First-Day Letter Request

Read More
Whitepaper

Fentanyl trafficking red flags checklist

Read More
Whitepaper

Fraud Guidebook: Practical insights for financial institutions

Read More
About the Authors

Jessica Corey, CAMS

Senior Risk Management Consultant
Jessica Corey has over 17 years of experience in BSA/AML Operations and Compliance in the banking industry, working both in medium & large community and commercial banks.  She started her banking career in retirement services, moving to deposit operations and the compliance/fraud arenas where she was a BSA/AML Analyst/Investigator and

Full Bio

Terri Luttrell, CAMS-Audit, CFCS

Compliance and Engagement Director
Terri Luttrell is a seasoned AML professional and former director and AML/OFAC officer with over 20 years in the banking industry, working both in medium and large community and commercial banks ranging from $2 billion to $330 billion in asset size.

Full Bio

About Abrigo

Abrigo enables U.S. financial institutions to support their communities through technology that fights financial crime, grows loans and deposits, and optimizes risk. Abrigo's platform centralizes the institution's data, creates a digital user experience, ensures compliance, and delivers efficiency for scale and profitable growth.

Make Big Things Happen.