August 4, 2026

How to Write a SAR Narrative (With Annotated Example)

Axle Team

Key takeaways

FinCEN's standard has not changed in two decades: cover who, what, when, where, why, and how, in a narrative that stands alone without your case file.
The "why" is where most narratives fail. Restating fixed-field data ("wired $2,000 to Mexico") is explicitly called out by FinCEN as inadequate.
Structure it as introduction, body, conclusion — FinCEN's own recommendation — with individual dates and amounts in the text, not attachments.
No tables, spreadsheets, or attachments in the narrative; describe supporting documents and retain them for five years.
QA test that matters: can a reader who has never seen the case understand what happened and why it's suspicious in one pass?

To write a SAR narrative, tell the complete story of the suspicious activity in plain language: who conducted it, what instruments were used, when and where it occurred, why it is suspicious given the customer's expected behavior, and how it was carried out. FinCEN recommends organizing the narrative as an introduction, body, and conclusion.

How to write a SAR narrative law enforcement can actually use

A SAR narrative is the only free-text portion of the filing, and it is the part an investigator reads to decide whether your report becomes a case. FinCEN's Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative puts it bluntly:

"The failure to adequately describe the factors making the transaction or activity suspicious undermines the very purpose of the SAR and lessens its usefulness to law enforcement." — FinCEN, Guidance on Preparing a Complete & Sufficient SAR Narrative, Nov. 2003

The same guidance defines the required coverage:

"In general, a SAR narrative should identify the five essential elements of information – who? what? when? where? and why? – of the suspicious activity being reported. The method of operation (or how?) is also important and should be included in the narrative." — FinCEN, SAR Narrative Guidance, Nov. 2003

Treat those six elements as a coverage test, not an outline. A narrative organized literally as six labeled answers reads like a form; a narrative that covers all six in a chronological story reads like a referral — which is what it is.

The three-part structure FinCEN recommends

Introduction. The purpose of the filing and type of activity (structuring, layering, funnel activity), the date range and total amount, any prior SARs on the subject, your internal case number, and a one-line summary of the red flags.
Body. The facts, in chronological order: parties and their relationships, accounts affected, origination and destination of funds, and individual dates and amounts — not just aggregates. Include counterparty institutions and foreign jurisdictions where known.
Conclusion. What the institution did about it: account closure or ongoing monitoring, contacts for follow-up, and what additional records are available on request.

Two mechanical rules from the same guidance: keep individual transaction dates and amounts in the narrative rather than only aggregated totals, and do not insert objects, tables, or pre-formatted spreadsheets into the filing — they may not convert properly in the SAR system.

Annotated example

A condensed, fictional example of the shape that works:

"This SAR reports apparent structuring of cash deposits followed by outbound wires, totaling approximately $184,000 between 03/02/2026 and 05/28/2026. No prior SARs have been filed on the subject. Internal case #2026-0417."

— Introduction: activity type, date range, total, prior-SAR status, case number. An investigator can triage from this paragraph alone.

"John Roe (DOB XX/XX/XXXX), sole owner of Roe Vending LLC, deposited cash 22 times across three branches, each deposit between $8,400 and $9,700. Deposits on 03/02 ($9,200), 03/04 ($9,500), and 03/07 ($8,900) were followed on 03/09 by a $27,000 wire to an auto-parts importer in a third country. The account was opened with stated expected monthly cash deposits of $5,000."

— Body: who, what, how, with individual dates and amounts. The stated-expected-activity line sets up the why.

"The activity is inconsistent with the customer's stated business profile and appears designed to evade CTR reporting. The bank has closed the account and will provide transaction records upon request."

— Conclusion: the why in one sentence tied to expected behavior, plus disposition and follow-up.

The errors FinCEN sees most

FinCEN's guidance on common SAR errors is specific about what makes a narrative inadequate:

"In general, most inadequate narratives merely repeat data in the form's fixed fields (for example, 'John Doe sent two money transfers on 1/1/2007.', or 'Wired $2,000 to Mexico.'). Restating the information found in critical fields does not sufficiently illustrate why the transaction was suspicious, considering the nature and expected activities of the institution's customers." — FinCEN, Suggestions for Addressing Common Errors Noted in Suspicious Activity Reporting

The other recurring failures: blank narratives, and treating supporting documents as a substitute — attachments are prohibited, so anything an investigator needs must be described in the text, with the underlying records retained for five years. The FFIEC BSA/AML Examination Manual's SAR quality guidance (Appendix L) reinforces the same standard examiners apply when they sample your filings.

One workflow habit that fixes more narratives than any template: write the "why" sentence first, before assembling the chronology. Analysts who build the timeline first routinely run out of time and bolt a generic suspicion statement onto the end. And QA narratives blind — have the reviewer read the narrative before opening the case file. If they have questions the narrative doesn't answer, law enforcement will too, and they can't open your case management system.

Where AI helps — and where it doesn't

The expensive part of SAR writing is not prose; it's assembling a verified fact pattern from the alert, the KYC file, and the transaction data, then keeping the numbers consistent between narrative and fixed fields. That assembly is what Sam, Axle's SAR agent, automates — drafting a complete five-elements narrative with every fact traceable to source data, for a human filer to review and own. It pairs naturally with Rose upstream, so the investigation record the narrative draws on is already documented. The judgment call — whether the activity is suspicious at all — stays with your team.

FAQ

What is the deadline for filing a SAR?

A SAR must be filed within 30 calendar days of initial detection of facts that may constitute a basis for filing. If no suspect was identified on the date of detection, the institution may delay up to an additional 30 days to identify one — but never more than 60 days total.

Can I attach spreadsheets or supporting documents to a SAR?

No. SAR form instructions prohibit attachments, and FinCEN warns against inserting tables or pre-formatted spreadsheets into the narrative. Describe the supporting information in the text and retain the documents for five years, available on request.

How long should a SAR narrative be?

Long enough to cover who, what, when, where, why, and how with individual dates and amounts — and no longer. FinCEN asks for narratives that are clear, concise, and thorough; length is not the quality metric, standalone readability is.

Spending hours per SAR on assembly instead of judgment? See how Sam, Axle's SAR agent, drafts complete, five-elements narratives your team reviews and files. For a wider look at where agents fit in your program, start with the AI readiness playbook.

How to Write a SAR Narrative (With Annotated Example)

More from the blog