September 21, 2026

The 5 Ws of SAR Narratives

Axle Team

Key takeaways

FinCEN expects every SAR narrative to answer five essential questions — who, what, when, where, and why — plus a sixth: how the activity was conducted.
The narrative is the only free-text field on the SAR, and the FFIEC examination manual calls it "critical" for exactly that reason. A weak narrative can make an otherwise correct filing useless to law enforcement.
"Why" is the element that fails most often in practice. If your case file can't articulate why the activity is suspicious, the problem is upstream of the narrative.
Attachments don't substitute for the narrative. FinCEN's guidance is explicit that supporting documentation stays in your records (retained five years) — everything material goes in the text.
Structure the narrative as introduction, body, conclusion, in chronological order. Examiners and law enforcement both read it that way.

Every BSA officer knows the drill: the SAR narrative 5 Ws are who, what, when, where, and why — who conducted the suspicious activity, what instruments or mechanisms were used, when and where it occurred, and why the institution believes it is suspicious. FinCEN also expects a sixth element: how the activity was carried out. What separates a filing that gets read from one that gets ignored is how rigorously those questions get answered.

What are the SAR narrative 5 Ws?

The framework comes straight from FinCEN's guidance package on preparing a complete and sufficient SAR narrative, issued in consultation with the federal banking regulators:

"In general, a SAR narrative should identify the five essential elements of information – who? what? when? where? and why? – of the suspicious activity being reported. The method of operation (or how?) is also important and should be included in the narrative."
— FinCEN, Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative

The guidance is over two decades old and it remains the reference examiners cite. The form has changed; the analytical expectation hasn't. The same document is blunt about the stakes: "It is critical that the information provided in a SAR filing be as accurate and complete as possible."

Breaking down each element

Who — all subjects, not just the one in the subject fields: occupation, role or title in the business, nature of the business, relationships among subjects, additional addresses and ID numbers.
What — the instruments or mechanisms involved — wires, monetary instruments, shell companies, structuring, correspondent accounts, stored value, digital assets — with the source and destination of funds.
When — the full date range of the activity, with specific dates for key transactions rather than only an aggregate figure.
Where — branches, accounts, and jurisdictions involved; flag any foreign nexus explicitly.
Why — the reason the activity has no apparent lawful or business purpose — the analytical core of the filing.
How — the modus operandi: how the transactions were initiated and moved, described concisely and in logical order.

Why narrative quality decides whether your SAR gets used

The FFIEC BSA/AML examination manual's SAR quality appendix makes the point in language worth internalizing:

"Because the SAR narrative serves as the only free text area for summarizing suspicious activity, the narrative section is 'critical.' The care with which the narrative is written may make the difference in whether or not the described conduct and its possible criminal nature are clearly understood by law enforcement."
— FFIEC BSA/AML Examination Manual, Appendix L – SAR Quality Guidance

Two operational consequences follow. First, tables and spreadsheets attached to a filing are not part of the searchable SAR record — FinCEN's guidance tells filers not to write "see attached," and to keep supporting documentation in the institution's records for five years. If a fact matters, it goes in the narrative text. Second, timing pressure is real: a SAR is due no later than 30 calendar days after initial detection, extendable to 60 only when no suspect has been identified. Narrative quality has to be achievable inside that window, which is a process problem, not a writing problem.

A structure that works

FinCEN recommends describing the activity "in a concise and chronological format" and dividing the narrative into three sections:

Introduction — why the SAR is being filed, in one or two sentences: the subject, the activity type, the date range, and the total amount.
Body — the who/what/when/where/how, in chronological order, with specific dates, amounts, account numbers, and counterparties.
Conclusion — the disposition: whether the account was closed, whether law enforcement was contacted, whether this is a continuing-activity filing, and any follow-up planned.

Where narratives actually fail: the "why" is decided before anyone writes

Here is the pattern we see repeatedly in alert-to-SAR workflows: the who, what, when, and where are cheap — they're sitting in the transaction data and the case file. The "why" is expensive, because it isn't a data field; it's the analyst's argument. When a narrative reads as boilerplate ("unusual wire activity inconsistent with expected profile"), it's almost never a writing skill problem — it's that the alert disposition never captured a real theory of the suspicion. The practical fix is upstream: require the case record to state the specific expected behavior and the specific deviation at disposition time, before the SAR decision is made. If that sentence exists in the case file, the narrative writes itself; if it doesn't, no template will save it. This is also where AI agents for SAR drafting earn their keep — not by generating prose, but by assembling the five Ws from the case record and forcing the "why" to be explicit before anything is filed.

The same logic applies earlier in the funnel: narratives improve when alert handling preserves structured facts instead of free-text fragments, because every W in the SAR maps back to something an analyst established at the alert stage.

FAQ

How long should a SAR narrative be?

Long enough to answer all five Ws plus how, and no longer. FinCEN asks for concise, chronological narratives — completeness is measured in elements covered, not word count. A tight narrative that states the who, what, when, where, why, and how with specific dates and amounts beats a long one that buries them.

What is the deadline for filing a SAR?

Per the requirements referenced in FinCEN's narrative guidance, a SAR must be filed no later than 30 calendar days after the date of initial detection. If no suspect was identified on the date of detection, filing may be delayed an additional 30 calendar days to identify one — but never more than 60 calendar days in total.

Can I attach supporting documents instead of writing details in the narrative?

No. FinCEN's guidance instructs filers not to insert "see attached" — material facts must appear in the narrative itself. Keep supporting documentation in your institution's records for five years and produce it when law enforcement requests it.

Drafting SARs is the bottleneck in most case workflows. Sam, Axle's SAR drafting agent, builds complete five-Ws narratives directly from your case records — with every fact traceable to its source. See how Sam works →

The 5 Ws of SAR Narratives

More from the blog