September 25, 2026

SAR Narrative Examples by Typology (Annotated)

Axle Team

Key takeaways

Good SAR narratives share one skeleton whatever the typology: a one-line statement of what is being reported, a chronological body with dated transactions, and a conclusion covering disposition and records.
The typology changes what the "why" must prove. Structuring needs the threshold pattern and the innocent explanation you ruled out. Elder exploitation needs the victim's age and the bank's response. Scam proceeds need wallet addresses and hashes.
FinCEN advisory key terms belong in field 2 and in the narrative. They are how FinCEN and law enforcement find your filing.
Write the narrative so it stands on its own without the form fields.
Every example below is a fictional composite. Names, numbers and amounts are invented.

SAR narrative examples: the skeleton every typology shares

SAR narrative examples are model write-ups showing how a suspicious activity report should describe who was involved, what happened, when and where it occurred, why it looked suspicious and how the scheme worked. FinCEN's guidance recommends a chronological introduction, body and conclusion. The five examples below apply that structure to structuring, elder exploitation, money mules, funnel accounts and crypto off-ramps.

The source for that skeleton is still FinCEN's 2003 guidance, and it remains the document examiners cite when a narrative falls short.

In general, a SAR narrative should identify the five essential elements of information – who? what? when? where? and why? – of the suspicious activity being reported. The method of operation (or how?) is also important and should be included in the narrative.
— FinCEN, Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative (2003)

If the five Ws are new to your team, start with our SAR narrative 5 Ws breakdown. Each example here gives the narrative, then a short note on what carries the weight. Transaction lists are trimmed; a filed version would list every item.

Example 1: Structuring across two branches

Structuring, internal case 26-0412. First State Community Bank is reporting Rivera Tile & Stone LLC, business checking ending 4471, and sole signer Marco Rivera (DOB 03/14/1979, 218 Elm St, Dayton, OH). Between 06/02/2026 and 06/27/2026 the account received 14 cash deposits totaling $131,600, each between $9,200 and $9,900, alternating between the Main St and Northridge branches (06/02 $9,400 Main; 06/03 $9,800 Northridge; list continues). Prior activity averaged two cash deposits a month near $3,100. Within one business day of each deposit a check for a near-identical amount cleared to Second National Bank payable to Rivera personally. Asked on 06/19, Rivera said customers "prefer cash"; no invoices support the volume. Seasonal sales were considered and rejected because amounts cluster just under $10,000 rather than tracking any sales cycle. Account closure is scheduled for 07/15/2026; records are held under case 26-0412.

What carries the weight: the dated, branch-tagged list does the when and where. FinCEN asks for individual dates and amounts rather than an aggregate, and a plain list survives the filing system where a pasted table does not. The ruled-out explanation is the why, and it is the sentence most templates omit. Detection-side patterns are in our structuring guide.

Example 2: Elder financial exploitation through wires

Elder financial exploitation, EFE FIN-2022-A002, case 26-0533. Harbor Federal Credit Union is reporting member Dorothy Keane, age 81, Bangor, Maine (Penobscot County), as the apparent victim of a romance scam. Between 04/08/2026 and 07/30/2026 she sent nine wires totaling $148,500 to three beneficiaries she had never paid before, including 05/12 $22,000 and 06/20 $35,000 to a Georgia account she described as her fiancé's "shipping agent". On 06/20 teller J. Morales observed her reading instructions from her phone and becoming agitated when asked the purpose. No wires appear in 14 years of prior history. The credit union blocked further wires on 07/31/2026, warned the member, referred the matter to Maine Adult Protective Services on 08/01/2026, and recovered $12,400 through recall of the final wire. Records are held under case 26-0533.

What carries the weight: the key term opens the narrative and also goes in field 2, with the Elder Financial Exploitation box in field 38(d) checked. Age, county, the named witness, the institution's response and the recovered amount are all there because the advisory asks for them.

Financial institutions are reminded that behavioral red flags of EFE and the names of staff who witnessed them should be included in the SAR narrative to assist future law enforcement investigations.
— FinCEN, Advisory on Elder Financial Exploitation, FIN-2022-A002 (June 2022)

Example 3: Money mule for scam-center proceeds

Money laundering through a suspected money mule account, FIN-2026-SCAMCENTERS, case 26-0601. Lakeview Bank is reporting personal checking ending 8820 held by Tyler Nguyen (DOB 09/02/2001, Mesa, AZ), opened 05/14/2026 for stated payroll deposits that never posted. Between 05/20/2026 and 06/18/2026 the account received 23 transfers totaling $96,300 from 19 unrelated individuals in 11 states, $1,500 to $9,000 each, with memos including "investment" and "USDT". Within 24 hours of each credit most of the balance was wired to one account at a money services business or withdrawn in cash at the Mesa branch. Two originators called the bank on 06/10 and 06/15 saying an online "investment coach" had directed the payments. Reached on 06/16, Nguyen said he was "helping a friend move money" and could not name the friend. The account was frozen on 06/18/2026; messages are held under case 26-0601.

What carries the weight: the victims' calls are the why, so their dates and substance are recorded. Flow of funds is stated as source, timing and destination. The scam-center key term applies because the pattern matches how FinCEN describes professional money launderers (PMLs) moving proceeds into the banking system; the alert also asks for "Fraud-Other" in field 34(z) with "Scam Centers" in the text box.

PMLs integrate scam proceeds into the formal financial system through networks of money mules and through stablecoin transfers to digital asset exchanges outside of the United States.
— FinCEN, Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers, FIN-2026-Alert005 (Sept. 3, 2026)

Example 4: Funnel account

Suspected funnel account, case 26-0644. Prairie Trust Bank is reporting business checking ending 2210 in the name of GoldLine Freight LLC (registered 02/2026, Laredo, TX; sole member Ana Pérez, DOB 11/23/1988). Between 03/03/2026 and 05/29/2026 the account received 61 cash deposits totaling $412,700 at 17 branches in six states, none in Texas, from 14 conductors who were not signers and stated no relationship to the business. Deposits ranged from $2,000 to $9,500 and often hit two or more branches on the same day. Funds left within one to two days by check to a Laredo currency exchange and by wire to two beneficiaries in Nuevo Laredo, Mexico. No freight invoices, fuel purchases or payroll appear in the account. The bank closed the account effective 06/05/2026 and holds branch surveillance references under case 26-0644.

What carries the weight: where is the whole story. Out-of-state cash into an in-state business account is the funnel signature, and FinCEN asks for branch locations in cash cases. Conductors are identified as non-signers with no stated relationship, and the absence of ordinary business activity is stated as a finding rather than left to inference.

Example 5: Crypto off-ramp for an investment scam

Suspected investment scam proceeds, FIN-2023-PIGBUTCHERING, case 26-0702. Northgate Bank is reporting customer Priya Raman (DOB 06/30/1972, Edison, NJ). Checking ending 5519 sent five ACH transfers totaling $212,000 between 02/11/2026 and 03/28/2026 to her own account at a US-registered virtual asset exchange, including a $90,000 home-equity draw moved the same day it funded. Records obtained through a 314(b) request show conversion to USDT and transfer to external address 0x4f…c19a; the four transaction hashes are entered in the cyber indicator fields. On 03/30/2026 Ms. Raman told a banker she was investing through a platform recommended by a messaging-app contact and had been shown a $1.4 million balance she could not withdraw without paying "tax". Three prior years show no crypto activity. Transfers were blocked on 03/31/2026 and the customer was directed to the FBI's IC3 portal. Screenshots are held under case 26-0702.

What carries the weight: the alert asks filers to include the addresses, transaction hashes, apps and the URL or domain the victim was told to deposit into, in the structured cyber indicator fields as well as the narrative. The customer's own statement is dated, attributed and quoted. Field 34(z) "Fraud-Other" with "Pig Butchering" and the key term in field 2 complete the filing.

Key terms and fields by typology

Structuring — Key term for field 2 and the narrative: None specific. Also select: Structuring checkboxes as applicable.
Elder financial exploitation — Key term for field 2 and the narrative: EFE FIN-2022-A002. Also select: Field 38(d), Elder Financial Exploitation.
Money mule for scam-center proceeds — Key term for field 2 and the narrative: FIN-2026-SCAMCENTERS. Also select: Field 34(z) Fraud-Other, "Scam Centers"; money laundering fields as applicable.
Funnel account — Key term for field 2 and the narrative: None specific. Also select: Money laundering fields as applicable.
Crypto off-ramp, investment scam — Key term for field 2 and the narrative: FIN-2023-PIGBUTCHERING. Also select: Field 34(z) Fraud-Other, "Pig Butchering"; cyber indicator fields.

FinCEN keeps a running list of SAR advisory key terms. Check it at filing time, since alerts supersede one another.

The line most SAR narrative examples leave out

Templates teach the five Ws. What they rarely teach is the sixth sentence: the legitimate explanation you considered and why the facts do not support it. Examiners and investigators read a SAR to judge a decision, and the ruled-out explanation is the only part of the narrative that shows the decision was made rather than assumed.

There is a workflow effect too. Analysts who draft that sentence before pulling the transaction list write tighter narratives, because they already know which transactions prove the point. Those who paste the list first tend to describe everything and prove nothing, which is how filings end up on the wrong side of the questions regulators ask about SAR quality.

Axle's SAR agent, Sam, drafts to this structure: typology and key term first, dated flow of funds, attributed customer statements, the ruled-out explanation, then disposition. The analyst edits and owns the filing. Details are on the SAR filing solution page.

FAQ

How long should a SAR narrative be?

Long enough to carry the facts and no longer. FinCEN asks for a concise, chronological account and asks filers not to reference attachments. If the transaction list is long, state the pattern with totals and date range, then list representative dated transactions.

Does the advisory key term go in field 2 or in the narrative?

Both. Every FinCEN advisory or alert with a key term requests it in field 2, the Filing Institution Note to FinCEN, and in the narrative. Selecting the matching suspicious activity checkbox is a separate request and should be done as well.

Should the narrative repeat information already in the form fields?

Yes, for the identifiers that matter. FinCEN's guidance says the narrative should further describe subjects and identify all affected accounts. The narrative is the only free text in the report and is often read on its own.

Draft narratives in this structure from the case file

Sam builds the narrative from the alert, the account history and the analyst's notes, in the introduction, body and conclusion shape shown above, with the key term and the ruled-out explanation in place before review. See how it works at axleruns.com/agent/sam.

SAR Narrative Examples by Typology (Annotated)

More from the blog