August 25, 2026

How to Write a Transaction Monitoring Investigation Narrative

Axle Team

Key takeaways

A transaction monitoring investigation narrative should let a cold reader — examiner, auditor, or law enforcement — reconstruct both the activity and the decision without opening the case file.
FinCEN's narrative guidance still sets the standard: the five W's plus how, organized as introduction, body, and conclusion.
Individual dates and amounts beat aggregates — regulator guidance says so explicitly, and flow-of-funds ambiguity is the most common QA failure.
No-SAR dispositions deserve the same rigor. The narrative that closes an alert is your defense in a lookback.
Write the disposition sentence first; build the evidence under it. Narratives drafted evidence-first bury the conclusion.

What a transaction monitoring investigation narrative must do

A transaction monitoring investigation narrative documents who was investigated, what activity triggered the alert, when and where it occurred, how funds moved, and why the activity is — or is not — suspicious. Structure it as an introduction, body, and conclusion; cite specific dates and amounts; and state the disposition rationale plainly enough that a reviewer can follow it cold.

The stakes are set by where the narrative can end up. If the case escalates to a SAR, your investigation write-up becomes the raw material for the filing — and FinCEN has been clear for two decades about what that document carries:

"Because the SAR narrative serves as the only free text area for summarizing suspicious activity, it is essential that financial institutions' staff write narratives that are clear, concise, and thorough."
— FinCEN, Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative (2003)

The same guidance warns that incomplete, incorrect, or disorganized narratives make further analysis difficult, if not impossible — and that failing to describe what made the activity suspicious undermines the purpose of filing at all. Everything below is about not being that filer.

Anchor on the five W's — and the how

FinCEN's guidance says a narrative should identify "the five essential elements of information – who? what? when? where? and why?" and adds that the method of operation — the how — belongs in the narrative too. Each element maps to a question your case file already answers:

Who — the customer and counterparties: occupation, business type, relationships among parties. Non-account holders count, described to the maximum extent possible.
What — the instruments and mechanisms: wires, monetary instruments, cash structuring, correspondent activity, crypto on- and off-ramps.
When — the date the activity was first noticed, its duration, and individual transaction dates. Bursts of activity and dormancy breaks are part of the story.
Where — branches, channels, and any foreign jurisdictions, with institutions and account numbers named where known.
Why — what makes the activity inconsistent with this customer's expected profile and with similar customers in the same segment.
How — the modus operandi, told in sequence: source of funds, movement, destination or beneficiary.

A structure that survives review

FinCEN suggests dividing the narrative into an introduction, a body, and a conclusion. That maps cleanly onto monitoring investigations:

Introduction — one paragraph: the alert or referral source, the rule or typology that fired, the review period, any prior SARs on the subject and why they were filed, and the punchline — what you concluded.
Body — the evidence: parties and their relationships, account behavior against expected activity, and transaction detail in chronological order with dates and amounts. Break larger volumes into credits and debits, by date and amount.
Conclusion — the disposition and its rationale, follow-up actions (ongoing monitoring, relationship review, exit), and what additional material the institution can make available to law enforcement on request.

Two mechanical rules from the guidance save rework at filing time: keep tables and attachments out of the narrative text, and never write "see attached" — only explicit narrative text is ingested into the SAR system.

Flow of funds: dates and amounts, not aggregates

The most common deficiency QA teams flag is the aggregate summary: "$412,000 in structured deposits over six months." The examination manual asks for the opposite:

"When possible, in order to better track the flow of funds, individual dates and amounts of transactions should be included in the narrative rather than only the aggregated amount."
— FFIEC BSA/AML Examination Manual, Appendix L: SAR Quality Guidance

The same applies to origination and destination: name the source of funds and the beneficiary, with account numbers and institutions where known. If what looks like structuring feeds outbound wires, both halves belong in the narrative — dates, destinations, amounts, frequency, and beneficiaries of the transfers.

Write the disposition sentence first

The workflow habit that most improves narrative quality costs nothing. Before drafting, write the single sentence a skeptical examiner should walk away with — "We are filing because X moved funds through Y in a pattern inconsistent with Z," or "We are closing because the activity is explained by A, evidenced by B." Then build the narrative to support that sentence. Analysts who draft evidence-first tend to produce chronologies that never commit to a conclusion; reviewers bounce them, and cycle time doubles.

A related tell in QA: the phrase "activity appears consistent with expected profile" with no statement of what the expected profile is or where it came from. Ban the phrase unless both follow it.

The no-SAR narrative is still a narrative

Alerts closed without filing outnumber filings by an order of magnitude in most programs, and those closures are exactly what a lookback re-examines. The same five W's discipline applies, compressed: what triggered, what was reviewed, what explained the activity, and what evidence supports the explanation. The FFIEC's quality guidance is framed around SARs, but its logic is about readers:

"The care with which the narrative is written may make the difference in whether or not the described conduct and its possible criminal nature are clearly understood by law enforcement, and thus a failure to adequately describe the factors making a transaction or activity suspicious undermines the purpose of the SAR."
— FFIEC BSA/AML Examination Manual, Appendix L: SAR Quality Guidance

Where AI agents fit

Most of a transaction monitoring investigation narrative is assembly: pulling KYC data, transaction detail, prior cases, and screening results into a chronology before an analyst exercises judgment. That assembly is what Rose, Axle's transaction monitoring agent, automates — investigating alerts end-to-end and drafting the narrative with the five W's structure, individual transactions cited, and the disposition rationale stated up front, ready for a human decision.

Teams working out where agents belong in their case workflow can start with the AI readiness playbook, or size the case-handling math with the ROI calculator.

FAQ

How long should a SAR narrative be?

As long as the five W's and the flow of funds require — no longer. FinCEN asks for clear, concise, and thorough, in chronological order. Length is a symptom: padded narratives usually mean the writer never decided what mattered; thin ones usually omit dates, amounts, or the why.

What's the difference between an investigation narrative and a SAR narrative?

The investigation narrative is the internal case record, written for every disposition — filed or not. The SAR narrative is the regulatory filing distilled from it. Write the internal narrative to SAR standard and the filing becomes an edit, not a rewrite.

Do closed (no-SAR) alerts need a full narrative?

They need a decision-quality one: trigger, review scope, explanation, evidence. Examiners sample closed alerts in every BSA/AML exam, and a lookback will re-adjudicate them. If the closure rationale can't be reconstructed from the narrative alone, the work will be redone as if it never happened.

Put your narratives on rails

If narrative quality depends on which analyst catches the alert, the fix is structural — not another template. See how Rose, Axle's AI transaction monitoring agent, investigates alerts and drafts examiner-ready narratives.

How to Write a Transaction Monitoring Investigation Narrative

More from the blog