Category: Suspicious Activity Reporting

SAR Narrative

Also known as: Suspicious Activity Report Narrative

Simply put

A SAR narrative is the written portion of a Suspicious Activity Report (SAR) that describes, in plain language, the activity a financial institution considers suspicious. It explains what happened and why the activity was flagged, so that the recipient authorities can understand the concern. It is one part of a broader report rather than the report in its entirety.

Formal definition

The SAR narrative is the free-text component of a Suspicious Activity Report in which the filing institution documents the suspicious activity in a concise, objective, and complete manner. Guidance from US authorities generally recommends that the narrative address the five essential elements of information, who, what, when, where, and why, for the activity being reported, and that filers follow a structured process for organizing and writing it. In the US context, SARs function as a communication channel between financial institutions and law enforcement; the narrative supplements structured data fields by providing the contextual explanation of the reporting institution's basis for suspicion. The specific format, required fields, and filing mechanics are set by the relevant reporting regime and supervisory guidance and should be confirmed against the applicable rules. Note that in some jurisdictions the equivalent report is termed a Suspicious Transaction Report (STR); terminology and requirements vary. The filing of a SAR and its narrative reflects suspicion and does not, by itself, establish that any wrongdoing has occurred.

Why it matters

The SAR narrative is often the single most consequential element of a Suspicious Activity Report because it converts structured data fields into a coherent account that recipient authorities can act upon. In the US context, SARs function as a primary communication channel between financial institutions and law enforcement, and the narrative is where the filing institution explains the basis for its suspicion. A poorly constructed narrative can leave investigators unable to understand what the institution observed or why it was concerning, even when the underlying activity is genuinely significant. Guidance from US authorities generally emphasizes that the narrative should address the five essential elements of information, who, what, when, where, and why, so that the concern is intelligible to a reader without prior knowledge of the account or transactions.

Because the narrative captures the reporting institution's reasoning, its quality directly affects the usefulness of the report to authorities and, indirectly, the institution's ability to demonstrate that it has met its reporting obligations under the applicable regime. A concise, objective, and complete narrative helps distinguish a well-founded suspicion from an unexplained alert. Filers are generally expected to follow a structured process for organizing and writing the narrative, and supervisory guidance in the US has historically provided recommended approaches for doing so.

It is important to stress that the filing of a SAR and its narrative reflects suspicion only and does not, by itself, establish that any wrongdoing has occurred. The narrative documents the institution's basis for concern; it is not a finding of criminal conduct, and it should not be read as one. Exact format, required fields, and filing mechanics are set by the relevant reporting regime and supervisory guidance and should be confirmed against the applicable rules, as terminology and requirements vary by jurisdiction, in some jurisdictions the equivalent report is termed a Suspicious Transaction Report (STR).

Who it's relevant to

AML compliance officers and SAR filers

Staff responsible for drafting and reviewing SARs rely on the narrative to document the institution's basis for suspicion clearly and objectively. Guidance generally recommends addressing the five essential elements of information and following a structured process for organizing the narrative, so that the report is concise, complete, and intelligible to the recipient authorities. Exact filing requirements should be confirmed against the applicable regime.

Financial intelligence analysts and investigators

Analysts within an institution's financial crime function use the narrative to translate alerts and transaction data into a coherent account of what was observed and why it was concerning. Because the narrative captures the reasoning behind the filing, its clarity affects how effectively downstream reviewers and recipient authorities can interpret the report.

Law enforcement and recipient authorities

In the US context, SARs function as a communication channel between financial institutions and law enforcement, and the narrative provides the contextual explanation that the structured data fields do not. Recipients depend on a well-written narrative to understand the reported activity, though it should be understood that a SAR reflects suspicion and does not establish that wrongdoing has occurred.

Compliance program managers and supervisors

Those overseeing AML reporting programs are concerned with narrative quality as a measure of whether the institution is meeting its reporting obligations under the applicable regime. Supervisory guidance in the US has historically offered recommended approaches for organizing and writing narratives; specific expectations and equivalent report types, such as STRs in some jurisdictions, vary and should be confirmed against the relevant rules.

Inside SAR Narrative

The Five Essential Elements (Who, What, When, Where, Why/How)

A well-constructed SAR narrative generally addresses who is conducting the suspicious activity, what instruments or mechanisms are involved, when the activity took place, where it occurred, and why the filer considers the activity suspicious, including how the activity was detected or carried out. In the US context, FinCEN guidance describes these as the core building blocks of an effective narrative, though the precise expectations should be confirmed against current FinCEN instructions.

Subject Identification

Identifying details of the parties involved, such as account holders, beneficial owners where known, and other related persons or entities, along with account numbers and relationships. This describes the subject(s) of the report but does not itself establish that any subject has committed a crime.

Description of the Suspicious Activity

A clear, factual account of the transactions or conduct that gave rise to suspicion, typically including transaction amounts, dates, frequency, patterns, and the flow of funds. This is a factual and operational description rather than a legal determination of wrongdoing.

Basis for Suspicion

An explanation of why the activity is considered unusual or suspicious relative to the customer's expected profile, business, or prior behavior. This articulates the filer's reasoning and any red flags or typologies observed, which are indicators for consideration rather than proof of illicit conduct.

Chronological and Logical Structure

A narrative that presents events in a clear sequence so that a reader unfamiliar with the case can follow what happened and understand the concern. Clarity and completeness support the usefulness of the report to financial intelligence units and investigators.

Supporting Context and Investigative Steps

Relevant background such as the results of the institution's internal review, any documentation gathered, and where applicable a note on whether the account or relationship remains active. Supporting records are typically retained by the institution and made available to authorities on request rather than always attached to the filing itself.

Common questions

Answers to the questions practitioners most commonly ask about SAR Narrative.

Does filing a SAR with its narrative mean the institution has established that a crime occurred?

No. A SAR and its narrative report activity that appears suspicious or unusual; the filing does not establish, allege, or prove that any crime has been committed. The narrative documents the facts, patterns, and reasons giving rise to suspicion so that a financial intelligence unit or law enforcement body can assess the matter. Determining whether wrongdoing occurred is a function of investigative and criminal-law processes that sit outside the filing itself. Note that terminology varies by jurisdiction, with some regimes using the term Suspicious Transaction Report (STR) rather than SAR.

Is a SAR narrative just a restatement of the alert or transaction data that triggered it?

No. A narrative that merely repeats the underlying transaction data or the alert output generally does not serve its purpose. The narrative is expected to explain, in a structured way, what the suspicious activity is, who is involved, where and when it occurred, how it was conducted, and why it is considered suspicious. It should provide context and analysis that the raw data alone does not convey, rather than duplicating figures already captured in the structured fields of the report.

What information does a SAR narrative typically need to cover?

Narratives generally address the core investigative questions: who is involved (subjects and any relevant parties), what the suspicious activity consists of, when it occurred, where it took place, how it was carried out, and why the institution regards it as suspicious. Many financial intelligence units publish guidance on preferred narrative structure and content. Exact expectations vary by jurisdiction and by the reporting body's instructions, which should be confirmed against the applicable regime and the relevant FIU's guidance.

How should a narrative handle activity that spans multiple transactions or a long period?

Where suspicious activity involves multiple transactions or an extended timeframe, the narrative typically summarizes the overall pattern and time period rather than listing every transaction in prose, while ensuring the pattern that gives rise to suspicion is clearly explained. Supporting transaction detail is often conveyed through the report's structured fields or accompanying documentation as permitted by the applicable filing format. The specific approach should follow the format and instructions of the relevant reporting regime.

Should a SAR narrative state a definitive conclusion about the subject's conduct?

The narrative should describe the facts and the basis for suspicion using measured, factual language rather than asserting that the subject has committed an offence. Because a filing does not establish wrongdoing, narratives generally avoid conclusory statements of guilt and instead explain why the activity appears unusual or inconsistent with what is known about the customer. This distinction between reporting suspicion and alleging a crime is important both operationally and in criminal-law terms.

Who within an institution is typically responsible for drafting and approving the narrative?

Responsibility for preparing SAR narratives commonly sits with analysts or investigators within an institution's financial crime or compliance function, with review and approval often involving a designated officer such as the person responsible for reporting under the applicable regime. The precise roles, escalation paths, and approval requirements depend on the institution's internal procedures and on the obligations set by the relevant jurisdiction's rules, which should be confirmed against the applicable regulation.

Common misconceptions

A SAR narrative asserts or proves that the subject committed a crime.

A SAR (or STR in many non-US jurisdictions) documents activity that the filer finds suspicious; the narrative describes the basis for suspicion, not a legal conclusion of guilt. The filing itself does not establish wrongdoing, and the determination of any criminal conduct rests with the relevant authorities.

The terms SAR and STR mean exactly the same thing everywhere.

The US Bank Secrecy Act and FinCEN framework use the term Suspicious Activity Report (SAR), while many other jurisdictions use Suspicious Transaction Report (STR) or similar terminology, and the specific content requirements, filing bodies, and scope differ by regime. The underlying concept is related but the obligations should be checked against the applicable local law.

A longer narrative containing all available data is always better.

Effectiveness depends on clarity and relevance rather than length. A narrative should present the material facts and the reasoning for suspicion in a structured, readable way; excessive or unfocused detail can obscure the concern rather than aid the receiving authority.

Best practices

Structure the narrative around the core elements, who, what, when, where, and why/how, so that a reader with no prior knowledge of the case can follow it.

Use factual, precise language to describe the activity and clearly separate observed facts from the filer's assessment of suspicion, avoiding statements that imply a legal finding of criminality.

Explicitly articulate why the activity is suspicious relative to the customer's expected profile or business, rather than relying on the reader to infer the concern.

Present transactions and events in a clear chronological sequence, including amounts, dates, and the flow of funds where known.

Confirm content and formatting expectations against the applicable regulatory instructions for your jurisdiction, since requirements for SARs and STRs differ across regimes.

Retain supporting documentation and records of the internal review so they can be provided to authorities on request, and note relevant investigative steps within the narrative.