How to Write a SAR Narrative That Law Enforcement Can Actually Use
A complete SAR narrative answers six questions: who conducted the activity, what they did, when and where it happened, why it's suspicious for this specific customer, and how the pattern was carried out. If a trained investigator can't re-perform your review from the narrative alone and reach the same conclusion, it isn't finished, no matter how long it is.
That's the whole standard. Everything else is detail. The problem is that most narratives never clear it, and they fail the same way every time: they restate the numbers already sitting in the fixed fields and call the activity "suspicious" without ever explaining what made it suspicious. A filing like that closes an alert. It does nothing for the agent who pulls it two years later trying to build a case.
This post covers what to include in a SAR narrative, the six elements the FFIEC and FinCEN use to judge quality, the failure patterns examiners cite most, and a full worked example showing the difference between a narrative that works and one that just fills the box.
What "Complete and Sufficient" Actually Means
FinCEN's guidance on preparing a SAR narrative sets the bar at five essential elements, who, what, when, where, and why, plus a sixth, how, covering the modus operandi. The FFIEC BSA/AML Examination Manual reinforces it in plainer terms. The manual calls the narrative "critical" because it's the only free-text space for summarizing the activity, and notes that the care taken in writing it "may make the difference in whether or not the described conduct and its possible criminal nature are clearly understood by law enforcement."
Read that again. The regulator's own standard isn't "did you file." It's whether someone downstream can understand the conduct well enough to act on it. FinCEN has been explicit that a narrative which merely repeats fixed-field data, amounts and dates with no context, is insufficient on its face.
Here's the mental model that makes this concrete. Call it the re-performance test. A narrative passes if a reader who has never seen the account can:
Identify the subject and their relationship to the institution
Understand the activity specifically enough to pull the same transactions
Understand why that activity is unusual for this particular customer
See what the institution investigated and what it ruled out
Reach the same filing decision on their own
Fail any one of those and the narrative is operationally useless, which also makes it a regulatory liability. Appendix L of the FFIEC manual, the examiner reference for SAR quality, documents vagueness as the deficiency examiners cite most. It isn't complexity that sinks narratives. It's the absence of specifics that would let anyone verify the work.
The Six Elements, and What Each One Needs
Who. The subject, their role, and their relationship to the institution. Account holder, signer, beneficiary, non-customer conducting a transaction. Include identifiers, but the narrative has to state the relationship in plain language, not just point at a field.
What. The activity itself, in transaction-level detail. Not "multiple cash deposits" but the count, the amounts, the range, the channel.
When. The date range, and where timing itself is part of the pattern, the specific dates. Eleven deposits on consecutive Mondays is a different story than eleven deposits scattered across a quarter, and the narrative has to say which.
Where. Branch, ATM, online, the geography of any counterparties or destination accounts. Where funds went matters as much as where they came in.
Why. The element that separates a real narrative from a form letter. Why is this activity suspicious for this customer, given their profile, stated occupation or business purpose, and prior account history? Without an established baseline, there's no contrast, and without contrast there's no articulable suspicion.
How. The modus operandi. How was the pattern executed? This is where structuring stops being a list of sub-$10,000 deposits and becomes a described method: deposits deliberately kept under the reporting threshold, timed and sized to avoid a CTR, followed by immediate outbound wires.
Miss the "why" and "how," and you've written a transaction log. Those two elements are the analysis. The other four are the facts the analysis rests on.
A Worked Example: Structuring
The fastest way to see the standard is side by side. Same case, same facts. One narrative works. One doesn't.
Weak:
This SAR is being filed regarding unusual cash activity in the account of [Subject]. The customer made multiple cash deposits below $10,000 on various dates. The bank reviewed the account and found the activity to be suspicious. The bank will cooperate with any law enforcement requests.
Everything wrong with SAR writing is in those four sentences. No date range. No amounts. No baseline. No pattern. No investigation described. No articulated reason for suspicion beyond the word itself. An investigator can do nothing with this.
Complete:
Between March 1 and June 15, 2025, [Subject], an individual customer holding personal checking account [XXXX], conducted 14 cash deposits totaling $68,400, each structured below the $10,000 CTR threshold. The customer opened the account in January 2023; stated occupation is retail sales associate. Account history from opening through February 2025 shows average monthly deposits of $2,100 to $2,800, consistent with bi-weekly direct deposit from a single employer, with no prior cash transaction above $500.
Beginning March 1, 2025, the customer made cash deposits exclusively at the branch ATM between 8:00 and 9:00 AM on weekdays. The 14 deposits ranged from $4,800 to $9,800, none reaching $10,000; 11 of the 14 occurred on Mondays. During the same period, outflows consisted of two wire transfers totaling $67,200 to an account at [Foreign Bank], [Country], on April 3 and June 10, 2025.
Upon alert, [Institution] reviewed 24 months of account history and confirmed no prior cash activity of this volume. Stated occupation was verified against employment documentation on file; no update was on record. A customer contact attempt on June 20, 2025 went unanswered, and no explanation for the cash activity or the foreign wires has been provided. [Institution] is filing under suspicious activity code 35 (Structuring). No prior SARs have been filed on this subject.
The second version is longer, but length isn't why it's better. It's better because every sentence gives the reader something to act on. The baseline establishes what normal looked like. The pattern analysis shows the method. The investigation section marks the boundary between what the institution verified and what remains unknown, which tells law enforcement exactly where their work begins.
Notice one thing the good narrative doesn't do: it never claims the customer "knew" about CTR requirements. Structuring doesn't require proving knowledge. The pattern is the evidence. Asserting intent you can't support weakens the filing and isn't your call to make.
The Deficiencies Examiners Cite Most
Across exam findings and FinCEN guidance, the same handful of problems come up again and again:
Restating the fixed fields. The amount and date are already captured elsewhere in the report. Repeating them in the narrative without context adds nothing and is explicitly called insufficient.
No baseline. The narrative describes activity but never establishes what was normal for this customer, so the reader can't tell why it's unusual.
"Suspicious" as a conclusion, not a demonstration. Labeling activity suspicious isn't the same as showing why. The narrative has to make the reader reach the conclusion, not announce it.
No investigation on the record. A narrative that jumps from alert to filing, with nothing about what the institution reviewed or tried to rule out, reads like a monitoring system fired and no human looked. Examiners notice.
Editorializing past the facts. Using loaded terms, "trafficking," "fraud ring," without a factual basis in the institution's records. Describe the observed indicators and, where relevant, note they align with a specific FinCEN advisory. Let the facts carry it.
Quality beats quantity every time here. FinCEN reaffirmed as recently as its October 2025 FAQ update that institutions shouldn't expend resources on filings that don't give law enforcement usable information, a concise, specific narrative outperforms a long vague one. A wall of text isn't thoroughness. It's often the opposite, specifics buried under boilerplate.
What This Means for Your SAR Process
A few things worth bringing to a team review:
If your narrative template opens with the alert reference number or how the alert generated, flip it. Lead with the activity and the subject. FinCEN wants the reader's attention on the suspicious conduct first, not on your case-management plumbing.
Build the baseline into the workflow, not the writing. If analysts are reconstructing normal account behavior from scratch at narrative time, it's slow and inconsistent. Surface prior-period activity as a standard step before the narrative gets written.
Treat the investigation section as non-optional. What you reviewed, what you asked, what you ruled out. It's the part that shows an examiner a human conducted a genuine inquiry, and it's the part weak narratives skip entirely.
None of this is about writing more. It's about writing so someone else can act.
Frequently Asked Questions
What are the five essential elements of a SAR narrative?
FinCEN identifies five essential elements: who conducted the activity, what instruments or mechanisms were used, when it took place, where it occurred, and why the institution considers it suspicious. A sixth element, how (the modus operandi), describes the method behind the pattern. Together these are the standard for a complete and sufficient narrative.
How long should a SAR narrative be?
There's no required length. FinCEN's standard is quality over quantity, a narrative should be as long as it needs to be to cover the six elements and no longer. A concise, specific narrative is more useful to law enforcement than a long one padded with boilerplate or restated field data.
What's the most common SAR narrative mistake?
Vagueness. The most cited deficiency is a narrative that restates the fixed-field data (amounts and dates) and labels the activity "suspicious" without establishing a customer baseline, describing the pattern, or documenting the investigation. It closes an alert but gives law enforcement nothing to act on.
Should a SAR narrative state that the customer intended to break the law?
No. Describe the facts and the pattern, not intent you can't establish. For structuring in particular, proving the customer "knew" about reporting thresholds isn't required, the transaction pattern itself is the basis for the filing. Asserting unsupported intent weakens the narrative.
Do I need to include what the institution investigated?
Yes. The investigation section shows examiners that a genuine inquiry took place rather than an automated alert-to-filing pipeline, and it tells law enforcement where the institution's knowledge ends and their work begins. Document what was reviewed, what was asked, and what was ruled out.
Primary Sources
This post draws on publicly available regulatory guidance:
FinCEN, SAR Narrative Guidance Package: Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative (November 2003) — fincen.gov
FFIEC BSA/AML Examination Manual, Appendix L: SAR Quality Guidance — bsaaml.ffiec.gov
FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting (Assessing Compliance) — bsaaml.ffiec.gov
FinCEN, Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report (October 9, 2025) — fincen.gov
Stay current on financial crimes enforcement.
The AML Brief publishes weekly intelligence on enforcement actions, typologies, and regulatory updates, straight to your inbox every Tuesday.
[Subscribe free → theamlbrief.com]
Last updated: July 23, 2026
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice, and should not be relied upon as such. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.