SAR Narrative: Definition and Use in Compliance

What is SAR Narrative?

The SAR Narrative is the free-text written section of a Suspicious Activity Report (SAR) where a compliance analyst describes suspicious conduct in plain language. It's the part investigators actually read. Everything else in the SAR form, account numbers, transaction codes, filing dates, is structured data. The narrative is what gives that data meaning.

FinCEN's instructions for the SAR form (FinCEN Report 111) require the narrative to address the "5 Ws and 1 H": who conducted the suspicious activity, what was done, when it occurred, where it took place, why the institution considers it suspicious, and how it was carried out. This framework has been standard since FinCEN's early SAR Activity Review publications and remains the foundation of every U.S. SAR narrative today.

A strong narrative is specific. "Customer deposited $9,500 on three consecutive business days across three branches" is useful. "Customer engaged in unusual cash activity" is not. FinCEN has repeatedly emphasized in its guidance that vague narratives reduce the actionability of SARs and limit law enforcement's ability to build cases.

Consider a concrete example. A regional bank identifies a business account receiving large wire transfers from multiple foreign counterparties, then immediately dispersing funds via ACH to 30 individual accounts. The SAR Narrative for that case needs to name each counterparty, list wire amounts and dates, describe the ACH disbursement pattern, note any Customer Due Diligence (CDD) gaps in the business relationship, and explain why the pattern conflicts with the account's stated purpose. That's a minimum. Anything less and the FIU analyst on the other end is left guessing.

Poorly written narratives are a leading cause of SAR returns and persistent law enforcement frustration with the quality of financial intelligence.

How is SAR Narrative used in practice?

Most compliance teams engage with the SAR Narrative at three stages: during the investigation itself, at the filing review, and in post-submission quality audits.

During investigation, analysts draft the narrative as they work the case. This is deliberate. Writing forces the analyst to articulate why activity is suspicious, which sometimes surfaces gaps that need to be closed before filing. It's common for an analyst to realize mid-draft that they've never confirmed the customer's stated business type, which triggers a round of Enhanced Due Diligence (EDD) before the SAR is submitted.

At filing, the MLRO or BSA Officer reviews the narrative for quality and completeness. High-performing compliance functions use an internal checklist. Is every dollar amount included? Are dates specific? Is the "why suspicious" section explicit, not inferred? Does the narrative stand alone without the attached exhibits? Most regulators expect the narrative to be self-contained.

Post-filing, institutions increasingly conduct random audits of submitted SARs. This is partly driven by OCC and FinCEN examination findings, which have flagged narrative quality as a recurring weakness. TD Bank, which paid $3 billion in BSA/AML penalties in October 2024, had documented failures in its SAR filing program across high-risk correspondent banking activity.

Some banks now use AI-assisted drafting. The system generates a first-pass narrative from structured case data, cutting typical drafting time from three hours to under 45 minutes. Analysts review and edit before submission. This also improves consistency: every narrative covers the same required fields, regardless of which analyst handles the case.

Transaction Monitoring systems generate the alerts that start most SAR investigations. The quality of the narrative depends heavily on how well the underlying case data is organized and surfaced to the analyst.

SAR Narrative in regulatory context

The legal basis for SAR Narratives in the United States is 31 U.S.C. § 5318(g) and FinCEN's implementing regulations at 31 CFR Part 1020 for banks, Part 1021 for credit unions, and Part 1023 for broker-dealers. Every covered institution must file a SAR when it knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, or involves $5,000 or more in suspected illicit funds.

The narrative is the only section of the SAR that conveys investigative judgment. Examiners from the OCC, FDIC, and Federal Reserve review narrative quality during BSA/AML examinations. FinCEN's guidance makes clear that narrative clarity directly affects downstream law enforcement utility.

Internationally, the concept maps to the Suspicious Transaction Report (STR) used across FATF member jurisdictions. FATF Recommendation 20 requires countries to mandate STR filing and ensure the accompanying narrative provides sufficient information for the Financial Intelligence Unit (FIU) to analyze the report. FATF's mutual evaluation process assesses whether FIUs receive actionable intelligence from financial institutions, and narrative quality factors into those evaluations.

In the UK, the Proceeds of Crime Act 2002 (POCA) governs suspicious activity reports filed with the National Crime Agency. The NCA's SAR reporter guidance states that a good narrative tells a complete story, clear enough for a reader unfamiliar with the account to understand why the institution is filing.

For institutions using goAML, the UNODC-developed reporting system adopted by dozens of FIUs globally, the narrative field maps to the free-text description field in the goAML XML schema. Institutions submitting to goAML jurisdictions must adapt their narratives to fit that format without sacrificing specificity.

Common challenges and how to address them

The two biggest problems with SAR Narratives in practice are quality and volume. At most large financial institutions, they aren't separate problems. Volume pressure is what degrades quality.

A major U.S. money center bank may file 50,000 to 100,000 SARs annually. At that scale, analyst time is the constraint. A complex structuring or trade-based money laundering case can take four hours to narrate properly. With backlogs of thousands of overdue cases and analysts averaging 30 to 50 open investigations each, corners get cut. The narrative suffers first.

Vague narratives are the most documented deficiency. FinCEN's SAR Activity Review has flagged them across multiple annual publications. Phrases like "customer engaged in activity inconsistent with their profile" appear in thousands of filings and tell investigators nothing specific. The fix is a narrative template that forces specificity: mandatory fields for transaction amounts, dates, counterparty names, and a required explanation of the pattern in concrete terms.

Inconsistency across analysts is the second major failure mode. Two analysts investigating similar structuring cases can produce narratives of widely different quality and length. Standardized templates and AI-assisted first drafts reduce this variance. One U.S. bank that deployed structured prompts in its Case Management system saw narrative quality scores in internal audits rise from 62% passing to 89% passing within six months.

Backlog compounds regulatory risk. A bank that fell behind on SAR filings cleared its queue from 6,000 to under 400 cases within eight weeks after deploying AI-assisted drafting and dedicated narrative review queues.

Legal language creep is subtle but damaging. Analysts trained in legal thinking sometimes write narratives as briefs, inserting hedging phrases like "the institution believes this may potentially constitute money laundering." FinCEN guidance is direct on this point. State what you observed. Leave the legal characterization to investigators.

Related terms and concepts

SAR Narrative sits at the intersection of AML operations, regulatory reporting, and investigative intelligence. Understanding it means understanding the workflow it lives inside.

The Suspicious Activity Report (SAR) is the parent document. The narrative is one field within it, alongside structured data for transaction details, subject information, and filing institution records. In jurisdictions outside the U.S., the equivalent document is the Suspicious Transaction Report (STR), though the narrative function is identical.

Alert Disposition is the decision point before SAR filing. Once an analyst escalates an alert to a case, the SAR Narrative is what documents the reasoning behind that escalation and the full investigation that followed. The two are linked: a well-documented alert disposition makes the narrative faster to write and easier to defend under examination.

The Money Laundering Reporting Officer (MLRO) typically holds final sign-off on SAR filings. In many institutions, they review every narrative before submission. In high-volume programs, they sample, with automated quality checks covering the rest.

Customer Due Diligence (CDD) records frequently appear in SAR Narratives as background context. If the customer's stated occupation conflicts with their transaction pattern, the narrative should say so explicitly. EDD findings for high-risk customers feed directly into the narrative's explanation of why activity is suspicious.

For Politically Exposed Persons, narratives require particular care. PEP status alone is not suspicious. Transactions inconsistent with a PEP's known source of wealth are, and the narrative must make that distinction clearly. Lumping the two together is a common examiner finding.

Audit Trail documentation backs every narrative. Each factual claim in the narrative should have a corresponding record in the case file: transaction logs, call recordings, CDD documents, and analyst notes. Without that backing, the narrative is assertion, not evidence.