A SAR narrative example that actually helps a filer looks like this: a short opening sentence naming the type of suspicious activity and the total dollar amount, a chronological walk-through of the transactions with specific dates and figures, a plain-language explanation of why the behavior did not fit the customer, and a closing note on what the institution did. Part V of FinCEN Form 111 is a free-text field, and it is the section law enforcement relies on most heavily. The structured checkboxes in Parts I through IV tell an investigator what category the activity falls into; the narrative tells them what actually happened.
A Sample Narrative
Here is an abbreviated example that follows the structure FinCEN’s guidance recommends:
“This SAR is being filed to report suspected structuring activity involving account holder John Doe (account #XXXXX). Between March 1, 2026 and May 15, 2026, Doe made 14 cash deposits ranging from $8,500 to $9,900 at four separate branch locations, totaling $131,400. Doe’s account was opened in January 2026 with stated employment as a freelance graphic designer and expected monthly deposits of $3,000. When questioned by a teller on April 10 about the source of the cash, Doe provided inconsistent explanations, first citing a car sale and later describing the funds as a gift from a family member. The institution placed a hold on Doe’s account on May 16, 2026 and is considering account closure.”
Read that paragraph as a template. The first sentence identifies the activity type and the subject. The second gives the dates, the count of transactions, the range of individual amounts, the number of branches involved, and the aggregate. The third establishes the baseline — what the institution knew about this customer and expected from the account. The fourth introduces a specific interaction that added to the suspicion, dated and attributed. The fifth reports the institution’s response. Nothing in the paragraph accuses Doe of a crime; it describes behavior and lets the pattern speak.
What the Narrative Has to Cover
FinCEN’s guidance organizes the narrative around six questions. Treat them as a checklist you work through before you write, not as headings inside the report.1FFIEC. FFIEC BSA/AML Examination Manual – Appendix L – SAR Quality Guidance
Who. Go beyond what Part I already captures. Include the subject’s occupation, their role in any business involved, and any known associates who participated. If the subject used an intermediary or a shell company, say so and name it.
What. Identify the instruments and mechanisms. Wire transfers, cashier’s checks, prepaid cards, digital currency, correspondent accounts, shell companies — specify which. The Part II checkboxes flag the category; the narrative should name the actual products used.
When. Give dates and amounts for individual transactions where possible, not just an aggregated total. If the activity spans months, say when your institution first detected it and how long it ran.
Where. Identify the branches or locations where transactions occurred. Note when funds moved to or from a foreign jurisdiction.
Why. Explain what made the activity unusual for this particular customer, given their account history, stated occupation, and normal product use. This is where the sample narrative’s line about a graphic designer with $3,000 expected monthly deposits does its work. Without that baseline, 14 cash deposits is just a number.
How. Describe the method of operation. If the subject made deposits at different branches on the same day, say that. If a business account received large incoming wires and immediately sent them overseas with no connection to the stated business, walk through the sequence in order.
How to Structure the Text
A practical order is summary, chronology, institution action.
The summary is one or two sentences at the top. It names the type of suspicious activity, identifies the subject, and states the total dollar amount and the date range. An investigator triaging hundreds of reports should be able to read that opening and know what the report is about.
The chronology is the body. Walk through transactions in date order. Group them where grouping helps (fourteen cash deposits over ten weeks is easier to read as a range than as a list), but keep enough specificity that an investigator could pull the underlying records. When something a person did or said contributed to the suspicion — a teller interaction, an inconsistent explanation, a refusal to provide documentation — put it in place chronologically and attribute it.
The closing describes what the institution has done: holds placed, accounts closed or under review, relationships terminated, law enforcement contacted by phone if the situation required it. This tells the reader the current status of the customer relationship and signals whether follow-up action from the institution is likely.
Language to Avoid
Do not declare that the customer committed a specific crime. The narrative reports facts and identifies a pattern; the legal conclusion belongs to investigators and prosecutors. “Doe provided inconsistent explanations” is a fact. “Doe committed structuring” is a conclusion, and stating it can undermine the report’s credibility.
Avoid internal jargon and system-specific acronyms. The people who will read your SAR do not work at your institution and will not know what your internal alert codes, product names, or department abbreviations mean. Spell things out.
Do not lean on aggregated totals when specifics are available. A single line saying “the customer deposited $131,400 in cash” tells an investigator far less than the same total broken into fourteen deposits of stated amounts at four named branches over a stated period.
How the Narrative Fits With the Rest of Form 111
Part V does not stand alone. FinCEN Form 111 has five parts, and the narrative complements the structured data rather than repeating it.2Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions Part I captures subject identity — full legal name, address, tax identification number, date of birth, identification documents, relationship to the institution, account numbers. Part II captures the activity category, dollar amount, and date range through predefined selections. Part III identifies the institution where the activity occurred; Part IV identifies the filer.
The narrative should assume the reader has those fields in front of them. You do not need to restate the subject’s home address or the account opening date if Part I already carries them. What the narrative adds is the story the checkboxes cannot tell: the sequence, the context, and the reason the pattern looked wrong.
For a continuing-activity SAR — required when suspicious behavior continues after an earlier filing — the narrative should include the cumulative dollar amount to date, reference the previous filing’s BSA Identifier, and update the account of the activity with anything new since the last report.2Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
Confidentiality Applies to What You Write
Once the SAR is filed, federal law prohibits directors, officers, employees, and agents of the institution from telling the subject or anyone else involved in the reported transaction that a SAR exists.3Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The prohibition covers not just the document but any information that would reveal a SAR was filed. Unauthorized disclosure carries civil fines up to $100,000 per violation and criminal penalties of up to $250,000, five years in prison, or both.4Financial Crimes Enforcement Network. SAR Confidentiality Reminder for Internal and External Counsel of Financial Institutions
The underlying transactional records — the deposit slips, the wire instructions, the surveillance footage — are not themselves confidential in the same way; those raw facts can be produced when appropriate. What cannot be revealed is the SAR itself or the fact that one was filed. Write the narrative with that split in mind: it is a document that will move through law enforcement and supervisory channels, and its distribution is restricted by statute.