A suspicious activity report example is most useful when you can see the narrative itself, understand why it works, and then apply the same structure to your own facts. The sample below is adapted from FinCEN’s own published guidance on preparing SAR narratives, and it covers a case involving structured cash deposits and suspicious wire transfers to the United Arab Emirates.1FinCEN.gov. Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative
A Sample SAR Narrative
Investigation case number: A5678910. The customer, a grocery store and its owner, are suspected of intentionally structuring cash deposits to avoid federal reporting requirements. The customer also appears to be running an unlicensed money transfer operation, depositing bulk cash along with third-party out-of-state checks and money orders, then sending aggregate wire transfers to Dubai, UAE. The volume and type of activity are inconsistent with the customer’s expected business and differ significantly from similar businesses in the same area.
John Doe opened a personal checking account (#12345-6789) in March 1994, presenting a Virginia driver’s license and stating he was the self-employed owner of a grocery store called Acme, Inc. A business checking account (#23456-7891) was opened for Acme, Inc. in January 1998. Between January 17 and March 21, 2003, John Doe originated nine wire transfers totaling $225,000, each for $25,000, sent weekly to the Bank of Anan in Dubai to benefit Kulkutta Building Supply Company (account #3489728).
A review of the personal account between January 2 and March 17 revealed 13 deposits totaling approximately $50,000, with individual amounts ranging from $1,500 to $9,500, several occurring on consecutive business days. The business account during the same period received 33 deposits totaling approximately $275,000. Of these, 22 fell between $9,150 and $9,980. In nine instances where deposits were made to both accounts on the same day, the combined cash exceeded $10,000. Currency transaction reports were filed for all aggregate daily transactions over $10,000. A web search revealed that Acme, Inc. advertises remittance services to Middle Eastern countries including Iran. The state banking department confirmed Acme, Inc. is not licensed as a money transfer business.
Why This Example Works
Read the sample twice. The first two sentences give an investigator everything they need to decide whether this report belongs on their desk: a named subject, the suspected conduct (structuring and unlicensed money transmission), and the destination of the funds. That summary at the top is not optional. An investigator scanning a stack of SARs should know within seconds whether yours is relevant.
The second paragraph fixes the subject in time and identity. Account numbers, the opening dates, the identification document presented, the stated occupation. The nine wire transfers are counted, totaled, dated, and tied to a specific beneficiary account at a specific bank. No rounding, no vague references to “several” transfers.
The third paragraph does the same work for the deposit activity and then adds something investigators particularly value: the research steps the bank took on its own. Checking the state banking department for a money transmitter license, finding the remittance advertising online. Those details tell the reader this is not a reflexive filing. The bank thought about what it was seeing before it wrote the report.
Notice what the narrative does not do. It does not say John Doe is laundering money. It does not accuse him of a crime. It describes what he did, contrasts it with what would be normal for a grocery store, and lets the investigator reach the conclusion.
The Six Questions Every Narrative Must Answer
FinCEN’s guidance frames every narrative around six questions: who, what, when, where, why, and how.1FinCEN.gov. Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative The FFIEC examination manual lays out the same elements for examiners who review SAR quality.2FFIEC BSA/AML InfoBase. Appendix L – SAR Quality Guidance
Who: the subject’s full name, any aliases or business names, and the subject’s relationship to the institution. Any other individuals or entities involved in the transactions.
What: the type of suspicious activity (structuring, wire fraud, mortgage fraud, unlicensed money transmission, and so on) and the financial products or payment methods used.
When: the specific dates of individual transactions, not just a date range for the review period. If activity spans months, note the full window and the dates of key transactions within it.
Where: the branches, accounts, and geographic locations involved, including the destinations of any wire transfers.
Why: what makes this activity suspicious. The narrative should contrast the behavior with the customer’s stated occupation, business type, or prior transaction history.
How: the mechanics of the scheme, including how funds moved into, through, and out of the institution.
Principles That Separate Good Narratives From Bad
Lead with a summary. The first one or two sentences should state the type of suspected activity and name the subject. If an investigator reads only the opening and nothing else, they should still understand the report.
Use specific dates and dollar amounts. “Between January 5 and February 12, the customer made 14 cash deposits totaling $127,400” is useful. “The customer made several large deposits over several weeks” is not. Investigators reconstructing a timeline need individual data points, not aggregated prose.
Explain why the activity is unusual. A wire transfer to Dubai is not inherently suspicious. It becomes suspicious when the sender runs a local landscaping company and has never sent an international wire before. The contrast is the whole point.
Describe how the activity was detected. Was it flagged by automated transaction monitoring, spotted by a teller, or surfaced during a routine account review? That context tells the investigator how complete the picture is.
Stick to observable facts. Describe behavior and let the reader draw conclusions. “The customer made 22 deposits ranging from $9,150 to $9,980” is a fact. “The customer is clearly laundering drug money” is a conclusion you cannot support and should not write.
Write in plain English and in chronological order where possible. Avoid acronyms the reader may not share. Spell out names in full the first time you use them.
What the Form Collects Around the Narrative
The narrative sits in Part V of FinCEN Form 111. The other parts collect the structured data that lets investigators search and sort SARs across the system.3FinCEN.gov. FinCEN Suspicious Activity Report Electronic Filing Instructions
Part I captures the subject: full name, aliases, date of birth, address, Social Security Number or Taxpayer Identification Number, occupation, phone number, email, a government identification number such as a driver’s license or passport, and the subject’s relationship to the institution. If a field is unknown, the filer checks the corresponding “unknown” box rather than leaving it blank.
Part II covers the suspicious activity itself: the dollar amount, the date range, and checkbox categories for the type of activity (structuring, money laundering, terrorist financing, various types of fraud, mortgage fraud, securities violations, insurance-related activity). Filers also identify the product types and payment methods involved.
Parts III and IV identify the filing institution and the specific branch or branches where the activity occurred. If activity touched multiple branches, each should be listed.
Everything in the narrative should be consistent with what the structured fields say. If Part II shows $225,000 in wire activity, the narrative should account for the same figure.
When the Narrative Is Due
A bank has 30 calendar days from initial detection of facts that may warrant a SAR to file the report through the FinCEN BSA E-Filing System.4eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions If no suspect has been identified at detection, the bank gets an additional 30 days to try to identify one, but the filing cannot be delayed beyond 60 days total.
Broker-dealers and insurance companies follow the same 30/60-day timeline.5eCFR. 31 CFR 1023.320 – Reports by Brokers or Dealers in Securities of Suspicious Transactions Money service businesses file within 30 days with no extension.6FinCEN.gov. Money Services Business (MSB) Suspicious Activity Reporting
Situations that demand immediate attention, such as ongoing money laundering or suspected terrorist financing, require a phone call to law enforcement in addition to the electronic filing.5eCFR. 31 CFR 1023.320 – Reports by Brokers or Dealers in Securities of Suspicious Transactions
After filing, keep the SAR and all supporting documentation for five years from the filing date, organized so it can be produced quickly if FinCEN, a federal regulator, or law enforcement asks for it.4eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Writing the Follow-Up Narrative
Suspicious activity rarely stops after a single report. FinCEN guidance calls for review of continuing suspicious activity at least every 90 calendar days, with the follow-up SAR due no later than 120 days after the filing date of the prior report.7FFIEC BSA/AML InfoBase. Suspicious Activity Reporting – Overview An institution can file sooner if the facts warrant earlier law enforcement attention.
A continuing activity narrative should reference the prior filing by date and tracking number and then describe only what has happened since. The cumulative dollar amount field (item 28) is designed to let investigators see the running total of suspicious transactions across reporting periods.
Keep the Narrative Confidential
While you are writing a SAR, and after you file it, federal law prohibits disclosing to the subject that a report has been filed or even that one exists.8Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The prohibition reaches current and former directors, officers, employees, agents, and contractors.
SARs should not be produced in response to a civil subpoena. They are shared only with federal, state, and local law enforcement with jurisdiction, and with regulatory agencies that examine the institution for BSA compliance.4eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
In exchange for that confidentiality, filers get broad immunity. Any financial institution that discloses possible legal violations to a government agency, whether the filing is mandatory or voluntary, is shielded from civil liability under federal law, state law, and any private contract.8Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority That protection covers the institution and any individual director, officer, employee, or agent who participates in the report, and it covers the decision not to tell the subject.
Write the narrative knowing it will be read by investigators who have never met your customer and never seen your transaction monitoring system. Give them the facts, in order, with the numbers that let them pick up where you left off.