How to Write a SAR Narrative: Best Practices for Fintechs

The Suspicious Activity Report narrative is the most consequential element of a SAR filing. It is the document that law enforcement and regulators actually read to understand what happened, who was involved, and why you determined the activity was suspicious. A well-written SAR narrative enables the investigation. A poorly written one — vague, incomplete, or generic — wastes the filing opportunity entirely.

Inadequate SAR narratives are among the most commonly cited examination findings for fintechs and MSBs. This guide covers what a strong SAR narrative includes, how to structure it, and the most common mistakes to avoid.

What a SAR Narrative Must Accomplish

The SAR narrative must describe, in a clear and comprehensive way, what activity occurred, who was involved, how the activity was conducted, when it happened, where it occurred, and why it is suspicious. These are the 5 Ws that every SAR narrative must answer — not as a checklist, but as a coherent account of the activity and your analysis.

The narrative must be self-contained. A reader with no knowledge of your platform, your customer, or your prior investigation should be able to read the narrative and understand exactly what happened and why it was flagged.

The 5 Ws Framework

Who

Identify all subjects and relevant parties — the customer account holder, any other individuals involved in the transactions, and any known third parties. Include full names, account numbers, identification numbers, and addresses where known. If identities could not be verified, note that and explain the circumstances.

What

Describe what occurred — the specific transactions, amounts, dates, and transaction types. Be specific. "The customer engaged in frequent transfers" is not acceptable. "The customer conducted 47 outbound wire transfers totaling $312,000 between March 3 and March 17, 2025" is what a SAR narrative requires.

When

Provide specific dates and time ranges for the suspicious activity. If the activity spans a period of time, describe both the overall period and key specific dates within it.

Where

Identify the platform, account, and jurisdiction involved. For international transactions, identify the originating and destination countries.

Why

This is the most important element. Explain specifically why the activity is suspicious — not just that it triggered an alert, but what pattern, inconsistency, or red flag led you to conclude that the activity may involve illicit activity. Reference the customer's stated profile and explain how the observed activity deviates from expectations. Note any prior activity that provides context.

What a Strong SAR Narrative Includes

A strong narrative opens with a clear, concise summary of the suspicious activity — one to three sentences that give the reader the key facts immediately. It follows with a detailed description of the suspicious transactions in chronological order, including amounts, dates, transaction types, and counterparties. It describes the customer's expected activity based on their stated profile and account history. It explains specifically how the observed activity deviates from expectations. It describes the investigation steps taken and what they revealed. And it concludes with a clear statement of the specific reason for filing.

What SAR Narratives Should NOT Include

Do not include conclusions about whether criminal activity definitively occurred — that determination is for law enforcement, not the filer. Do not include legal conclusions or characterize activity as "money laundering" — describe the pattern and let the analysis speak for itself. Do not include irrelevant account history that does not contribute to understanding the suspicious activity. Do not use vague language like "unusual activity" or "possible suspicious transactions" without specifics.

Common SAR Narrative Failures

The most common SAR narrative failures that examiners cite include narratives that merely repeat the SAR header data without adding explanation, narratives that describe generic patterns without customer-specific detail, narratives that fail to explain why the activity is suspicious in the context of the specific customer, and narratives that simply say "structuring" without describing the specific pattern that indicates structuring.

Frequently Asked Questions

How long should a SAR narrative be?

FinCEN provides a 2,000 character limit for the SAR narrative field, but complex activities may warrant attaching a more detailed narrative document. The right length is whatever is required to fully describe the activity and the basis for suspicion. Brevity at the expense of completeness is not acceptable. For complex multi-transaction patterns, a longer narrative with a complete transaction table is often appropriate.

Should I describe the investigation process in the narrative?

Yes. Describing what investigation steps were taken and what they revealed — review of transaction history, review of customer profile, attempts to obtain additional information from the customer — strengthens the narrative and demonstrates that the filing is based on analysis, not automation.

How ComplyOne Helps

ComplyOne helps fintechs develop SAR filing programs — including investigation procedures, narrative templates, and quality review processes — that produce SAR filings that satisfy regulatory standards and support law enforcement effectively, through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.