Explore This Section

SRC Insights: First Quarter 2008

Guidance for Writing Effective SAR Narratives

Tell what happened, tell it well, tell it concisely...William F. Buckley, Jr.

Since 1996, depository institutions-including banks, bank holding companies, and nonbank subsidiaries of bank holding companies-have been required to file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN) when they detect a known or suspected violation of federal law, a suspicious transaction related to money laundering activity, or a violation of the Bank Secrecy Act (BSA). Specifically, a SAR must be filed under the following circumstances:

  • Criminal violations involving insider abuse in any dollar amount
  • Criminal violations aggregating $5,000 or more where a suspect can be identified
  • Criminal violations aggregating $25,000 or more, regardless of a potential suspect
  • Transactions aggregating $5,000 or more that may involve potential money laundering or violations of BSA or where the transaction has no business or apparent lawful purpose

The information contained in filings provides SAR users (FinCEN, law enforcement, federal regulators, and intelligence agencies) with valuable data for investigating and combating money laundering, terrorism, terrorist financing, and other financial crimes and identifying patterns and emerging trends in suspicious and criminal activities. However, the increasing volume of SARs (the number filed by depository institutions soared from 62,388 in 1996 to 567,000 in 2006) presents a challenge for users who must review the reports but have limited resources to dedicate to that process. Therefore, it is imperative that depository institutions submit SARs that are complete, accurate, and timely so the users can extract the most useful information efficiently. Depository institutions can improve the utility of SARs by composing clear, concise, and thorough narratives in Part V of the SAR form, Suspicious Activity Information Explanation/Description.

Given the importance of the narrative, the purpose of this article is to provide guidance on how to write effective SAR narratives.1 The process for writing the narrative can be divided into two steps: compiling the information and formatting the relevant information in a cohesive manner.

Compiling Information for the Narrative
To the fullest extent possible, the preparer of the SAR should gather all information necessary to answer the following five essential questions, which comprise the basis of the SAR narrative.

  1. Who is conducting the suspicious activity? Fully describe and identify all suspects with respect to their occupation, position, or title within the business and the nature of the business. Explain the relationship amongst the suspects, and provide any other identification numbers, addresses, and aliases not reported elsewhere on the SAR form.
  2. What instruments or mechanisms were used to facilitate the suspicious activity? Fully describe these instruments, which may include, but are not limited to, wire transfers, letters of credit, correspondent accounts, structuring, shell companies, bonds/notes, stocks, mutual funds, insurance policies, travelers checks, bank drafts, money orders, credit/debit cards, stored value cards, and/or digital currency business services.

    Preparers also should explain briefly and clearly how the suspicious activity was conducted, documenting the method used to initiate the transaction, such as the Internet, phone, mail, ATM, and couriers. When describing the flow of funds, include the source of funds and the use, destination, or beneficiary of the funds. Identify all account numbers at financial institutions affected by the suspicious activity and, if possible, the account numbers held at other financial institutions involved, along with the institutions' names and locations.
  3. When did the suspicious activity take place? Record the date when the suspicious activity was first noticed and the timeframe in which it occurred. To better track the flow of funds, list the individual dates and the amounts of each transaction in chronological order rather than just the aggregate amount of all transactions.
  4. Where did the suspicious activity occur? If multiple offices of a single institution were involved in the suspicious activity, provide the addresses of these locations. If the activity or transaction involved a foreign jurisdiction, provide the name of the jurisdiction and the name and address of any financial institutions involved, with any corresponding account numbers, if possible.
  5. Why is the activity considered suspicious? Explain why the activity is unusual for the customer, considering the types of products and services offered by the institution and the typical activities of similar customers. The following is a sample, not a comprehensive list, of common patterns of suspicious activity:

    • A lack of evidence of legitimate business activity, or any business operations at all, undertaken by many of the parties involved in the transactions
    • Transactions that are not commensurate with the stated business type and/or that are unusual and unexpected in comparison with the volumes of similar businesses
    • Unusually large numbers and/or volumes of wire transfers and/or repetitive wire transfer patterns
    • Unusually complex series of transactions indicative of layering activity involving multiple accounts, banks, parties, or jurisdictions
    • Bulk cash and monetary instrument transactions
    • Transactions seemingly designed or attempting to avoid reporting and recordkeeping requirements
    • Transactions being conducted in bursts of activities within a short period of time, especially in previously dormant accounts
    • Beneficiaries maintaining accounts at foreign banks that have been subjects of previous SAR filings
    • Parties and businesses that do not meet the standards of routinely initiated due diligence and anti-money laundering oversight programs

Formatting the Narrative
Once all the necessary information has been compiled, it must be transcribed into the SAR narrative in a succinct, comprehensive, and well-organized format. Do not insert tables or other pre-formatted templates in the narrative because the conversion process used by the IRS Detroit Computing Center does not convert them properly, and the information becomes indecipherable. Also, do not submit any supporting documentation with the SAR form, because such documents are not entered into the database, thus making any reference to them meaningless. If possible, perform a second review of the SAR to ensure accuracy and completeness. In particular, verify that the suspicious activity described in the narrative matches the activity indicated in Part III of the SAR form, Suspicious Activity Information.

The following outline may be used as a guide for composing a more effective SAR narrative.

  1. Introduction
    This section can include:
    • A brief description of the institution filing the report and its primary business
    • The purpose of the SAR, including a general description of the known or alleged violation or activity and a summary of the suspicious patterns that initiated the SAR
    • The date of and reason for any SARs previously filed on the suspect or related suspects
    • Whether the SAR is associated with the Office of Foreign Assets Control's (OFAC) sanctioned countries or Specially Designated Nationals and Blocked Persons or other government lists for individuals or organizations
  2. Body
    This section should provide, in chronological order, all pertinent information supporting why the SAR was filed, including the following:
    • The key components of the answers to the following questions: Who is conducting the suspicious activity? What instruments were used to facilitate the suspicious activity? When, where, and how did the suspicious activity occur? Why is the activity considered suspicious?
    • Any other information not recorded elsewhere on the SAR that could aid investigations
    • Any factual observations or incriminating statements made by the suspect
  3. Conclusion
    The final section can summarize the report and might also include:
    • Information about any follow-up actions conducted by the depository institution
    • Names and telephone numbers of other contacts at the depository institution, if different from the point of contact indicated in Part IV of the SAR form, Contact for Assistance
    • Any additional information or documentation that may be made available to law enforcement
    • Names of any law enforcement personnel investigating the complaint who are not already identified in another section of the SAR

The guidance presented above provides depository institutions with a methodology for preparing quality SAR narratives. As stated earlier, incomplete and insufficient SAR narratives waste the valuable time of law enforcement and investigatory resources and hinder investigations. By writing concise, comprehensive, and well-organized narratives, depository institutions provide SAR users with the crucial information they need to conduct investigations into financial crimes and to identify emerging trends and threats.

In addition, improving the quality of SARs can benefit a depository institution directly. By analyzing their SARs internally, a depository institution may also be able to identify any potential operational weakness and better assess its risk profile. Preparing accurate and timely SARs is required by law and is a key requirement of an institution's BSA/AML program. During a BSA/AML examination, examination staff will assess the policies, procedures, processes, and overall compliance with statutory and regulatory requirements for monitoring, detecting, and reporting SARs. Consequently, the systemic failure to file SARs, systemic filing of incomplete or inaccurate SARs, or failure to maintain an adequate BSA/AML compliance program could result in supervisory action against the institution; its board of directors, officers, employees, or agents; or other institution-affiliated parties.

This article focused on just one aspect of the SAR report, the narrative. For additional information regarding SARs, please refer to the following documents produced by FinCEN: SAR Activity Review, Trends, Tips, and Issues and Suspicious Activity Reporting Guidance, which are both available online External Link, and Suggestions for Addressing Common Errors Noted in Suspicious Activity Reporting, which is also available online External Link.

For additional information related to BSA/AML, please refer to the Bank Secrecy Act/Anti-Money Laundering Examination Manual, available online External Link.

  • 1   More information on BSA forms and filing requirements is available on the FinCEN website External Link.

The views expressed in this article are those of the author and are not necessarily those of this Reserve Bank or the Federal Reserve System.