# Suspicious Activity Report Narrative: [Case reference]

> Internal case file that takes one suspicion from alert and investigation
> to a filed Suspicious Activity Report (SAR, United States) or Suspicious
> Transaction Report (STR, EU, UK and most other countries), or to a
> documented decision not to file. It follows the who, what, when, where,
> why and how method of the FinCEN Guidance on Preparing a Complete and
> Sufficient Suspicious Activity Report Narrative (November 2003), the US
> bank SAR rule at 31 CFR 1020.320, the FinCEN and federal banking agency
> SAR FAQs of 2025-10-09, the EU reporting and tipping-off rules
> (Directive (EU) 2015/849 Articles 33 and 39 as transposed in national
> law, replaced by Regulation (EU) 2024/1624 (AMLR) Articles 69 and 73 from
> 2027-07-10) and FATF Recommendations 20 and 21 (names and numbers only).
> The example bank, Fernhollow Bank, its customers and all facts are
> fictional. Replace every `[bracketed]` value and every row marked
> *Example*. Obtain the law and the regulator guidance for the normative
> text. This is a document format, not legal or compliance advice.

<!--
Guidance: How to use this template
- Keep this file inside the restricted financial crime case system or an
  encrypted local folder. Never upload it to a shared drive, ticketing
  tool or AI service outside the approved environment. The existence of a
  report is confidential by law.
- Work in order: deadline tracker (section 1), legal route (2), subjects
  (3), evidence (4), transactions (5), red flags (6), then build the
  narrative (7 and 8). Write the decision (9) last, when the facts are in.
- The narrative must stand alone. A reader at the financial intelligence
  unit (FIU) sees the form fields and your free text, not your case file.
- Common pitfall: a narrative that lists transactions without saying why
  they are suspicious. State the suspicion in the first paragraph and
  link every fact back to it.
-->

## Document control

<!-- Guidance: Restrict access to named investigators, the reporting officer and approvers. Record the classification so that nobody copies the file into general systems or customer correspondence. -->

| Field | Value |
|---|---|
| Document ID | [FCI-SAR-2026-0147] *(Example)* |
| Case reference (internal only) | [CASE-2026-0147] *(Example)* |
| Reporting entity | [Fernhollow Bank] *(Example, fictional EU credit institution)* |
| Reporting unit | [Financial Intelligence Unit, Financial Crime Compliance] |
| Report type | [STR to national FIU / SAR to FinCEN (US branch) / Both / No filing] |
| Version | [1.0] |
| Status | [Investigation / Draft narrative / Approved / Filed / Closed no file] |
| Owner | [@investigator] |
| Approvers/reviewers | [@mlro], [@quality-reviewer] |
| Last updated | YYYY-MM-DD |
| Classification | [Strictly confidential, SAR/STR information, need to know] |
| Retention | [Five years from filing or decision, longer if national law or a hold requires] |
| Related alert(s) | [TM-ALT-2026-08812] *(Example)* |

### Approvals

| Step | Role | Name | Decision | Date |
|---|---|---|---|---|
| Investigation complete | Level 2 investigator | [@name] | [Recommend file] | YYYY-MM-DD |
| Quality review | Senior investigator | [@name] | [Narrative sufficient] | YYYY-MM-DD |
| Filing decision | MLRO / BSA Officer / AML compliance officer | [@name] | [File / Do not file] | YYYY-MM-DD |
| Exit or restriction decision (if any) | Business head with MLRO | [@name] | [Exit / Retain with conditions] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@investigator] | Case opened from alert |
| 1.0 | YYYY-MM-DD | [@investigator] | Narrative approved and filed |

## Contents

- [1. Case reference and filing deadline tracker](#1-case-reference-and-filing-deadline-tracker)
- [2. Legal basis and reporting route](#2-legal-basis-and-reporting-route)
- [3. Subjects](#3-subjects)
- [4. Investigation steps and evidence](#4-investigation-steps-and-evidence)
- [5. Transaction summary](#5-transaction-summary)
- [6. Red flags observed](#6-red-flags-observed)
- [7. Narrative builder](#7-narrative-builder)
- [8. Draft narrative](#8-draft-narrative)
- [9. Decision and rationale](#9-decision-and-rationale)
- [10. Post-decision actions and continuing activity](#10-post-decision-actions-and-continuing-activity)
- [11. Confidentiality and tipping-off controls](#11-confidentiality-and-tipping-off-controls)
- [12. Quality review checklist](#12-quality-review-checklist)
- [13. Glossary and references](#13-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Case reference and filing deadline tracker

<!-- Guidance: Purpose: prove the report was timely. Record the date the suspicion was formed, not only the alert date, and compute the deadline for each jurisdiction involved. Pitfall: letting an investigation run for weeks after the alert and then counting 30 days from the end of it. Regulators look at the whole elapsed time. -->

Timeliness is examined in every supervisory review of suspicious activity
reporting. Record each milestone on the day it happens and keep the
evidence (alert log, case notes, emails) in the case file. Under US
practice the 30-day clock in 31 CFR 1020.320(b)(3) generally starts on
the date the institution, during its review, knows or has reason to
suspect that the activity is reportable. That is not the same as the date
the alert fired, but the review leading to that point must itself be
prompt and documented. Explain any gap longer than your internal service
level in the "Notes" column.

EU national laws transposing Directive (EU) 2015/849 Article 33 require
reports "promptly", and many FIUs publish a target in days. From
2027-07-10 AMLR Article 69 applies directly; it also sets a five working
day default for answering FIU requests for information. Record the local
target in the table so that the reviewer can test against it. Where the
suspicion concerns a transaction not yet executed, consider whether
national law requires you to refrain from executing it until the FIU
responds (Directive 2015/849 Article 35, AMLR Article 71 from 2027-07-10).

| Milestone | Date | Evidence | Notes |
|---|---|---|---|
| Alert generated | [2026-07-24] *(Example)* | [TM-ALT-2026-08812, scenario TM-SCN-007 third-party funnel account] | |
| Level 1 review completed, escalated | [2026-07-28] *(Example)* | [Alert disposition note] | Within 5 business day service level |
| Case opened (Level 2) | [2026-07-29] *(Example)* | [Case log entry] | |
| Request for information to customer | [2026-07-31] *(Example)* | [Relationship manager letter, scripted, no reference to suspicion] | Reviewed by MLRO for tipping-off risk |
| Customer response received | [2026-08-05] *(Example)* | [Three invoices, no contracts] | |
| Suspicion formed (date of initial detection) | [2026-08-12] *(Example)* | [Investigator memo] | Clock start |
| EU FIU target | [2026-08-14] *(Example: local FIU guidance, check national law)* | | |
| US SAR deadline, suspect known (30 calendar days) | [2026-09-11] *(Example, only if US branch activity)* | | 2026-08-12 plus 30 days |
| US SAR outer limit, no suspect identified (60 calendar days) | [2026-10-11] *(Example)* | | Not applicable when a suspect is known |
| Report filed | [2026-08-13] *(Example)* | [FIU acknowledgement number, stored in restricted field] | |

```mermaid
flowchart LR
  A["Alert generated"] --> B["Level 1 review"]
  B -->|"close with reason"| C["Alert closed"]
  B -->|"escalate"| D["Level 2 case"]
  D --> E["Evidence and RFI"]
  E --> F{"Suspicion formed?"}
  F -->|"yes"| G["Draft narrative"]
  F -->|"no"| H["No-file decision note"]
  G --> I["MLRO approval"]
  I --> J["File with FIU"]
  J --> K["Post-filing actions"]
  H --> K
```

## 2. Legal basis and reporting route

<!-- Guidance: Purpose: show which law obliges the report and where it goes. One case can trigger reports in more than one country when a branch or a correspondent is involved. Pitfall: filing only in the head-office country when the activity ran through a branch abroad. -->

List every jurisdiction where the reported activity touched an account or
branch of the group. Each obliged entity reports to the FIU of the
country where it is established, through the channel that FIU prescribes.
Group information sharing is permitted only within the limits of the law
(AMLR Article 73(3) from 2027-07-10; national transposition of Directive
2015/849 Article 39 until then; 31 CFR 1020.320(e) and FinCEN guidance on
sharing with head office and affiliates in the United States). Table rows
are as of 2026-10; check local law before relying on them.

| Jurisdiction | Legal basis (cite by number) | Receiving body and channel | Threshold | Deadline | Tipping-off rule |
|---|---|---|---|---|---|
| EU Member State (current) | National law transposing Directive (EU) 2015/849 Art. 33 | National FIU, often through the goAML system | No amount threshold | Promptly; local FIU target | Art. 39 as transposed |
| EU (from 2027-07-10) | AMLR (EU) 2024/1624 Art. 69 | National FIU; format per AMLA technical standards | No amount threshold | Promptly; FIU requests within 5 working days unless the FIU sets otherwise | AMLR Art. 73 |
| United States (bank or US branch) | 31 U.S.C. 5318(g); 31 CFR 1020.320 | FinCEN, BSA E-Filing System | USD 5,000 or more (aggregate) where the bank knows, suspects or has reason to suspect any of the four categories in 1020.320(a)(2); the banking agencies' SAR rules add insider abuse at any amount and USD 25,000 with no suspect (for example 12 CFR 21.11) | 30 calendar days from initial detection; up to 60 when no suspect identified | 1020.320(e) |
| United Kingdom | Proceeds of Crime Act 2002 Part 7; Terrorism Act 2000 | National Crime Agency, SAR Portal | No amount threshold | As soon as practicable; consent route for a defence against money laundering where needed | POCA s.333A (regulated sector); Terrorism Act 2000 s.21D; POCA s.342 (prejudicing an investigation) |
| [Other] | [Law and section] | [FIU] | [ ] | [ ] | [ ] |

Where the US branch is involved, ongoing violations that need immediate
attention (for example a scheme in progress or terrorist financing)
require a telephone call to law enforcement as well as the SAR, under
1020.320(b)(3). The FinCEN Financial Institutions Toll-Free Hotline and
local law enforcement contacts belong in your procedure, not in this case
file.

Record the route in this case:

| Field | Value |
|---|---|
| Reporting entity and branch | [Fernhollow Bank, head office, EU] *(Example)* |
| Receiving FIU | [National FIU of the home Member State] *(Example)* |
| Report category or reason code | [Suspected money laundering, layering through third-party payments] *(Example)* |
| Second filing | [None: no US branch accounts involved] *(Example)* |
| Prior reports on the same subjects | [None found in the case system] *(Example)* |
| Law enforcement contact or production order | [None] *(Example)* |

## 3. Subjects

<!-- Guidance: Purpose: identify every person and entity the FIU should know about, with the role each played. Use the full legal name and identifiers in the filing system; this case file may use internal subject IDs. Pitfall: omitting the counterparties because they are not your customers. -->

Use one row per subject. A subject is anyone whose conduct is part of the
suspicion: the account holder, signatories, beneficial owners, remitters,
beneficiaries and intermediaries. Mark whether the subject is a customer,
because FIUs weigh the quality of identification data differently for
customers you have verified and for counterparties seen only in payment
messages. Do not record speculation about a person's motive as fact;
write what the evidence shows and label any inference.

| Subject ID | Role | Type | Customer? | Identifiers held | Relationship to activity |
|---|---|---|---|---|---|
| SUB-01 *(Example)* | Account holder | Legal entity: [Ardent Loom Textiles Ltd] *(fictional)* | Yes, since 2026-02 | Registration number, address, LEI if any | Received and forwarded funds |
| SUB-02 *(Example)* | Director and 100% beneficial owner of SUB-01 | Natural person: [Person P1] *(fictional)* | Yes, as signatory | Passport, date of birth, address | Sole authorised signatory; initiated all outgoing payments |
| SUB-03 *(Example)* | Beneficiary of outgoing transfers | Legal entity: [Calder Reach Trading FZ] *(fictional)* | No | Name, account and bank from payment messages | Received 1,600,000 in four transfers |
| SUB-04 to SUB-09 *(Example)* | Remitters R1 to R6 | Legal entities in four countries *(fictional)* | No | Names and account numbers from payment messages | Sent the eight incoming credits |

Customer profile at onboarding:

| Field | Declared at onboarding | Observed |
|---|---|---|
| Business activity | [Wholesale of household textiles] *(Example)* | No textile supplier payments, no payroll, no rent |
| Expected monthly turnover | [EUR 120,000] *(Example)* | EUR 1,694,000 received in 37 days |
| Expected counterparties | [Retailers in the home country] *(Example)* | Six unrelated remitters abroad, one beneficiary in a free zone |
| Customer risk rating | [Medium] *(Example)* | Raised to High on 2026-08-12 |

For the customer profile and periodic review evidence, link the KYC and
CDD Profile (`compliance/kyc-cdd-profile`) and, where enhanced due
diligence was performed, the EDD Memo (`compliance/edd-memo`).

## 4. Investigation steps and evidence

<!-- Guidance: Purpose: show the work that supports the conclusion, so a reviewer can repeat it. Record sources consulted even when they returned nothing. Pitfall: evidence held only in an investigator's mailbox, lost when the investigator leaves. -->

An investigation is sufficient when a second investigator, given the same
file, would reach the same conclusion for the same reasons. Record what
you looked at, what it showed and where the evidence is stored. Internal
sources normally include the customer profile, account statements, payment
messages, online banking logs (IP address and device), prior alerts and
cases, and relationship manager notes. External sources include company
registries, sanctions and politically exposed person screening, adverse
media and, where lawful, information obtained from other institutions
under an information-sharing gateway.

A request for information to the customer is a normal part of due
diligence, but it carries tipping-off risk. Ask about the business purpose
in the same way you would during a periodic review, never mention an
alert, an investigation or a report, and have the wording approved by the
reporting officer. Record that approval in the evidence log.

| Step ID | Date | Action | Source | Result | Evidence location |
|---|---|---|---|---|---|
| INV-01 *(Example)* | 2026-07-29 | Reviewed 12 months of statements | Core banking | Account dormant until 2026-06-15, then 12 large movements | [Case folder /statements] |
| INV-02 *(Example)* | 2026-07-29 | Retrieved payment messages for all credits and debits | Payments archive | Remittance information "goods" or "invoice" with no invoice numbers | [Case folder /payments] |
| INV-03 *(Example)* | 2026-07-30 | Screened all subjects | Sanctions, PEP and adverse media screening | No sanctions or PEP matches; no adverse media | [Screening export] |
| INV-04 *(Example)* | 2026-07-30 | Registry checks on SUB-03 and remitters | Open company registries | SUB-03 registered 2026-03 with a shared-office address | [Registry extracts] |
| INV-05 *(Example)* | 2026-07-30 | Online banking log review | Digital channel logs | All outgoing payments initiated from one device, also used to log in to two unrelated customer accounts | [Log export, hash recorded] |
| INV-06 *(Example)* | 2026-07-31 | Request for information | Relationship manager | Approved wording sent | [Letter copy] |
| INV-07 *(Example)* | 2026-08-05 | Assessed customer reply | Customer documents | Invoices lack VAT numbers and shipping terms; amounts do not match credits | [Customer documents] |
| INV-08 *(Example)* | 2026-08-12 | Linked-account analysis | Case system | The two linked accounts received credits from remitters R2 and R5 | [Network chart] |

## 5. Transaction summary

<!-- Guidance: Purpose: give the FIU the money trail in a form it can load. Use the same currency, date format and amount format throughout, and reconcile totals to the statements. Pitfall: totals that do not match the transaction list, which undermines the whole report. -->

List the transactions that form the suspicious activity. State the
currency and whether amounts are in the account currency or the original
currency. If the list is long, give a summary here and attach the full
export in the format the FIU accepts. Always reconcile: the totals below
must equal the sum of the rows and must match the account statements.

All amounts in EUR, account currency, value dates.

| Ref | Date | Direction | Counterparty | Amount (EUR) | Remittance information |
|---|---|---|---|---|---|
| TXN-01 *(Example)* | 2026-06-15 | In | R1 | 148,500 | "invoice payment" |
| TXN-02 *(Example)* | 2026-06-17 | In | R2 | 212,000 | "goods" |
| OUT-01 *(Example)* | 2026-06-18 | Out | SUB-03 | 340,000 | "purchase textiles" |
| TXN-03 *(Example)* | 2026-06-22 | In | R3 | 96,750 | "goods" |
| TXN-04 *(Example)* | 2026-06-29 | In | R1 | 305,000 | "invoice payment" |
| OUT-02 *(Example)* | 2026-07-01 | Out | SUB-03 | 380,000 | "purchase textiles" |
| TXN-05 *(Example)* | 2026-07-03 | In | R4 | 187,250 | "services" |
| TXN-06 *(Example)* | 2026-07-08 | In | R5 | 264,000 | "goods" |
| OUT-03 *(Example)* | 2026-07-10 | Out | SUB-03 | 425,000 | "purchase textiles" |
| TXN-07 *(Example)* | 2026-07-14 | In | R2 | 229,500 | "goods" |
| TXN-08 *(Example)* | 2026-07-20 | In | R6 | 251,000 | "invoice" |
| OUT-04 *(Example)* | 2026-07-22 | Out | SUB-03 | 455,000 | "purchase textiles" |

| Measure | Value *(Example)* |
|---|---|
| Total credits (8) | EUR 1,694,000 |
| Total debits (4) | EUR 1,600,000 |
| Share of credits forwarded | 94.5% (1,600,000 / 1,694,000) |
| Balance retained | EUR 94,000 |
| Activity window | 2026-06-15 to 2026-07-22 (37 days) |
| Credits compared with declared monthly turnover | 14.1 times EUR 120,000, received in 37 days |

```mermaid
flowchart LR
  R["Remitters R1 to R6, four countries"] -->|"8 credits, EUR 1,694,000"| A["SUB-01 account at Fernhollow Bank"]
  A -->|"4 debits, EUR 1,600,000"| B["SUB-03, free zone trading company"]
  D["Shared device"] -.-> A
  D -.-> L["Two linked customer accounts"]
  R -.->|"R2 and R5 also pay"| L
```

## 6. Red flags observed

<!-- Guidance: Purpose: name each indicator and the fact that shows it. Map indicators to your typology library and to the business-wide risk assessment, so the case also feeds monitoring and tuning. Pitfall: listing generic indicators that the facts do not show. -->

Each red flag must point to a specific fact in sections 4 and 5. One
indicator alone rarely establishes suspicion; the narrative should
explain how the indicators combine. Map each red flag to the typology
used by your monitoring scenarios (see the Transaction Monitoring Scenario
Specification, `compliance/transaction-monitoring-scenario-spec`) and to
the relevant risk in the AML Business Risk Assessment
(`compliance/aml-business-risk-assessment`). Where a national FIU, FinCEN
advisory or supervisory typology report describes the pattern, cite it by
title and date rather than copying its indicator list.

| Flag ID | Indicator | Supporting fact | Evidence ref |
|---|---|---|---|
| RF-01 *(Example)* | Activity inconsistent with declared business and turnover | 14.1 times declared monthly turnover in 37 days; no operating expenses | INV-01, section 5 |
| RF-02 *(Example)* | Rapid pass-through of funds | 94.5% of credits forwarded, usually within 1 to 3 days | Section 5 |
| RF-03 *(Example)* | Unrelated third-party remitters in several countries | Six remitters, no trade documents linking them to the customer | INV-02, INV-04 |
| RF-04 *(Example)* | Beneficiary recently incorporated with a shared address | SUB-03 registered 2026-03 | INV-04 |
| RF-05 *(Example)* | Supporting documents of poor quality | Invoices without VAT numbers or shipping terms; amounts differ from credits | INV-07 |
| RF-06 *(Example)* | Shared device across unrelated customers | One device used for three customer profiles | INV-05, INV-08 |

## 7. Narrative builder

<!-- Guidance: Purpose: collect the answers before drafting, so the narrative is complete. Answer every question; write "not known" rather than leaving a gap, and say what was done to find out. Pitfall: answering "why" with "the activity is unusual" instead of explaining what it is unusual against. -->

The FinCEN 2003 guidance organises a narrative around six questions:
who is conducting the activity, what instruments or mechanisms
are used, when it happened, where it happened, why it is suspicious, and
how it was carried out. The same logic works for any FIU, because every
FIU analyst needs the same facts. Fill the builder table first and then
write the narrative from it in section 8.

| Question | Answer for this case | Source |
|---|---|---|
| Who | [SUB-01 through its director SUB-02; beneficiary SUB-03; remitters SUB-04 to SUB-09; two linked customers sharing a device] *(Example)* | Sections 3, 4 |
| What | [Incoming SEPA and cross-border credit transfers, outgoing cross-border credit transfers] *(Example)* | Section 5 |
| When | [2026-06-15 to 2026-07-22; account opened 2026-02, dormant until June] *(Example)* | Section 5 |
| Where | [Business current account at the head office; payments initiated through online banking; counterparties in four countries and one free zone] *(Example)* | Sections 4, 5 |
| Why suspicious | [Volume and pattern inconsistent with declared textile wholesale; funds pass through without business expenses; weak documents; shared device suggests coordinated control of several accounts] *(Example)* | Section 6 |
| How | [Third parties pay the account with generic references; funds consolidated and forwarded in round amounts to one beneficiary within days] *(Example)* | Sections 5, 6 |
| What the bank did | [Raised risk rating, restricted outgoing payments pending review, filed report, began exit review] *(Example)* | Section 10 |

Writing rules for the narrative:

- Open with a summary paragraph that states the suspected activity, the
  subjects, the total amount and the period. An analyst who reads only the
  first paragraph should understand the case.
- Write in chronological order in the body. Give dates, amounts and
  account identifiers exactly as they appear in the transaction list.
- Separate facts from inferences. Use phrasing such as "the bank could
  not identify a business purpose" rather than labelling a crime.
- Explain what is normal for this customer and why the activity departs
  from it. The expected profile is the yardstick.
- Mention the customer's explanation and why it did not resolve the
  concern. Leaving it out makes the report look one-sided.
- Close with the actions taken and where supporting documents are held,
  so law enforcement knows what to request.
- Do not include internal jargon, scenario codes or abbreviations the
  reader cannot decode, and do not paste the full transaction list into
  the free text when the form or an attachment carries it.

## 8. Draft narrative

<!-- Guidance: Purpose: the text that goes into the free-text field of the report. Keep it factual, chronological and self-contained. Check the character limit of the filing system and the language the FIU requires. Pitfall: pasting the case notes; the FIU needs a summary written for an outside reader. -->

*Example narrative (fictional facts):*

Fernhollow Bank reports suspected money laundering through the business
current account of Ardent Loom Textiles Ltd (SUB-01), whose director and
sole beneficial owner is Person P1 (SUB-02). Between 2026-06-15 and
2026-07-22 the account received eight credit transfers totalling EUR
1,694,000 from six unrelated companies in four countries and sent four
transfers totalling EUR 1,600,000 to Calder Reach Trading FZ (SUB-03), a
company incorporated in 2026-03. The bank could not identify a business
purpose consistent with the customer's declared activity.

The account was opened in 2026-02. At onboarding the customer described
its business as wholesale of household textiles to domestic retailers,
with expected monthly turnover of about EUR 120,000. The account showed
no activity until 2026-06-15. In the following 37 days it received
credits equal to about fourteen times the declared monthly turnover.
Remittance information on the credits read "goods", "invoice" or
"services" without invoice numbers. The bank found no payments for
staff, premises, transport or textile suppliers.

Funds were forwarded to SUB-03 in round amounts of EUR 340,000, 380,000,
425,000 and 455,000, each one to three days after the preceding credits,
so that 94.5% of the money received left the account. All outgoing
payments were initiated through online banking from a single device that
was also used to access the accounts of two other, apparently unrelated
business customers of the bank. Two of the remitters (R2 and R5) also
paid those linked accounts.

On 2026-07-31 the bank asked the customer, as part of routine due
diligence, to describe its trading activity and provide supporting
documents. On 2026-08-05 the customer supplied three invoices addressed to
remitters R1, R2 and R5. The invoices carry no VAT numbers, delivery terms
or shipping references, and their amounts do not match the credits
received. The customer provided no contract with SUB-03.

Screening found no sanctions or politically exposed person matches and no
adverse media for any subject. Based on the volume inconsistent with the
profile, the rapid pass-through, the unrelated remitters, the weak
documentation and the shared device, the bank suspects the account is
used to layer funds of unknown origin. The bank has raised the customer
risk rating, placed outgoing payments under manual review and started an
exit review. Statements, payment messages, device logs and customer
documents are retained and available on request.

| Check | Result |
|---|---|
| Character count within the filing system limit | [Yes, n characters] |
| Language required by the FIU | [ ] |
| Amounts and dates match section 5 | [Yes] |
| No internal codes or unexplained abbreviations | [Yes] |

## 9. Decision and rationale

<!-- Guidance: Purpose: record the reporting officer's decision and why. Under the FinCEN FAQs of 2025-10-09 US law does not require a written record of a decision not to file, but many supervisors outside the US and most internal policies still expect one. Pitfall: a no-file note that only says "no suspicion" without the reason. -->

The decision belongs to the nominated reporting officer (MLRO, BSA
Officer or AMLR Article 11 compliance officer, depending on the
jurisdiction) or a delegate named in the AML/CFT Programme Policy
(`compliance/aml-cft-programme-policy`). Investigators recommend; the
reporting officer decides. Record dissent where the reviewer disagreed
with the investigator, and how it was resolved.

For US filings, the SAR FAQs issued by FinCEN with the Federal Reserve,
FDIC, NCUA and OCC on 2025-10-09 clarify that neither the Bank Secrecy
Act nor its rules require an institution to document a decision not to
file, and that where an institution chooses to document it, a short,
concise statement generally suffices, with more detail for complex
investigations. Treat this as the US legal floor. As internal good
practice, and because EU and UK supervisors and internal auditors test
closed cases, keep a brief no-file rationale for every escalated case.
Check your national law and supervisor expectations before shortening
your procedure.

| Field | Value |
|---|---|
| Decision | [File / Do not file / File and refer to law enforcement directly] |
| Decision date | [2026-08-12] *(Example)* |
| Decision maker | [@mlro] |
| Rationale (two to five sentences) | [Activity is inconsistent with the declared business, funds pass through without economic purpose, documents do not support the payments, and a shared device links three customers. Suspicion of layering is reasonable; report.] *(Example)* |
| Alternative explanations considered | [Agency or commission trading: customer did not claim it, no agency agreement provided] *(Example)* |
| Reviewer disagreement and resolution | [None] |

No-file note format (when the decision is not to file): state the
alert or referral, the main facts reviewed, the explanation that
resolved the concern and the evidence for it, for example "Credits of EUR
[amount] matched signed sales contracts and shipping documents for
[customer]; activity consistent with seasonal peak recorded in prior two
years; no further action."

## 10. Post-decision actions and continuing activity

<!-- Guidance: Purpose: decide what happens to the relationship and how continuing activity will be watched. Relationship decisions are separate from the reporting decision and must not alert the customer. Pitfall: freezing or closing the account in a way that tells the customer a report was made. -->

After filing, decide whether to keep, restrict or exit the relationship
under your customer risk policy. A report does not oblige you to exit, and
an exit does not replace a report. In some countries you need FIU or
law enforcement agreement before exiting or before executing further
transactions; in the United Kingdom, consider whether a defence against
money laundering is needed before dealing with suspected criminal
property. Coordinate exits so that the timing and the notice wording do
not reveal the report.

The 2025-10-09 FAQs also state that US law does not require a separate
post-filing review to decide whether suspicious activity has continued,
and that the suggested cadence for continuing activity SARs (review
around 90 days after the previous filing, file within a further 30 days)
is a suggestion rather than a rule. Institutions may rely on their normal
risk-based monitoring. Many institutions still schedule a targeted review
for high-risk cases. State your approach in the table.

| Action ID | Action | Owner | Due | Status |
|---|---|---|---|---|
| ACT-01 *(Example)* | Raise customer risk rating to High and set EDD review | [@kyc-lead] | 2026-08-14 | Done |
| ACT-02 *(Example)* | Manual review of outgoing payments from SUB-01 and linked accounts | [@payments-ops] | 2026-08-13 | Done |
| ACT-03 *(Example)* | Open cases on the two linked accounts | [@investigator] | 2026-08-14 | In progress |
| ACT-04 *(Example)* | Exit review with business head, timing agreed with MLRO | [@business-head] | 2026-09-15 | Open |
| ACT-05 *(Example)* | Targeted continuing activity review (internal policy for high-risk cases) | [@investigator] | 2026-11-10 | Open |
| ACT-06 *(Example)* | Tuning feedback: shared-device indicator added to scenario backlog | [@tm-owner] | 2026-10-01 | Open |

## 11. Confidentiality and tipping-off controls

<!-- Guidance: Purpose: keep the report and the investigation secret as the law requires, and record who knows. Pitfall: relationship managers told "a SAR was filed" in a general email, or a customer complaint answered with details of the review. -->

Disclosing that a report has been made or that an investigation is under
way is prohibited. In the EU the prohibition is in Directive 2015/849
Article 39 as transposed, and from 2027-07-10 in AMLR Article 73, which
extends to directors, employees, agents and distributors and allows
limited disclosure to supervisors, law enforcement and, under conditions,
within a group or between entities involved in the same transaction. In
the United States, 31 CFR 1020.320(e) makes a SAR, and any information
that would reveal its existence, confidential; a bank that receives a
subpoena or other request for a SAR must decline it and notify FinCEN.
In the United Kingdom, the Proceeds of Crime Act 2002 contains the
tipping-off offence for the regulated sector (section 333A), the
Terrorism Act 2000 contains a parallel offence for terrorist property
reports (section 21D), and section 342 of the 2002 Act covers
prejudicing an investigation outside the regulated sector. These rules
apply to staff, contractors and service providers.

Control the risk in practice: keep the case in a restricted system,
brief only staff who must act, use neutral reasons in customer
correspondence, and have the reporting officer approve any communication
with the customer while a case is open. Do not include report references
in customer-facing systems, complaint files, credit files or data subject
access responses without legal review.

| Control | How applied in this case |
|---|---|
| Access list (names and roles) | [Investigator, senior investigator, MLRO, payments operations lead] *(Example)* |
| Staff briefed and reminded of tipping-off rules | [Relationship manager briefed 2026-08-13, no report details shared] *(Example)* |
| Customer communications reviewed | [Exit letter template approved by MLRO] *(Example)* |
| Subpoena or third-party requests | [None received; procedure: refer to legal and reporting officer] *(Example)* |
| Data subject access requests | [Flag on file; legal review before response] *(Example)* |

## 12. Quality review checklist

<!-- Guidance: Purpose: a second-line check before filing. Use it for every report or for a risk-based sample, as your procedure says. Pitfall: a checklist ticked without reading the narrative against the evidence. -->

The reviewer reads the narrative as the FIU would, then traces each
statement back to the evidence. Reviews that find defects should send the
draft back with comments, not fix it silently, so that investigators
learn and the quality assurance results can be reported to management.

| Check | Yes / No | Comment |
|---|---|---|
| First paragraph states the suspicion, subjects, amount and period | | |
| Every subject in the narrative appears in section 3 with identifiers | | |
| Amounts and dates reconcile to section 5 and to statements | | |
| Each red flag is supported by a fact and an evidence reference | | |
| Customer explanation is described and assessed | | |
| Facts and inferences are distinguished; no accusatory labels | | |
| Deadline met, or delay explained | | |
| Correct FIU and channel; second jurisdiction considered | | |
| Tipping-off controls in place for customer contact and exit | | |
| Evidence retained for the required period | | |
| Example data and placeholders removed | | |

## 13. Glossary and references

<!-- Guidance: Keep definitions short and local to this case file. Cite laws and guidance by number and date; obtain the official text for normative wording. -->

Glossary:

- **SAR / STR**: report of suspicious activity or transactions to a
  financial intelligence unit. SAR is the US and UK term; STR is common
  elsewhere. The AMLR uses the language of reporting suspicious
  transactions and activity.
- **FIU**: financial intelligence unit, the national body that receives
  and analyses reports.
- **Date of initial detection**: the date the institution, in its review,
  knows or has reason to suspect activity is reportable; starts the US
  filing period.
- **Tipping off**: disclosing to the subject or any unauthorised person
  that a report has been or may be made, or that an investigation is under
  way.
- **Continuing activity report**: a follow-up report on activity that
  continues after a first report.
- **Request for information (RFI)**: a due diligence question to the
  customer about the purpose of activity.
- **MLRO**: money laundering reporting officer; in the US, the BSA
  Officer.

References (as of 2026-10; check the current official versions):

- 31 CFR 1020.320, Reports by banks of suspicious transactions (eCFR).
- FinCEN, Guidance on Preparing a Complete and Sufficient Suspicious
  Activity Report Narrative, November 2003.
- FinCEN with the Federal Reserve, FDIC, NCUA and OCC, Frequently Asked
  Questions regarding suspicious activity reporting, 2025-10-09.
- Directive (EU) 2015/849, Articles 33, 35 and 39, as transposed in
  national law (in force until 2027-07-09).
- Regulation (EU) 2024/1624 (AMLR), Articles 69, 71, 73 and 77, applying
  from 2027-07-10.
- United Kingdom, Proceeds of Crime Act 2002, Part 7, including section
  333A and 342; Terrorism Act 2000, section 21D.
- FATF Recommendations 20 (reporting of suspicious transactions) and 21
  (tipping-off and confidentiality), names and numbers only.
- Related templates: AML/CFT Programme Policy
  (`compliance/aml-cft-programme-policy`), Transaction Monitoring Scenario
  Specification (`compliance/transaction-monitoring-scenario-spec`), KYC
  and CDD Profile (`compliance/kyc-cdd-profile`), EDD Memo
  (`compliance/edd-memo`), AML Independent Test Report
  (`compliance/aml-independent-test-report`), Fraud Investigation Report
  (`compliance/fraud-investigation-report`).

## Standard and licence note

Based on the US bank SAR rule (31 CFR 1020.320), FinCEN guidance and the
2025-10-09 interagency SAR FAQs, which are US federal works in the public
domain, and on EU law (Directive (EU) 2015/849 and Regulation (EU)
2024/1624, EUR-Lex, reuse with acknowledgement), described in original
wording. FATF Recommendations and UK legislation are cited by name and
number only. The template structure, wording, checklist and the
Fernhollow Bank case are original and fictional; no real person or
company is described. Check the current official texts, your FIU's
filing instructions and national law before use. This is a document
format, not legal or compliance advice. Template licence: MIT.