SAR and STR Narrative Template (FinCEN, EU AMLR, Tipping-Off Controls)

Suspicious Activity Report Narrative: [Case reference]

Internal case file that takes one suspicion from alert and investigation to a filed Suspicious Activity Report (SAR, United States) or Suspicious Transaction Report (STR, EU, UK and most other countries), or to a documented decision not to file. It follows the who, what, when, where, why and how method of the FinCEN Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative (November 2003), the US bank SAR rule at 31 CFR 1020.320, the FinCEN and federal banking agency SAR FAQs of 2025-10-09, the EU reporting and tipping-off rules (Directive (EU) 2015/849 Articles 33 and 39 as transposed in national law, replaced by Regulation (EU) 2024/1624 (AMLR) Articles 69 and 73 from 2027-07-10) and FATF Recommendations 20 and 21 (names and numbers only). The example bank, Fernhollow Bank, its customers and all facts are fictional. Replace every [bracketed] value and every row marked Example. Obtain the law and the regulator guidance for the normative text. This is a document format, not legal or compliance advice.

Document control

Approvals

Revision history

Contents

• 1. Case reference and filing deadline tracker
• 2. Legal basis and reporting route
• 3. Subjects
• 4. Investigation steps and evidence
• 5. Transaction summary
• 6. Red flags observed
• 7. Narrative builder
• 8. Draft narrative
• 9. Decision and rationale
• 10. Post-decision actions and continuing activity
• 11. Confidentiality and tipping-off controls
• 12. Quality review checklist
• 13. Glossary and references
• Standard and licence note

1. Case reference and filing deadline tracker

Timeliness is examined in every supervisory review of suspicious activity reporting. Record each milestone on the day it happens and keep the evidence (alert log, case notes, emails) in the case file. Under US practice the 30-day clock in 31 CFR 1020.320(b)(3) generally starts on the date the institution, during its review, knows or has reason to suspect that the activity is reportable. That is not the same as the date the alert fired, but the review leading to that point must itself be prompt and documented. Explain any gap longer than your internal service level in the "Notes" column.

EU national laws transposing Directive (EU) 2015/849 Article 33 require reports "promptly", and many FIUs publish a target in days. From 2027-07-10 AMLR Article 69 applies directly; it also sets a five working day default for answering FIU requests for information. Record the local target in the table so that the reviewer can test against it. Where the suspicion concerns a transaction not yet executed, consider whether national law requires you to refrain from executing it until the FIU responds (Directive 2015/849 Article 35, AMLR Article 71 from 2027-07-10).

2. Legal basis and reporting route

List every jurisdiction where the reported activity touched an account or branch of the group. Each obliged entity reports to the FIU of the country where it is established, through the channel that FIU prescribes. Group information sharing is permitted only within the limits of the law (AMLR Article 73(3) from 2027-07-10; national transposition of Directive 2015/849 Article 39 until then; 31 CFR 1020.320(e) and FinCEN guidance on sharing with head office and affiliates in the United States). Table rows are as of 2026-10; check local law before relying on them.

Where the US branch is involved, ongoing violations that need immediate attention (for example a scheme in progress or terrorist financing) require a telephone call to law enforcement as well as the SAR, under 1020.320(b)(3). The FinCEN Financial Institutions Toll-Free Hotline and local law enforcement contacts belong in your procedure, not in this case file.

Record the route in this case:

3. Subjects

Use one row per subject. A subject is anyone whose conduct is part of the suspicion: the account holder, signatories, beneficial owners, remitters, beneficiaries and intermediaries. Mark whether the subject is a customer, because FIUs weigh the quality of identification data differently for customers you have verified and for counterparties seen only in payment messages. Do not record speculation about a person's motive as fact; write what the evidence shows and label any inference.

Customer profile at onboarding:

For the customer profile and periodic review evidence, link the KYC and CDD Profile (compliance/kyc-cdd-profile) and, where enhanced due diligence was performed, the EDD Memo (compliance/edd-memo).

4. Investigation steps and evidence

An investigation is sufficient when a second investigator, given the same file, would reach the same conclusion for the same reasons. Record what you looked at, what it showed and where the evidence is stored. Internal sources normally include the customer profile, account statements, payment messages, online banking logs (IP address and device), prior alerts and cases, and relationship manager notes. External sources include company registries, sanctions and politically exposed person screening, adverse media and, where lawful, information obtained from other institutions under an information-sharing gateway.

A request for information to the customer is a normal part of due diligence, but it carries tipping-off risk. Ask about the business purpose in the same way you would during a periodic review, never mention an alert, an investigation or a report, and have the wording approved by the reporting officer. Record that approval in the evidence log.

5. Transaction summary

List the transactions that form the suspicious activity. State the currency and whether amounts are in the account currency or the original currency. If the list is long, give a summary here and attach the full export in the format the FIU accepts. Always reconcile: the totals below must equal the sum of the rows and must match the account statements.

All amounts in EUR, account currency, value dates.

6. Red flags observed

Each red flag must point to a specific fact in sections 4 and 5. One indicator alone rarely establishes suspicion; the narrative should explain how the indicators combine. Map each red flag to the typology used by your monitoring scenarios (see the Transaction Monitoring Scenario Specification, compliance/transaction-monitoring-scenario-spec) and to the relevant risk in the AML Business Risk Assessment (compliance/aml-business-risk-assessment). Where a national FIU, FinCEN advisory or supervisory typology report describes the pattern, cite it by title and date rather than copying its indicator list.

7. Narrative builder

The FinCEN 2003 guidance organises a narrative around six questions: who is conducting the activity, what instruments or mechanisms are used, when it happened, where it happened, why it is suspicious, and how it was carried out. The same logic works for any FIU, because every FIU analyst needs the same facts. Fill the builder table first and then write the narrative from it in section 8.

Writing rules for the narrative:

• Open with a summary paragraph that states the suspected activity, the subjects, the total amount and the period. An analyst who reads only the first paragraph should understand the case.
• Write in chronological order in the body. Give dates, amounts and account identifiers exactly as they appear in the transaction list.
• Separate facts from inferences. Use phrasing such as "the bank could not identify a business purpose" rather than labelling a crime.
• Explain what is normal for this customer and why the activity departs from it. The expected profile is the yardstick.
• Mention the customer's explanation and why it did not resolve the concern. Leaving it out makes the report look one-sided.
• Close with the actions taken and where supporting documents are held, so law enforcement knows what to request.
• Do not include internal jargon, scenario codes or abbreviations the reader cannot decode, and do not paste the full transaction list into the free text when the form or an attachment carries it.

8. Draft narrative

Example narrative (fictional facts):

Fernhollow Bank reports suspected money laundering through the business current account of Ardent Loom Textiles Ltd (SUB-01), whose director and sole beneficial owner is Person P1 (SUB-02). Between 2026-06-15 and 2026-07-22 the account received eight credit transfers totalling EUR 1,694,000 from six unrelated companies in four countries and sent four transfers totalling EUR 1,600,000 to Calder Reach Trading FZ (SUB-03), a company incorporated in 2026-03. The bank could not identify a business purpose consistent with the customer's declared activity.

The account was opened in 2026-02. At onboarding the customer described its business as wholesale of household textiles to domestic retailers, with expected monthly turnover of about EUR 120,000. The account showed no activity until 2026-06-15. In the following 37 days it received credits equal to about fourteen times the declared monthly turnover. Remittance information on the credits read "goods", "invoice" or "services" without invoice numbers. The bank found no payments for staff, premises, transport or textile suppliers.

Funds were forwarded to SUB-03 in round amounts of EUR 340,000, 380,000, 425,000 and 455,000, each one to three days after the preceding credits, so that 94.5% of the money received left the account. All outgoing payments were initiated through online banking from a single device that was also used to access the accounts of two other, apparently unrelated business customers of the bank. Two of the remitters (R2 and R5) also paid those linked accounts.

On 2026-07-31 the bank asked the customer, as part of routine due diligence, to describe its trading activity and provide supporting documents. On 2026-08-05 the customer supplied three invoices addressed to remitters R1, R2 and R5. The invoices carry no VAT numbers, delivery terms or shipping references, and their amounts do not match the credits received. The customer provided no contract with SUB-03.

Screening found no sanctions or politically exposed person matches and no adverse media for any subject. Based on the volume inconsistent with the profile, the rapid pass-through, the unrelated remitters, the weak documentation and the shared device, the bank suspects the account is used to layer funds of unknown origin. The bank has raised the customer risk rating, placed outgoing payments under manual review and started an exit review. Statements, payment messages, device logs and customer documents are retained and available on request.

9. Decision and rationale

The decision belongs to the nominated reporting officer (MLRO, BSA Officer or AMLR Article 11 compliance officer, depending on the jurisdiction) or a delegate named in the AML/CFT Programme Policy (compliance/aml-cft-programme-policy). Investigators recommend; the reporting officer decides. Record dissent where the reviewer disagreed with the investigator, and how it was resolved.

For US filings, the SAR FAQs issued by FinCEN with the Federal Reserve, FDIC, NCUA and OCC on 2025-10-09 clarify that neither the Bank Secrecy Act nor its rules require an institution to document a decision not to file, and that where an institution chooses to document it, a short, concise statement generally suffices, with more detail for complex investigations. Treat this as the US legal floor. As internal good practice, and because EU and UK supervisors and internal auditors test closed cases, keep a brief no-file rationale for every escalated case. Check your national law and supervisor expectations before shortening your procedure.

No-file note format (when the decision is not to file): state the alert or referral, the main facts reviewed, the explanation that resolved the concern and the evidence for it, for example "Credits of EUR [amount] matched signed sales contracts and shipping documents for [customer]; activity consistent with seasonal peak recorded in prior two years; no further action."

10. Post-decision actions and continuing activity

After filing, decide whether to keep, restrict or exit the relationship under your customer risk policy. A report does not oblige you to exit, and an exit does not replace a report. In some countries you need FIU or law enforcement agreement before exiting or before executing further transactions; in the United Kingdom, consider whether a defence against money laundering is needed before dealing with suspected criminal property. Coordinate exits so that the timing and the notice wording do not reveal the report.

The 2025-10-09 FAQs also state that US law does not require a separate post-filing review to decide whether suspicious activity has continued, and that the suggested cadence for continuing activity SARs (review around 90 days after the previous filing, file within a further 30 days) is a suggestion rather than a rule. Institutions may rely on their normal risk-based monitoring. Many institutions still schedule a targeted review for high-risk cases. State your approach in the table.

11. Confidentiality and tipping-off controls

Disclosing that a report has been made or that an investigation is under way is prohibited. In the EU the prohibition is in Directive 2015/849 Article 39 as transposed, and from 2027-07-10 in AMLR Article 73, which extends to directors, employees, agents and distributors and allows limited disclosure to supervisors, law enforcement and, under conditions, within a group or between entities involved in the same transaction. In the United States, 31 CFR 1020.320(e) makes a SAR, and any information that would reveal its existence, confidential; a bank that receives a subpoena or other request for a SAR must decline it and notify FinCEN. In the United Kingdom, the Proceeds of Crime Act 2002 contains the tipping-off offence for the regulated sector (section 333A), the Terrorism Act 2000 contains a parallel offence for terrorist property reports (section 21D), and section 342 of the 2002 Act covers prejudicing an investigation outside the regulated sector. These rules apply to staff, contractors and service providers.

Control the risk in practice: keep the case in a restricted system, brief only staff who must act, use neutral reasons in customer correspondence, and have the reporting officer approve any communication with the customer while a case is open. Do not include report references in customer-facing systems, complaint files, credit files or data subject access responses without legal review.

12. Quality review checklist

The reviewer reads the narrative as the FIU would, then traces each statement back to the evidence. Reviews that find defects should send the draft back with comments, not fix it silently, so that investigators learn and the quality assurance results can be reported to management.

13. Glossary and references

Glossary:

• SAR / STR: report of suspicious activity or transactions to a financial intelligence unit. SAR is the US and UK term; STR is common elsewhere. The AMLR uses the language of reporting suspicious transactions and activity.
• FIU: financial intelligence unit, the national body that receives and analyses reports.
• Date of initial detection: the date the institution, in its review, knows or has reason to suspect activity is reportable; starts the US filing period.
• Tipping off: disclosing to the subject or any unauthorised person that a report has been or may be made, or that an investigation is under way.
• Continuing activity report: a follow-up report on activity that continues after a first report.
• Request for information (RFI): a due diligence question to the customer about the purpose of activity.
• MLRO: money laundering reporting officer; in the US, the BSA Officer.

References (as of 2026-10; check the current official versions):

• 31 CFR 1020.320, Reports by banks of suspicious transactions (eCFR).
• FinCEN, Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative, November 2003.
• FinCEN with the Federal Reserve, FDIC, NCUA and OCC, Frequently Asked Questions regarding suspicious activity reporting, 2025-10-09.
• Directive (EU) 2015/849, Articles 33, 35 and 39, as transposed in national law (in force until 2027-07-09).
• Regulation (EU) 2024/1624 (AMLR), Articles 69, 71, 73 and 77, applying from 2027-07-10.
• United Kingdom, Proceeds of Crime Act 2002, Part 7, including section 333A and 342; Terrorism Act 2000, section 21D.
• FATF Recommendations 20 (reporting of suspicious transactions) and 21 (tipping-off and confidentiality), names and numbers only.
• Related templates: AML/CFT Programme Policy (compliance/aml-cft-programme-policy), Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec), KYC and CDD Profile (compliance/kyc-cdd-profile), EDD Memo (compliance/edd-memo), AML Independent Test Report (compliance/aml-independent-test-report), Fraud Investigation Report (compliance/fraud-investigation-report).

Standard and licence note

Based on the US bank SAR rule (31 CFR 1020.320), FinCEN guidance and the 2025-10-09 interagency SAR FAQs, which are US federal works in the public domain, and on EU law (Directive (EU) 2015/849 and Regulation (EU) 2024/1624, EUR-Lex, reuse with acknowledgement), described in original wording. FATF Recommendations and UK legislation are cited by name and number only. The template structure, wording, checklist and the Fernhollow Bank case are original and fictional; no real person or company is described. Check the current official texts, your FIU's filing instructions and national law before use. This is a document format, not legal or compliance advice. Template licence: MIT.