A Suspicious Activity Report (SAR) is only as strong as its story. While ticking boxes for suspicious transaction amounts or geographic risk codes tells a regulator what happened, the narrative tells them why it matters.
The narrative is the investigator’s opportunity to connect dots, contextualize data, and transform a series of isolated transactions into a coherent picture of potential money laundering, fraud, or terrorist financing. A poorly written narrative can cause a critical case to be ignored by law enforcement; a well-crafted one can trigger an immediate investigation.
Below, we break down three realistic SAR narrative examples, ranging from simple structuring to complex trade-based money laundering.
Contents
The Anatomy of a Strong SAR Narrative
Before diving into examples, every effective narrative must answer five fundamental questions, often remembered by the acronym W5:
- Who? (Subjects, accomplices, beneficial owners)
- What? (The specific suspicious activity and financial instruments used)
- When? (The timeframe of the activity, including specific dates of key events)
- Where? (The geographic locations involved, including branches, IP addresses, and counterparty countries)
- Why? (The logical conclusion of why the activity is suspicious—a departure from expected behavior)
Note: These examples use fictional names and institutions.
Example 1: Structuring/Smurfing (Retail Banking)
This is the most common type of suspicious activity and requires the narrative to focus on the deliberate avoidance of reporting thresholds.
SAR Narrative:
On January 15, 2026, a manual review of daily aggregated cash transactions triggered an alert on account #XXXX7890, held by subject John Miller. The account is a personal checking account opened on October 2, 2025, with a stated occupation of “Unemployed” and an expected monthly activity of $500.
The review revealed a stark departure from expected behavior. Between January 5, 2026, and January 12, 2026, the subject deposited $48,000 in cash across four branch locations within the Phoenix metropolitan area. Each deposit ranged from $9,500 to $9,900, consistently falling just below the $10,000 Currency Transaction Report (CTR) threshold.
Specifically:
- Jan 5: $9,600 cash deposit at Branch 112 (Main St.)
- Jan 7: $9,800 cash deposit at Branch 145 (Camelback Rd.)
- Jan 10: $9,500 cash deposit at Branch 112 (Main St.)
- Jan 12: $9,700 cash deposit at Branch 189 (Scottsdale Rd.)
Surveillance footage from January 12 shows the subject entering Branch 189 and spending approximately 4 minutes at the teller counter. Following the deposit, the subject immediately initiated a wire transfer of $40,000 to an account at CryptoExchange International, a virtual currency exchange. This wiring pattern was repeated on January 7 ($35,000 outgoing wire following the cash deposit).
The transaction pattern—repeated cash deposits structured below the $10,000 federal reporting threshold, rapid movement to a cryptocurrency exchange, and an account profile that does not support a legitimate source of large-scale cash—strongly suggests an attempt to layer illicit funds and evade CTR reporting requirements. This institution is filing this SAR for Structuring, Money Laundering, and Suspicious Use of Virtual Currency.
Example 2: Money Mule / Elder Financial Exploitation
This narrative focuses on a sudden relationship dynamic and the “romance scam” or “confidence fraud” typology.
SAR Narrative:
This narrative covers activity involving subject Jane Doe, an 83-year-old retired teacher and a long-standing customer (account opened 1994). Ms. Doe maintains a checking account (#XXXX3456) receiving monthly pension and Social Security deposits of approximately $3,200. Her typical banking behavior consists of local point-of-sale purchases, paper checks for utilities, and occasional cash withdrawals averaging $200.
In December 2025, the account activity shifted dramatically. The subject began receiving wire transfers ranging from $5,000 to $8,000 from third-party accounts at various out-of-state banks (Bank A in Florida, Bank B in Texas), with memo lines reading “Investment Opportunity” and “Loan for Gold Assets.”
Within 24 hours of each incoming wire, Ms. Doe withdrew the funds in cash at the teller line or purchased cashier’s checks payable to a “John Richards.” During a transaction on December 18, 2025, a relationship banker inquired about a $7,500 cashier’s check. Ms. Doe stated she was helping her “fiancé,” whom she met online, pay for a business license and medical emergency. She expressed urgency, stating he needed the funds immediately to avoid legal trouble.
A total of $28,500 was wired in from various third parties and funneled out via cashier’s checks to the suspected external fraudster over 30 days. The subject’s own life savings were not replenished.
It appears an unknown third party has compromised Ms. Doe’s account, using her as a money mule to receive and disburse funds from additional fraud victims. Simultaneously, the subject appears to be a victim of a confidence/romance scam. This activity is suspicious for Money Laundering, acting as a Money Mule, and Elder Financial Exploitation. Law enforcement welfare check is respectfully suggested.
Example 3: Complex Commercial Account / Trade-Based Laundering
This example shows how to handle a business account with invoice manipulation.
SAR Narrative:
A review of business account #XXXX9988, held by “Global Tech Imports LLC,” identified high-value international wire transfers inconsistent with the company’s stated line of business (electronic components). The account was opened on March 1, 2026, with a projected monthly turnover of $100,000. As of May 31, 2026, total credits exceeded $2.4 million, with nearly $2.2 million immediately debited to a beneficiary in a jurisdiction flagged as high-risk by FATF.
An examination of supporting documentation provided by the customer reveals significant red flags. On May 15, 2026, Global Tech Imports received an incoming wire of $450,000 from Company X (a shell company registered in a secrecy haven). The related invoice #GTI-0515 describes the goods as “50 units of standard USB cables,” priced at $9,000 per cable. Open-source checks indicate the fair market value of the described cable is under $5 per unit. The total shipment value is grossly over-invoiced.
Additionally, all outbound transfers are routed to a separate shell company, “Pacific Rim Ventures,” located in Hong Kong. The address listed for the beneficiary matches a virtual office space with no physical manufacturing presence. The funds are systematically swept out within hours of receipt, leaving a minimal operating balance. No payroll, rent, or domestic utility payments—indicators of legitimate business operations—have been identified on the account.
The pattern of significant over-invoicing for simple goods, combined with immediate transshipment of funds to a high-risk jurisdiction and the lack of genuine business substance, is indicative of Trade-Based Money Laundering designed to justify the cross-border movement of illicit value.
The “Golden Rules” Checklist for Your Narrative
To ensure your narrative passes regulatory scrutiny, always apply this checklist before filing:
- Start with a Chronological Summary: Don’t bury the lead. State the total amount of suspicious activity and the timeframe in the first two sentences.
- Avoid Law Enforcement Jargon: Use plain English. Instead of “The subject attempted to nefariously circumvent BSA protocols,” write “The subject made cash deposits under $10,000 to avoid detection.”
- Define Unusual Behavior: It’s not enough to say activity was “suspicious.” Explain why. “This is unusual because the business has no payroll expenses,” or “This is unusual because the account is a low-income student account.”
- Separate Fact from Opinion: State the facts of the transaction first. State your conclusion at the end. Never say “The subject is a drug trafficker.” Say, “The transaction pattern matches typologies consistent with drug trafficking and money laundering.”
- Avoid the “Kitchen Sink”: If the activity is primarily about structuring, focus on the cash movements. Only include the unrelated forged check deposit if it directly feeds into the laundering scheme.
By combining transaction data with a clear, logical narrative, you provide FinCEN and law enforcement with the actionable intelligence they need to combat financial crime.