How to Write an AML Investigation Narrative

Introduction

Anti-Money Laundering (AML) investigation narratives are critical documents that tell the story of suspicious financial activity. These narratives serve as the backbone of Suspicious Activity Reports (SARs), providing investigators, compliance officers, and regulators with a clear, factual account of potentially illicit transactions. Writing an effective AML narrative requires a unique blend of investigative skill, analytical thinking, and precise communication.

A well-crafted narrative does more than just list transactions—it connects dots, identifies patterns, and provides context that helps readers understand why specific activity warranted further scrutiny. This guide will walk you through the essential components, best practices, and common pitfalls of writing AML investigation narratives.

Understanding the Purpose of an AML Narrative

Before diving into the writing process, it’s crucial to understand what an AML narrative aims to accomplish:

Providing a clear factual account: The narrative should present facts objectively, without speculation or unfounded conclusions.

Demonstrating investigative thoroughness: Regulators expect to see that you’ve conducted a reasonable investigation before filing a SAR.

Connecting suspicious indicators: The narrative should explain how various red flags, transactions, and behaviors interrelate.

Supporting the suspicion determination: Ultimately, the narrative should justify why the activity is considered suspicious enough to warrant reporting.

Key Components of an AML Investigation Narrative

1. Opening Summary

The opening paragraph should provide a concise overview of the entire investigation. Think of this as the “executive summary” that gives readers an immediate understanding of what the narrative will cover.

A strong opening summary includes:

  • The subject of the investigation (individual or entity)
  • The nature of the suspicious activity
  • The time period covered
  • The primary red flags identified
  • The conclusion reached

Example: “This investigation concerns John Doe, a retail business owner, whose account activity between January and March 2026 exhibited multiple indicators of potential money laundering, including structured cash deposits, rapid movement of funds, and transactions inconsistent with the stated business purpose.”

2. Subject Background and Profile

This section establishes who the subject is and provides context for understanding their expected financial behavior. Include:

Personal or entity identifiers: Name, address, date of birth, tax identification numbers, business registration details

Business or employment information: Occupation, industry, nature of business, years in operation

Expected financial profile: Typical account activity, expected transaction volumes, normal patterns

Relationship to financial institution: Account opening date, products used, relationship history

Prior history: Any previous SAR filings, compliance actions, or regulatory issues

Understanding the subject’s baseline behavior is essential because suspicious activity is often identified by deviations from established patterns.

3. Triggering Event and Initial Alert

Describe how the investigation began. This could be:

  • An automated system alert (transaction monitoring, watchlist screening)
  • A manual review by a compliance analyst
  • A law enforcement request
  • Information from another financial institution
  • Internal employee identification

Include details about the specific transaction or activity that triggered the alert, the date of the alert, and the initial review that confirmed further investigation was warranted.

4. Factual Findings and Analysis

This is the heart of your narrative. Present the evidence you gathered during your investigation in a logical, chronological, or thematic order.

Transaction Analysis

Detail the specific transactions that contributed to the suspicious activity determination. For each significant transaction or series of transactions, include:

  • Dates and amounts
  • Counterparties (who was on the other side)
  • Geographic locations
  • Purpose or stated reason for the transaction
  • Any anomalies or red flags observed

Use tables or structured formats when appropriate, but ensure the narrative text explains the significance of the data presented.

Pattern Recognition

Identify and explain any patterns that emerged during the investigation:

  • Structuring or smurfing (multiple transactions just below reporting thresholds)
  • Round-dollar transactions
  • Rapid movement of funds through multiple accounts
  • Unexplained increases in transaction volume
  • Frequent changes in transaction counterparties
  • Geographic anomalies
  • Unusual timing (transactions occurring outside normal business hours)

Source of Funds Analysis

Investigate and document the purported source of funds and your assessment of its legitimacy:

  • What did the subject claim as the source of funds?
  • Does the transaction pattern support this claim?
  • Are there discrepancies between the claimed source and actual activity?
  • Is the subject’s income level consistent with the transaction volume?

Customer Due Diligence and KYC Review

Document your review of the customer’s profile and any discrepancies identified:

  • Were all required KYC documents complete and current?
  • Is the subject’s beneficial ownership information clear?
  • Are there inconsistencies in the information provided?
  • Has the subject been non-responsive to information requests?

Public Records and Open Source Research

Include relevant findings from external research:

  • Negative news articles
  • Court records or legal proceedings
  • Corporate registrations
  • Social media activity
  • Regulatory actions or sanctions

Relationship Analysis

Examine connections between the subject and other parties:

  • Related accounts at your institution
  • Known business relationships
  • Family connections
  • Shared addresses or contact information
  • Transactions with other flagged entities

5. Red Flags and Suspicious Indicators

This section explicitly connects your findings to known money laundering or terrorist financing indicators. Common red flags to consider include:

Transactional Red Flags:

  • Transactions structured to avoid reporting thresholds
  • Funds transferred in round-dollar amounts
  • Multiple deposits followed by immediate withdrawals
  • High volume of transactions inconsistent with customer profile
  • Transactions involving high-risk jurisdictions
  • Unexplained wire transfers to or from accounts with similar ownership

Behavioral Red Flags:

  • Unusual nervousness or reluctance to provide information
  • Frequent changes in account information
  • Inconsistent explanations for activity
  • Unusually complex business arrangements
  • Reluctance to identify beneficial owners

Documentation Red Flags:

  • Incomplete or inconsistent documentation
  • Unverifiable identity documents
  • Fictitious or shell company structures
  • Unusual corporate structures

6. Conclusion and Suspicion Determination

State clearly whether you have reasonable suspicion of money laundering, terrorist financing, or other illicit activity. Your conclusion should:

  • Clearly state the basis for your suspicion
  • Acknowledge any alternative explanations considered
  • Indicate the level of confidence in your findings
  • Recommend whether a SAR should be filed

Example: “Based on the patterns of structured transactions, the inconsistency between the claimed business purpose and actual activity, and the subject’s inability to provide satisfactory explanations, I have reasonable suspicion that the activity described above may represent money laundering or the proceeds of criminal activity.”

7. Supporting Documentation

Although not part of the narrative text itself, list or reference all supporting documentation that corroborates your findings:

  • Account statements
  • Transaction records
  • KYC documentation
  • Public records
  • Internal communication records
  • Screenshots of alerts

Essential Writing Principles

Clarity and Precision

AML narratives are legal documents that may be reviewed by regulators, law enforcement, and in some cases, used in legal proceedings. Write with precision:

  • Use exact dates and amounts
  • Define all abbreviations on first use
  • Avoid vague language (“some transactions,” “several instances”)
  • Be specific about what you observed versus what you inferred

Objectivity and Neutrality

Maintain an objective tone throughout. Your role is to present facts and reasonable conclusions based on those facts:

  • Avoid judgmental language (“clever scheme,” “obvious evasion”)
  • Distinguish between facts and interpretations
  • Present evidence that supports and potentially contradicts your conclusions
  • Avoid speculation beyond what the evidence reasonably supports

Logical Flow

Organize information so that readers can follow your investigative reasoning:

  • Present facts before conclusions
  • Use chronological order when appropriate
  • Connect related observations
  • Explain how different pieces of evidence relate to one another
  • Avoid jumping between unrelated topics

Completeness

Include all relevant information, even if it doesn’t support your conclusion:

  • Document attempts to gather additional information
  • Note when the subject was unresponsive
  • Include mitigating circumstances or alternative explanations
  • Be transparent about limitations in your investigation

Common Mistakes to Avoid

1. Including Irrelevant Information

While completeness is important, avoid including unnecessary details that don’t contribute to the suspicious activity determination. Each element should serve a purpose.

2. Premature Conclusions

Don’t jump to conclusions without sufficient evidence. If you have only indicators, say so rather than claiming certainty.

3. Lack of Specificity

Vague descriptions like “numerous transactions” or “various sources” weaken your narrative. Use specific numbers, dates, and details.

4. Inadequate Context

Failing to provide sufficient context about the subject’s expected behavior makes it difficult to understand why specific activity is suspicious.

5. Inconsistent Terminology

Use consistent language throughout the narrative. If you refer to an entity as “ABC Corp.” in one section, don’t switch to “ABC Corporation” elsewhere.

6. Overreliance on Transaction Data

Don’t just list transactions—explain their significance and how they connect to the suspicious activity determination.

7. Poor Organization

A disorganized narrative is difficult to follow and may lead to misinterpretation. Use clear headings and logical structure.

Special Considerations

Confidentiality and Data Protection

Be mindful of privacy and data protection obligations:

  • Redact unnecessary personal information
  • Protect sensitive sources and methods
  • Follow institutional policies regarding document handling
  • Limit distribution of the narrative

Timeliness

Narratives should be completed promptly after the investigation concludes. Delays in filing can impede law enforcement efforts and expose your institution to regulatory criticism.

Quality Assurance

Implement review processes to ensure quality:

  • Peer review by another analyst
  • Supervisor review
  • Compliance department review
  • Quality control checklist

Record Keeping

Maintain clear records of your investigation and narrative development:

  • Document all review steps
  • Record decisions and their rationale
  • Preserve all supporting documentation
  • Maintain version control

Sample Narrative Structure

[HEADER: Subject Name, Case Number, Date]

OPENING SUMMARY
Brief overview of investigation and conclusion.

SUBJECT PROFILE
Name, identifiers, expected activity, account history.

TRIGGERING EVENT
Description of how the investigation began.

INVESTIGATIVE FINDINGS
Transaction analysis with specific details.
Patterns identified.
Source of funds assessment.
KYC and due diligence review.
Public records research.
Relationship analysis.

RED FLAGS IDENTIFIED
Explicit connection to money laundering indicators.

CONCLUSION
Clear statement of suspicion and basis.

RECOMMENDATION
SAR filing recommended or not recommended.

ATTACHMENTS
List of supporting documentation.

Conclusion

Writing an effective AML investigation narrative is both an art and a science. It requires meticulous attention to detail, analytical rigor, and clear communication skills. The best narratives tell a coherent story that enables readers to understand not just what happened, but why it was suspicious and how the investigation reached its conclusions.

By following the principles outlined in this guide—providing comprehensive factual information, maintaining objectivity, organizing content logically, and clearly connecting findings to red flags—you can craft narratives that serve their essential purpose: supporting the detection and reporting of potentially illicit financial activity.

Remember that each investigation is unique, and flexibility is important. While this guide provides a framework, you should adapt your approach based on the specific circumstances of each case, the expectations of your institution, and the requirements of relevant regulations.