Practical guide · LearnAML Editorial Board · 18 October 2026 · 5-minute read
A useful STR/SAR narrative explains the activity, the evidence and the reason for suspicion in a sequence a reader can follow. This guide offers a practical drafting structure and a fictional example, with a clear distinction between observed facts and unresolved questions.
What should an STR/SAR narrative explain?
Start with the reporting framework that applies to your institution. A suspicious transaction report (STR) or suspicious activity report (SAR) is submitted through the relevant national system. FATF Recommendation 20 addresses prompt reporting to the financial intelligence unit when the stated suspicion test is met; Recommendation 21 addresses confidentiality and tipping-off. Filing formats, deadlines and the exact legal test depend on local law. Source: FATF Recommendations 20 and 21.
The narrative should help a reader understand why the activity matters. FinCEN’s narrative guidance asks filers to address who, what, when, where and why. Its guidance on common errors stresses explaining why activity is unusual for the customer rather than merely repeating form fields. These are US sources; the writing principles can be useful elsewhere, while US filing instructions should not be treated as worldwide requirements. Source: FinCEN, common reporting errors, 10 October 2007.
A practical narrative structure
Use an opening, a factual sequence and a reasoned conclusion. FinCEN’s narrative guidance package offers a process for organising the report. The structure below is LearnAML’s working adaptation for practice, rather than an official form. Use the current instructions issued by your own FIU when preparing a real submission. Source: FinCEN, SAR Narrative Guidance Package.
- Opening: Identify the customer or subject, the review period, the activity and the central concern.
- Expected activity: Explain the relevant business or account profile.
- Chronology: Set out the dates, amounts, currencies, counterparties and movement of funds.
- Enquiries: Describe what was checked and any explanations received.
- Assessment: Connect the evidence to the concern and state material limitations.
- Actions and records: Record relevant actions and identify supporting material under the applicable instructions.
Worked example: replacing a vague conclusion
All names, transactions and institutions in this example are fictional. The short extract demonstrates writing technique. It is not a complete filing, and the amounts are not legal thresholds. A real report would need the identifiers and other fields required by the relevant FIU.
Weak draft: “The customer made unusual transfers and may be laundering money. Please investigate.”
The weak draft gives the reader no evidence to assess. It omits the period, the customer’s expected business and the basis of the concern. It also uses a criminal label without showing how the analyst reached the assessment. A better extract would make the underlying observations visible:
“Harbour Example Bank reviewed the account of Fictional Cedar Trading Ltd for 1–30 September 2026 after a monitoring alert on 18 September. The customer’s recorded business is domestic office-supply distribution, with expected monthly receipts of approximately USD 30,000.
“Between 12 and 17 September, six previously unseen companies paid USD 148,000 into the account. Between 13 and 18 September, the customer transferred USD 139,000 to Fictional Bay Services Ltd. The outgoing payments described the purpose as ‘consultancy’.
“On 22 September, the customer supplied two invoices totalling USD 48,000 and stated that the remaining receipts concerned additional sales. At the review cutoff on 30 September, the bank had not received records linking the other four payers to sales or explaining the consultancy payments. The concern arises from the departure from the recorded profile, the rapid onward movement and the unresolved commercial links. The bank has not established the underlying source of the incoming funds.”
The revised extract lets a reader test the assessment. The incoming and outgoing totals are separate, so they are not inadvertently presented as USD 287,000 of distinct funds. The dates show the sequence. The customer’s response is included. The final sentence identifies a limitation instead of converting uncertainty into an allegation.
Build a small evidence map before drafting
Match each important statement to a record. In this fictional case, the account profile supports expected activity; the transaction ledger supports dates and totals; correspondence supports the customer’s explanation. A reviewer should be able to follow those references without searching an unlabelled folder. Preserve the underlying records through the institution’s approved process.
Supporting records should remain identifiable. FinCEN explains that supporting documentation includes records that assisted the filing decision, such as transaction records, account information and correspondence. That US guidance reinforces the practical value of a clear record trail. Apply local retention and disclosure requirements, and the current filing system’s instructions on attachments. Source: FinCEN, SAR Supporting Documentation.
Review the draft before submission
Read the narrative as someone who has never seen the case. Ask whether the opening explains the concern, the chronology reconciles with the records and each conclusion rests on a stated fact. Check dates, currencies and arithmetic. Explain what is unknown. Remove unexplained acronyms and unsupported labels. Use the approved review route and protect the report’s confidentiality.
Does a red flag prove money laundering?
A red flag is a reason to examine the facts. Explain the concern and the available evidence without presenting an unproven criminal conclusion as established fact. The authorised reporting decision must follow the applicable legal test.
Can I reuse this example in a real report?
Use its structure as a practice aid. Write the real account of the facts from your own case records. A copied narrative can conceal important differences and introduce information that never occurred.
Practise investigation and reporting
Turn a transaction review into an evidence-led narrative. Explore our free, self-paced AML Investigations & STR/SAR Reporting course, or compare all five free courses.
Educational guidance. The fictional extract is an original LearnAML teaching example, not an official FIU template. Follow current local law, FIU instructions and institutional procedures for real reporting.