An AML investigation report records why a case was opened, what the investigator reviewed, what was found, what it means and what the bank should do, and the sample below fills each of those sections in for one fictional structuring case. The part that decides whether a report is any good is not the prose. It is whether every amount, count and date in it can be traced back to the rows it came from, because if the bank files a SAR, the rule treats the documents behind it as filed with the SAR, and they must be handed to FinCEN or law enforcement on request. Botminds' AML Case Management builds the case file with a citation on every item and has a second agent check every value in the draft against its source before the investigator decides. This guide follows one figure, $211,100 in cash, from the core banking system to the SAR packet.
The case is C-2026-04417 at Corvane National Bank, a fictional sample bank; the customer, the people and every amount are invented.
What does an AML investigation report look like? A sample, filled in
An AML investigation report is usually a short structured document, not an essay: a header that fixes the case and its clock, the subjects, why the case was opened, what was reviewed, the customer's expected activity, the findings, the analysis, the conclusion and recommendation, and an index of the evidence. Regulators do not prescribe a format. The FFIEC manual asks only that investigators write down their conclusions, including whether they recommend a SAR (FFIEC manual). The sample below is the report the agents and the investigator produced on the sample case, laid out in nine sections.
A sample AML investigation report: case C-2026-04417, nine sections
- 1. Case header
- C-2026-04417 · Lindqvist Imports LLC · business checking ••6620 · alert ALT-2026-0929-20871, structuring scenario, fired Sep 29, 2026 · escalated by Level 1 · investigator Renata Solís · approver Priya Raman · detection date Oct 5, 2026 · SAR due Wed, Nov 4, 2026 · restricted
- 2. Subjects
- Lindqvist Imports LLC; Erik Lindqvist, managing member, 100% owner, sole signer; Dorian Pask (••4472); Teodora Vance (••5109); Brightfield Home Goods LLC (••8841).
- 3. Why the case was opened
- Repeated cash deposits just under $10,000 at several branches. Level 1 could not reconcile them with the customer's expected cash of about $5,000 a month and escalated.
- 4. Scope of review
- Activity Sep 1 to Oct 9, 2026 in detail; twelve months of statements; customer profile and beneficial ownership; seven counterparties; prior alerts, cases and the SAR index; 314(a) (no match); one 314(b) request to Alder Ridge Savings Bank (answered Oct 19); 14 documents from imaging, 2 deposit tickets not returned.
- 5. Customer and expected activity
- Importer of Scandinavian home furniture, customer since June 2019, rated Medium. Expected cash about $5,000 a month from showroom sales (twelve-month average before September: $4,300); expected wires about $55,000 a month to suppliers in Sweden and Denmark.
- 6. Findings
- (a) 23 cash deposits, Sep 8 to 26, $8,600 to $9,700 each, $211,100 in total, at six branches; on eight days the cash was split between two branches so each day exceeded $10,000. (b) Sep 14: a teller noted the depositor asked whether two deposits on one day are added together. (c) Four wires, $203,500, Sep 11 to Oct 1, to Jadeport Trading Co. Ltd, Hong Kong, a counterparty absent from the profile, no invoice on file; regular suppliers received $43,600 in September against $54,800 in August. (d) Three customers made 16 cash deposits, $147,200, each within 60 minutes of a Lindqvist deposit at the same branch; one shares the registered address, one the online banking device; Brightfield wired $48,000 to the same Jadeport account.
- 7. Analysis
- September cash was about 49 times the prior monthly average. The split days, the teller's note and third-party depositors are signs the deposits were designed to evade currency reporting, not cash near the threshold alone. The wires do not fit the customer's stated business or suppliers.
- 8. Conclusion and recommendation
- File a SAR. Reason codes F-01 structuring (signs of intent to evade reporting), F-02 funds transfers inconsistent with the business, F-03 third-party or nominee depositors. Activity Sep 8 to Oct 1, 2026; network cash 39 deposits, $358,300; wires to Jadeport five, $251,500. Proposed: three customer ratings to High; account exit for two accounts.
- 9. Supporting documentation index
- 41 items, each with its system, identified at filing and kept as supporting documentation: statements and transaction history, branch transaction log, device log, profile, ownership certification, wire records, deposit tickets, teller note, 314(b) reply, prior SAR reference on a linked party.
Three things make this report usable by someone who never saw the case. Every finding is specific: dates, amounts, branches, names. The analysis separates what was observed from what it means, which matters since the October 2025 interagency FAQs said that cash near $10,000 alone does not require a SAR. And the recommendation states the reason codes, the activity dates and the totals the SAR will carry, so the filing team does not have to reconstruct them.
What is in an AML investigation report? Nine sections and the question each answers
Each section answers one question a reviewer will ask. The header answers which case and which clock. Subjects answer who. Why opened and scope answer what was looked at and what was not, which protects the investigator when a later reviewer finds something outside the scope. Expected activity answers what normal looks like, and the findings answer what happened instead. Analysis answers why that is suspicious, the conclusion answers what to do, and the index answers where the evidence is.
The scope section deserves more care than it usually gets. A report that says "reviewed account activity" cannot be tested; one that names the period, the systems and the sources that could not be reached can. In the sample case the scope records that document imaging returned 21 of 23 deposit tickets, and the findings do not rely on the two that are missing; the core system has both deposits. A reviewer reading the report can see the gap and judge it.
The investigation report stays inside the FIU; the SAR narrative goes to FinCEN
Investigation report: The decision maker, quality control, internal audit and examiners.
SAR narrative: Law enforcement analysts who have never heard of the bank's customer.
Investigation report: Everything reviewed, including what was ruled out and why, and the sources that could not be reached.
SAR narrative: Who, what, when, where, why and how of the suspicious activity, in chronological order.
Investigation report: An index of every item, cited to its system.
SAR narrative: Described, never attached; FinCEN asks filers not to write "see attached".
Investigation report: Internal matters such as alerts, scenario names and law enforcement inquiries the bank received.
SAR narrative: Only the facts that support suspicion; law enforcement discourages any reference to a grand jury subpoena, the FFIEC manual notes.
Investigation report: The bank's own retention policy; supporting documentation at least five years from filing.
SAR narrative: A copy kept five years from filing, with the supporting documentation.
One number from statement to SAR: following $211,100
The total that matters most in this case is $211,100: the cash Lindqvist Imports deposited in 23 deposits between September 8 and 26. It appears in the findings, the statement, the SAR packet and, eventually, the SAR narrative, and it has to be the same number everywhere and traceable to 23 rows. Here is the path it took in the solution, and where a person had to act.
One cash total in AML Case Management, from the core system to the SAR packet
Agent
Case builder reads the rowsPulls 64 rows of activity for Sep 1 to Oct 9 from the core banking system, each with date, branch, time and amount, and cites them.
Never: reads outside the restricted workspace
Agent
Timeline analyst sums and drawsCounts 23 cash deposits, $8,600 to $9,700, $211,100 in total, at six branches, and draws each as a square sized by amount.
Never: states a figure without a source row
Agent
Drafter writes the statementWrites "23 cash deposits totaling $211,100 … at five branches" into the file recommendation, with citations.
Never: decides
Agent
Verifier checks every valueOn a second model, recomputes 38 amounts, counts, dates and names from source with $0 tolerance. 37 agree; "five branches" does not.
Never: edits the draft
A person decides
Investigator accepts the correctionRenata Solís opens the source, accepts "six branches", decides File a SAR and attests. 38 of 38 values now agree.
A person decides
Senior investigator approvesPriya Raman sees the value check, the maker-checker check and the clock, and approves.
A person decides
Filing team filesReceives a packet with five subjects, activity dates, the cash and wire totals and 41 cited items, and files through BSA E-Filing.
The catch was small and it matters. "Five branches" against six would not change the decision, but a SAR that says five, filed with supporting documentation that shows six, is a SAR whose own evidence contradicts it. If an error like that is found after filing, the instructions require a corrected report for any error found in a SAR already filed (SAR Filing Instructions, 6.1.3; the guide to corrected and amended SARs walks through one). Checking before the decision is cheaper.
The recommendation and the verifier, side by side
What is SAR supporting documentation? Everything that helped decide
SAR supporting documentation is every document or record that helped the bank decide a SAR was required. FinCEN's 2007 guidance defines it in those words, "all documents or records that assisted a financial institution in making the determination that certain activity required a SAR filing," and adds two rules that shape how a case file must be built: the bank "must identify supporting documentation at the time the SAR is filed," and "a document or record may qualify as supporting documentation even if not identified in the narrative" (FIN-2007-G003).
The regulation then gives that documentation the status of the SAR itself: the bank must mark it as supporting documentation and keep it that way, and it counts as filed with the SAR (31 CFR 1020.320(d)). Two consequences follow. The documentation is confidential to the same degree as the SAR wherever it would reveal one. And a report whose figures cannot be traced to identified documents has a gap in the very material the bank is deemed to have filed.
The supporting documentation index for the sample case, by system
| System | Items | Used for |
|---|---|---|
| Transaction monitoring and case management | Alert, scenario logic, Level 1 note | Why the case was opened |
| Core banking system | Twelve statements, transaction history, branch transaction log, online banking device log, signature card | Every cash total, branch count and the same-hour links |
| Client lifecycle management | Customer profile, beneficial ownership certification, expected activity, rating history | What normal looks like; who owns the business |
| Payments hub | Seven counterparties and their wires | The $203,500 to Hong Kong and the supplier comparison |
| Document imaging | Deposit tickets (21 of 23), teller note of Sep 14, wire forms | Who deposited, and the question about adding deposits together |
| FinCEN 314 programs and correspondence | 314(a) result, 314(b) reply from Alder Ridge Savings Bank | Activity of a linked customer at another bank |
Who can request SAR supporting documentation, and does it need a subpoena?
FinCEN, an appropriate law enforcement agency or the bank's supervisory agency can request SAR supporting documentation, and the bank must provide it without a subpoena. FinCEN's guidance says financial institutions "must provide all documentation supporting the filing of a SAR upon request," and that FinCEN interprets the rules as "requiring a financial institution to provide supporting documentation even in the absence of legal process." The Right to Financial Privacy Act, which normally requires legal process and notice to the customer before records go to a government agency, does not apply to these requests.
The same guidance puts a duty on the bank: it "should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency," for example by independent verification with the requester's field office. That is why the sample bank's export packs are built per audience. A law-enforcement request for supporting documentation gets the cited items for that SAR, account numbers masked to the last four digits, approved by the BSA officer and logged; it does not get the rest of the FIU's files. What happens when a request arrives by subpoena instead is a different matter, covered in what to do when a grand jury subpoena for bank records arrives.
How long must SAR supporting documentation be retained? Five years from filing
A bank must keep a copy of each SAR, with the original or business-record copy of its supporting documentation, for five years from the date it files the SAR (31 CFR 1020.320(d)). The general BSA retention rule adds that records must be stored so they can be retrieved within a reasonable time (31 CFR 1010.430(d)), which is the part a scattered case file fails: documentation spread across shared drives and inboxes is retained, but not accessible.
There is no federal retention rule for a decision not to file, because since October 2025 there is no requirement to document one. Banks set their own period. The sample bank keeps every case file five years from filing or from the no-file decision, extended by any legal hold; that is a policy choice in its settings, not the law.
Every value opens its source passage
How do you check the figures in a SAR before it is filed?
Check every value against its source, not against the draft that contains it. A reviewer who rereads a recommendation checks that it is plausible; a check that recomputes each amount from the rows checks that it is true. In the solution the verifier does the second, for every amount, count, date and name in the draft, on a different model family from the drafter, with no tolerance on amounts: a one-dollar difference is a disagreement, and a decision waits while any disagreement is open.
Before a SAR decision: checks on the figures in the report
- Recompute every total from rows
Cash, wires and network totals summed from the transactions, not copied from an earlier sentence.
- Count what the text counts
Deposits, branches, days, subjects. Counts typed by hand are where reports drift.
- Match dates to the activity period
The first and last suspicious transactions bound the SAR's activity dates.
- Spell every name as the source does
Subjects and counterparties exactly as they appear in the profile and the wire records.
- Separate the subject from the network
Lindqvist's $211,100 is not the network's $358,300; each total says whose it is.
- Note what could not be checked
Missing documents named, and the finding shown not to rely on them.
Writing the narrative from the report: who, what, when, where, why and how
The SAR narrative is written from the report but for a different reader. FinCEN's 2003 guidance, which the FFIEC manual still points to, asks a narrative to answer who, what, when, where and why, with how added, set out "in a concise and chronological format," and suggests dividing it "into three sections: an introduction, a body, and a conclusion" (FinCEN, 2003 narrative guidance). The current filing instructions add that filers describe the supporting documentation in the narrative, keep it for five years, and do not attach it.
A report built the way the sample is makes that translation mechanical: the findings are already chronological and specific, the subjects are listed, the reason codes name the why. What the narrative leaves out matters as much: internal alert names, the investigator's ruled-out theories, and any law enforcement inquiry the bank received. The SAR filing team in the sample bank receives the packet, not the whole report. How the whole case unfolded, day by day, is in the AML case study example; the solution is at AML Case Management.
The hand-off: a SAR filing packet built from the approved decision
Questions people ask
How do you document an AML investigation?
Record what triggered the case, the scope of review, the evidence with where each item came from, the findings, the analysis and the recommendation, and who decided and approved it. The FFIEC manual asks investigators to document conclusions and any recommendation on filing; examiners test that chain on a sample of cases rather than second-guessing each decision.
Should the investigation report be attached to the SAR?
No. FinCEN asks filers not to include supporting documentation with the SAR and not to write "see attached" in the narrative. The report and the documents stay at the bank, are identified as supporting documentation, and are provided on request. A single CSV file of up to one megabyte of transaction data can be attached as part of the narrative, but it does not replace the narrative.
Can a bank refuse a law enforcement request for SAR supporting documentation?
Not a genuine one. The rules require a bank to provide supporting documentation on request by FinCEN or an appropriate law enforcement or supervisory agency, without legal process. The bank should verify that the requester is who they say they are before handing anything over.
What reason codes go in an AML investigation report?
Reason codes are each bank's own, set in its procedures, so a decision and its approval can be compared across cases. The sample bank uses codes such as F-01 for structuring with signs of intent to evade reporting and F-02 for funds transfers inconsistent with the customer's business. The SAR form has its own categories of suspicious activity, which the filing team selects from the findings.
What happens if a number in a filed SAR is wrong?
The bank files a corrected report. FinCEN's April 2026 filing instructions require a corrected SAR whenever errors are discovered in the data reported, with box 1b checked, the prior report's BSA identifier entered if known, and the correction described at the start of the narrative.