To write a SAR narrative, answer six questions about the suspicious activity, who, what, when, where, why and how, and arrange the answers in three parts: an introduction that says what is being reported and about whom, a body that sets out the transactions in date order with the reason each is suspicious, and a conclusion that says what the bank did and where the evidence is kept. That structure comes from FinCEN's 2003 narrative guidance, and the April 2026 filing instructions add a checklist on top: whether transactions were completed or only attempted, who benefited, what supporting documentation the bank holds. Write it for an investigator who has never seen the case and has only the report. Botminds' SAR Narrative & Filing drafts narratives this way from the case file, each sentence cited and tinted by the question it answers, for the analyst to correct and the BSA officer to sign.
The worked example is a fictional sample case: Tessaly Community Bank and suspected structuring by Northgate Resale Supply LLC. The narrative below is written in the form this guide recommends; every name and number in it is invented.
A structuring narrative, sentence by sentence, with the question each one answers
IntroductionWhat is being reported, about whom, and the case number
WhoWhatTessaly Community Bank is filing this report on Northgate Resale Supply LLC, its managing member Gavin Treloar, and Lena Treloar, who deposited cash for the business, for suspected structuring of cash deposits to avoid currency transaction reporting (internal case TCB-2026-0418).
WhenWhatBetween September 2 and October 8, 2026, the subjects made 24 cash deposits totaling $184,900 into Northgate's business checking account ending 4471, and the funds left in six wires totaling $171,300.
BodyThe money in, the money out, what was said, and why it is unusual
WhereHowThe deposits were made at four branches, Millbrook, Harlan Street, Ridgeview and East Fenwick; on six days the cash was split between two branches, and every deposit was below $10,000.
WhyWhenOn September 18, 2026, Gavin Treloar asked a Harlan Street teller what amount is reported to the government; when told, he deposited $9,100 of the $14,600 he carried and deposited the remaining $5,500 at the Millbrook branch that afternoon.
WhyAt account opening Northgate expected about $12,000 a month in cash from sales of used restaurant equipment; in this period its cash deposits averaged about $150,000 a month.
WhoHowLena Treloar made five of the deposits, all at Ridgeview, identifying herself with a state ID ending 2291; she is not a signer on the account.
HowWhyWithin two business days of each run of deposits, funds left in outgoing wires to Pellham Auto Group Inc., an auto dealer at an unaffiliated bank, each described as "inventory": $28,400 on September 4, $31,900 on September 15, $26,500 on September 21, $29,700 on September 29, $27,300 on October 2 and $27,500 on October 9. Northgate's stated business does not involve vehicles.
WhatWhyAll deposits and wires were completed; the bank does not know how Pellham Auto Group used the funds. On October 6 the bank asked Northgate for invoices supporting the wires; none had been provided by October 20.
ConclusionWhat the bank did, and where the evidence is
WhatTessaly filed currency transaction reports for the six business days on which the deposits, taken together, exceeded $10,000, and has placed the account under enhanced monitoring.
WhereThe 24 deposits are listed in the attached CSV file. Deposit tickets, the teller's note, wire records and account statements are kept with this report for five years and are available from Tessaly's BSA Officer on request.
How do you write a SAR narrative? Start from the five Ws
Start by collecting the answers, then write. FinCEN's guidance says "a SAR narrative should identify the five essential elements of information – who? what? when? where? and why? – of the suspicious activity being reported. The method of operation (or how?) is also important and should be included in the narrative" (FinCEN, Guidance on Preparing a Complete & Sufficient SAR Narrative, 2003). Write the answers down as notes from the case file, each with the document it came from, before writing a sentence. A narrative written straight from memory of the investigation tends to be strong on why and thin on when and where.
The reader is the reason for the order. The narrative is the only free text in the report, and an investigator may find it years later through a search on a name or an account, with no other context. FinCEN's guidance puts the standard plainly: it is "essential that financial institutions' staff write narratives that are clear, concise, and thorough." Clear means one fact per sentence where possible. Concise means no restating of the fields that already say the same thing. Thorough means that every transaction the bank relies on can be found.
What are the 5 Ws of a SAR narrative?
Who did it, what they used, when it happened, where it happened and why the bank finds it suspicious, plus how it was done. Each has a specific meaning in FinCEN's guidance, and each has a common way of going wrong. The table sets them out with the sample case's answers.
The five Ws and how: what each asks, and the sample case's answer
| Question | What FinCEN asks for | Sample case | Common miss |
|---|---|---|---|
| Who | Every subject, with occupation or business, role, identifiers and relationships among them | Northgate; Gavin Treloar, managing member; Lena Treloar, not a signer | A subject who acted but is not an account holder |
| What | The instruments and mechanisms, and the flow of funds from source to application | Cash deposits in; wires out to an auto dealer | Only the money in, nothing on where it went |
| When | When first noticed, how long it ran, individual dates and amounts | September 2 to October 9, 2026; dates of each wire | A total with no dates |
| Where | Each branch or location, other institutions, any foreign jurisdiction | Four branches; the beneficiary's bank | Branches left in the fields only |
| Why | Why it is unusual for this customer, against expected activity and similar customers | The question to the teller; cash twelve times the expected level; no invoices | Restating the alert rule that fired |
| How | The method, end to end | Split deposits across branches, then wires within two business days | Describing the deposits but not the wires |
Two answers deserve more care than they usually get. "What" includes where the money went: the guidance asks filers to "always include the source of the funds (origination) that lead to the application for, or recipient use of, the funds (as beneficiary)." And "how" means both halves of a scheme. "If what appears to be structuring of currency deposits is matched with outgoing wire transfers from the accounts, the SAR narrative should include information about both the structuring and outbound transfers (including dates, destinations, amounts, accounts, frequency, and beneficiaries of the funds transfers)."
The introduction: purpose, subjects and the red flags
The introduction says, in one or two sentences, what is being reported and about whom. FinCEN suggests it can give "the purpose of the SAR and a general description of the known or alleged violation", the date and reason of any earlier SAR on the same subjects, any internal investigation number "which may be a point of reference for law enforcement", and "a summary of the 'red flags' and suspicious patterns of activity that initiated the SAR", which may go in the introduction or the conclusion.
In the sample, the first sentence names the three subjects, their relationship and the suspected activity, and gives the bank's case number. The second gives the period, the count, the total and the account, and the total that left. An investigator who reads only those two sentences knows whether to read on. That is their job.
Name the type of activity in words people search. FinCEN alerts and advisories ask for specific key terms in the narrative; the 2024 deepfake alert, for example, asks filers to include "FIN-2024-DEEPFAKEFRAUD" (FinCEN Alert, November 2024). Where a case matches an advisory, the key term belongs in the introduction.
The body: money in, money out, and what was said
The body sets out the facts that support the filing, in date order where the activity spans more than one day. The April 2026 checklist asks filers to "describe the conduct or transaction(s) that caused suspicion" chronologically where appropriate, and to "explain whether any transaction(s) involved were completed or only attempted" and "who benefited and how they benefited, financially or otherwise" (FinCEN SAR Filing Instructions, Part V). The 2003 guidance adds what investigators value most: "any factual observations or incriminating statements made by the suspect."
The strongest sentence in the sample is the teller's. On September 18 the customer asked what amount is reported to the government, then split $14,600 between two branches. Since the October 2025 interagency FAQs, that kind of evidence carries the "why" of a structuring SAR, because amounts at or near the $10,000 CTR threshold are no longer, on their own, enough to require one (SAR FAQs, October 9, 2025, Question 1). A structuring narrative that lists amounts under $10,000 and nothing else no longer explains itself.
Give individual dates and amounts, not only totals, but keep tables out of the text. The 2003 guidance asks that "individual dates and amounts of transactions should be included in the narrative rather than just the aggregated amount", and the 2026 instructions say "do not include tabular data in a FinCEN SAR narrative". The way through is the one in the sample: six wires listed in a sentence, 24 deposits in a CSV attachment of up to one megabyte that the narrative describes.
The same suspicion, written two ways
Insufficient: "We believe this customer is structuring to avoid CTR filing." (FinCEN's insufficient example 3, in full.)
Sufficient: Ten sentences: who, the period and totals, branches, the teller's note, expected against actual cash, the wires and the bank's actions.
Insufficient: None named.
Sufficient: Wires listed by date and amount; deposits in a described CSV attachment.
Insufficient: Not said.
Sufficient: Six wires to an auto dealer at another bank, described as inventory.
Insufficient: Asserted, not shown.
Sufficient: The customer's question about reporting, the split deposit, cash far above expected activity, no invoices.
Insufficient: Not said.
Sufficient: CTRs filed for six days; account under enhanced monitoring; records kept and available.
The conclusion: what the bank did and where the records are
The conclusion closes the report with what an investigator needs next. FinCEN suggests "information about any follow-up actions conducted by the financial institution (e.g., intent to close or closure of accounts, ongoing monitoring of activity, etc.)", other contacts at the institution, and "a general description of any additional information related to the reported activity that may be made available to law enforcement". The 2026 checklist adds "describe all supporting documentation and retain the documentation for five years. DO NOT include supporting documentation with the FinCEN SAR."
In the sample, the conclusion says the bank filed CTRs for the six days on which deposits together exceeded $10,000, put the account under enhanced monitoring, and holds the deposit tickets, the teller's note, the wire records and the statements. It does not say the account will be closed, because no decision had been made. A conclusion that promises an action the bank then does not take is a small inaccuracy an examiner can find.
Every figure in the narrative, checked against the fields and the records
The checker names the cause of each disagreement; a person chooses which value stands.
What should not be in a SAR narrative?
Leave out anything that would compromise an investigation, anything that belongs elsewhere, and anything that is there for the bank's comfort rather than the reader's understanding. The examination manual is explicit about one item: a SAR filed after a national security letter must not mention the letter, and law enforcement discourages any mention of a grand jury subpoena; the narrative carries only the facts and activity that support the finding of suspicion (FFIEC manual; the guide to grand jury subpoenas explains why).
Nine things that do not belong in a SAR narrative
- Any mention of a national security letter or grand jury subpoena
Describe the activity the bank found, not the request that prompted the review.
- "See attached"
An attachment is part of the narrative, never a substitute; describe what it contains.
- Tables
Transaction detail too long for sentences goes in one CSV file of up to one megabyte.
- Supporting documents
Describe them and keep them for five years; do not send them with the SAR.
- Legal disclaimers
The 2026 instructions say so in capitals.
- Victims as subjects
Describe victims only where needed to understand the activity; never in a Part I subject record.
- The bank's policies, unless needed
Only where the activity cannot be understood without them.
- The whole of a prior narrative
A continuing report covers its own period and only what is needed from earlier reports.
- Speculation dressed as fact
The bank need not prove the crime; say what it observed and why it suspects, and attribute statements to who made them.
One correction to common advice: the instructions' list of prohibited words, such as "unknown", "various" and "see narrative", applies to the other text fields of the form, "other than in Part V". The narrative is where such words can be explained. If a total is unknown, the narrative says why.
How long should a SAR narrative be?
As long as it takes to answer the six questions and no longer; FinCEN sets the standard, not a length. The sample narrative is ten sentences, about 2,200 characters, because the case is one pattern at one bank over five weeks. A multi-bank layering case may need several pages. The test is whether an investigator can reconstruct the activity from the report, and whether every sentence carries something the fields do not. The instructions say information in other sections "need not be repeated in the narrative unless necessary to provide a clear and complete description".
Searches for a "SAR narrative character limit" usually come from people who hit one in their filing software. The filing instructions and FinCEN's SAR FAQs cited here do not state a narrative limit; batch filers should check the current BSA E-Filing technical specifications, and any filer near a limit is usually writing tables in prose, which the CSV attachment exists to take.
Writing it with SAR Narrative & Filing
The solution drafts the narrative the way this guide describes, from the case. A case reader agent reads the documents, 47 from six systems in the sample case, and cites every value to its page. A narrative drafter writes the introduction, body and conclusion, labels each sentence with the questions it answers and its citations, and counts the coverage; a missing W becomes a question to the analyst. It never writes "see attached" and never sends. A separate checker then compares every amount, date and name with the bank's systems of record, which is how the sample draft's total of $186,400 was caught against the bank's $184,900: one deposit sat in two overlapping alerts.
The analyst stays the author. She asks the drafter for changes in plain words, such as "list the wires by date", accepts or rejects each proposed sentence, and sends the SAR to review. For how the drafter and checker are kept apart, see why a SAR narrative generator should never check its own work; for how a reviewer scores the result, see the SAR quality scoring sheet.
Every source behind the narrative, with the cited line marked
Questions people ask
Is there a SAR narrative template?
FinCEN does not publish a fill-in template; it publishes a structure. Its 2003 guidance suggests an introduction, a body and a conclusion built around the five Ws and how, with examples of sufficient and insufficient narratives for banks, money services businesses, broker-dealers and casinos.
What is a good SAR narrative example?
FinCEN's 2003 guidance prints sanitised narratives with commentary; its depository example 2 describes six structured $9,800 deposits by two signers at two branches, each followed by a $9,800 check to another bank, with dates, branches and the bank's next steps. The worked sample on this page follows the same pattern for a case with wires.
Should a SAR narrative include the customer's own explanation?
Yes. The April 2026 checklist asks filers to describe "any admission or explanation of the activity or transaction(s) provided by the subject(s), witness(s), or other person(s), including to whom and when it was given". Quote or paraphrase it and say who heard it and when.
Can a SAR narrative mention a 314(b) request?
Where the SAR contains information received from another institution under the 314(b) program, the instructions ask for the statement "This SAR contains 314(b) data" in the narrative. A grand jury subpoena or national security letter, by contrast, should not be mentioned.
How do you write a narrative for a corrected SAR?
Complete the whole report again and describe the corrections at the beginning of the narrative, before the narrative itself. The prior report's BSA ID goes in field 1e, and box 1b is checked. Corrected vs amended SAR explains when each applies.
Do you have to prove the crime in a SAR narrative?
No. The FFIEC manual says a bank does not have to investigate the underlying crime or confirm that it happened; that is law enforcement's job. The narrative describes what the bank observed and why it suspects, as precisely as it can.