Writing a SAR narrative: trace every line to a record before you file

Summary

The narrative is the part of a SAR that explains what happened and why it's suspicious, and a draft can look complete while resting on a double-counted total or a customer explanation written up as fact. Before it goes to the approver, trace every statement in the narrative back to a record the bank holds. FinCEN asks for a "clear, concise and chronological" narrative that covers who, what, when, where, why and how (FinCEN SAR narrative guidance), and the records you trace become the supporting documentation the bank has to keep for five years (31 CFR 1020.320(d)).

For BSA investigators and SAR reviewers at U.S. banks. The BSA officer decides whether to file and what the SAR says.

What's required and what's bank practice

Topic	What applies	Source
Filing deadline	30 calendar days after initial detection; up to 60 if no suspect was identified on that date	31 CFR 1020.320(b)(3)
Narrative content	A clear, chronological account of who, what, when, where, why and how, including why the activity is suspicious	FinCEN SAR narrative guidance
Supporting documentation	Every record that helped the bank decide to file, identified at the time of filing	FinCEN FIN-2007-G003
Retention	Five years from the filing date, for the SAR and its supporting documentation	31 CFR 1020.320(d)
Attachments	One CSV file of tabular data, such as transactions, which is part of the narrative but can't replace it	FinCEN e-filing guidance
Statement-by-statement tracing, review checklist	Not required by any rule; this is how the bank checks the draft	Bank procedures

Check a SAR narrative in six steps

1. Break the draft into single statements

Split the narrative so each amount, date, account, party, explanation and conclusion sits on its own line. Then label each one: something a bank record shows, something a person said, the investigator's analysis, or something the investigation hasn't established. Most problems surface here, because a sentence that mixes all four usually reads as fact.

Keep an eye on the clock while you do this. The 30-day filing deadline runs from initial detection, not from when the narrative was drafted.

2. Link each fact to its source

For every statement a record should support, note the system, the record ID and the field: a core transaction ID, a wire reference, a page in the KYC file, a dated call note. If you can't find the source, remove the statement or rewrite it as something the bank doesn't know yet.

3. Rebuild every total from unique transactions

Build each total from distinct transaction IDs, not export rows. Two overlapping exports will repeat the same transfer. Confirm whether each transaction posted, is pending or was returned, state the period covered, and recompute the total. For larger volumes, FinCEN's guidance suggests breaking the activity into credits and debits by date and amount. If the detail runs long, put it in the CSV attachment and summarize it in the narrative.

4. Attribute what the customer said

Write explanations as statements the customer made, with the date and channel: "On a recorded call on March 4, the customer said the payments were for equipment." If nothing in the file backs it up, say what the bank asked for and whether it arrived. A missing invoice doesn't prove a transaction was fake, so don't write it that way.

5. Explain why it's suspicious without guessing at motive

FinCEN's guidance says a narrative that doesn't explain what makes the activity suspicious undermines the purpose of the SAR. Lay out those reasons from the records, such as a stated purpose that doesn't fit the recipient, or activity that breaks from the customer's normal pattern. Leave out claims about intent that the records can't show.

6. Check the structure, then mark the supporting documentation

FinCEN suggests three parts: an introduction with the purpose of the SAR and the suspected violation, a chronological body with the accounts, transactions, parties and other institutions involved, and a conclusion with any follow-up action and a contact for supporting documents. Describe the supporting documentation and say where the bank keeps it, but don't send it with the SAR, and never write "see attached" in place of a narrative (FIN-2007-G003).

Then save your statement-to-source list with the case file. That way, the records the bank keeps as supporting documentation match what the narrative actually relied on.

Worked example

Illustrative example. All names and figures are fictional.

A draft narrative says three outgoing transfers totaling $36,000 bought equipment, and that the customer meant to hide the recipient. The reviewer traces each claim.

Draft says	Records show	Corrected narrative
Three transfers totaling $36,000	Two posted transfers of $12,000. A second export repeats one of them with the same transaction ID.	Two posted transfers totaling $24,000; the duplicate is noted in the reconciliation
The transfers bought equipment	A dated call note with the customer's explanation. No invoice on file.	The customer said on a dated call that the transfers paid for equipment; the bank requested an invoice and hasn't received it
The customer meant to hide the recipient	The payment record and the call note describe the recipient differently. The relationship isn't verified.	The recipient in the payment record differs from the one the customer described; the relationship hasn't been verified

The corrected narrative is shorter and less dramatic, and every line can now be traced to a record. It still gives the BSA officer what they need to decide whether to file: a $24,000 discrepancy between what the customer said and where the money went.

Where SAR narratives go wrong

The most common problem is a narrative that describes the transactions but never says why they're suspicious, which FinCEN's guidance says undermines the purpose of the SAR. Totals built from export rows are another, since a duplicated transfer inflates the amount and is hard to explain later. Customer explanations often get written as facts, and missing documents get written as evidence of fraud. And when the supporting documentation isn't identified at filing, the bank can struggle to produce it when law enforcement asks.

How Bretton fits in

Bretton's agents gather the evidence for each case, apply your bank's policy and draft the full case for your investigators to approve, with SAR drafting as one of the ready-made workflows (Bretton platform). In Bretton Horizon, the narrative is drafted from your bank's own narrative library after the analysis is done, so it follows your templates. Bretton's agent harness only counts a source the agent actually retrieved, and transaction totals are computed separately so the narrative matches them.

Common questions

What should a SAR narrative include?

FinCEN asks for a clear, chronological account of who was involved, what happened, when and where it happened, why it's suspicious and how it was done. It should also describe the supporting documentation and where the bank keeps it.

Can you attach documents to a SAR?

You can attach one CSV file with tabular data, such as transaction details, but it doesn't replace the narrative. Other supporting documents stay with the bank and are provided on request.

How long do banks keep SAR supporting documentation?

Five years from the date the SAR was filed.

Related guides

• How to build an AML case file examiners can follow
• How to route AML and fraud cases without losing evidence or the SAR clock
• All operating guides

Sources

• FinCEN, Guidance on Preparing a Complete and Sufficient SAR Narrative, November 2003
• FinCEN, FIN-2007-G003: Suspicious Activity Report Supporting Documentation
• FinCEN, Filing FinCEN's new Currency Transaction Report and Suspicious Activity Report
• 31 CFR 1020.320, reports by banks of suspicious transactions
• Bretton, Platform, Horizon and Agent harness

Book a demo to see how Bretton drafts SAR narratives your investigators can trace.