SAR narrative template
A five-part structure for a suspicious activity report narrative. Free to use and adapt, no email required, no sign-up. Copy it from this page or download the Word version.
Write for a reader who has no access to your case management system, your alert, your customer file, or the three emails you exchanged with the relationship manager. Everything they will ever know about this case is in the box you are typing into.
The five parts below are ordered the way a reader's questions arrive.
1 · Who
Full legal name, company number or date of birth, address, account number and sort code, date the relationship opened, and the customer's own declared business or source of funds.
The declared activity is the yardstick for everything that follows. Most reports turn on a gap between what was declared and what was observed.
2 · What
The activity, in numbers. Counts, totals, ranges, averages, and the direction of travel.
Not "significant cash deposits" but "138 cash deposits totalling £1,214,300, individual amounts between £7,950 and £9,700". Every adjective should be replaceable by a number.
3 · When
A defined period with both ends, then any pattern inside it: days of the week, times of day, the lag between credit and onward payment.
A reader who can see timing can see coordination. Note any dates where activity overlapped across locations.
4 · Where
Branches, ATMs, counties, counterparties, jurisdictions, and distances from the trading or residential address where relevant.
Geography is often the most useful thing in a cash case, and the thing most often left out.
5 · Why
Why this is on someone's desk. Not a verdict — the specific mismatches, and the features of the pattern that the account profile does not account for.
Write these as separate observations rather than a conclusion. Any one alone would be thin; together they are a case.
Tail · what we did
What was asked and when, what the customer said, what documents were requested and whether they arrived, whether the account is still open, whether any restriction has been applied, whether the customer has been notified, what evidence is held, and a named contact with a direct line.
This section protects both the report and the reader. It tells the receiving unit how quickly to act.
What to keep out
Speculation without a stated reason. Legal conclusions — do not write that money was laundered or that an offence was committed; set out amounts, dates, thresholds and gaps, and let the reader characterise them. Internal jargon: model names, queue codes, rule identifiers, risk-band labels, none of which survive the journey out of your building. The alert text copied across, since an alert is a trigger rather than an account of events. And hedging stacked on a thin observation.
Before you file
Read it aloud. It is a crude test and it works — you will hear the vague months, the adjectives without numbers, and the sentence where you got tired and stopped being specific. Then hand it to a colleague who has never seen the case and ask them to tell you back what happened, when, and why you are worried. If they can, the report will travel.
Worth remembering: the narrative is the only part of a report a person reads, and the only part that decides whether anyone acts on it.
The full reasoning behind this structure, with one complete narrative worked end to end on a layered cash-deposit case, is in how to write a SAR narrative.