How to write a SAR narrative, with a full worked example
Most SAR training stops at the five Ws and leaves you to guess what a finished narrative actually looks like. This note goes further: the structure, the sentences that get a report bounced back by an MLRO, and one complete narrative written out end to end on a layered cash-deposit case, with a commentary on what every paragraph is doing.
The narrative is the only part anyone reads
I have reviewed a great many suspicious activity reports over about twenty years, and I have signed off a fair number of them myself. The structured fields matter for routing and matching. The narrative is what decides whether a human being at the financial intelligence unit does something with your report or files it behind four thousand others.
That reader has no access to your case management system. They cannot see your alert, your risk score, your customer file, or the three emails you exchanged with the relationship manager. Everything they will ever know about this case is in the box you are typing into. Write for that person.
One framing I press on every analyst I train: an alert is arithmetic, not an accusation. Your job is to lay the arithmetic out so plainly that the reader can follow it without you in the room, and to be honest about where the arithmetic stops and inference would begin.
The five-part structure
I teach five parts, in this order, because the order is how a reader's questions arrive.
Who. Full legal name, company number or date of birth, address, account number and sort code, date the relationship opened, and the customer's own declared business or source of funds. That last element does more work than people expect, because most reports turn on a gap between what was declared and what was observed.
What. The activity, in numbers. Counts, totals, ranges, averages, and the direction of travel. Not "significant cash deposits" but "138 cash deposits totalling £1,214,300, individual amounts between £7,950 and £9,700".
When. A defined period with both ends, and then any pattern inside it — days of the week, times of day, the lag between credit and onward payment. A reader who can see timing can see coordination.
Where. Branches, ATMs, counties, counterparties, jurisdictions. Geography is often the single most useful thing in a cash case and the thing analysts most often leave out.
Why. Why this is on someone's desk. Not a verdict — the specific mismatches, the specific features of the pattern that the account profile does not account for.
I then add a short tail that is not one of the five Ws but should never be missing: what we did, what the customer said when asked, what documents we hold, whether the account is still open, and who to ring.
Sentences that get a report sent back
When I was reviewing reports as an MLRO, I kept a mental list of the lines that made me push the draft back across the desk. Some of them:
"The customer's activity is highly suspicious and inconsistent with normal behaviour." This tells the reader that you have an opinion. It does not tell them what you saw. Every adjective in a narrative should be replaceable by a number, and if it cannot be, cut it.
"The deposits were clearly structured to evade reporting thresholds, an offence under the Proceeds of Crime Act." You are not the prosecutor and this is not your call. Describe the amounts and the threshold as facts side by side; let the reader draw the line. I have seen reports weakened badly by a legal conclusion the writer could not support, because the reader then discounts the factual parts too.
"Alert raised by rule CASH-STRUCT-07, scenario 3b, risk score 82, disposition code RFI-2." Meaningless outside your building. If the tuning logic matters, say it in English: the pattern was identified because deposits below a set amount recurred at multiple branches within short windows.
"The customer is a Romanian national who works in construction." If nationality or occupation is relevant, tie it to the activity in the same sentence. If you cannot, it is decoration, and decoration of that kind reads as bias to anyone downstream.
"Over the past several months there have been numerous cash credits." Two vague words in one clause. How many months, and which ones. How many credits, and totalling what.
"The RM has confirmed the customer is legitimate and there is nothing to worry about." This is hearsay that argues against your own report. Record what the relationship manager said, attributed and dated, and let it sit as evidence rather than as reassurance.
A worked case: cash under the counter threshold at three branches
Case note
A composite from several files I have handled. A single-director limited company operating a convenience store opened a business account in March 2021, declaring expected annual turnover of about £240,000, roughly seventy per cent of it cash. For two years the account behaved as declared. From early January 2024 the cash volume rose sharply: 138 counter deposits between 8 January and 28 June 2024, totalling £1,214,300, each one between £7,950 and £9,700. None reached £10,000, the figure at which the bank's counter staff complete an enhanced source-of-funds enquiry.
The deposits were spread across three branches, 18, 31 and 44 miles from the trading address. Card acquiring receipts over the same period came to £41,600 — about three per cent of total credits, against a declared model of roughly thirty per cent card. Ninety-two per cent of credited funds left within forty-eight hours, mostly to a wholesale company incorporated in November 2023 and to a counterparty abroad. Nothing resembling rent, wages, VAT or PAYE ever left the account.
Here is the narrative I would file on those facts. Names and numbers are placeholders.
This report concerns Customer A Limited, company number 00000000, incorporated 14 February 2021, registered office 1 Example Street, Anytown AT1 1AA, and its sole director and shareholder Mr B, date of birth 3 July 1986, residential address 2 Example Road, Anytown AT2 2BB. Customer A Limited holds business current account 00-00-00 / 00000000, opened 3 March 2021. At onboarding the declared activity was retail sale of food, drink and tobacco from one leased convenience store at 1 Example Street, with expected annual turnover of £240,000, of which about seventy per cent was expected to be cash and thirty per cent card.
Between 8 January 2024 and 28 June 2024 the account received 138 over-the-counter cash deposits totalling £1,214,300. Individual deposits ranged from £7,950 to £9,700, with an average of £8,800. No deposit reached £10,000, the amount at which this bank's branch staff complete an enhanced source-of-funds enquiry. Deposits were made at three branches: Branch X, 61 deposits (18 miles from the trading address); Branch Y, 47 deposits (31 miles); Branch Z, 30 deposits (44 miles). Deposits fell most often on Tuesdays and Fridays between 09:15 and 10:40. On eleven dates, deposits were made at two different branches within the same three-hour window. Card acquiring receipts over the same period totalled £41,600 across 4,180 transactions.
Of the funds credited, ninety-two per cent left the account within forty-eight hours of the deposit. £684,000 was paid in 46 transfers to Wholesale C Limited, company number 11111111, incorporated 2 November 2023, with references \"stock\". £392,500 was sent in 31 international payments to D SRL in [jurisdiction], with references \"goods\". £58,200 was withdrawn in cash from ATMs, in amounts between £200 and £500. No payments were observed for rent, wages, utilities, HMRC PAYE or VAT during the period. The account balance did not exceed £9,300 on any day.
This report is made on the following observations. Annualised, the cash received is about five times the declared turnover, and the cash increase was not preceded by any notification of a change of business. Card receipts represent about three per cent of total credits against a declared model of about thirty per cent, which does not fit a convenience store of the size described. Cash deposits fall consistently within £2,050 of, but always below, the £10,000 enhanced enquiry amount. The use of three branches between 18 and 44 miles from the trading address, including deposits at two branches within the same morning, is not accounted for by the single-site business declared. Onward payments are near-immediate, and the largest recipient was incorporated two months before the first payment to it.
The relationship manager telephoned Mr B on 14 May 2024 and asked about the increase in turnover. Mr B stated that a second, unregistered market stall had been added and that a cousin deposits takings while travelling for work. He did not name the cousin. Supplier invoices, the market pitch licence and the store lease were requested in writing on 21 May 2024 and again on 6 June 2024; nothing has been provided. The account remains open and no restriction has been applied. The customer has not been informed that this report is being made. We hold the onboarding file, six months of statements, a full transaction listing, branch deposit slips and the call note of 14 May 2024, all available on request. Contact: [name, role, direct line, email].
What each paragraph is doing
The first paragraph gives the reader identity and expectation in one place, so that everything after it can be measured against something. The declared turnover in that paragraph is the yardstick for the whole report.
The second is the arithmetic, and it does the work that adjectives cannot. Note that the threshold is stated as a fact about the bank's process, sitting next to the deposit range, and no motive is attached to the proximity. The eleven same-morning dates are there because timing is the detail an intelligence officer can act on.
The third paragraph follows the money out, which is the part analysts most often shorten and the part an FIU most often needs, because counterparties are how one report joins another. The absent payments matter as much as the present ones: a trading business with no rent, wages or tax is a shape, and shapes are reportable.
The fourth is the "why", written as five specific mismatches rather than a conclusion. Any one of them alone would be thin. Together they are a case.
The fifth protects the report and the reader. It records that we asked, what we were told, what we requested, and what remains outstanding — and it tells the FIU the account is live, which affects how quickly they act.
What to keep out
Speculation is the first thing to cut. "The funds may derive from the sale of illicit tobacco" belongs in your internal case notes if you have a reason for thinking it, and even then only with the reason attached. In the narrative, unsupported theories crowd out facts and invite the reader to doubt your judgement generally.
Legal conclusions are the second. Do not write that money was laundered, that an offence was committed, or that the customer structured deposits with intent. Set out amounts, dates, thresholds and gaps. The reader is far better placed than you are to characterise them, and if a case is ever tested, you will be glad you described rather than concluded.
Internal jargon is the third, and it is the easiest to fix. Model names, queue codes, rule identifiers, risk-band labels, the abbreviations your team invented three years ago — none of it survives the journey out of your building. I ask analysts to read a draft imagining the reader has never heard of their employer.
I would add two habits. Do not copy the alert text into the narrative; the alert is a trigger, not an account of events. And do not hedge for comfort. "It is possible that this could potentially indicate" is three cushions stacked on one thin observation. Either the observation stands on its own or it should not be in the paragraph.
The last read
Before I sign anything, I read it aloud. It is a crude test and it works: I hear the vague months, the adjectives without numbers, the sentence where I got tired and stopped being specific. Then I hand it to a colleague who has never seen the case and ask them to tell me back what happened, when, and why we are worried. If they can, the report will travel.
What matters: A narrative works when someone with no access to your systems, your alert or your colleagues can follow the arithmetic and act on it without ringing you.