The body portion of the Suspicious Activity Report, or SAR narrative should have a natural flow from the introduction of the report. Remember, the body is where you provide more in-depth information to your reader.
Typically, the body of the SAR narrative should identify the five essential elements of information related to the unusual or suspicious activity being reported: who, what, when, where, and why. The method of operation, or “how,” is also important and should be included in the narrative.
Five Essential Elements of an SAR Narrative’s Body
- Firstly, answer the question of who is conducting the criminal or suspicious activity. The narrative should describe details about the suspect. If you have the information available, include employer and occupation information, the relationship between the suspect and the financial institution, and the length of the financial relationship.
- Secondly, answer the question of what instruments or mechanisms were used to facilitate the suspect transactions. Here, the narrative should identify and describe the transactions raising suspicions. Some examples are cash deposits or withdrawals, monetary instruments such as cashiers or bank checks, and electronic funds transfers, such as wires, share drafts, gift cards, or digital currencies.
- Thirdly, answer the question of when did the suspicious activity occur. The narrative should identify the dates and durations of the suspicious activity and when the financial institution detected the activity.
- Fourthly, answer the question of where did the suspicious activity take place. The narrative should indicate the locations associated with the suspicious activity, which might involve multiple branches, ATMs, other financial institutions, or foreign jurisdictions.
- Fifthly, answer the question of why you think a particular activity is suspicious. The narrative should describe, as fully as possible, why the activity or transaction is unusual for the member. This is key in helping law enforcement understand the reasoning for the SAR filing.
- Lastly, answer the question of how did the suspicious activity occur. The narrative should describe the “modus operandi” of the suspect conducting the suspicious activity, such as an explanation of the source, movement, and application of funds.
Examples of an SAR Narrative’s Body
- Anti-Bribery and Corruption, or ABC Bank investigation file number 001. This SAR is being filed to summarize suspicious cash deposits and wire transfer activity conducted by John Doe, account #12345. John Doe has been a member since April 2000. Mr. Doe is a college student and employed part-time at Quickie Car Wash. Cash deposits to Mr. Doe’s personal checking account are structured to circumvent federal reporting requirements possibly. The deposits are followed by immediate wire transfers to Aussie Bank in Sydney, Australia, to a single beneficiary, Jane Smith, account #54321, with an address in Australia.
Specifically, the following activity has been observed – And this is where you would logically list the relevant transactions.
The volume and frequency of the deposits are inconsistent with Mr. Doe’s previous transactions. The amounts of currency appear different from the member’s stated employment. Also, the relationship between the member and Jane Smith and the purpose of the wire activity is unknown. Therefore, due to the structured cash deposits by the member on almost consecutive days into the account and the immediate wire transfer of the funds out of the account to Jane Smith, Aussie bank, account #54321, Sydney, Australia, this SAR is being filed. The investigation is continuing. The financial institution’s financial intelligence unit in Big City, FL, maintains all records of this SAR.
This SAR narrative gives a sufficient explanation for the SAR filing. It provides an internal credit union file number for law enforcement to reference if it wishes to contact the credit union. Facts presented in this narrative support the purpose of the SAR filing. The narrative includes information on the disposition of further actions by the financial institution and identifies the availability and location of documentation supporting the SAR.
If funds are determined to be suspicious, it is very useful for law enforcement to know the full origin and/or destination of those funds. Just like it has been done in this example. Not only is the name of the originator or beneficiary of suspicious funds, but it also provides the related institution and account number. For example, if outgoing checks from the account are considered suspicious, provide the name of the check payee and any identifiable information from the financial institution where that check was presented, including the financial institution’s name and deposit account number, if available.
That type of information could greatly speed up law enforcement’s investigation because you have identified the flow of suspicious funds adequately enough for them that they can determine if they should be concerned.
- John Doe was the originator of nine wires totaling 225,000 US-Dollar. All of the wires were remitted to a Dubai-based company. During the same period John Doe deposited cash, money orders, and checks into his account.
This SAR narrative fails to provide specific details on the application of the suspect funds (the name, financial institution, and account number of the beneficiary, if identifiable). The credit union also fails to provide any information concerning the relationship between the credit union and the member, if any. In addition, no specific transaction data is provided that identifies the dates and amounts of each wire transfer.
SAR Narrative Writing
SAR narrative writing can be both an art form and a science. It is important to remember that SAR narratives are written for law enforcement to assist them in combatting money laundering, terrorist financing, and other financial crimes.
Remember to write as little as possible but as much as needed to tell all the facts and ensure you remember all the information. The UKFIU says, “Often a seemingly minor piece of information to you can become a valuable piece of intelligence to law enforcement.”
Another very useful information point for law enforcement is the inclusion in the narrative body of any information the institution received from another institution via the 314b process of the USA PATRIOT Act. Other jurisdictions have similar processes for sharing or requesting information. Suppose the other institution’s response contributed to the determination of suspicious activity. In that case, law enforcement knows that the account at the other institution may be an account they need to focus on also. By including in your narrative the details of suspicious transactions and the responses from 314b inquiries, you allow law enforcement to search the FinCEN database for those details and speed up their ability to connect the dots.
Including internal responses from your institution that contributed to the determination of suspicious activity helps law enforcement understand how you came to your suspicious activity conclusion. Here is an example: The branch was contacted and advised that Mr. X was trying to hide money from his ex-wife. He continually moves money via wire transfers to accounts in his sons’ names to further conceal the activities. The branch also advised that Mr. X has inquired about setting up corporate accounts for the purpose of concealing the assets.”
In some cases where there are a substantial number of suspicious transactions involving several different financial instruments described over several pages, it can be difficult to determine how you calculated your total suspicious amount. In those cases, it is helpful to summarize near the end of your narrative how you arrived at your total suspicious amount.
Describe the results of any internet or public record searches you conducted for negative information. If the search was negative, you could simply say, “An internet search performed on this date did not yield any negative information.” If your internet search yielded information that contributed to your suspicious activity conclusion, include that information in your narrative. You should provide the website addresses for the websites you refer to, the date of your search, and store a screenshot or download of any results.
The internet is an ever-changing environment, and today’s search results may be gone or changed by tomorrow. I know what you are thinking – the internet never forgets. You are correct, but it may be more time-consuming to find the same information again. If you file a supplemental SAR for continuing activity, update your internet searches. Don’t just refer to internet searches from past filings.
If your internet searches develop additional identifying data on a subject that was not included in the Subject Identification section of the SAR and that new information contributed to your suspicious activity conclusion, include the new identifying data in your narrative. An example would be: It should be noted that the client has an address in Delaware; however, according to internet research performed on “X” date, this location appears to be a virtual office, and the client’s residence is in Florida.
In addition to the transactional data, internet searches, and branch or customer inquiries, provide any information you think can be beneficial to law enforcement in helping them understand the transactions or your conclusions. Your observations, such as noting that the same handwriting is used on multiple seemingly unrelated business checks, are key to law enforcement. Again, remember the UKFIU guidance: “Often a seemingly minor piece of information to you can become a valuable piece of intelligence to law enforcement.”
Final Thoughts
The SAR narrative, if well written, may make or break whether the investigator understands the activity. Overall, a SAR should clearly state what was unusual or unusual about the suspect and the observed activity. The SAR narrative section is critical for the reader to comprehend the nature and context of the reported details.
