Connect ► twitter| youtube|  Log In ► Members Only  |  Corporate One Safekeeping  |  Search

Tips on writing Suspicious Activity Report (SAR) narratives

By: Naomi Glass, BSA/AML/OFAC Compliance Manager

June 28, 2017 -- Suspicious activity reporting forms the cornerstone of the Bank Secrecy Act (BSA) reporting system. Credit unions are required to report known or suspected violations of law or suspicious activity by filing Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN). In many instances, SARs have been instrumental in enabling law enforcement to initiate or supplement major money laundering or terrorist financing investigations and other criminal cases.

Missed the live version of our annual BSA/AML training webinar? You’re in luck.

The live dates have passed, but there’s still time to take the on-demand version of our annual BSA/AML and OFAC compliance training webinar with ProBank. Available through September 4.

Credit unions are required to submit SARs that are complete, sufficient and timely. Unfortunately, some credit unions file SARs that contain incomplete, incorrect, and/or disorganized narratives, making further analysis difficult, if not impossible. The failure to adequately describe the factors making the transaction or activity suspicious undermines the very purpose of the SAR and lessens its usefulness to law enforcement. It is essential that credit unions staff write SAR narratives that are clear, concise, and thorough.

Five essential elements of a SAR

Typically, a SAR narrative should identify the five essential elements of information related to the unusual or suspicious activity being reported: Who, what, when, where, and why. The method of operation (or “how”) is also important and should be included in the narrative, as well.

Below are examples of the kinds of details that should be included in a well-written SAR narrative:

  • Who is conducting the criminal or suspicious activity?
    • The narrative should describe details about the suspect(s):
      • Employer and occupation information
      • Relationship between the suspect and the credit union
      • Length of the financial relationship
  • What instruments or mechanisms are being used to facilitate the suspect transaction(s)?
    • The narrative should identify and describe the transactions raising suspicions. For instance:
      • Cash deposits and/or withdrawals
      • Monetary instruments (money orders: cashiers or bank checks)
      • Electronic funds transfers (wires, ACH), share drafts, gift cards, digital currency
  • When did the suspicious activity occur?
    • The narrative should identify the date(s) and duration of the suspicious activity, as well as when credit union detected the activity.
  • Where did the suspicious activity take place?
    • The narrative should indicate the locations associated with the suspicious activity. This might involve the following:
      • Multiple branches or ATMs
      • Other financial institutions
      • Foreign jurisdictions
  • Why does the credit union think the activity is suspicious?
    • The narrative should describe, as fully as possible, why the activity or transaction is unusual for the member. This is KEY in helping law enforcement understand the reasoning for the SAR filing.
  • How did the suspicious activity occur?
    • The narrative should describe the “modus operandi” of the suspect conducting the suspicious activity (i.e. an explanation of the source, movement, and application of funds).

Examples of sufficient and insufficient SAR narratives

In an effort to provide helpful guidance to financial institutions, FinCEN released “Guidance on Preparing A Complete & Sufficient Suspicious Activity Report Narrative” in November 2003. The report has multiple examples of SAR narratives deemed sufficient and complete along with examples of narratives that are anything but.

Let’s take a closer look at two such examples. Can you tell a difference between the two?

Narrative 1:

Credit union investigation file number AA67325. This SAR is being filed to summarize suspicious cash deposits and wire transfer activity conducted by John Doe, account #12345678910. John Doe has been a member since April 2000. Mr. Doe is a college student and employed part-time at Quickie Car Wash. Cash deposits to Mr. Doe’s personal checking account are structured to possibly circumvent federal reporting requirements. The deposits are followed by immediate wire transfers to Aussie Bank in Sydney, Australia to a single beneficiary, Jane Smith, account #981012345, with an address located in Australia. Specifically the following activity has been observed: cash deposits (dates followed by amounts): 03/15/02 16 $9,950.00; 03/17/02 $9,700.00; 03/18/02 $10,000; total: $29,650. Wire transfers out (dates followed by amounts): 03/16/02 $9,900.00, 03/18/02 $9,700.00, 03/19/02 $9,900.00. The volume and frequency of the deposits is not consistent with previous transactions conducted by Mr. Doe. The amounts of currency do not appear consistent with the member’s stated employment. Also, the relationship between the member and Jane Smith, and the purpose for the wire activity is unknown. Therefore, due to the structured cash deposits by the member on almost consecutive days into the account, and the immediate wire transfer of the funds out of the account to Jane Smith, Aussie bank, account #891012345, Sydney Australia, this SAR is being filed. Investigation is continuing. The credit union’s financial intelligence unit in Big City, FL, maintains all records related to this SAR.

This SAR narrative gives a sufficient explanation for the SAR filing in addition to providing an internal credit union file number for law enforcement to reference if it wishes to contact the credit union. Facts presented in this narrative clearly support the purpose of the SAR filing. The narrative includes information on disposition on further actions by the financial institution and identifies the availability and location of documentation supporting the SAR.

Narrative 2:

John Doe was the originator of nine wires totaling $225,000. All of the wires were remitted to a Dubai based company. During the same period of time John Doe deposited cash, money orders, and checks into his account.

This SAR narrative fails to provide specific details on the application of the suspect funds (the name, financial institution, and account number of the beneficiary, if identifiable). The credit union also fails to provide any information concerning the relationship, if any, between the credit union and the member. In addition, no specific transaction data is provided that identifies the dates and amounts of each wire transfer.

Balancing the art and the science of writing SARs

Ultimately, SAR narrative writing can be both an art form and a science. It is important to be mindful that SAR narratives are written for law enforcement to assist them in combatting money laundering, terrorist financing, and other financial crimes. So to those credit union employees tasked with writing SAR narratives, I have three, brief parting reminders:

  • Be thorough. Remember the five essential elements of who, what, when, where, and why. (And throw in the “how,” also, if it’s relevant.)
  • Make it accurate. Keep the information factual, clear and concise.
  • Make it timely. Don’t wait too long to file your SAR.