CAMP · Certified Anti Money Laundering Professional

SAR Narrative Writing Guide: How to Write a SAR / STR, Step by Step

A SAR narrative writing guide for AML investigators: how to write a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) that a Financial Intelligence Unit can actually act on — the five elements every strong narrative covers, common mistakes, and a structural template.

By , Riskpro Learning Published Last updated

Part of a Live, Graded Simulation

This reference sits alongside Riskpro's CAMP (Certified Anti Money Laundering Professional) simulation — a live, graded case-management exercise where you triage and investigate realistic AML alerts exactly as an L1 analyst or L2 investigator would on a real compliance desk. Every case pulls its own customer profile, transaction ledger and red flags, and every decision you make, including how you write up your rationale, is scored against a deterministic rubric, with a Director and Investigation Lead guiding you through the programme. It's the practical counterpart to this reference: read the theory here, then apply it against real alerts inside the simulation.

Register for CAMP →

What a SAR/STR Is For

A Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) is not an accusation and does not require proof of a crime. It exists to give a Financial Intelligence Unit (FIU) the specific facts it needs to decide whether a customer, account or pattern of activity is worth further investigation. The legal bar in most jurisdictions is "reasonable grounds to suspect" — a level well below certainty or even a balance-of-probabilities standard, but it still has to be grounded in concrete, articulable facts rather than a vague feeling that something is "off."

Because a SAR/STR is read by an analyst who has never seen this customer or this alert before, the filing has to do all of the explaining on its own. A narrative that assumes the reader already knows the context — or that leaves the reader to infer why something is suspicious — has failed at its one job, no matter how much good investigative work sits behind it.

SAR vs. STR vs. CTR: Getting the Terminology Right

The terms overlap enough to cause real confusion for new analysts, so it's worth separating them clearly. A Suspicious Activity Report (SAR) and a Suspicious Transaction Report (STR) serve the same underlying purpose — flagging activity that appears inconsistent with a customer's known, legitimate profile — but the two terms come from different regulatory traditions: SAR is the term used in the United States and a number of other jurisdictions, while STR is more common in the UK, much of Europe, and large parts of Asia and the Middle East. For the purposes of this guide, and inside the CAMP simulation, the two terms are treated as functionally interchangeable — the writing discipline is the same either way.

A Currency Transaction Report (CTR), by contrast, is a different instrument entirely. A CTR is typically a mandatory, threshold-triggered filing — for example, any single cash transaction above a fixed amount — filed regardless of whether the institution suspects anything wrong. A SAR/STR, by comparison, is a judgment call: it is filed because an analyst has formed a suspicion, not because a transaction crossed a numeric line. Structuring — deliberately breaking a transaction into smaller pieces specifically to stay under a CTR threshold — is itself one of the most common reasons a SAR/STR gets filed, which is why the two instruments are so often discussed together.
New analysts often over-think the evidentiary bar, either filing too cautiously (waiting for something close to proof) or too loosely (filing on a hunch with nothing concrete behind it). "Reasonable grounds to suspect" sits deliberately between those two extremes. It means a reasonable, appropriately trained analyst — looking at the same facts you have — would also conclude that something here doesn't add up, given what the customer says they do and what the activity actually shows.

In practice, this means two things for how you write. First, you don't need to identify which specific crime occurred, or prove intent — you need to show a deviation from expected behaviour that has no innocent explanation you can point to in the file. Second, you do need more than an unease or a pattern-matched red flag on its own; a rule firing is a starting point for investigation, not a substitute for it. The narrative should show the reader the reasoning that took you from "a rule fired" to "I have reasonable grounds to suspect," not just assert the conclusion.

The Five Elements Every Strong Narrative Covers

Almost every weak SAR/STR narrative is missing one of five things. Training yourself to check for all five, every time, is the single highest-leverage habit an investigator can build.

Who: the subject(s) of the report — name, account or customer identifiers, and their relationship to the activity (account holder, beneficial owner, authorized signatory, counterparty).

What: the specific transactions under review — dates, amounts, currencies, transaction types, and the channel used (cash, wire, card, correspondent banking, virtual asset, etc.).

Why suspicious: which red flag(s) fired, and — critically — why they don't fit this customer's declared profile. A red flag without this explanation is just an observation.

How it was investigated: what evidence you actually reviewed — RFI responses, sanctions/PEP screening results, supporting documentation, prior account history — and, honestly, what each piece showed, whether or not it supported your conclusion.

Conclusion: a closing statement that ties the facts together and states the suspicion plainly, using language such as "there are reasonable grounds to suspect that..." followed by the specific typology or activity you believe is occurring.

Be Specific, Not Just Descriptive

The single most common weakness in a first-draft narrative is staying too general. "The customer made several large transactions that seemed suspicious" tells the FIU nothing they can act on — it isn't falsifiable, it isn't searchable, and it gives an analyst on the receiving end no starting point. Compare that to: "Between 3 and 14 March 2026, the customer made six cash deposits ranging from $9,100 to $9,800, each below the $10,000 reporting threshold, across three different branches." The second version gives a reader dates, amounts, a pattern, and an inference (structuring) they can immediately act on.

Always pull real amounts, real dates, real counterparties, and real account or reference numbers directly from the case evidence — never approximate, round for convenience, or reconstruct from memory. If you find yourself writing "approximately" or "around" more than once in a narrative, that's usually a sign you need to go back to the transaction ledger rather than the summary you skimmed.

Explain the Deviation From the Customer's Profile

A transaction is not suspicious in a vacuum — it's suspicious relative to what would reasonably be expected of this specific customer. A $200,000 wire transfer is unremarkable for an active import/export business and highly unusual for a customer declared as an unemployed student. The narrative has to make that comparison explicit: state the customer's declared occupation, income band, stated source of funds or business purpose, and then directly contrast it with the observed activity.

This single move — stating the expectation, then showing how the activity departs from it — is what turns a list of facts into an actual, defensible case for suspicion. Skipping it is why some narratives read as "here is a list of transactions" rather than "here is why these transactions are suspicious for this customer."

Writing Up Structuring and Smurfing

Structuring narratives live or die on the pattern, so lead with it: list every relevant transaction with its date, amount and channel, in chronological order, and let the reader see the threshold-avoidance pattern for themselves before you name it. State the reporting threshold you believe is being evaded and show the sub-threshold cushion (e.g. consistently $150–$900 under the limit) — a pattern that hugs just under a threshold is far more probative than one that happens to fall under it once. If multiple branches, tellers, or channels were used to spread the activity (a classic "smurfing" pattern), name each one explicitly; this detail is often what distinguishes deliberate evasion from coincidence in the reader's mind.

Writing Up Layering and Rapid Movement of Funds

Layering is about obscuring the origin of funds through a chain of transfers, so the narrative needs to reconstruct that chain, not just describe its endpoints. Trace the funds step by step — where they entered the account, where they moved to next, and how quickly — and call out short "dwell time" explicitly (e.g. "funds received on 4 April were transferred out in full within six hours"). Note any pattern of pass-through activity where incoming and outgoing amounts closely match, since that is often the clearest evidence that an account is being used as a conduit rather than for its stated purpose. If the destination account or institution is in a jurisdiction with weak beneficial-ownership transparency, say so, since that context matters to the reader assessing traceability.

Writing Up Trade-Based Money Laundering (TBML)

TBML narratives are frequently the weakest in a new analyst's portfolio because the suspicious element is a discrepancy, not a transaction amount on its own. Anchor the narrative in the specific mismatch: an invoiced value that diverges materially from a reasonable market price for the goods described (over- or under-invoicing), a declared quantity or description that doesn't match shipping or customs documentation, or payment terms that are inconsistent with the type of goods or the relationship between the parties. Name the counterparty jurisdictions involved, since certain trade corridors carry materially higher TBML risk, and note whether the goods themselves (high-value, easily re-exportable, or dual-use items) raise the risk profile independently of the pricing discrepancy.

Writing Up Shell Companies and Beneficial Ownership Concerns

When the suspicion centers on a shell or front company, the narrative should state plainly what makes the entity look hollow: no verifiable physical operating presence, no employees consistent with the stated business, a registered address shared with numerous unrelated entities, or financial activity with no correlation to the entity's stated business purpose. If the ultimate beneficial owner (UBO) is undisclosed, layered behind nominee structures, or inconsistent across the documentation on file, say so directly and cite the specific documents reviewed. A shell-company narrative is strongest when it shows the gap between what the entity claims to be and what its transaction activity actually looks like.

Writing Up PEP, Sanctions and Adverse Media Concerns

For politically exposed person (PEP) and sanctions-adjacent narratives, precision protects both the filing and the customer. State the specific PEP status or sanctions/watchlist match, including the screening source and match strength, and note whether the customer's PEP status or close association was disclosed at onboarding or discovered afterward — an undisclosed PEP relationship is itself a red flag worth stating explicitly. Where the concern is adverse media, cite what was found in enough detail to be useful (the nature of the allegation, its recency, its credibility) without overstating a mere allegation as an established fact. Tie any of these findings back to the transaction activity under review — a PEP flag alone is a due-diligence issue; a PEP flag combined with activity inconsistent with the customer's declared profile is what elevates it to a SAR/STR-worthy suspicion.

Sourcing Your Facts: What to Pull From the Case File

A strong narrative is assembled, not composed from memory. Before you start writing, go back to the primary sources in the case file: the transaction ledger (for exact dates, amounts and counterparties), the customer's KYC/onboarding record (for declared occupation, income, source of funds and stated business purpose), any RFI responses on file (for what the customer or relationship manager actually said, including partial or unsatisfactory answers), and screening results (for PEP, sanctions and adverse media hits). Every specific fact in your narrative should be traceable back to one of these sources — if you can't point to where a detail came from, it doesn't belong in the filing. This is also why narratives written immediately after reviewing the case are consistently stronger than ones written from a summary or from memory hours later.

Confidentiality and the Tipping-Off Prohibition

In most jurisdictions, it is a serious compliance and legal breach to disclose to a customer — directly or indirectly — that a SAR/STR has been or is being filed on their activity. This is usually called the "tipping-off" prohibition, and it exists because advance warning lets a genuinely suspicious customer move funds, destroy records, or otherwise defeat the purpose of the report before an FIU can act. In practice this affects how you conduct any further inquiries: a Request for Information sent to a customer should be framed as routine due diligence, never as "we are filing a report on you," and internal discussion of a pending or filed SAR/STR should be limited to those with a genuine need to know, consistent with your institution's escalation and reporting policy. This guide describes the general principle only — the specific rules, exceptions and penalties vary by jurisdiction, so always follow your own institution's policy and your local regulatory requirements rather than relying on general training material for a live decision.

Common Mistakes to Avoid

Do not speculate about the underlying crime beyond what the evidence actually supports — describe the pattern you observed, not a theory of guilt you can't substantiate. Do not include your personal opinion of the customer's character, background, or credibility; stick to the activity and the facts. Do not omit evidence that doesn't support your conclusion — for example, a partially satisfactory RFI response — because a narrative that only shows one side of the picture is a weaker, less credible filing, and omitting contrary evidence can itself become a problem later. Do not use vague filler phrases ("this seems odd," "something is not right," "felt suspicious") in place of a specific, evidenced claim — every sentence should be doing factual work. And do not bury the conclusion: a reader should never have to guess, at the end of your narrative, what you actually believe is happening.

A Pre-Filing Quality Checklist

Before you consider a narrative finished, run it against this list. Does it name the subject(s) and their relationship to the account? Does it list specific dates, amounts, and transaction types rather than generalities? Does it name the red flag(s) and explain why they don't fit this customer's profile? Does it state what was investigated (RFI, screening, documentation) and what each step actually found, including anything inconclusive? Does it explicitly compare the activity to the customer's declared profile? Does it end with a clear, specific statement of what is suspected, in language a reader outside your institution can act on without needing to ask you a follow-up question? If any answer is no, the narrative isn't ready yet — send it back to the file, not to the FIU.

Timeliness: Why When You File Matters

A SAR/STR loses much of its value the longer it sits unfiled — funds move, accounts close, and the window in which an FIU can meaningfully act on the information narrows every day. Most institutions set internal escalation timeframes precisely because "I was still gathering more evidence" is rarely a good reason to delay a filing once reasonable grounds to suspect already exist; additional investigation can continue after filing, and many jurisdictions expressly allow supplementary or follow-up reports. Treat the moment you can honestly write a complete five-element narrative as the moment to file, not the moment you've exhausted every possible avenue of inquiry.

The Narrative Lab: Where You Practise This For Real

Everything above is the theory. The Narrative Lab is where you actually apply it: a dedicated writing exercise inside the CAMP simulation, separate from the L1 triage and L2 investigation case queues, built specifically to drill the five-element narrative structure this guide teaches until it's automatic.

It unlocks at L3 — reached once you've cleared L2 mastery (the accuracy threshold and minimum case count your administrator has configured) — because by that point you've already handled enough real alerts to have facts worth writing up well; the Narrative Lab tests the write-up itself, not whether you can still spot a red flag.

Each Narrative Lab scenario gives you a case briefing — a customer profile and a specific pattern of activity (structuring, trade-based money laundering, a money-mule pass-through, a PEP-linked transfer, and more) drawn directly from realistic AML typologies. You write your own SAR/STR narrative for it in free text, exactly as you would for a live case.

Your narrative is then auto-graded against a deterministic, rule-based rubric — not a subjective read, and not an external AI call, but a transparent, reproducible check for the specific things a strong narrative always contains: the exact amounts, dates, names and locations from the briefing (so you can't pass by writing vaguely around the facts you were actually given), the relevant typology language for that pattern (structuring, layering, over-invoicing, and so on), and a minimum length that rules out a narrative too thin to cover all five elements. Because grading only ever checks facts present in the briefing itself, you're never marked down for something you had no way of knowing — the rubric is checking your writing discipline, not testing your memory of outside material.

The practical effect: by the time you write a SAR/STR narrative that actually matters, the five-element structure and the specific-facts-over-generalities habit from this guide aren't something you're consciously assembling anymore — they're just how you write one.

A Simple Structural Template

1. Subject and account identification — who, and their relationship to the activity.
2. Summary of the activity under review — dates, amounts, transaction types, channels.
3. Red flags identified, each tied to specific facts from the case.
4. Investigative steps taken (RFI, screening, documentation review) and what they showed, including anything that didn't support the conclusion.
5. How the activity deviates from the customer's declared profile — the expectation, stated plainly, next to what actually happened.
6. Closing statement: reasonable grounds to suspect, and what specifically is suspected (e.g. structuring, layering, TBML, sanctions evasion).

This is the same structure the CAMP simulation's Narrative Lab grades every case write-up against — practising it here, on realistic alerts with real evidence to draw from, is what makes it automatic by the time you're writing one for real.

Frequently Asked Questions About SAR/STR Writing

What is the difference between a SAR and an STR?
They serve the same purpose — reporting activity an institution has reasonable grounds to suspect is linked to money laundering or terrorist financing — under different regional terminology. SAR (Suspicious Activity Report) is the term used in the United States and several other jurisdictions; STR (Suspicious Transaction Report) is more common across the UK, Europe, and much of Asia and the Middle East. The writing discipline described in this guide applies equally to both.
Do I need proof of a crime before filing a SAR/STR?
No. The standard in most jurisdictions is "reasonable grounds to suspect," which is well below the standard of proof required to establish a crime. You need concrete, articulable facts that would lead a reasonable, trained analyst to the same suspicion — not certainty, and not a theory of exactly which offence occurred.
What happens if I file a SAR/STR and it turns out the activity was legitimate?
Filing in good faith, on reasonable grounds, based on the evidence available at the time, is exactly what the framework is designed for — most SARs/STRs do not result in a confirmed finding of criminal activity, and that is expected. This is a key reason the "reasonable grounds to suspect" standard exists: it allows institutions to report genuinely unusual activity without needing certainty first.
Can I tell the customer that I am filing, or have filed, a SAR/STR on their account?
In most jurisdictions this is prohibited under "tipping-off" rules and can carry serious legal and regulatory consequences. Any further inquiries, such as a Request for Information, should be framed as routine due diligence rather than referencing a report. Always follow your own institution's policy and local law for the specifics.
How long should a SAR/STR narrative be?
There is no fixed word count — the right length is however long it takes to cover all five elements (who, what, why suspicious, how it was investigated, and the conclusion) with specific, sourced facts. A narrative that is long because it is vague is worse than a shorter one that is specific; padding does not substitute for detail.
What is the single most common mistake in a first-draft SAR/STR?
Staying too general — describing that "several large or unusual transactions occurred" instead of naming the specific dates, amounts, counterparties and pattern, and explaining exactly why they don't fit the customer's declared profile. A narrative should give the reader something they can act on, not just a summary of a feeling.
What is the Narrative Lab in the CAMP programme?
It's a dedicated SAR/STR writing exercise inside the CAMP simulation, unlocked at L3 once you've reached L2 mastery. You write a full narrative for a realistic case briefing and get it auto-graded against a deterministic rubric that checks for the specific facts, typology language, and minimum depth a strong narrative needs — the practical counterpart to the writing discipline this guide teaches.

This reference is part of CAMP by Risk Academy — the Certified Anti Money Laundering Professional programme, which pairs it with a live, graded alert-investigation simulation for L1 and L2 AML analysts.

Register for CAMP →