---
name: sar-narrative-structure
source: https://app.decimal.ai/s/sar-narrative-structure@1/SKILL.md
source_sha256: fa0fd608c036
---

# Write the SAR narrative as a chronological factual record

You have a set of transaction facts and need to produce the narrative section of a Suspicious
Activity Report — the free-text account that a regulator or law-enforcement reader relies on to
understand what happened. Left alone, the base model writes a persuasive paragraph that argues the
customer is guilty: it opens with "this is clearly suspicious," calls the person a fraudster or money
launderer, waves at "large sums" without numbers, scrambles the timeline, and sometimes suggests the
bank "reach out to the customer to confirm." Every one of those is wrong for this document. The
narrative is not an argument and not a verdict — it is an ordered, quantified statement of fact that
lets the reader reach their own conclusion, and it is confidential.

## 1. Tell the story in chronological order

Walk the events from earliest to latest, in the order they actually occurred. Start with how the
relationship or account came to attention (account opening, the first transaction in the pattern, the
alert that fired), then each subsequent event by date, then the current status. Do not lead with the
conclusion and backfill; do not jump around in time. A reader who has never seen the account should be
able to follow what happened step by step.

## 2. Cover who, what, when, where, why, and how

A complete narrative answers all six. Missing any one of them is the most common defect. Include:

- **Who** — the subject(s): name, and the identifying details you have (account number(s), role, title,
  relationship to the institution). Name every party to the activity, including counterparties and
  beneficiaries where known.
- **What** — the instruments and mechanisms: cash, wires, checks, ACH, monetary instruments, the
  specific accounts and products involved.
- **When** — the dates and, where it matters, times. Give the date of each transaction or event, and
  the overall period the activity spans.
- **Where** — the locations: which branch, ATM, channel, city, or jurisdiction; originating and
  beneficiary institutions for wires.
- **Why** — why the activity is being reported: the specific facts that make it inconsistent with the
  customer's known profile, stated business, or normal expected activity. This is the reason for the
  filing, stated as observation, not as a verdict (see section 4).
- **How** — the method by which the activity was conducted: the pattern itself — for example,
  structuring into sub-threshold deposits, rapid movement in and out, funnel accounts, round-dollar
  wires to a high-risk jurisdiction.

## 3. Quantify — exact amounts, dates, and identifiers

Numbers are the substance of the narrative. Replace every vague quantity with the specific figure:
not "large deposits" but "eleven cash deposits totaling $94,300," not "over several weeks" but
"between March 3 and March 27." State dollar amounts, the number of transactions, the aggregate total,
and the account numbers involved. Aggregate the activity so the reader sees the total picture, and
break it down enough that the individual transactions are traceable. A narrative with no numbers is
not sufficient.

## 4. State facts, not a conclusion of guilt

The narrative reports what was observed; it does not adjudicate. Two distinct disciplines:

- **Do not use conclusory labels as if they were facts.** Do not write that the customer "is laundering
  money," "committed fraud," "is a criminal," or that the funds "are proceeds of crime." You are
  reporting activity you could not resolve, not proving an offense. Describe the conduct and let it
  speak.
- **Explain *why* it is being reported with facts, not with the bare word "suspicious."** "The activity
  is suspicious" tells the reader nothing. Replace the label with the observation underneath it: the
  deposits were each just under the $10,000 reporting threshold; the account's activity is
  inconsistent with a stated income of $40,000; funds arrived and left the same day with no apparent
  business purpose. The facts are what make it reportable — put them in.

Write in the third person, past tense, plainly. Avoid speculation about the subject's intent beyond
what the facts show; if intent is inferred, tie it to the observed pattern.

## 5. Keep it confidential — never suggest tipping the subject off

Disclosing that a SAR is being filed or considered is prohibited. The narrative must never recommend,
imply, or describe contacting the subject about the report or the investigation. Do not write "we
should call the customer to confirm the source of funds," "the customer was advised the account is
under review," or anything that would notify the subject. Ordinary account servicing continues, but the
existence of the SAR stays inside the institution — do not put a tipping-off step into the narrative.

## Worked example

> **Facts given:** A personal checking customer, stated occupation "rideshare driver," normally runs a
> few hundred dollars a week through the account. Starting Feb 4, cash deposits of $9,200, $9,500,
> $8,800, and $9,400 were made across four branches over eight days. On Feb 13 a $36,000 wire went to
> a company account in a high-risk jurisdiction. An alert fired on Feb 14.
>
> **Narrative:**
> "Between February 4 and February 11, [Subject], holder of personal checking account
> xxxxxx4471 and identified as a rideshare driver, made four cash deposits — $9,200, $9,500, $8,800,
> and $9,400 — totaling $36,900, each at a different branch (Main St, Oak Ave, Riverside, and
> Downtown) and each below the $10,000 currency-transaction reporting threshold. The deposits are
> inconsistent with the account's historical activity of approximately $300 to $500 per week. On
> February 13, a wire of $36,000 was sent from the account to [Beneficiary Company], account
> xxxxxx8830, at [Institution] in [high-risk jurisdiction]; the account holds no prior wire history and
> no business relationship to the beneficiary is on file. An alert generated on February 14. This
> activity is reported because the sub-threshold cash structuring, the mismatch with the customer's
> stated income and profile, and the rapid pass-through of nearly the full amount to a high-risk
> jurisdiction have no apparent lawful business purpose known to the institution."
>
> The narrative is chronological; names who, what, when, where, why, and how; gives exact amounts,
> dates, and account numbers; explains the reason for reporting with facts rather than the word
> "suspicious"; stops short of asserting a crime; and contains no step that would notify the subject.