Be a Crime Fighter By Writing Compelling Suspicious Activity Reports


One of the critical tools law enforcement has in combatting financial crime is the Suspicious Activity Report (SAR). A SAR itself is not direct evidence that a crime has occurred; it is a report that indicates criminal activity may have occurred. SARs are extremely confidential and unauthorized individuals do not have access or should not have knowledge that one has been filed. However, as the single point of filing, FinCEN shares information with law enforcement analysts who review SARs and then disseminate useful information to national and local law enforcement task forces. These task forces or agencies then evaluate whether the event(s) is elevated to a level that warrants further investigation.

Use by law enforcement

If you remember that SAR filings are written reports of exploitable leads for development and its details are the most important lead, no detail is too small for inclusion in the SAR. Law enforcement looks at common themes such as: name, times, events, amounts, or dates. In addition, they will look at frequency, type of instruments used (cash, wires, etc.), and if local law enforcement agencies were notified. All parties involved are reviewed, despite lack of complete identifying information, because these individuals could be useful if subpoenas are issued, or the scope of the investigation widens. Law enforcement also aggregates new SARs with ongoing investigations including the same subjects.

Your responsibility

As a BSA or Compliance Officer, you are required to properly monitor activity that is alerted as potentially criminal. Your internal controls and detection programs should be sufficiently designed to detect and then alert you to suspicious events. These alerts should be based on actionable data. Many analysts choose to defensively file SARs but bear in mind, quality is more important than quantity. Fine-tune your alert system so that your false alerts are minimized, and your credible alerts are maximized. There is analysis involved with this. Consider talking to your third-party software provider for tips on how to analyze and test your alerts.

Time sensitive

Timely filing of SARs is critical because the more time that has passed between the event and law enforcement’s review, the more likely the trail could go cold. A financial institution is required to file a suspicious activity report no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a suspicious activity report (this is not necessarily the date of the activity; it is the date you determine the facts warrant filing). If no suspect was identified on the date of detection of the incident requiring the filing, a financial institution may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect. In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

Critical value of the narrative

The body of the SAR contains the basic information of who participated in the activity, where it occurred, and what occurred. It also provides contact information. However, the meat of the information is in the narrative. That is the data mine where investigators sift to hit criminal gold. Therefore, it is critical that sufficient and detailed information be reported so that the report is useful and effective.

Detailed, but concise

Paint a complete picture to intrigue law enforcement. You have one or two sentences to capture their attention. If your narrative does not quickly paint a compelling story of why it is worth their time to review further, it is likely to get pushed aside, never to be looked at again. Spend time crafting a story that tells law enforcement what they need to know. Remember, an unread narrative is a wasted narrative.

Include key words: SARs are subject to sorting algorithms that look for specific key words, zip codes, names, amounts, type of activity, etc. Be sure to slip these into your narratives so that you can be sure your SAR gets seen. While we are on this subject, it might even be helpful to paste your narrative into a Word document and run spell check just to make sure you have not misspelled a word, especially if you have included key words, which are likely to get missed if they are misspelled. The other benefit of this is you do not have to worry about losing the information if the site times out or if you inadvertently leave the site.

Go back to your school writing days. Include the “5 Ws” and even the “How” if it is applicable or known! These include:

  1. Who conducted the activity and who were all the participants?
  2. What type of instruments were used, such as cash, check, wire, ACH, cryptocurrency, etc.?
  3. Where did the transactions take place?
  4. When did the activity occur? Include the times of day and when you detected the activity.
  5. Why do you believe the activity is suspicious?
  6. How was the activity conducted? Including the subject’s normal types of behavior.

Detail the transactions: Include the transactions and list the dates, types, amounts, and known address locations for branches or ATMs. Including this information helps build a picture of how the suspect operates and why the activity may be suspicious. Consider if the subject is visiting multiple branches or ATM locations across the country, or even across the city.

Use an attachment if there are multiple transactions. The SAR form allows the use of an Excel attachment if the transactions are too numerous to list out. Do not be afraid to use the attachment for your benefit and to make sorting the details easier.

Ineffective vs. effective

To help create a clearer understanding of what is considered an effective narrative and what is not, we have included two sets of example narratives for you to compare. The first narrative of each example is an ineffective account of the events leading to the filing. Unfortunately, we see this quite frequently when we visit our credit union clients. The second narrative is more useful for law enforcement. Disclaimer: These narratives are not actual filings and do not contain actual events or persons; however, they represent narratives we typically see. Any similarities are purely coincidence.

Example 1:

This narrative was written to report a member who was structuring cash deposits.

Ineffective Narrative:

The member structured 3 cash deposits. He visited our Main St and State St branches once a week to deposit $9,000 in cash. This is unusual for him, so we are filing a SAR.

More Effective Narrative:

John Smith is suspected of structuring $27,000 in cash over the period of 3 weeks. Each week, he deposited $9,000 in currency in $50 denominations. During interaction with branch staff, Mr. Smith was hesitant to discuss the source of the cash but eventually indicated he saved the funds. The cash had a mildew smell and was slightly damp at the times of the deposits.

He conducted the following deposits:
$9,000 on 2/11/2021 at the Main Street Branch
$9,000 on 2/18/2021 at the State Street Branch
$9,000 on 2/25/2021 at the State Street Branch

The branch locations have been provided in Part III.

This activity is unusual for Mr. Smith because he is a teacher for Columbus City schools and has never conducted more than $3,500 in cash in a 90-day period in the previous 24 months. Additionally, the condition of the cash at the times of the deposits is unusual.

The activity was detected on March 3, 2021, and the determination to file this SAR for structured cash deposits was made on March 10, 2021. The member will be reviewed in 90 days to determine if further SAR reporting is required.

Example 2:

This set of narratives was written to report a member who was the victim of a romance scam.

Ineffective Narrative:

The member was convinced to send transfers to an individual she met online who she believes is her boyfriend. She sent 102 transfers totaling $38,000 to other countries over the last 2 months. This is unusual since she has not sent transfers like this before. We closed the account.

More Effective Narrative:

Our member, Ida Member, is believed to be the victim of a romance scam. Ms. Jones’ account number is 123, her address is 456 Lonely Hearts Road, her social security number is 123-45-6789, and her date of birth is January 1, 1950.

Ms. Member met an individual named John Stranger on a website called and began an online relationship 3 months ago. Beginning on April 3, 2021, she started sending small transfers internationally via PayPal. Her transfers were sent to several countries, including Taiwan, Nigeria, Vietnam, Romania, and Chile. These funds were from her retirement disbursements. All the funds were sent to the same business in each of these locations. The beneficiary who received the funds is MadeUp, LLC. These transactions are detailed in the SAR attachment titled 2021-Case 012.

Ms. Member is a retired widow who is 67 years old. She previously had not used PayPal for her transfers, and she typically uses checks to pay her bills and send money to her family. She alerted the credit union to the scam on May 28, 2021, when she had paid for Mr. Stranger to travel to meet her, and he never arrived at the airport as she had expected him to. She also filed police report 2021-JRF1283RP97 with the Cleveland City Police. The credit union closed her account immediately and opened a new account to ensure further access to her account would not cause additional losses. The determination to file this SAR was made on May 28, 2021. The member will be reviewed in 90 days to determine if further SAR filing is required.

As you can see, the second narrative of each example provides detailed information that would be much more useful than the first set. By reading the second narrative, law enforcement has a clearer picture of what happened and actionable information to further an investigation.

Wrapping it up

Filing SARs is not a quick task, but it is vitally important. And failure to do so with complete, descriptive information is not only critical, but also required. Businesses and financial institutions are censured by FinCEN and their regulators for ineffective SARs, and even more so if activity occurs that is dismissed and not acted upon by the compliance officer.

If you have any questions, please feel free to contact us. We cannot write a SAR for you or review every narrative you write but we can assist you in understanding whether you are writing effective, actionable SARs.

P.s. Check out this diagram!

This chart represents the type and number of SARs filed in 2020 in the state of Ohio by depository institutions. Look at how many were for suspicious receipt of government payments/benefits (e.g. unemployment)!

Click for full size


  • Keri Lillie

    Keri joined Lillie and Company in 2017 after spending almost two decades working for a Central Ohio credit union. Her experience and skills enhance our firm’s ability to provide specialized services to clients and dedicated forensic analysis.

  • Heather Williams

    Heather Williams is a seasoned BSA Professional with a decade of experience in BSA, and joined Lillie and Company as a BSA Auditor in 2021. She focuses on working closely with credit unions to ensure their BSA programs are adequate and can stand up to regulator scrutiny.

Your email address will not be published. Required fields are marked *