Writing a Suspicious Activity Report

Overview
Within the CAMS domain Controls, Investigations and the AFC Organization, the ability to write a clear, complete and useful Suspicious Activity Report (SAR) – known in many jurisdictions as a Suspicious Transaction Report (STR) – is treated as a core compliance skill. The SAR is the final product of the alert, investigation and escalation process. It is the point at which the private sector hands information to the public sector, and its quality determines whether a financial intelligence unit (FIU) and law enforcement can actually act on what the institution has found. This guide explains why SAR writing matters, what a SAR is, how a well-constructed report is built, and how to recognise the correct answer when the exam tests you on it.

Why It Is Important
1. It is a legal obligation. FATF Recommendation 20 requires that when a financial institution suspects, or has reasonable grounds to suspect, that funds are the proceeds of crime or related to terrorist financing, it must report promptly to the FIU. Failure to file, late filing or filing of poor-quality reports exposes the institution and individual officers to regulatory sanctions, fines and, in serious cases, criminal liability.
2. It is the main bridge to law enforcement. Investigators cannot see inside an institution. The SAR narrative is frequently the only description they will ever read of the activity. Analysts at FIUs review thousands of reports; a vague, disorganised or jargon-filled narrative is likely to be set aside, while a clear chronological account can start a criminal case or add a missing piece to an existing one.
3. It demonstrates the effectiveness of the AML programme. Examiners read a sample of SARs to judge whether monitoring, investigations and escalation actually work. Weak narratives, inconsistent filing decisions and undocumented decisions not to file are classic examination findings.
4. It protects the institution. In most jurisdictions a good-faith filer receives a safe harbor from civil liability for making the report. Proper filing also evidences that the institution did not knowingly facilitate laundering.

What a SAR Is
A SAR is a confidential report submitted by a reporting entity to its national FIU (for example FinCEN in the United States, the NCA in the United Kingdom, AUSTRAC in Australia) describing activity the institution knows, suspects or has reason to suspect involves funds derived from illegal activity, is designed to evade reporting requirements, has no apparent business or lawful purpose, or involves the institution being used to facilitate criminal activity. Key features you should remember:
- Standard of suspicion, not proof. The filer does not need to establish that a crime occurred, identify the predicate offence or know who the ultimate beneficiary is. Reasonable suspicion based on the facts is sufficient.
- Structured data plus a free-text narrative. Most SAR forms contain fixed fields (subject identification, account numbers, dates, amounts, activity type codes) and a narrative section. The narrative is universally regarded as the most important component because it is where the filer explains why the activity is suspicious.
- Confidentiality and anti-tipping-off. FATF Recommendation 21 and national laws prohibit disclosing the existence or content of a SAR to the subject or to any unauthorised party. In the US, this prohibition extends even to civil litigation discovery; the institution must refuse to confirm or deny that a SAR exists and should notify FinCEN of any subpoena seeking SAR information.
- Filing deadlines. Rules differ by country, but the US framework is the one most often quoted in CAMS materials: file within 30 calendar days of the initial detection of facts that constitute a basis for filing; up to 60 days if no suspect has been identified; ongoing suspicious activity is reviewed at least every 90 days and a continuing-activity SAR is filed within 120 days of the prior filing. US monetary thresholds for banks are USD 5,000 when a suspect can be identified and USD 25,000 regardless of suspect; insider abuse is reportable at any amount; MSBs use a USD 2,000 threshold. Many jurisdictions have no monetary threshold at all.
- Record retention. The SAR and all supporting documentation must be kept for the statutory period (five years in the US) and made available to the FIU and appropriate law enforcement on request, without the need for a subpoena.
- Governance. The decision to file rests with the compliance/AML function (the BSA/AML officer or a SAR committee), not with the business line or relationship manager. Senior management or the board should be informed, at least in summary form, of SARs filed. Decisions not to file after an investigation must be documented with the reasoning.

How It Works: Building the Report
Step 1 – From alert to filing decision. Transaction monitoring, employee referrals, law enforcement inquiries or negative news generate an alert. An investigator reviews the activity, gathers KYC information, transaction history, open-source research and any prior SARs, and documents the findings. The case is escalated and the AML officer or committee decides whether the activity meets the standard for reporting. The clock for filing starts at initial detection of the facts, and the institution should not delay filing merely because its internal investigation is incomplete; a follow-up SAR can be filed later.

Step 2 – Complete the structured fields accurately. Every subject should be identified as fully as possible: full name, aliases, date of birth, identification numbers, addresses, occupation, phone numbers, relationship to the institution, and all related account numbers. Totals must reconcile with the narrative. Select the correct activity-type categories and, where regulators have issued advisories with key terms (for example terms relating to fentanyl, human trafficking, ransomware or specific sanctions regimes), include those key terms so the FIU can route the report correctly.

Step 3 – Write the narrative around the Five Ws and How.
- Who conducted the activity? Include customers, counterparties, beneficial owners, signatories and any third parties, and explain how they are related.
- What instruments or mechanisms were used (cash, wires, cheques, ACH, structured deposits, crypto, trade documents) and what exactly happened?
- When did it occur? Give the full date range and, where useful, a chronological sequence of key transactions.
- Where did it take place? Branches, ATMs, jurisdictions, originating and beneficiary institutions and countries.
- Why is it suspicious? Compare the activity to the customer's profile and expected behaviour, cite the red flags observed, and explain why there is no apparent legitimate purpose.
- How was the activity detected and how was it carried out? Mention the monitoring rule, employee referral or external request that triggered the review.

Step 4 – Use a three-part structure.
Introduction: state the purpose of the report (initial, continuing, corrected or joint filing), summarise the suspicious activity in a few sentences, give the total amount and date range, identify the main subjects and their relationship to the institution, and note any prior SARs on the same subjects.
Body: present the facts in chronological order; describe the accounts involved, the pattern of transactions, representative examples with dates and amounts, the counterparties, the customer's stated business and how the activity deviates from it, the results of any customer contact (for example explanations given that were implausible or unverifiable), and the relevant typology (structuring, funnel account, trade-based laundering, elder exploitation, etc.).
Conclusion: summarise why the institution concluded the activity is suspicious, state any actions taken (enhanced monitoring, account restrictions, account closure, referral to law enforcement), confirm that supporting documentation is maintained and available on request, and provide the name and contact details of the compliance point of contact.

Step 5 – Apply the writing standards regulators expect.
- Write in clear, plain language, in complete sentences, as if the reader knows nothing about your institution or customer.
- Define acronyms and avoid internal jargon, system names and product codes without explanation.
- Be factual and objective. Describe what the activity appears consistent with; do not declare that the customer is a money launderer, terrorist or fraudster, and do not speculate beyond what the facts support.
- Be complete but concise. Include every material fact, but summarise repetitive transactions rather than listing hundreds of individual items; the full transaction detail belongs in supporting documentation.
- Do not attach or paste bank statements, spreadsheets, screenshots or internal memoranda into the narrative, and do not write see attached. Supporting documents are retained by the institution and provided on request (the FinCEN form permits only a limited transaction CSV attachment).
- Never include references to the institution's own SAR filing in communications with the customer, including account closure letters.
- Have a second reviewer check the narrative for accuracy, consistency between fields and narrative, spelling of names, and completeness before submission.

Step 6 – After filing. Record the filing date and confirmation number, keep the file for the retention period, implement any approved account actions, continue monitoring, and calendar the 90-day continuing-activity review. Respond promptly to any FIU or law enforcement request for supporting documentation. Report trends from SARs back into risk assessment and monitoring tuning.

How to Answer Exam Questions on SAR Writing
CAMS questions in this area are almost always scenario-based. You will be given a situation (an investigator has finished a case, a manager wants to add something to a narrative, a customer or lawyer asks about a report, a deadline is approaching) and asked for the best or most appropriate action, or which elements a narrative should contain. Use this approach:
1. Identify what is being tested. Is it narrative content, filing timing, confidentiality, governance or record keeping? Most questions test one principle.
2. Apply the core principles. Facts over conclusions; Five Ws and How; chronological, clear, complete and concise; no attachments; no tipping off; compliance owns the decision; file on time even if the investigation is ongoing; document decisions not to file; retain records; respond to law enforcement requests.
3. Eliminate the distractors. Wrong answers typically involve accusing the customer of a specific crime, attaching documents, waiting for proof before filing, letting the relationship manager decide or ask the customer directly, mentioning the SAR to the customer or their lawyer, listing every transaction verbatim, using unexplained abbreviations, or treating SAR filing as automatically requiring account closure.
4. Choose the most complete and most conservative compliant option. When two answers look right, the better one usually includes both the regulatory requirement and the practical quality element (for example, filing on time and explaining why the activity is suspicious).

Exam Tips: Answering Questions on Writing a Suspicious Activity Report
- The narrative is king. If a question asks which part of a SAR is most important or most useful to law enforcement, the answer is the narrative that explains why the activity is suspicious.
- Remember the Five Ws and How. Any answer describing a narrative that omits the why (the reason the activity is suspicious in light of the customer profile) is incomplete.
- Facts, not accusations. The correct phrasing is the activity appears consistent with structuring, not the customer is structuring to launder drug money.
- Nothing attached, everything retained. Supporting documents are kept on file, typically for five years, and provided to the FIU or law enforcement on request. Options that attach statements or write see attached are wrong.
- Do not delay filing to finish the investigation. The standard is suspicion, not proof. File within the deadline and submit a follow-up or continuing SAR as new facts emerge.
- Know the US timelines when quoted: 30 days from initial detection, 60 days if no suspect identified, 90-day continuing-activity review, 120 days for the continuing SAR, five-year retention; thresholds of USD 5,000 (suspect known), USD 25,000 (no suspect), any amount for insider abuse, USD 2,000 for MSBs.
- Confidentiality is absolute. Never confirm or deny a SAR to the customer, the customer's lawyer, a civil litigant or the media. If served with a subpoena for a SAR, refuse to produce it and notify the FIU. Account closure letters must not mention the SAR.
- Governance questions: the AML/compliance officer or SAR committee makes the filing decision; business line pressure to not file or to soften a narrative must be escalated; the board or senior management should receive periodic SAR reporting; decisions not to file must be documented.
- Filing a SAR does not require closing the account. The decision to exit a relationship is separate and risk-based; the exam often tests this by offering automatic closure as a distractor.
- Use regulatory key terms from FIU advisories in the narrative when the typology matches, so the report is routed to the right analysts.
- Quality checks matter. Answers that involve a second-level review for accuracy, consistency and completeness before filing are generally correct.
- International framing. If the question is not US-specific, think FATF Recommendations 20 (prompt reporting of suspicion to the FIU) and 21 (safe harbor and tipping-off prohibition), and the term STR rather than SAR.

Quick Checklist for a Strong SAR Narrative
- Opening sentence states the type of filing and summarises the activity, amount and dates.
- All subjects fully identified and their relationships explained.
- Chronological, factual description of transactions and mechanisms.
- Explicit comparison to the customer's expected profile and clear statement of the red flags.
- Explanation of how the activity was detected and any customer explanations obtained.
- Objective language, no accusations, no speculation, no unexplained jargon.
- No attachments; statement that supporting documentation is available on request.
- Actions taken, point of contact, and reference to prior or anticipated follow-up filings.
- Reviewed for consistency with structured fields and filed within the deadline.

Master these principles and the typical distractors, and SAR-writing questions in the Controls, Investigations and the AFC Organization domain become some of the most predictable items on the CAMS exam.