Suspicious Activity Report (SAR/STR) Template: A Maker-Checker Narrative You Can Defend

What a SAR/STR actually is — and why the template is a legal artefact, not a form¶

Strip away the acronyms and a SAR is a structured allegation. You are telling your FIU: we observed activity we cannot explain on a legitimate basis, here is the activity, and here is why we find it suspicious. That report is filed — in most EU jurisdictions through the UNODC's goAML portal — and from that moment it is a legal record. An FIU analyst reads it cold, with none of your context. A prosecutor may rely on it. An AMLA or national-supervisor examiner may pull it years later and ask you to reconstruct exactly what you knew, when you knew it, and who decided to file.

That is why a SAR template is not a convenience form. It is the structure that determines whether the report is defensible. A defensible SAR has two qualities: a narrative a stranger can follow without you in the room, and every factual assertion traceable to a source the firm can produce on demand. The AMLR sharpens the second point. Article 69(1) requires obliged entities to answer an FIU's request for information within five working days, and FIUs can compress that to under 24 hours in urgent cases. A five-day clock that collapses to one day is a test of whether your evidence was captured at the moment of the decision — not a feature you bolt on after the request arrives.

This guide treats the template as what it is: the durable interface between your investigation and the examiner who will read it later. Build it well once and reuse the structure for every filing. You can generate a report to this exact skeleton with the SAR/STR maker-checker generator.

The 5W1H narrative structure: who, what, when, where, why, how¶

FIU analysts and supervisors are explicit that the narrative is the heart of a SAR. Structured fields (amounts, account numbers, dates) tell the system what happened; the narrative tells a human why it is suspicious. The most reliable way to write a narrative a stranger can follow is the journalist's discipline — 5W1H — answered in plain, chronological language, with no jargon and no internal codes the FIU cannot decode.

Write each element so it stands alone. An analyst should be able to read the narrative top to bottom and never need to ask you a clarifying question — because a clarifying question to you is, in practice, an Article 69 request against a five-day clock.

- Who — every party: the subject (customer), counterparties, beneficial owners, intermediaries, and any third party who appears. Use full legal names, identifiers, and the relationship between them. Resolve aliases; never leave a counterparty as a bare account number.

- What — the activity and the instruments: transaction types, amounts, currencies, the products or accounts used, and any sanctions/PEP/adverse-media context. State the conduct, not a conclusion ("structured into nine deposits below the reporting threshold," not "money laundering").

- When — the timeline. Booking dates, the period of activity, when the alert fired, when the customer was onboarded, when KYC was last refreshed. Dates anchor the whole narrative and let the FIU sequence events against its own data.

- Where — geography and corridors: jurisdictions, branches, payment corridors, and any high-risk or sanctioned nexus. "KY→MC corridor" means nothing without expansion; spell out the jurisdictions.

- Why — the suspicion itself. This is the field analysts say is most often weak. State, specifically, what makes the activity inconsistent with the customer's known profile, expected behaviour, or a legitimate economic rationale. Tie it back to the Who/What/When/Where you have already laid out.

- How — the mechanism and the method of detection. How the funds moved, how the structure was assembled, and how you found it (which monitoring rule or screening hit raised the alert). The "how it was detected" half lets the FIU judge the reliability of the signal.

The narrative fields: good vs. weak examples¶

The difference between a SAR that an FIU acts on and one it deprioritises is almost always specificity. The table below pairs each narrative field with a weak formulation (vague, conclusory, or untraceable) and a good one (specific, sourced, defensible). The weak column is not invented for effect — these are the patterns that recur in poor filings.

Notice the through-line in the good column: it names parties, dates, amounts, and sources; it describes conduct rather than asserting a legal conclusion; and it never relies on a code or system shorthand an outside reader cannot decode.

The source-evidence checklist: every assertion must be traceable¶

A narrative is only as defensible as the evidence behind it. The discipline is simple to state and easy to skip under deadline pressure: no assertion in the narrative without a source the firm can produce. When an FIU comes back under Article 69, you are not re-investigating — you are retrieving. That only works if you captured the evidence references as you wrote, sealed alongside the report.

Run every draft SAR against this checklist before it goes to the checker. Each item is a class of source you should be able to point to for the claims in your narrative.

- Transaction records — the actual booked transactions (IDs, amounts, currencies, value dates, counterparties), not a summary you cannot trace back.

- KYC / CDD file — the customer profile, risk rating, expected activity, and the date of the last refresh. A stale KYC is itself a fact worth stating.

- Beneficial-ownership / UBO evidence — registry extracts or ownership data that substantiate any related-party or shared-owner claim, with the date pulled.

- Sanctions / PEP / adverse-media screening results — the list, the entity matched, the match strength, and the effective date of the hit.

- Counterparty and network data — links to related parties, shared owners, or known typology patterns you assert in the narrative.

- Detection provenance — which monitoring rule or screening process raised the alert, and when. This lets the FIU weigh the signal.

- Prior SARs / case history — any earlier reporting on the same subject, so the FIU sees the pattern, not a single snapshot.

- Analyst reasoning and uncertainty — what you concluded, what you could not confirm, and any gaps. Honest uncertainty is more defensible than false confidence.

The practical move is to attach evidence references to each narrative claim, not to dump documents. The reference is the contract: it says "this assertion is backed by this record, and we can produce it." Our AML Agent Control & Evidence Map lays out how those references map to the controls an examiner expects.

Why filing must stay a maker-checker gate — and why an agent may draft but never file¶

Here is the line that 2026 makes unavoidable. Agentic AI now drafts SAR narratives at machine speed — assembling evidence, summarising transactions, and producing a first-pass narrative in minutes. That is a genuine productivity gain, and it is fine: drafting is reversible, and a draft is just a proposal. Filing is not reversible, and it is not a proposal. The filed report is a legal record submitted to a state authority. So the act of filing must stay a maker-checker control — two people, or one agent as maker and a named human as checker — with the human approving before anything reaches the FIU.

This is not a stylistic preference; it is what firm accountability requires. The Wolfsberg Group's AI/ML principles (1 December 2022) state plainly that "FIs are responsible for their use of AI/ML, including for decisions that rely on AI/ML analysis, regardless of whether the AI/ML systems are developed in-house or sourced externally." An autonomously-filed SAR is a decision that relies on AI/ML analysis with no human who can be held accountable for it. Where the EU AI Act applies, Article 14 adds meaningful human oversight including the ability to intervene and override — and a human-in-the-loop who cannot actually stop the filing is decoration, not oversight.

The maker-checker gate has to be sealed at approval, not reconstructed afterwards. When the checker signs off, the record that gets sealed is the whole unit: the narrative, the evidence references, the policy that required approval, and the identity of the approving human, captured at that instant and tamper-evident from then on. That is what makes the filing defensible to an FIU analyst or an AMLA examiner who reads it later — they are not asked to trust a dashboard's after-the-fact account; they can verify what was approved, by whom, and on what basis.

Map this onto how a runtime control plane enforces it. A Policy Builder rule treats the file action as `require_approval`, never `allow`. The agent's attempt to file is routed to a Decision Desk two-person approval queue. The human approves, rejects, or sends it back. Only on approval does the report file — and the sealed lineage lands in the Evidence Room. The agent's hard constraint, in plain terms, is the one our own AML triage template encodes: never file a SAR. It drafts and routes; the human decides.

Common filing pitfalls — and how to avoid them¶

Most SAR weaknesses are not exotic. They are a small set of recurring failures that an FIU analyst or examiner spots immediately. The table below names the pitfall, the consequence, and the fix. Read it as a pre-flight check before any SAR goes to the checker.

Several of these are amplified, not reduced, by agentic drafting: an agent that drafts fast can file fast and wrong if filing is not gated, and can produce a fluent narrative with assertions it cannot source if evidence references are not captured. The maker-checker gate is the structural answer to both.

Tie to the AMLR (10 July 2027), AMLA, and goAML practice¶

The template above is not a generic best practice; it is shaped by what the incoming European regime will expect. The AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027 as a directly-applicable single rulebook, and AMLD6 (Directive (EU) 2024/1640) carries the same general transposition deadline. The new EU Anti-Money Laundering Authority, AMLA, is seated in Frankfurt, has operated since 1 July 2025, and will begin direct supervision of a first wave of high-risk cross-border firms from 2028 after a 2027 selection. The supervisory bar is rising, and it is harmonising across the Union.

Two operational facts should anchor how you build SARs today. First, goAML — the UNODC's reporting platform used by most EU FIUs — is where your report lands, in structured XML plus narrative. That means your template should map cleanly onto goAML's structured fields and carry a narrative that stands alone; do not let the structured data and the narrative tell different stories. Second, AMLR Article 69(1)'s five-working-day FIU response window, compressible to under 24 hours, is the reconstruction test. If your SAR's evidence references were sealed at approval, the request is a retrieval. If they were not, it is a fire drill.

This is also why operational-resilience law is part of the SAR story even though it is not AML law. Under DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025), the systems supporting AML reporting can qualify as critical or important ICT functions — and DORA presumes you can reconstruct precisely what those systems did and why. A SAR pipeline whose evidence is sealed at the moment of approval satisfies the AMLR's reconstruction clock and DORA's resilience expectation with the same control. For the wider control map across DORA, the AMLR, and the AI Act, see Governing AML & payments agents.

Build your SAR/STR to this structure¶

You do not have to assemble the 5W1H narrative, the evidence checklist, and the maker-checker sign-off from scratch each time. The SAR/STR maker-checker generator takes the structure in this guide and turns it into a working report: it prompts each 5W1H field, holds you to a source for every assertion, and — the part that matters most — keeps filing behind a two-person approval so the draft and the sign-off are never the same act. An agent (or an analyst) drafts as the maker; a named human approves as the checker; the approved report and its sealed evidence become the record an FIU or AMLA examiner reads later.

The principle underneath the tool is the one this whole guide argues for: the control and the evidence belong in the execution path, at the moment of filing, not in a policy PDF or a dashboard reviewed the next morning. A SAR you can defend is a SAR whose narrative a stranger can follow, whose every claim is sourced, and whose filing was approved by an accountable human and sealed as it happened. Build the next one that way.