Suspicious Activity Report (SAR/STR) Template: A Maker-Checker Narrative You Can Defend

What a SAR/STR actually is, and why the template is a legal artefact¶

Strip away the acronyms and a SAR is a structured allegation. You are telling your FIU: we observed activity we cannot explain on a legitimate basis, here is the activity, and here is why we find it suspicious. That report is filed (through the UNODC's goAML portal in many jurisdictions, or a national channel such as Tracfin's ERMES in France) and from that moment it is a legal record. An FIU analyst reads it cold, with none of your context. A prosecutor may rely on it. An AMLA or national-supervisor examiner may pull it years later and ask you to reconstruct exactly what you knew, when you knew it, and who decided to file.

That is why a SAR template is not a convenience form. It is the structure that determines whether the report is defensible. A defensible SAR has two qualities: a narrative a stranger can follow without you in the room, and every factual assertion traceable to a source the firm can produce on demand. The AMLR sharpens the second point. Article 69(1) requires obliged entities to answer an FIU's request for information within five working days, and FIUs can compress that to under 24 hours in urgent cases. A five-day clock that collapses to one day is a test of whether your evidence was captured at the moment of the decision, not a feature you bolt on after the request arrives.

This guide treats the template as what it is: the durable interface between your investigation and the examiner who will read it later. Build it well once and reuse the structure for every filing. You can generate a report to this exact skeleton with the SAR/STR maker-checker generator.

The 5W1H narrative structure: who, what, when, where, why, how¶

FIU analysts and supervisors are explicit that the narrative is the heart of a SAR. Structured fields (amounts, account numbers, dates) tell the system what happened; the narrative tells a human why it is suspicious. The most reliable way to write a narrative a stranger can follow is the journalist's discipline (5W1H) answered in plain, chronological language, with no jargon and no internal codes the FIU cannot decode.

Write each element so it stands alone. An analyst should be able to read the narrative top to bottom and never need to ask you a clarifying question, because a clarifying question to you is, in practice, an Article 69 request against a five-day clock.

- Who: every party: the subject (customer), counterparties, beneficial owners, intermediaries, and any third party who appears. Use full legal names, identifiers, and the relationship between them. Resolve aliases; never leave a counterparty as a bare account number.

- What: the activity and the instruments: transaction types, amounts, currencies, the products or accounts used, and any sanctions/PEP/adverse-media context. State the conduct, not a conclusion ("structured into nine deposits below the reporting threshold," not "money laundering").

- When: the timeline. Booking dates, the period of activity, when the alert fired, when the customer was onboarded, when KYC was last refreshed. Dates anchor the whole narrative and let the FIU sequence events against its own data.

- Where: geography and corridors: jurisdictions, branches, payment corridors, and any high-risk or sanctioned nexus. "KY→MC corridor" means nothing without expansion; spell out the jurisdictions.

- Why: the suspicion itself. This is the field analysts say is most often weak. State, specifically, what makes the activity inconsistent with the customer's known profile, expected behaviour, or a legitimate economic rationale. Tie it back to the Who/What/When/Where you have already laid out.

- How: the mechanism and the method of detection. How the funds moved, how the structure was assembled, and how you found it (which monitoring rule or screening hit raised the alert). The "how it was detected" half lets the FIU judge the reliability of the signal.

The narrative fields: good vs. weak examples¶

The difference between a SAR that an FIU acts on and one it deprioritises is almost always specificity. The table below pairs each narrative field with a weak formulation (vague, conclusory, or untraceable) and a good one (specific, sourced, defensible). The weak column is not invented for effect: these are the patterns that recur in poor filings.

Notice the through-line in the good column: it names parties, dates, amounts, and sources; it describes conduct rather than asserting a legal conclusion; and it never relies on a code or system shorthand an outside reader cannot decode.

The source-evidence checklist: every assertion must be traceable¶

A narrative is only as defensible as the evidence behind it. The discipline is simple to state and easy to skip under deadline pressure: no assertion in the narrative without a source the firm can produce. When an FIU comes back under Article 69, you are not re-investigating: you are retrieving. That only works if you captured the evidence references as you wrote, sealed alongside the report.

Run every draft SAR against this checklist before it goes to the checker. Each item is a class of source you should be able to point to for the claims in your narrative.

- Transaction records: the actual booked transactions (IDs, amounts, currencies, value dates, counterparties), not a summary you cannot trace back.

- KYC / CDD file: the customer profile, risk rating, expected activity, and the date of the last refresh. A stale KYC is itself a fact worth stating.

- Beneficial-ownership / UBO evidence: registry extracts or ownership data that substantiate any related-party or shared-owner claim, with the date pulled.

- Sanctions / PEP / adverse-media screening results: the list, the entity matched, the match strength, and the effective date of the hit.

- Counterparty and network data: links to related parties, shared owners, or known typology patterns you assert in the narrative.

- Detection provenance, which monitoring rule or screening process raised the alert, and when. This lets the FIU weigh the signal.

- Prior SARs / case history: any earlier reporting on the same subject, so the FIU sees the pattern, not a single snapshot.

- Analyst reasoning and uncertainty: what you concluded, what you could not confirm, and any gaps. Honest uncertainty is more defensible than false confidence.

The practical move is to attach evidence references to each narrative claim, not to dump documents. The reference is the contract: it says "this assertion is backed by this record, and we can produce it." Our AML Agent Control & Evidence Map lays out how those references map to the controls an examiner expects.

Complete example 1 (United States): a FinCEN SAR for structured cash deposits¶

Jurisdiction and filing rules. A US bank files a FinCEN SAR under 31 CFR 1020.320 through FinCEN's BSA E-Filing System, which FinCEN has required for BSA reports since 2012. The deadline is 30 calendar days after the bank first detects facts that may be a basis for filing, extendable by 30 days to identify a suspect, with no more than 60 days in total. The SAR, and any information that would reveal it exists, is confidential. The bank keeps a copy and the supporting documentation for five years from the filing date and makes that documentation available to FinCEN and law enforcement on request. FinCEN and the federal banking agencies' SAR FAQs of 9 October 2025 add two points used below: cash deposits near the $10,000 currency transaction report (CTR) threshold do not by themselves require a SAR, because the bank must know, suspect or have reason to suspect they were designed to evade reporting; and a separate post-filing review for continuing activity is not required. Evading CTR reporting is the offence of structuring under 31 U.S.C. 5324.

How we built it. The AML agent template in our demo tenant carries hard constraints: never file a SAR, never contact the customer, never close a case, and cite the tool calls and evidence behind every conclusion. The example follows the same split. An agent assembled the case file and drafted the narrative as maker; a BSA officer reviewed it as checker. The bank, people, accounts and figures are synthetic.

Scenario. Harbor Point Community Bank (fictional) holds the business account of Delmar Auto Detailing LLC, owned by R. Castellano. The account profile, set at onboarding in 2022 and refreshed in January 2025, expects about $15,000 in cash deposits a month. A monitoring rule for repeated cash deposits between $8,000 and $10,000 flagged the account on 31 March 2026.

Narrative as filed. "Harbor Point Community Bank reports suspected structuring of cash deposits by Delmar Auto Detailing LLC (business checking account ending 4471) and its sole owner, R. Castellano. Between 3 March and 28 March 2026, Mr. Castellano made 14 cash deposits of $8,600 to $9,800 each, totalling $129,400, at three branches in Toledo, Ohio, on 14 different business days. No single business day exceeded $10,000 in cash. The account profile expects about $15,000 in cash deposits a month. On 19 March 2026 a teller recorded that Mr. Castellano asked how much he could deposit 'without the bank filing paperwork'. Between 5 March and 31 March 2026 the account sent four wires totalling $118,000 to an account at another US bank held by Northgate Motors Trading LLC. The bank has no record of a business relationship between the two companies and has not identified the source of the cash. The bank's cash-structuring monitoring rule flagged the activity on 31 March 2026, and the bank's review identified the pattern described here."

• Missing information: the source of the cash. The file holds no 2026 sales records, and the bank did not ask the customer about the deposits, to avoid tipping off. The narrative says the source is unknown.
• Missing information: the owners of Northgate Motors Trading LLC. The bank has no access to them; the narrative names the company and states nothing more.
• Reviewer correction 1: the draft called the activity "money laundering". The checker replaced the label with the observed conduct and the suspected structuring.
• Reviewer correction 2: the draft wire total included a $3,000 rent payment to the landlord. The checker corrected it to $118,000 and linked each wire record.
• Reviewer correction 3: the draft gave 3 March, the first deposit, as the detection date. The checker recorded 31 March, when the alert fired and review identified the pattern, and confirmed the filing date against it.
• Maker-checker sign-off: maker: AML agent, draft 2, 14 April 2026. Checker: BSA officer, approved 16 April 2026 after corrections 1 to 3. Filed through BSA E-Filing on 16 April 2026, 16 days after detection. Two-person approval is this bank's operating control; the SAR rule itself does not require two signatures.

Complete example 2 (France): a déclaration de soupçon to Tracfin for a funnel account¶

Jurisdiction and filing rules. A French bank files a déclaration de soupçon (suspicious transaction report) with Tracfin, the French financial intelligence unit, under Article L. 561-15 of the Code monétaire et financier. The duty covers sums and transactions the bank knows, suspects or has good reason to suspect come from an offence punishable by more than one year's imprisonment, or relate to terrorist financing. Article L. 561-16 requires the declaration before the transaction is executed, so that Tracfin can use its right to oppose it; when deferral was impossible, the bank declares without delay after execution. Article R. 561-31 requires every declaration to set out the analysis of the facts behind the suspicion. Financial institutions send declarations through Tracfin's ERMES platform. Each institution designates its Tracfin declarants and correspondents under Articles R. 561-23 and R. 561-24. Article L. 561-18 makes the declaration confidential, and Article L. 574-1 punishes disclosure. The current ACPR and Tracfin joint guidelines (April 2025, updating the 2015 and 2018 versions) explain each of these rules.

Scenario. Banque Valmont (fictional) holds the account of Atelier Morel Import SAS, a furniture importer in Lyon and a client since 2021 with declared annual turnover of €350,000. A monitoring rule for incoming transfers from new payers flagged the account on 9 March 2026. An agent drafted the narrative as maker; the bank's designated Tracfin declarant reviewed it as checker. The bank, people, accounts and figures are synthetic. The declaration is written in French; the narrative is translated here.

Narrative as filed (translation). "Banque Valmont reports its suspicion concerning Atelier Morel Import SAS (account ending 2208), represented by its manager, C. Morel. Between 2 February and 20 March 2026 the account received 31 transfers totalling €184,300 from 11 private individuals holding accounts in Belgium, Germany, Italy and Spain. None of these individuals appears in the customer or supplier lists the client provided at its 2025 review. Within one to three days of the credits, the account sent €171,000 in five transfers to Kowloon Harbour Trading Ltd in Hong Kong. Over the previous twelve months the account received on average €29,000 a month, mainly from French retailers. Asked on 12 March 2026 about the incoming transfers, Ms Morel said they were customer pre-orders and provided four invoices totalling €38,400; none matches any of the 31 transfers by amount or date. On 23 March 2026 the client ordered a further transfer of €62,000 to Kowloon Harbour Trading Ltd, which Banque Valmont has not executed. The many unrelated payers, the rapid transfer onward to a single foreign beneficiary and the invoices that do not support the credits lead the bank to suspect that the account is being used to collect and move funds of unknown origin."

• Missing information: the owners of Kowloon Harbour Trading Ltd. The bank could not obtain them; the narrative names the company and states nothing more.
• Missing information: whether the 11 payers are connected. Not established; the narrative states only what the records show.
• Reviewer correction 1: the draft called the payers "money mules". The checker removed the label and kept the observed pattern.
• Reviewer correction 2: the draft monthly average of €35,000 included a one-off loan disbursement. The checker corrected it to €29,000.
• Reviewer correction 3: the draft left out the €62,000 transfer on hold. Under Article L. 561-16 the bank declares before executing it, so the checker added the transfer and marked the declaration urgent.
• Maker-checker sign-off: maker: AML agent, draft 3, 23 March 2026, 15:10. Checker: the bank's designated Tracfin declarant, approved and filed through ERMES on 23 March 2026 at 17:40, before the held transfer was executed. Access is restricted to the financial crime team. Two-person approval is this bank's operating control. French rules route the declaration through the declarant the bank has designated, and Article R. 561-23 lets a manager or employee declare directly in exceptional cases.
• Both narratives, with their evidence tables and notes, are in the downloadable narrative examples (Markdown). Rebuild them for your own case in the SAR/STR generator.

Why filing must stay a maker-checker gate, and why an agent may draft but never file¶

Here is the line that 2026 makes unavoidable. Agentic AI now drafts SAR narratives at machine speed: assembling evidence, summarising transactions, and producing a first-pass narrative in minutes. That is a genuine productivity gain, and it is fine: drafting is reversible, and a draft is just a proposal. Filing is not reversible, and it is not a proposal. The filed report is a legal record submitted to a state authority. So the act of filing must stay a maker-checker control (two people, or one agent as maker and a named human as checker) with the human approving before anything reaches the FIU.

This is not a stylistic preference; it is what firm accountability requires. The Wolfsberg Group's AI/ML principles (1 December 2022) state plainly that "FIs are responsible for their use of AI/ML, including for decisions that rely on AI/ML analysis, regardless of whether the AI/ML systems are developed in-house or sourced externally." An autonomously-filed SAR is a decision that relies on AI/ML analysis with no human who can be held accountable for it. Where the EU AI Act applies, Article 14 adds meaningful human oversight including the ability to intervene and override, and a human-in-the-loop who cannot actually stop the filing provides no oversight.

The maker-checker gate has to be sealed at approval, not reconstructed afterwards. When the checker signs off, the record that gets sealed is the whole unit: the narrative, the evidence references, the policy that required approval, and the identity of the approving human, captured at that instant and tamper-evident from then on. That is what makes the filing defensible to an FIU analyst or an AMLA examiner who reads it later: they are not asked to trust a dashboard's after-the-fact account; they can verify what was approved, by whom, and on what basis.

Map this onto how a runtime control plane enforces it. A Policy Builder rule treats the file action as require_approval, never allow. The agent's attempt to file is routed to a Decision Desk two-person approval queue. The human approves, rejects, or sends it back. Only on approval does the report file, and the sealed lineage lands in the Evidence Room. The agent's hard constraint, in plain terms, is the one our own AML triage template encodes: never file a SAR. It drafts and routes; the human decides.

In our own test tenants we learned two things about the checker step. Decision Desk lists confirmation checks the reviewer completes before Approve or Reject becomes available, such as checking that the cited evidence still supports the proposed route. And a reviewer who cannot decide needs to see why: in one internal review, a reviewer with the approver role saw a bare "View only" and could not tell what was missing. Decision Desk now states the reason, for example a missing permission, membership of the wrong reviewer group, or that the reviewer drafted the item.

Common filing pitfalls, and how to avoid them¶

Most SAR weaknesses are not exotic. They are a small set of recurring failures that an FIU analyst or examiner spots immediately. The table below names the pitfall, the consequence, and the fix. Read it as a pre-flight check before any SAR goes to the checker.

Several of these are amplified, not reduced, by agentic drafting: an agent that drafts fast can file fast and wrong if filing is not gated, and can produce a fluent narrative with assertions it cannot source if evidence references are not captured. The maker-checker gate is the structural answer to both.

Tie to the AMLR (10 July 2027), AMLA, and goAML practice¶

The template above is not a generic best practice; it is shaped by what the incoming European regime will expect. The AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027 as a directly-applicable single rulebook, and AMLD6 (Directive (EU) 2024/1640) carries the same general transposition deadline. The new EU Anti-Money Laundering Authority, AMLA, is seated in Frankfurt, has operated since 1 July 2025, and will begin direct supervision of a first wave of high-risk cross-border firms from 2028 after a 2027 selection. The supervisory bar is rising, and it is harmonising across the Union.

Two operational facts should anchor how you build SARs today. First, goAML (the UNODC's reporting platform used by many FIUs; Tracfin in France uses ERMES) is where your report lands, in structured XML plus narrative. That means your template should map cleanly onto goAML's structured fields and carry a narrative that stands alone; do not let the structured data and the narrative tell different stories. Second, AMLR Article 69(1)'s five-working-day FIU response window, compressible to under 24 hours, is the reconstruction test. If your SAR's evidence references were sealed at approval, the request is a retrieval. If they were not, it is a fire drill.

This is also why operational-resilience law is part of the SAR story even though it is not AML law. Under DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025), the systems supporting AML reporting can qualify as critical or important ICT functions, and DORA presumes you can reconstruct precisely what those systems did and why. A SAR pipeline whose evidence is sealed at the moment of approval satisfies the AMLR's reconstruction clock and DORA's resilience expectation with the same control. For the wider control map across DORA, the AMLR, and the AI Act, see Governing AML & payments agents.

Build your SAR/STR to this structure¶

You do not have to assemble the 5W1H narrative, the evidence checklist, and the maker-checker sign-off from scratch each time. The SAR/STR maker-checker generator takes the structure in this guide and turns it into a working report: it prompts each 5W1H field, records the source evidence behind each assertion, and records a maker and a separate checker with their dates, so the draft and the sign-off stay two acts. An agent (or an analyst) drafts as the maker; a named human approves as the checker; the approved report and its sealed evidence become the record an FIU or AMLA examiner reads later.

The principle underneath the tool is the one this whole guide argues for: the control and the evidence belong in the execution path, at the moment of filing, not in a policy PDF or a dashboard reviewed the next morning. A SAR you can defend is a SAR whose narrative a stranger can follow, whose every claim is sourced, and whose filing was approved by an accountable human and sealed as it happened. Build the next one that way.