# SAR narrative examples: a US FinCEN SAR and a French déclaration de soupçon

**Version:** 1.0  
**Last updated:** 2026-10-18  
**Source:** [kla.digital/blog/suspicious-activity-report-template](https://kla.digital/blog/suspicious-activity-report-template)

> **Synthetic data.** Every bank, person, company, account, amount and date below is invented. These are drafting examples. They are not legal advice. Check the current rules and guidance of your own jurisdiction before filing.

Each example contains the narrative as filed, a source-evidence table, missing-information notes, reviewer corrections and the maker-checker sign-off. Two-person approval is the operating control of the fictional banks; neither the US SAR rule nor the French declaration rule requires two signatures.

---

## Complete example 1 (United States): a FinCEN SAR for structured cash deposits

**Jurisdiction and filing rules.** A US bank files a FinCEN SAR under [31 CFR 1020.320](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-C/section-1020.320) through FinCEN's BSA E-Filing System, which FinCEN has [required for BSA reports since 2012](https://www.fincen.gov/resources/mandatory-e-filing-faqs). The deadline is 30 calendar days after the bank first detects facts that may be a basis for filing, extendable by 30 days to identify a suspect, with no more than 60 days in total. The SAR, and any information that would reveal it exists, is confidential. The bank keeps a copy and the supporting documentation for five years from the filing date and makes that documentation available to FinCEN and law enforcement on request. FinCEN and the federal banking agencies' [SAR FAQs of 9 October 2025](https://www.fincen.gov/system/files/2025-10/SAR-FAQs-October-2025.pdf) add two points used below: cash deposits near the $10,000 currency transaction report (CTR) threshold do not by themselves require a SAR, because the bank must know, suspect or have reason to suspect they were designed to evade reporting; and a separate post-filing review for continuing activity is not required. Evading CTR reporting is the offence of structuring under [31 U.S.C. 5324](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section5324&num=0&edition=prelim).

**How we built it.** The AML agent template in our demo tenant carries hard constraints: never file a SAR, never contact the customer, never close a case, and cite the tool calls and evidence behind every conclusion. The example follows the same split. An agent assembled the case file and drafted the narrative as maker; a BSA officer reviewed it as checker. The bank, people, accounts and figures are synthetic.

**Scenario.** Harbor Point Community Bank (fictional) holds the business account of Delmar Auto Detailing LLC, owned by R. Castellano. The account profile, set at onboarding in 2022 and refreshed in January 2025, expects about $15,000 in cash deposits a month. A monitoring rule for repeated cash deposits between $8,000 and $10,000 flagged the account on 31 March 2026.

**Narrative as filed.** "Harbor Point Community Bank reports suspected structuring of cash deposits by Delmar Auto Detailing LLC (business checking account ending 4471) and its sole owner, R. Castellano. Between 3 March and 28 March 2026, Mr. Castellano made 14 cash deposits of $8,600 to $9,800 each, totalling $129,400, at three branches in Toledo, Ohio, on 14 different business days. No single business day exceeded $10,000 in cash. The account profile expects about $15,000 in cash deposits a month. On 19 March 2026 a teller recorded that Mr. Castellano asked how much he could deposit 'without the bank filing paperwork'. Between 5 March and 31 March 2026 the account sent four wires totalling $118,000 to an account at another US bank held by Northgate Motors Trading LLC. The bank has no record of a business relationship between the two companies and has not identified the source of the cash. The bank's cash-structuring monitoring rule flagged the activity on 31 March 2026, and the bank's review identified the pattern described here."

### Source evidence for example 1 (synthetic)

| Assertion in the narrative                                       | Source                                                       | Review status                                   |
| ---------------------------------------------------------------- | ------------------------------------------------------------ | ----------------------------------------------- |
| 14 cash deposits, $8,600–$9,800, total $129,400, 3–28 March 2026 | Core banking cash transaction export, account ending 4471    | Verified against the export                     |
| Three branches, 14 business days, no day above $10,000           | Teller transaction records by branch and business day        | Verified; daily totals recomputed               |
| Expected cash about $15,000 a month                              | Customer due diligence profile, 2022, refreshed January 2025 | Verified                                        |
| Teller note of 19 March 2026                                     | Teller note, branch 2                                        | Verified; quoted words checked against the note |
| Four wires totalling $118,000 to Northgate Motors Trading LLC    | Outgoing wire records                                        | Corrected: the draft said $121,000              |
| No known business relationship; source of cash unknown           | Customer file and open-source search                         | Gap stated in the narrative                     |
| Flagged 31 March 2026 by the cash-structuring rule               | Alert record with rule ID and timestamp                      | Verified; sets the start of the 30-day period   |

### Notes, corrections and sign-off

- **Missing information:** the source of the cash. The file holds no 2026 sales records, and the bank did not ask the customer about the deposits, to avoid tipping off. The narrative says the source is unknown.
- **Missing information:** the owners of Northgate Motors Trading LLC. The bank has no access to them; the narrative names the company and states nothing more.
- **Reviewer correction 1:** the draft called the activity "money laundering". The checker replaced the label with the observed conduct and the suspected structuring.
- **Reviewer correction 2:** the draft wire total included a $3,000 rent payment to the landlord. The checker corrected it to $118,000 and linked each wire record.
- **Reviewer correction 3:** the draft gave 3 March, the first deposit, as the detection date. The checker recorded 31 March, when the alert fired and review identified the pattern, and confirmed the filing date against it.
- **Maker-checker sign-off:** maker: AML agent, draft 2, 14 April 2026. Checker: BSA officer, approved 16 April 2026 after corrections 1 to 3. Filed through BSA E-Filing on 16 April 2026, 16 days after detection. Two-person approval is this bank's operating control; the SAR rule itself does not require two signatures.

---

## Complete example 2 (France): a déclaration de soupçon to Tracfin for a funnel account

**Jurisdiction and filing rules.** A French bank files a _déclaration de soupçon_ (suspicious transaction report) with Tracfin, the French financial intelligence unit, under Article L. 561-15 of the [Code monétaire et financier](https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006072026/). The duty covers sums and transactions the bank knows, suspects or has good reason to suspect come from an offence punishable by more than one year's imprisonment, or relate to terrorist financing. Article L. 561-16 requires the declaration before the transaction is executed, so that Tracfin can use its right to oppose it; when deferral was impossible, the bank declares without delay after execution. Article R. 561-31 requires every declaration to set out the analysis of the facts behind the suspicion. Financial institutions send declarations through Tracfin's ERMES platform. Each institution designates its Tracfin declarants and correspondents under Articles R. 561-23 and R. 561-24. Article L. 561-18 makes the declaration confidential, and Article L. 574-1 punishes disclosure. The current [ACPR and Tracfin joint guidelines](https://acpr.banque-france.fr/fr/publications-et-statistiques/publications/lignes-directrices-conjointes-de-lacpr-et-de-tracfin-relatives-aux-obligations-de-vigilance-sur-les) (April 2025, updating the 2015 and 2018 versions) explain each of these rules.

**Scenario.** Banque Valmont (fictional) holds the account of Atelier Morel Import SAS, a furniture importer in Lyon and a client since 2021 with declared annual turnover of €350,000. A monitoring rule for incoming transfers from new payers flagged the account on 9 March 2026. An agent drafted the narrative as maker; the bank's designated Tracfin declarant reviewed it as checker. The bank, people, accounts and figures are synthetic. The declaration is written in French; the narrative is translated here.

**Narrative as filed (translation).** "Banque Valmont reports its suspicion concerning Atelier Morel Import SAS (account ending 2208), represented by its manager, C. Morel. Between 2 February and 20 March 2026 the account received 31 transfers totalling €184,300 from 11 private individuals holding accounts in Belgium, Germany, Italy and Spain. None of these individuals appears in the customer or supplier lists the client provided at its 2025 review. Within one to three days of the credits, the account sent €171,000 in five transfers to Kowloon Harbour Trading Ltd in Hong Kong. Over the previous twelve months the account received on average €29,000 a month, mainly from French retailers. Asked on 12 March 2026 about the incoming transfers, Ms Morel said they were customer pre-orders and provided four invoices totalling €38,400; none matches any of the 31 transfers by amount or date. On 23 March 2026 the client ordered a further transfer of €62,000 to Kowloon Harbour Trading Ltd, which Banque Valmont has not executed. The many unrelated payers, the rapid transfer onward to a single foreign beneficiary and the invoices that do not support the credits lead the bank to suspect that the account is being used to collect and move funds of unknown origin."

### Source evidence for example 2 (synthetic)

| Assertion in the narrative                                          | Source                                                | Review status                                        |
| ------------------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------- |
| 31 credits totalling €184,300 from 11 individuals in four countries | Account statement export; payer IBAN country codes    | Verified                                             |
| Payers absent from the client's customer and supplier lists         | Lists provided at the 2025 periodic review            | Verified; the lists date from 2025, noted as a limit |
| €171,000 in five transfers to Kowloon Harbour Trading Ltd           | Outgoing transfer records                             | Verified                                             |
| Average €29,000 a month over twelve months                          | Account turnover report                               | Corrected: the draft said €35,000                    |
| Four invoices, €38,400, none matching                               | Invoices received 12 March 2026; reconciliation sheet | Verified                                             |
| Client's explanation of 12 March 2026                               | Relationship manager's call note                      | Verified; wording kept close to the note             |
| €62,000 transfer ordered 23 March 2026 and not executed             | Payment order and hold record                         | Verified                                             |

### Notes, corrections and sign-off

- **Missing information:** the owners of Kowloon Harbour Trading Ltd. The bank could not obtain them; the narrative names the company and states nothing more.
- **Missing information:** whether the 11 payers are connected. Not established; the narrative states only what the records show.
- **Reviewer correction 1:** the draft called the payers "money mules". The checker removed the label and kept the observed pattern.
- **Reviewer correction 2:** the draft monthly average of €35,000 included a one-off loan disbursement. The checker corrected it to €29,000.
- **Reviewer correction 3:** the draft left out the €62,000 transfer on hold. Under Article L. 561-16 the bank declares before executing it, so the checker added the transfer and marked the declaration urgent.
- **Maker-checker sign-off:** maker: AML agent, draft 3, 23 March 2026, 15:10. Checker: the bank's designated Tracfin declarant, approved and filed through ERMES on 23 March 2026 at 17:40, before the held transfer was executed. Access is restricted to the financial crime team. Two-person approval is this bank's operating control. French rules route the declaration through the declarant the bank has designated, and Article R. 561-23 lets a manager or employee declare directly in exceptional cases.

---

## Blank structure

| Field                                               | Entry |
| --------------------------------------------------- | ----- |
| Jurisdiction and filing channel                     | [ ]   |
| Filing deadline and how it was computed             | [ ]   |
| Detection date and source                           | [ ]   |
| Narrative (who, what, when, where, why, how)        | [ ]   |
| Source evidence per assertion                       | [ ]   |
| Missing information and how the narrative states it | [ ]   |
| Reviewer corrections                                | [ ]   |
| Maker (name or agent, draft version, date)          | [ ]   |
| Checker (name and role, decision, date)             | [ ]   |
| Filing reference and date                           | [ ]   |

_Template provided by KLA Digital. Synthetic examples. Not legal advice._