SAR Narrative Drafter

intent

use this skill when a BSA officer, AML investigator, transaction-monitoring analyst, or financial-intelligence-unit staffer at a U.S. financial institution needs to draft a FinCEN SAR Part V narrative for a single Suspicious Activity Report under 31 C.F.R. Chapter X. the skill converts an investigative case file into a structured DRAFT narrative that enforces evidence discipline, confidentiality, and FFIEC SAR-quality standards. it does not file SARs, contact law enforcement, decide filing thresholds, or disclose the SAR's existence to the subject. use it when you have collected the investigation details and need to map facts to Who / What / When / Where / Why / How, tag FinCEN keywords and advisories, audit for weak language, and produce a document ready for BSA officer review and sign-off.

inputs

filer institution

• type: bank, credit union, MSB, broker-dealer, mutual fund, casino, virtual-currency exchange, residential mortgage lender / originator, insurance, futures, or other FinCEN-regulated entity.
• RSSD ID, IRS EIN, or other filer identifier (do not paste; confirm on file only).

filing posture

• initial: first SAR on this subject / activity.
• continuing-activity: linked to prior BSA ID; user provides prior BSA ID and filing date.
• joint: filed with another institution; user identifies co-filer.
• corrected: amends a prior BSA ID; user provides the prior BSA ID being corrected.

detection and timeline

• initial-detection date: when the institution first identified facts that may form the basis for filing (sets the 30-calendar-day filing clock, or 60 days if no suspect is identified).
• activity window: start and end dates of the activity covered by this SAR.

subject(s) and accounts

• subject type: individual, entity, or both; role (customer, non-customer, employee, counterparty).
• relationship to institution: account holder since when, product type, signers, beneficial owners, last-4 of identifiers (SSN, EIN, account number, card number, passport).
• account(s): product, opening date, last-4, signers, beneficial-ownership percentages.
• counterparties: other-side institutions, wire beneficiaries / originators, payment processors, exchanges (last-4 where applicable).
• geographies: subject domiciles, transaction-origination / destination, high-risk-jurisdiction flags (FATF gray / black lists, current FinCEN advisories).

activity and aggregate

• transaction-activity window: start and end dates.
• aggregate dollar amount (USD equivalent), transaction count, instrument mix (cash, wire, ACH, check, card, cryptocurrency, money order, internal transfer).
• structuring allegation: if applicable, specific dates, amounts, and pattern description (do not characterize as "potential structuring"; describe the pattern and let the BSA officer characterize).
• 314(a) match or 314(b) information-sharing request: dates and counterparties involved.

red-flag triggers and investigation

• alert source: automated transaction-monitoring rule (scenario name), branch / front-line referral, 314(a) match, law-enforcement subpoena, news / negative news, internal investigation, prior-SAR follow-up.
• red flags observed: plain factual language (e.g., "10 cash deposits of $9,000 to $9,800 within 14 business days across three branches").
• investigation steps taken: KYC re-review, transaction sampling, branch interview, open-source intelligence (OSINT), sanctions screening, peer-account review, counterparty outreach.
• disposition rationale: why the institution is filing or why the BSA officer should consider filing.

FinCEN keywords and advisories

• applicable keywords from current FinCEN-published advisory list (examples: EFE for elder financial exploitation, HUMAN TRAFFICKING, HEALTHCARE FRAUD, CYBER EVENT, CVC for convertible virtual currency, FAST PAYMENTS for PIX / fast-payments fraud, TBML for trade-based money laundering, REAL ESTATE, or advisory-specific key terms such as FIN-2026-… for sanctions evasion or regional fraud patterns).
• user confirms that chosen keywords match current FinCEN advisory list.

external connections

• none required. the skill does not integrate with FinCEN BSA E-Filing, law enforcement, or any external API. all outputs are local and confidential.

edge cases and constraints

• rate limits: not applicable (no external API calls).
• auth expiry: not applicable.
• empty result sets: if any dimension of the 5 W's + H is unknown or missing, the skill logs it as Unknown , required for narrative and blocks drafting until resolved.
• network timeouts: not applicable.
• filing deadline: 30 calendar days from initial detection (60 days if no suspect identified). any case with ≤ 7 days remaining is flagged CRITICAL , DEADLINE IMMINENT.
• SAR confidentiality and tipping rule (31 U.S.C. § 5318(g)(2), 31 C.F.R. § 1020.320(e)): the SAR's existence, contents, investigation, and alert must never be disclosed to the subject, subject's representative, or unauthorized third party. all outputs are marked confidential and restricted to authorized BSA / AML personnel.
• full PII restriction: full SSN, full EIN, full account number, full card number, or full passport number must never appear in the narrative. use last-4 (or last-6 for cards if institution policy requires); full identifiers belong in structured Part I / II / III fields only.
• prior-SAR cross-reference: for continuing-activity filings, user provides prior BSA ID and filing date; the skill cites these and describes only incremental new activity since the prior filing.

procedure

follow these steps in order. ask one question at a time; wait for the user's answer before proceeding. do not draft the narrative until intake is complete and the user confirms the assumption summary.

step 1: filer and filing posture.

• ask: "filer institution type (bank, credit union, MSB, broker-dealer, mutual fund, casino, virtual-currency exchange, residential mortgage lender / originator, insurance, futures, other)? filer ID / RSSD / IRS-EIN on file (Y/N; do not paste)?"

• input: institution type, confirmation of ID on file.

• output: filer classification.

• ask: "filing posture , initial, continuing-activity (provide prior BSA ID), joint (provide co-filer), or corrected (provide prior BSA ID being corrected)?"

• input: filing posture and any prior BSA ID / co-filer name.

• output: filing posture and linked case ID (if applicable).

• ask: "initial detection date , when did the institution first identify the facts that may form the basis for filing? (format: YYYY-MM-DD)"

• input: detection date.

• output: filing-deadline date = detection date + 30 calendar days (or + 60 if no suspect identified). display: "Filing-deadline date: . Days remaining: ." if ≤ 7 days, label CRITICAL , DEADLINE IMMINENT.

step 2: subject(s) and accounts. collect one subject at a time using internal references (Subject 1, Subject 2, etc.). do not paste full identifiers.

• ask: "subject 1: type (individual / entity / both), role (customer / non-customer / employee / counterparty), relationship to institution (account holder since when, product, signers, beneficial owners)? provide last-4 of SSN / EIN / account number; do not paste full identifiers."

• input: subject type, role, relationship, last-4 identifiers.

• output: subject 1 profile (reference-safe).

• ask: "account(s) involved , product type, opening date, last-4 of account number, signers, beneficial-ownership percentages? any secondary accounts?"

• input: account details.

• output: account roster with last-4 identifiers.

• ask: "counterparties (other-side institutions, wire beneficiaries / originators, payment processors, exchanges) , provide names or last-4 where available. geographies involved (subject domiciles, transaction-origination / destination, high-risk-jurisdiction flags)?"

• input: counterparty list, geographies.

• output: counterparty and geography map.

• ask: "any additional subjects involved (employee, beneficial owner, wire beneficiary, etc.)? if yes, repeat subject intake for subject 2, etc. if no, confirm: all subjects and accounts captured?"

• input: additional subjects or confirmation.

• output: complete subject and account roster.

step 3: activity window and aggregate.

• ask: "activity-window start and end dates (format: YYYY-MM-DD)? aggregate USD amount, transaction count, instrument mix (cash, wire, ACH, check, card, cryptocurrency, money order, internal transfer)?"

• input: dates, amounts, counts, instruments.

• output: activity summary with aggregate and instrument breakdown.

• ask: "structuring allegation (if any): describe the specific pattern with dates and amounts (e.g., '10 cash deposits of $9,000 to $9,800 within 14 business days across three branches'). do not characterize as 'potential structuring'; state the pattern and let the BSA officer characterize. if no structuring, answer 'no'."

• input: structuring pattern description or "no".

• output: structuring flag or "not applicable".

• ask: "314(a) match or 314(b) information-sharing request? if yes, provide date, counterparty, and activity linked. if no, answer 'no'."

• input: 314(a) / 314(b) details or "no".

• output: 314 status.

step 4: red-flag triggers and investigation.

• ask: "source of alert , automated TM rule (provide scenario name), branch referral, 314(a) match, law-enforcement subpoena, news / negative news, internal investigation, prior-SAR follow-up? which one(s)?"

• input: alert source(s).

• output: alert-source classification.

• ask: "specific red flags observed: describe in plain factual language (e.g., '10 cash deposits of $9,000 to $9,800 within 14 business days across three branches'). list as many as apply."

• input: red-flag observations.

• output: red-flag list.

• ask: "investigation steps taken: KYC re-review, transaction sampling, branch interview, OSINT, sanctions screening, peer-account review, counterparty outreach, or other? list each step and findings."

• input: investigation steps and outcomes.

• output: investigation summary.

• ask: "disposition rationale , why is the institution filing (or why should the BSA officer consider filing)? one or two sentences."

• input: rationale.

• output: disposition summary.

step 5: FinCEN keyword and advisory tagging.

• ask: "which FinCEN keywords apply? examples: EFE (elder financial exploitation), HUMAN TRAFFICKING, HEALTHCARE FRAUD, CYBER EVENT, CVC (convertible virtual currency), FAST PAYMENTS (PIX / fast-payments fraud), TBML (trade-based money laundering), REAL ESTATE, or advisory-specific terms (e.g., FIN-2026-… for sanctions evasion). provide only keywords that match the current FinCEN-published advisory list."
• input: keyword list.
• output: confirmed keyword(s) for Field 2.

step 6: 5 W's + H coverage matrix.

• display the matrix:

Dimension	Coverage
Who	Subject(s), role, relationship, beneficial owners
What	Activity type, instruments, aggregate, count, FinCEN keywords
When	Start / end dates, key dates of representative transactions
Where	Branches, channels, geographies, counterparty institutions
Why	Why suspicious , the red-flag pattern in factual terms
How	Method of operation , chronological transaction sequence

• ask: "review the 5 W's + H matrix above. are all dimensions covered? if any cell is blank or unknown, identify it now so we can fill it before drafting."
• input: user confirms coverage or identifies gaps.
• output: if any gap, log as Unknown , required for narrative. if all covered, proceed to drafting.

step 7: assumption summary.

• display: filer, filing posture, detection / deadline dates, subjects, accounts, activity window, aggregate, alert source, red flags, investigation steps, keywords, and any unknowns.
• ask: "does this summary match your case? if yes, confirm 'ready to draft'. if no, which items should I correct?"
• input: confirmation or corrections.
• output: approved case profile or revised details.

step 8: narrative drafting.

once user confirms, draft three sections in this order. total length: typically 4 to 8 paragraphs; longer for complex activity; never padded.

introduction (1 short paragraph). template: "[Filer institution] is filing this [initial / continuing-activity / joint / corrected] Suspicious Activity Report regarding [Subject 1 (individual/entity)], [Subject 2 …], in connection with [activity type / FinCEN keyword] involving approximately $[aggregate] across [N] transactions between [start date] and [end date] in account(s) [last-4]."

body (chronological method of operation).

• list transactions chronologically with specific dates, amounts (USD), instruments, counterparties (last-4 where applicable), branches / channels, geographies.
• group like transactions only when grouping does not lose detective value; otherwise list representative transactions individually.
• for continuing-activity filings, cite prior BSA ID(s) and describe only new / incremental activity since the last filing date with a one-sentence pointer to the prior narrative.
• do not speculate motive. describe the pattern; let the reader infer.

conclusion (1 short paragraph). template: "[Filer institution]'s response: [account closed / restricted / continuing to monitor]. [If 314(b) used: 'A 314(b) information-sharing request was issued to / received from [other institution] on [date].'] Supporting documentation is retained at [location] for five years from the date of filing per 31 C.F.R. § 1020.320(d). this SAR and its contents are confidential under 31 U.S.C. § 5318(g)(2)."

• output: complete draft narrative with introduction, body, conclusion.

step 9: weak-language audit.

review the draft and strike or rewrite phrases that document uncertainty rather than suspicion:

• "may indicate"
• "could be consistent with"
• "appears to possibly"
• "seems"
• "likely / unlikely" (unsupported by data)
• "the customer might be"
• "we believe"

replace with concrete observations. the basis for reasonable suspicion is shown by specific facts, not hedge words.

• output: list of phrases struck / rewritten or "none".

step 10: FFIEC SAR-quality self-check.

tick each item; if any fails, return to the relevant phase.

• each of Who / What / When / Where / Why / How is covered

• introduction → body → conclusion structure present

• specific dates and amounts (no "various" or "multiple" without numbers)

• FinCEN keyword(s) tagged in Field 2 plan and referenced inline

• no full SSN / EIN / account / card / passport in narrative

• no tipping language; no reference shared with subject

• no hedge / weak-suspicion language

• no unrelated background information

• continuing-activity: prior BSA ID(s) cited; only incremental new facts described

• filing-deadline date is in the future (or escalation flagged if not)

• document-retention location and 5-year retention noted

• BSA-officer review block at the bottom

• output: pass / fail for each item.

step 11: generate final output artifact.

assemble all components in the output-contract format below.

• output: complete DRAFT SAR narrative package.

decision points

if filing posture is continuing-activity:

• require prior BSA ID and filing date.
• describe only new / incremental activity since the prior filing.
• cite the prior BSA ID inline in the introduction and body.

if filing posture is corrected:

• require the prior BSA ID being amended.
• note in the introduction that this corrects a prior filing.
• describe the specific information being corrected or added.

if filing posture is joint:

• require the co-filer institution name.
• note that both institutions are filing jointly.
• ensure no duplicate content in this SAR if the co-filer files a separate SAR on the same subject / activity.

if initial detection date is ≤ 7 calendar days before the 30-day deadline:

• flag CRITICAL , DEADLINE IMMINENT.
• do not delay drafting; expedite user review and BSA-officer sign-off.

if any dimension of the 5 W's + H is unknown or missing:

• log as Unknown , required for narrative.
• block drafting.
• ask the user to provide the missing information or confirm that the gap is acceptable to the BSA officer.

if structuring is alleged:

• do not characterize the pattern as "potential structuring" or "suspicious structuring pattern".
• describe the specific dates, amounts, and distribution (e.g., number of deposits, time window, branches, individual transaction amounts).
• let the BSA officer and the narrative reader characterize the suspicion.

if weak-language is present after drafting:

• rewrite using specific facts and observations.
• do not permit hedge words that undermine the factual foundation of reasonable suspicion.

if full PII (SSN, EIN, account number, card number, passport number) appears in the narrative:

• remove it.
• replace with last-4 (or last-6 for card if policy requires).
• note the correction.

if the narrative discloses the SAR's existence, contents, or investigation to the subject, subject's representative, or unauthorized third party:

• reject the narrative.
• rewrite to remove all tipping language.
• remind the user of 31 U.S.C. § 5318(g)(2) confidentiality obligation.

if the user indicates law-enforcement contact or notification:

• clarify that the SAR filing and law-enforcement notification are separate processes.
• the skill does not notify law enforcement.
• the institution does that through established channels, independently from the SAR filing.
• do not include law-enforcement contact instructions in the output.

if the user asks the skill to decide whether reasonable suspicion is met:

• refuse.
• state: "the BSA officer decides whether the reasonable-suspicion threshold is met. the skill flags strength and gaps; it does not vote."

output contract

format: text file or markdown-formatted document.

structure: DRAFT label, filer / filing-posture / detection / deadline header, Field 2 keyword(s), Part V narrative (Introduction / Body / Conclusion), 5 W's + H coverage matrix, weak-language audit summary, FFIEC quality self-check, prior SAR cross-references (if continuing-activity), document-retention block, unresolved-information block, and BSA-officer review block.

data format: dates in YYYY-MM-DD format; dollar amounts in USD; last-4 identifiers (SSN-xxxx-xxxx-1234, Account ****1234, Card ****6789); no full PII; no references to the subject by name in the narrative (use "Subject 1 / Subject 2" instead).

file location: stored locally; not uploaded to FinCEN BSA E-Filing or any external system. the user retains the DRAFT for BSA-officer review and sign-off before any external submission.

retention: supporting documentation (investigation file, transaction records, KYC re-review, branch notes, OSINT summary, etc.) retained at [location specified by user] for 5 years from the date of filing per 31 C.F.R. § 1020.320(d).

confidentiality: marked DRAFT , BSA OFFICER MUST REVIEW BEFORE FINCEN BSA E-FILING SUBMISSION on first line. all contents treated as confidential supervisory information. no sharing with the subject, subject's representative, or unauthorized third party.

example output template:

DRAFT ,  BSA OFFICER MUST REVIEW BEFORE FINCEN BSA E-FILING SUBMISSION

Filer: [institution name]   Filing posture: [initial | continuing-activity | joint | corrected]
Detection date: YYYY-MM-DD   Filing-deadline date: YYYY-MM-DD   Days remaining: N
[CRITICAL ,  DEADLINE IMMINENT]  ← only if ≤ 7 days

=== Field 2 ,  FinCEN Keyword(s) ===
- <keyword>

=== Part V Narrative ===

Introduction
<one paragraph>

Body
<chronological paragraphs with specific dates, amounts, last-4 identifiers, instruments, geographies>

Conclusion
<one paragraph: institution response, 314(b) status, retention statement, confidentiality reminder>

=== 5 W's + H Coverage Matrix ===
| Dimension | Coverage |
| --- | --- |
| Who | … |
| What | … |
| When | … |
| Where | … |
| Why | … |
| How | … |

=== Weak-Language Audit ===
- Phrases struck / rewritten: [list or "none"]

=== FFIEC Quality Self-Check ===
- [x] Coverage complete
- [x] Structure correct
- [x] Specific dates / amounts
- [x] Keywords tagged
- [x] No full PII in narrative
- [x] No tipping language
- [x] No hedge language
- [x] No unrelated background
- [x] Continuing-activity prior IDs cited
- [x] Deadline confirmed
- [x] Retention noted
- [x] BSA-officer block present

=== Prior SAR Cross-References (continuing activity) ===
- BSA ID <id>, filed <date>, covered <period>

=== Document Retention ===
Records location: <institution location>   Retention: 5 years from filing date per 31 C.F.R. § 1020.320(d)

=== Unresolved Information ===
- <item> ,  Unknown ,  required for narrative [if any]

=== BSA Officer Review ===
Reviewer name:                Date:
Decision: File | Hold for additional information | Do not file (case-close memo required)
Reasonable-suspicion basis (one sentence):
Filing-deadline date confirmed: YYYY-MM-DD
Field 2 keyword(s) confirmed:
Final BSA ID (after FinCEN BSA E-Filing submission):

outcome signal

the user knows the skill worked when:

1. intake is complete and structured: filer, filing posture, detection / deadline dates, subjects, accounts, activity window, aggregate, alert source, red flags, investigation steps, and keywords are captured without gaps or unknowns (or gaps are flagged Unknown , required for narrative and acknowledged by the user).

2. DRAFT narrative is produced: a 4 to 8-paragraph narrative (longer for complex activity) in Introduction / Body / Conclusion format, with specific dates, amounts, last-4 identifiers, instruments, counterparties, and geographies, free of hedge language, full PII, tipping language, and unrelated background.

3. 5 W's + H are covered: all dimensions (Who, What, When, Where, Why, How) are present in the narrative and verified in the matrix.

4. weak-language audit is passed: phrases such as "may indicate", "could be consistent with", "seems", "likely", and "we believe" are removed or rewritten with concrete facts.

5. FFIEC quality self-check is passed: all 12 items are ticked; no failures.

6. filing deadline is confirmed and not imminent: the filing-deadline date is in the future (or flagged CRITICAL , DEADLINE IMMINENT if ≤ 7 days).

7. prior SAR cross-references are listed (if continuing-activity): prior BSA ID(s), filing dates, and activity periods are cited.

8. document-retention location and 5-year rule are noted: the output includes the location where supporting documentation is retained and the 31 C.F.R. § 1020.320(d) 5-year retention obligation.

9. BSA-officer review block is present and ready for sign-off: the block includes fields for reviewer name, date, decision, reasonable-suspicion basis, filing-deadline confirmation, Field 2 keywords, and final BSA ID (assigned by FinCEN after submission).

10. confidentiality is enforced: the DRAFT is marked DRAFT , BSA OFFICER MUST REVIEW BEFORE FINCEN BSA E-FILING SUBMISSION and all contents are treated as confidential supervisory information. no sharing with the subject or unauthorized parties.

11. the BSA officer is ready to review and sign: the user can hand the DRAFT to the BSA officer with confidence that it meets FFIEC standards, enforces confidentiality and evidence discipline, and is compliant with 31 C.F.R. Chapter X and 31 U.S.C. § 5318(g)(2).