Each SAR field is entered into FinCEN’s searchable database, so law enforcement can pull information or run inquires to aid investigations into financial and other illicit crimes. That’s why SARs are crucial. The law enforcement agencies are your audience and they need to know the whole “story” since they were not actively involved in the nefarious activity. It is imperative to describe each detail of the transaction, thus painting a picture as if the agencies were present.
FinCEN offers guidance on what should be included in the SAR Narrative in the SAR electronic filing instructions starting on page 110. This checklist is a great reference tool and TCA recommends consulting these instructions prior to filing; however, each narrative is unique, and no instructions can describe every situation.
Here are some steps TCA’s bankers use to ensure SAR narratives are comprehensive. Some banks have the instructions next to the draft SAR for ease of reference. Then they complete worksheets or use other resources used to gather critically important details prior to compiling the narrative. SARs should include any information readily available, including information obtained during the account opening process and due diligence efforts. The narrative is the conclusion of your investigation, so tell the story of your research. Others simply run through a mental checklist to ensure all essential elements are present. However, by using the filing instructions you don’t have to worry about memory lapses and generally answers to questions have already been addressed in the guidance.
FinCEN suggests BSA staff should prepare narratives around the “5 Ws”: Who? What? Where? When? Why? And also, How? Let’s start with a sample narrative to see how this works.
John Doe structured deposits to his checking account.
This is a simple statement; unfortunately, it omitted all the circumstances surrounding the suspicious activity. Let’s now overlay writing the SAR narrative using the 5 Ws.
The “Who”
Suspect(s) should be described in full detail in the narrative. Other applicable information should include occupation, including any title or position or nature of business information. Identification numbers and any other pertinent information known about the suspect also should be detailed. Also, include account numbers, as well as account opening dates and how the account was opened, plus the relationship of the parties to the bank. Also, if there are co‐owners or other parties involved, identify them and indicate whether they were involved in the suspicious activity. Finally, if there is fraud or elder abuse, remember to list the victim. The victim should never be listed in Part 1 Subject Information.
Armed with the “Who” information, let’s expand upon our initial narrative:
John Doe has been a customer of Good Bank since January 2006. John Doe maintains a joint checking account with Jane Doe. John Doe (Date of Birth MMDDYYYY, Driver’s License #XXXXXXX and Social Security #XXX‐XX‐XXXX) is listed and occupation is noted as a retired postal worker. Jane Doe (Date of Birth MMDDYYYY, Driver’s License #XXXXXXX and Social Security #XXX‐XX‐XXXX) also is noted and she is a retired teacher. Jane was not present at the time of any of the suspicious activity.
The “What”
To answer the “what,” describe the instruments used in the activity (i.e., funds transfers, letters of credit, correspondent accounts, casinos, structuring, shell companies, bonds or notes, stocks, mutual funds, insurance policies, traveler’s checks, bank drafts, money orders, credit or debit cards, prepaid cards, and digital currency). Include key terms in narratives to describe the type of instruments and the types of suspicious activity being reported.
The narrative should summarize the flow of funds and include the source of funds, the use, destination, and beneficiary of the funds.
Good Bank identified via its daily cash control reports that John Doe made three $9,000 cash deposits.
The “Where”
The narrative should indicate where the activity took place. Try to answer these questions:
- At which office(s) or branch(es) did the activity take place
- Was the activity transacted online or in person?
- Does the activity involve any foreign countries?
- Does the activity involve ATMs?
Including the ‘Where” in the narrative we have:
Good Bank identified via its daily cash control reports on December 28, 2016, December 29, 2016, and December 30, 2016 that John Doe made three $9,000 cash deposits. These deposits were made each day at about 10:00 am. The first two deposits were made at a teller window in the main office and the last deposit was made at the main bank’s drive‐thru.
The “When”
In describing the timeline, try to answer these questions:
- Does it take place over a period of time?
- What date was it first discovered?
- How long did it last?
If individual dates, amounts and transaction types are available, they should be included, as well as the aggregated amount of the activity. If there is a multitude of transaction data, consider adding a Comma Separated Values file, or .csv file, which is a file containing plain text, only containing numbers and letters structured in a tabular format. A reference should be made to the .csv file in the SAR narratives.
The What” added to the “When” now looks like this.
Good Bank identified via its daily cash control reports on December 28, 2016, December 29, 2016, and December 30, 2016 that John Doe made three $9,000 cash deposits. These deposits were made each day at about 10:00 am.
The “Why”
The ‘Why” often proves to be the hardest to add to the narrative. Staff should attempt to provide a detailed explanation of why the activity is unusual for the customer, and include the bank’s assessment of the normal and expected activity of the customer in comparison to the actual customer’s activity and other activity of similar customers. It is helpful to include the date a bank determined the activity is suspicious because this identifies the 30‐day time frame in which the SAR needs to be filed if there is a subject, or 60 days if there is no subject. We’ve included the addition of the “Why” here.
The BSA Department determined on January 5, 2017 that suspicious or unusual activity was identified for John Doe. In reviewing 90 days of account activity, John and Jane Doe receive monthly deposits from pensions and other investments. The debits to the account are typical of their consumer spending. Typically, there are only cash withdrawals of a few hundred dollars a couple times a month. It does not seem normal or expected that John Doe would deposit $27,000 in cash.
On January 4, 2017, John Doe wrote a check payable to a local car dealership with a memo “Cadillac.” It appears John Doe purchased a car; however, the source of funds “cash” is unknown to Good Bank.
The “How”
The method by which the suspicious activity took place should be detailed in a chronologically organized manner. Dates, destinations, amounts, accounts, frequency, and beneficiaries of funds transfers should be described in order of occurrence. If a structured deposit occurs in close proximity to a wire transfer, this should be described in the sequence of events. This may be implied by the 5 Ws, but make sure you fully describe your knowledge of the suspicious activity. Also, acknowledge if this was an internal staff referral.
Good Bank received a suspicious activity notification form from the main bank tellers citing suspicious cash deposit activity by John Doe.
Additional tips:
Include an introduction that provides the SAR’s purpose, any prior filings, etc. Introduce your story.
Good Bank is filing its first SAR on John Doe since the BSA Department believes John Doe conducted structured transactions.
There should be a conclusion that describes any follow‐up actions, the location of supporting documentation, and a description of supporting documentation.
The Bank has not contacted law enforcement. The supporting documentation used in this investigation included signature card, initial account opening forms, transaction documents, and suspicious activity referral forms. Supporting documentation is located with the BSA Officer for Good Bank at 1234 Bank St, Any City, and State.
IMPORTANT REMINDER – DO NOT include actual supporting documentation used in your investigation, but you may attach a .csv file that describes the transactions. Anything beyond transaction information (i.e., signature cards, internal referral forms or source documents) should be maintained in accordance with record retention guidelines and be easily retrievable. Remember, this was our initial narrative:
John Doe structured deposits to his checking account.
Taking into consideration the instructions and the BSA’s staff investigation, our narrative would now look like:
Good Bank is filing its first SAR on John Doe since the BSA Department believes John Doe conducted structured transactions. Good Bank received a suspicious activity notification form from the main bank tellers of suspicious cash deposit activity by John Doe.
John Doe has been a customer of Good Bank since January 2006. John Doe maintains a joint checking account with Jane Doe. John Doe (Date of Birth MMDDYYYY, Driver’s License #XXXXXXX and Social Security #XXX‐XX‐XXXX) is listed and occupation is noted as a retired postal worker. Jane Doe (Date of Birth MMDDYYYY, Driver’s License #XXXXXXX and Social Security #XXX‐XX‐XXXX) also is noted and she is a retired teacher. Jane was not present at the time of any of the suspicious activity.
Good Bank identified via its daily cash control reports on December 28, 2016, December 29, 2016 and December 30, 2016 that John Doe made three $9,000 cash deposits. These deposits were made each day at about 10:00 am. The customer made the first two deposits with a main bank teller and the last deposit was made at the main bank’s drive‐thru.
The BSA Department determined on January 5, 2017 suspicious or unusual activity for John Doe. In reviewing 90 days account activity, John and Jane Doe receive monthly deposits from pensions and other investments. The debits to the account are typical of the consumer’s spending. Typically, there are only cash withdrawals of a few hundred dollars a couple times a month. It does not seem anticipated that John Doe deposited $27,000 in cash.
On January 4, 2017, John Doe wrote a check payable to a local car dealership with a memo “Cadillac.” It appears John Doe purchased a car; however, the source of cash funds is unknown to Good Bank.
The Bank has not contacted law enforcement. The supporting documentation used in this investigation included signature card, initial account opening forms, transaction documents and suspicious activity referral forms. Supporting documentation is located with the BSA Officer for Good Bank at 1234 Bank St, Any City, and State.
There are additional SAR narrative resources available from FinCEN. TCA encourages filers to review the additional training material:
- FinCEN SAR Electronic Filing Instructions
- FinCEN Guidance on Preparing A Complete and Sufficient Suspicious Activity Report Narrative (2003)
Who is your BSA Auditor?
TCA’s BSA Action Team specializes in Independent Audit!
Contact the BSA Action Team for a custom quote at [email protected]
