Automating SAR Narratives Without Losing Human Accountability

Last updated: September 2026

SAR narrative automation hands the first draft of a suspicious activity report (SAR) narrative to software, so an investigator starts by editing a draft built from the case file. It is worth doing only if every statement in the draft traces to that file and a named person still reviews the narrative and owns it. This guide covers what the Financial Crimes Enforcement Network (FinCEN) expects a narrative to carry, and how to draft, review and test narratives so that every statement holds up.

TL;DR

• Automate the assembly of the facts and the first draft. Keep the decision that activity is suspicious, the interpretation of the facts, the approval and the filing with named people.

• A drafted narrative is held to the same standard as a written one: FinCEN's five essential elements (who, what, when, where and why), plus how the activity was carried out.

• The slow part of a narrative is gathering facts from several systems before drafting starts. A draft can only be as good as the case file behind it.

• In a usable draft, every statement links to a record, inferences are marked, and gaps are flagged rather than filled.

• Review drafts against a written checklist, keep preparing and submitting in different hands, and measure the edits reviewers make.

• FinCEN has issued no guidance on AI in SAR preparation, and the revised model risk guidance leaves agentic AI outside its scope, so the institution's own controls carry the risk.

What is SAR narrative automation?

SAR narrative automation is the use of software, increasingly AI, to assemble the facts of an investigation and draft the suspicious activity report narrative for an investigator to review, edit and approve. The draft is useful only if every statement traces to the case record, inferences are marked as inferences, and gaps are flagged rather than filled. Automation changes who types the first version. The decision that the activity is suspicious, the approval of the narrative and the filing of the SAR stay with the same people as before.

The narrative is the finish of an investigation, and its quality is largely settled before drafting starts: a draft drawn from a thin case file will be thin however well it reads.

FinCEN's current SAR filing instructions call the narrative "critical to understanding the nature and circumstances of the suspicious activity," and that standard applies whatever produced the first draft. The institution owns what the SAR says.

What does a SAR narrative have to do?

A SAR narrative has to explain what happened and why it is suspicious, clearly enough that an investigator outside the institution can follow it. FinCEN's current SAR filing instructions, released in April 2026, say filers "must provide a clear, complete, and concise description of the activity, including what was unusual or irregular that caused suspicion." Any draft is checked against that standard, whoever or whatever produced it.

FinCEN's SAR narrative guidance, issued in 2003 and still posted on its website, sets out the structure. The guidance asks for narratives that are "clear, concise, and thorough," written in a "concise and chronological format" with an introduction, a body and a conclusion. FinCEN names five essential elements a narrative should identify and says the method of operation is "also important and should be included in the narrative." Each element has to come from somewhere in the case file:

• Who: the subjects and their relationship to the institution, from customer and account records.

• What: the accounts, instruments and transactions involved.

• When: the dates of the activity, in order.

• Where: where the activity took place, including where the initial transaction occurred.

• Why: what makes the activity unusual for this customer, set against what the customer normally does.

• How: the method of operation, meaning the steps by which the funds or the activity moved.

The current instructions add specifics. Describe the conduct that raised suspicion chronologically where it spans more than one instance or day, say whether transactions were completed or only attempted, and explain who benefited and how. Describe the supporting documentation and keep it for five years, without including it with the SAR, and keep tabular data out of the narrative.

Appendix L of the FFIEC's BSA/AML examination manual, its SAR quality guidance, adds two points. The narrative should describe, "as fully as possible, why the activity or transaction is unusual for the customer," and where it summarizes a flow of funds it "should always include the source of the funds (origination) and the use, destination, or beneficiary of the funds." Drafts tend to go thin on the why, because it depends on the customer's expected behavior, which lives in the case file rather than in the alert. FinCEN's 2003 guidance also includes worked examples of insufficient narratives, with its comments on what each one misses.

When a SAR must be filed, and by when, is a separate question, covered in a guide to SAR filing requirements.

Where does the time in a SAR narrative actually go?

Most of the time in a SAR narrative goes into assembling the facts, before anyone writes a sentence. Investigators pull records from several systems, copy them into spreadsheets and reconcile them before drafting. A senior fraud analyst at an asset management firm described it: "When we're doing the narratives, the case narratives, I'm in... different platforms, grabbing, copying and pasting, creating spreadsheets with IP address history and, or online activity. And it's so time consuming."

Templates are a common SAR writing aid for recurring activity, and they save less time than they seem to. "We do see a lot of the same type of activity," a BSA officer at a sponsor bank said. "And so it's you know, filling in the blanks on a template for a narrative. So it's still timely, you know, it still takes time."

A filled SAR narrative template is also not yet a narrative. A template can answer every prompt and still fail to tell the story in order, which is the failure FinCEN's own examples describe.

The raw material for a narrative already exists once the investigation has been done properly. The FFIEC's BSA/AML examination manual says that "after thorough research and analysis, investigators should document conclusions including any recommendation regarding whether or not to file a SAR." That documented conclusion, with the evidence behind it, is what a narrative is drafted from. A tool that drafts without assembling that evidence saves typing time and leaves the fact gathering untouched.

Some teams already use AI for drafting help. A BSA officer at a community bank said the only AI tool in use at the bank was a general assistant for compliance questions, which also helped narrate SARs and was not connected to the bank's core system. An assistant that cannot see the case record works only from what the investigator gives it, so the grounding and the checking still rest entirely on the investigator.

How alerts are reviewed and escalated before a case reaches this point is covered in a separate guide to AML L1 alert automation.

What can a drafting tool prepare, and what must a person keep?

A drafting tool can prepare everything that is assembly, and a person keeps everything that is judgment. The tool gathers the facts from connected records, produces a first draft in the institution's structure and terms, links each statement to its source, and lists what it could not establish. A person decides that the activity is suspicious, interprets the facts, edits and approves the narrative, and signs and files the SAR.

The left column can be checked against the record. The right column is judgment, and it stays with people the institution can name.

A head of product platform strategy at a payments company asked the question at the center of this guide: "So, if you can do this in an automated fashion, it will save a ton of time, but... Is that legally really right? And would it be helpful?" FinCEN has issued no guidance on AI in SAR preparation, so the answer sits in the existing standard: the narrative has to meet it, and the institution has to stand behind it.

Drafting assistance joins an accountability chain that already has several people in it, and it must not collapse that chain. The BSA officer at the sponsor bank quoted above described the chain at their institution:

"We have BSA analysts are doing the investigation, they're preparing the SAR form. They are writing the narrative, doing all of that stuff. And then we have BSA managers that are doing quality control, making sure it's filled in correctly. Then they would be the ones signing it and submitting it to FinCEN."

The FFIEC's examination manual explains why that matters. "By their nature, SAR narratives are subjective, and examiners generally should not criticize the bank's interpretation of the facts." That deference assumes the interpretation is the institution's own, reached by people who can explain it. The manual also tells examiners to focus on whether the bank has an effective SAR decision-making process, and a drafting tool becomes part of that process.

How do you keep every statement in a draft grounded in the case file?

You keep a draft grounded by drafting only from approved case data and the institution's policies, and by linking every factual statement to the record it came from. A reviewer can then check each claim against its source instead of trusting the prose. Three rules follow from that:

1. Link every statement to a record. Each figure, date, account and counterparty in the draft points at the transaction, customer record or document it came from.

2. Mark inferences as inferences. Keep facts apart from inferences and recommendations, and keep the language descriptive ("indicative of," not "this is suspicious"), so the investigator draws the conclusion and can walk a phrase back.

3. Flag gaps instead of filling them. A draft should say what it could not find, such as a missing beneficiary, an unexplained source of funds, or a field no connected system could fill.

The gaps can matter more to an investigator than the prose. A financial services lead at an AML managed services provider said: "I'm more focused on what you didn't find than what you did find as crazy as that sounds... You don't have a pretty narrative every time. It's going to be missing things a lot, and that's okay as long as we save some time."

The payments company's head of product platform strategy, quoted above, said that if a drafting tool hallucinates, sending FinCEN a report with even a few wrong words in it would be a very big problem. Source links make a wrong word findable before filing, because a statement with no source is the first thing a reviewer questions.

Details have to come from the underlying records. An AML investigations lead at the same managed services provider pointed out that "a SAR narrative must show where the transaction, the initial transaction occurred," and that detail sits in the transaction record rather than in the alert summary.

For banks, the regulation gives one more reason to link statements to records. Under 31 CFR 1020.320(d), supporting documentation "shall be identified, and maintained by the bank as such, and shall be deemed to have been filed with the SAR," and the bank keeps it for five years from the date of filing. A statement that points at identified documentation is one the institution can produce when asked.

Oscilar sets out the same principles for AI in case management: AI should work only from approved case data and policies, link material statements to source fields, and flag missing or conflicting information.

How do automated drafts go wrong?

Automated drafts go wrong in five predictable ways, and four of them run against FinCEN's own guidance. Each has a matching check in the review checklist in the next section.

Restating the form. A member of the BSA/AML team at a credit union described an earlier test of narratives drafted by AI, which were "essentially just taking everything from step one, step two, step three and regurgitating it into the narrative. But like if it's already on the SAR form itself, it doesn't need to be in the narrative." FinCEN's instructions ask for a narrative that encompasses the data in the form's structured parts and adds whatever else is needed to explain the activity, and a draft that only restates the fields skips the explaining.

Filling the checklist. One of FinCEN's examples of an insufficient narrative is a bank that "responds to the checklist found in the SAR instructions" but "fails to provide a chronological and complete account of the violation of law in order to explain the nature of the suspicious activity." A template filled in field by field produces that kind of narrative.

Dumping data. FinCEN's instructions ask filers to keep tabular data out of the narrative, and including more data does not make a narrative safer. A regulatory reporting lead at a large bank said the bank had put full transactional data into its narratives as a safety net against human error, and had recently been questioned by the regulator about why.

Internal jargon. The slides in FinCEN's narrative guidance package call this the number one rule: "Do not assume the reader is familiar with your institution's internal terminology, acronyms, operational processes, or has other knowledge related to the reported violation." A draft assembled from system labels, queue names and rule codes breaks that rule by default, because those are the words the source systems use.

Ignoring the team's own standard. Teams that write down how narratives should read expect a draft to follow what they wrote. A trade compliance officer at an asset management firm said: "I have a desktop procedure that explains how I want narratives to be written... So there's specific terminology I want in the opening paragraph."

Drafting to one written standard also helps consistency. A BSA manager at a credit union said templates had not solved inconsistency when several different people wrote narratives, so a standard applied to every draft is a quality measure in its own right, separate from speed.

How should a drafted narrative be reviewed and approved?

Review a drafted narrative against a written checklist before approval, keep the person who prepares it separate from the person who submits it, and record who reviewed and approved it. A chief BSA officer at another sponsor bank put the regulatory posture plainly: "Even if we could automate all the way through SAR submission, just because we can, doesn't mean we should, from a regulatory posture, they're going to want to see us having very tight guardrails on how we QC this."

The review checklist below draws on FinCEN's instructions and guidance and on the FFIEC's SAR quality guidance.

Each row can be checked against the case file or against FinCEN's own words, which keeps the review consistent from one reviewer to the next.

Keep preparing and submitting in different hands. A drafting tool does not change the separation of duties: the analyst who prepares a SAR should not be the person who submits it, and a draft the tool produced counts as prepared work the analyst owns.

Treat narrative quality as its own review. An AML operations manager at a fintech said the team's QA looks at two separate things: the quality of the narrative and analysis, and whether monitoring flagged the right activity in the first place. A narrative can read well and still rest on a weak alert, and a strong alert can end in a thin narrative, so each gets its own check.

Measure the edits reviewers make. A chief compliance officer at a community bank asked whether other teams were finding that drafted case narratives were good but still needed a lot of legwork to make better. Those edits are the most direct evidence of draft quality, because each one marks something the draft got wrong or left out.

A BSA officer at a different community bank described their hesitation: "I'm old school, I used to just putting eyes on and do my own calculations and my own spreadsheets and analyzing ins and outs. I've not yet trusted AI to do that for me." A reviewer who can open the record behind every statement is still putting eyes on the facts, and the draft changes only where the review starts.

Which role holds which right when an agent is involved, from recommending a disposition to filing, is covered in a separate guide to human-in-the-loop in fraud and AML.

What evidence should you expect before relying on drafted narratives?

Before relying on drafted narratives, expect four kinds of evidence: a test against narratives the team has already filed, a parallel run on live cases, measures of rework and reviewer edits, and a complete log of what the tool produced and what people changed. Confidentiality controls belong in the same review.

Test against past work first. Run the drafting tool on closed cases and compare its drafts with the narratives the team actually filed, looking for missing elements, unsupported statements and wrong figures. Then run it in parallel on live cases, with investigators working as normal, and read out the results before anyone relies on a draft. Oscilar structures its own evaluation before production the same way: a backtest against historical alerts, then shadow mode on the live queue, with a readout at the end.

Measure quality as well as time. Track rework, reviewer edits, reopened cases and quality assurance findings alongside any time saved. A tool that saves drafting time but adds review time has shifted the work to reviewers.

Log everything. Prompts, outputs, edits, overrides and approvals should stay logged for review, so the institution can reconstruct who changed what and who approved the final text. Expect examiners to ask about the tool as well as the narrative: a chief digital and risk officer at a sponsor bank said an examiner at a previous institution "beat me up pretty heavy on data validation and AI validation and model validation."

Keep drafting where access is controlled. For banks, 31 CFR 1020.320(e) says: "A SAR, and any information that would reveal the existence of a SAR, are confidential and shall not be disclosed except as authorized in this paragraph (e)." A draft narrative can reveal that a SAR is being prepared, so the careful operational reading is that drafts belong inside systems the institution controls, visible only to the people working the case. How the rule applies to a particular tool is a question for the institution's own counsel.

What have regulators said about AI and SAR narratives?

As of 24 September 2026, FinCEN, which sets the SAR standard, has issued no guidance on using AI to prepare SARs, and neither its current filing instructions nor its October 2025 SAR FAQs mention it. The existing narrative standard therefore applies to a drafted narrative in the same way it applies to a written one.

A March 2026 Treasury report to Congress on innovative technologies to counter illicit finance involving digital assets describes the practice in a section on how financial institutions use AI. According to the report, "financial institutions are experimenting with GenAI applications that can be used to assist AML/CFT compliance personnel at financial institutions with completing case reviews, investigating suspicious activity, and even drafting suspicious activity report (SAR) narratives." The same report says "data quality, governance, and validation concerns remain barriers to the implementation of AI tools." The report neither endorses nor restricts the practice.

The revised interagency model risk guidance, issued on 17 April 2026 as the Federal Reserve's SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026, places generative and agentic AI outside its scope. For tools the guidance does not cover, it says a banking organization's own risk management and governance practices "should guide the determination of appropriate governance and controls." The agencies have said they plan to issue a request for information on model risk management that considers, in particular, banks' use of AI, including generative and agentic AI; it had not been issued as of 24 September 2026.

The 2018 interagency statement on innovative efforts to combat money laundering and terrorist financing, still in effect, names suspicious activity reporting among the areas innovation may augment. The statement also says banks "must continue to meet their BSA/AML compliance obligations" when they pilot new approaches. The preamble to FinCEN's proposed AML/CFT program rule, published in April 2026 and still a proposal, says institutions that "responsibly experiment with innovative technologies" will not incur additional risk of a significant supervisory or enforcement action "solely based on the use of innovative technologies." Neither the statement nor the proposal changes who is accountable for the SAR: the institution files it and owns what it says, whatever produced the first draft.

How Oscilar approaches SAR narratives

Oscilar treats the narrative as the finish of an investigation, owned by the institution's investigators and reviewers. Its SAR narrative agent drafts from the case the investigator has built, and people at the institution edit, approve and file the result.

Oscilar's Agent Hub describes the agent in these words: "Drafts SAR narratives using structured case data, transaction history, and internal policies. The agent organizes facts into a regulator-ready format, highlights risk indicators, and serves this up as the last stage of SAR filing." Where the platform is connected to the source systems, it can populate SAR subject fields from them, and fields it cannot fill are highlighted for manual completion, so the gap stays visible to the investigator.

The same operating rule runs across Oscilar's agents that draft while investigators decide: agents never autonomously close or escalate alerts, and every recommendation is reviewed and confirmed by a human analyst before any action is taken. Oscilar keeps a full audit trail per decision with stored reasoning, and is human-in-the-loop by design. Role-based controls keep the analyst who prepares a SAR from being the person who submits it.

The SAR narrative agent is described in more detail on its own product page.

Frequently asked questions

What is SAR narrative automation?

SAR narrative automation is software, increasingly AI, that assembles the facts of an investigation and drafts the suspicious activity report narrative for an investigator to edit. A person still reviews and approves the narrative, and the institution files it and owns what it says. The approach works only when every statement in the draft traces to the case record and gaps are flagged rather than filled.

Can AI write a SAR narrative?

AI can draft a SAR narrative from the case record, and a March 2026 Treasury report to Congress describes institutions experimenting with that use. The draft is a starting point: a person reviews and edits it, someone with authority approves it, and the institution files the SAR and owns its content. FinCEN has issued no guidance on AI in SAR preparation, so the same narrative standard applies to a drafted narrative as to a written one.

How do you stop an AI-drafted narrative from stating something that is not in the case file?

Draft only from approved case data, and link every factual statement to the transaction, customer record or document it came from, so a reviewer can check each one against its source. Mark inferences as inferences, and have the draft list what it could not establish instead of filling the gap. The reviewer then checks the links as well as the prose before approving the narrative.

What must a SAR narrative contain to be complete and sufficient?

A complete and sufficient SAR narrative identifies the five essential elements FinCEN names (who, what, when, where and why) and describes how the activity was carried out. FinCEN's current filing instructions also ask for a chronological account where activity spans more than one instance or day, whether transactions were completed or only attempted, who benefited and how, and a description of the supporting documentation. The FFIEC's SAR quality guidance adds why the activity is unusual for the customer and, where funds moved, their source and destination.

What testing and audit trail should regulators and buyers expect from narrative automation?

Expect drafts to be tested against narratives the team has already filed, then run in parallel on live cases, with reviewer edits and rework measured before anyone relies on them. Prompts, outputs, edits, overrides and approvals should stay logged, so the institution can show who changed what and who approved the final narrative. The revised interagency model risk guidance places agentic AI outside its scope, so the institution's own governance sets these controls.

A drafted narrative is worth using when every statement traces to the case file and a named person has reviewed it and stands behind it. Automate the assembly and the first draft, and keep the decision to file and the accountability for what the SAR says with people. To see how drafting, review and an audit trail for every decision fit together, read about AML compliance for banks, or ask for a walkthrough on cases your team has already closed.