Writing Better SARs: What the NCA actually needs

Quality over quantity: the NCA's message

The UK receives more SARs per capita than almost any other country in the world. Yet the UKFIU and NCA have consistently flagged the same problem: too many SARs provide too little actionable intelligence. A defensive SAR, filed to avoid prosecution, with minimal content, vague language, and incomplete subject information, consumes UKFIU analyst time without contributing to law enforcement outcomes.

The difference between a good SAR and a bad one is not the length: it is the specificity, the clarity of reasoning, and the completeness of the information provided. This part of the guide teaches you to write SARs that get used.

The 5W framework: the backbone of every SAR

Every SAR, regardless of the typology or complexity, should answer five fundamental questions. These are the intelligence questions that the UKFIU analyst needs to begin an investigation.

Before submitting any SAR, ask yourself: does this report clearly answer all five questions? If any are missing or vague, the SAR needs more work before it is submitted.

Subject information: be exhaustive

The most common quality failure in SARs is inadequate subject information. The UKFIU cannot investigate a subject they cannot identify. Provide everything you know.

For individual subjects

For business/entity subjects

• Full legal name and any trading names
• Company registration number and registered address
• Nature of business and stated purpose of relationship
• Names and details of directors and ultimate beneficial owners
• All account numbers associated with the entity
• VAT number if known
• Related entities in the same group or under common ownership

Writing the narrative: the heart of the SAR

The narrative is the most important part of the SAR. It is where the MLRO explains the suspicious activity, sets it in context, and communicates why it gives rise to suspicion of money laundering or terrorist financing. A good narrative is clear, specific, logical, and reads like an intelligence report, not a compliance form.

Narrative structure: a recommended approach

1. Context: who is the customer, what is the relationship, what do you know about them? (2-3 sentences)
2. What happened: describe the suspicious activity specifically: dates, amounts, counterparties, accounts (as much detail as possible)
3. Why it's suspicious: explain why this activity is inconsistent with what you know about the customer, or why it matches a known ML/TF typology. This is the most important paragraph.
4. What you've done: any additional checks conducted: adverse media search, CDD review, customer contact (if appropriate)
5. What you need: if submitting a DAML, state clearly what consent you are seeking and the value/nature of the transaction

The key paragraph: why it's suspicious

Many SARs describe what happened without explaining why it's suspicious. The "why" is what makes your SAR actionable. Some examples of good "why" reasoning:

• "This activity is inconsistent with the customer's stated occupation as a part-time teacher and declared income of £18,000 per year: the account has received £240,000 in the past 12 months."
• "The pattern of deposits, multiple cash payments between £8,000 and £9,500 over a 30-day period, is consistent with structuring to avoid the firm's internal cash reporting threshold."
• "The customer provided no explanation for the source of funds when asked, stating only that it was 'a business payment' despite having no registered business activity on file."
• "The recipient account in Jurisdiction X has been associated with fraud in previous adverse media reporting identified during our checks."

Good vs bad: real examples

The difference between a useful SAR and a defensive one is stark. These examples illustrate the quality gap.

Example 1: structuring suspicion

Example 2: international wire suspicion

The most common SAR mistakes

Typology-specific SAR tips

Different money laundering typologies require different information in the SAR narrative. Here are the key additions for the most common typologies:

🏦 Structuring / smurfing

• List every deposit: date, amount, branch/channel, account credited
• State the threshold that appears to be avoided (e.g. your internal cash reporting threshold)
• Include the total amount deposited and the period over which it occurred
• Compare to customer's declared income and account history

🌍 Trade-based money laundering (TBML)

• Name the specific goods or services ostensibly involved in the trade
• Identify the over or under-invoicing indicators: compare invoice values to market rates
• Name the counterparties and their jurisdictions
• Flag any mismatch between the stated trade and the customer's known business activity

🏠 Property-related laundering

• Property address, purchase price, and any cash element
• Source of funds for the deposit or purchase, if unknown or suspicious, say so
• Any third-party payments or unusual settlement arrangements
• Conveyancer/solicitor details if known

💻 Cyber fraud / authorised push payment

• The specific nature of the fraud if known (invoice fraud, romance scam, impersonation)
• The receiving account details: sort code, account number, name of account holder
• Whether the victim is the subject of the SAR (mule) or a third party
• Any URLs, email addresses, or phone numbers associated with the fraud

🔐 Cryptoasset-related

• Wallet addresses associated with the activity
• Which blockchain/network (Bitcoin, Ethereum, etc.)
• Any exchange platforms used, named, if known
• Results of any blockchain analytics checks conducted
• Whether the wallet has been flagged by analytics tools as associated with illicit activity

Frequently asked questions