Writing a SAR the UKFIU Can Actually Use

A suspicious activity report that reads as a summary of a gut feeling doesn't hold up to regulatory review. One that reads as a chain of specific, dated observations does. The difference is almost entirely structural.

A Suspicious Activity Report does one job. It gives the National Crime Agency’s UK Financial Intelligence Unit enough specific, factual information to decide whether the activity described warrants investigation, or, where a defence against money laundering is being sought, whether to grant consent to proceed.

It is not a place to record suspicion as a feeling. It records suspicion as evidence, laid out so a reader with no prior context on the case can follow the reasoning to the same conclusion the analyst reached.

The single most common failure: conclusions without observations

The weakest narratives I have seen, and early on written, read something like this: “Customer’s transaction pattern is inconsistent with stated business purpose and appears suspicious.”

A conclusion wearing the grammar of an observation. It tells a reviewer nothing about what was seen, when, or why any of it mattered.

The defensible version of the same underlying concern reads closer to: “Between 3 and 28 March 2026, the customer’s account received eleven incoming transfers ranging from £7,200 to £7,900, from eleven different individuals with no apparent business relationship to the customer’s stated import/export activity. Funds were withdrawn as cash or converted to a bank draft within 24 hours of each deposit in nine of the eleven instances.” No adjectives. No editorialising. Just what happened, when, and a pattern a trained reviewer recognises without being told to — structuring into amounts designed to look unremarkable one at a time, then rapid conversion into something less traceable.

The structure that holds up

Whatever the software, whatever the exact SARs Online form fields, a strong narrative does five things, roughly in this order:

States who and what, unambiguously. The accounts, the customers, and the specific activity in scope, without assuming the reader has the case file open already.
Lays out the chronology of observed facts — dates, amounts, counterparties, channels — in the order they occurred rather than the order they were noticed.
Names the specific indicators that make the pattern suspicious, tied to recognised typologies where they apply: structuring, rapid movement of funds, unexplained third-party involvement, transactions inconsistent with stated occupation or business purpose. A generic “unusual activity” label does none of that work.
States what due diligence was performed before filing. Was the customer asked to explain? Was the explanation checked against anything else on the account? This is the section that gets skipped most often, and it is the one that shows an analyst did the work rather than pattern-matching a rule hit.
States the conclusion last, arriving as a consequence of everything above it rather than as the headline the rest was built to justify.

What to leave out, deliberately

Legal conclusions. “This constitutes money laundering under POCA 2002” is not the analyst’s determination to make. Describe the activity. Let the indicator speak.
Speculation about intent beyond what the facts carry. “Customer is likely laundering proceeds from narcotics trafficking” is a leap the evidence rarely licenses. “Activity is consistent with a structuring typology commonly associated with efforts to avoid scrutiny of the aggregate amount moved” stays inside what was observed.
Internal deliberation dressed as evidence. Three analysts discussing a case and disagreeing is not suspicious activity. Only the transactional facts are.

Suppose the SAR is a DAML — a Defence Against Money Laundering, filed under section 335 of the Proceeds of Crime Act 2002, because the institution would otherwise be handling criminal property, and therefore potentially laundering it, by completing the transaction. That narrative is not only informing an investigation. It is starting a clock.

Once the NCA receives the DAML it has seven working days to respond. Say nothing and consent is deemed to have been given automatically when the window closes, so the transaction proceeds. Refuse consent and a further 31-calendar-day moratorium begins, extendable by law enforcement in further 31-day blocks up to a statutory maximum, buying time to investigate, restrain assets or build a case — without ever telling you why.

Which produces a consequence most people miss. A vague DAML narrative risks more than a poor-quality intelligence record. It risks the NCA not having enough to act on inside seven working days, so consent is deemed granted by default and the money moves, regardless of how suspicious the underlying activity actually was. A precise, fact-dense narrative is what lets the UKFIU engage with the request inside a deadline that runs whether or not the writing is good enough to meet it.

Letting AI draft the narrative doesn’t lower the bar, it hides where it slipped

Generative AI is genuinely well suited to the mechanical part of this: take a structured set of transaction facts, produce clean chronological prose in roughly the format described above. Several case management platforms now ship exactly that feature.

The failure mode it introduces isn’t laziness. It is quieter than that.

Ask a model to write a “suspicious activity narrative” and it produces fluent, plausible-sounding prose whether or not every detail in it has been verified, because fluency is what it optimises for. A narrative that reads well is a different object from a narrative that is true, and the good-faith standard underneath the DAML consent regime depends on the second one. If an AI-drafted narrative states a date, an amount or a counterparty that nobody checked against source data, the analyst who files it carries the good-faith exposure. Not the tool that wrote it.

So: AI can draft the sentence structure. A human confirms every fact in it against its source before filing. Same discipline this piece has been arguing for throughout, applied to a new kind of first draft.

Why this discipline matters beyond the individual filing

A narrative built this way survives two things a vaguer one doesn’t. Regulatory examination of your programme’s SAR quality is the obvious one. The less obvious one is your own ability to reconstruct the reasoning six months later, when the same customer resurfaces in a different context and somebody has to work out what was already known.

Case files get reread far more often than they get written. A narrative that only makes sense to the person who filed it, on the day they filed it, has already failed at half its job.