How an AI employee drafts a SAR narrative from the case file under FinCEN rules, and which decisions stay with the BSA officer.
A suspicious activity report narrative is the part of a SAR that law enforcement actually reads, and it is the part analysts spend the most hours on. The evidence is already sitting in the case file. What takes time is turning it into a clear, chronological account that meets FinCEN's expectations before a 30-day clock runs out.
An AI employee can do the assembly work. It cannot own the decision. This post lays out where that line sits for a US bank or fintech under the Bank Secrecy Act.
The split matters because a SAR is a legal filing made on the institution's behalf. A draft is a work product. The filing decision and the final narrative carry the accountability, and they stay with named people.
FinCEN's SAR Electronic Filing Instructions (Version 1.0, April 2026) describe Part V as the section that explains the nature and circumstances of the activity. Filers must give a clear, complete and concise description, including what was unusual or irregular enough to cause suspicion. The instructions then give a checklist. Read against the classic who, what, when, where, why and how, it asks for the following:
Question | What the instructions ask for |
|---|---|
Who | Who conducted the activity, who benefited and how, plus any insider relationship to the institution |
What | The conduct or transactions that caused suspicion, and whether they were completed or only attempted |
When | A chronological account when the activity spans more than one day |
Where | Where it took place, such as a branch or agent location, and any foreign countries or currencies involved |
Why | What made the activity unusual, and whether it is an isolated incident or related to other activity |
How | The method, such as the instruments, channels or scheme used, and any evidence of cover-up or an explanation given by the subject |
The same checklist adds rules that a drafting tool must respect. Do not include tabular data in the narrative; put it in a CSV attachment of up to 1 megabyte. Do not attach supporting documents to the SAR, but describe them and keep them for five years. Do not include legal disclaimers. If the report contains information received under the 314(b) sharing program, the narrative must say so using the required statement. A corrected or amended SAR describes the corrections at the beginning of the narrative.
Under 31 CFR 1020.320(b)(3), a bank must file no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing. If no suspect was identified on that date, the bank may take up to 30 more days to identify one, but never more than 60 calendar days after initial detection. For violations that need immediate attention, such as an ongoing money laundering scheme, the bank must also call an appropriate law enforcement authority.
Continuing activity has its own convention. FinCEN's instructions note that its guidance has advised filing for continuing activity after a 90-day review period, with the filing due 120 calendar days after the previous related SAR. Institutions are not required to follow that approach and may file on the general timelines instead. If you use it, the timeline is day 0 detection, day 30 initial SAR, day 120 end of the 90-day period, and day 150 continuing SAR. The continuing narrative covers the 90-day period and uses prior narratives only where needed, without copying them.
The clock matters for an AI employee because the drafting window is short. A draft that is ready on day 12 leaves the reviewer room to challenge it. A draft that arrives on day 28 does not.
The AI employee handles the assembly and the first draft. People keep every judgment call.
Step | AI employee | Person |
|---|---|---|
Pull the case evidence | Gathers alerts, transactions, customer and account records, KYC and due diligence files, and prior SARs on the same subject | Confirms the file is complete |
Build the timeline | Orders events by date, flags gaps and attempted versus completed transactions | Checks that the timeline reflects what happened |
Draft the narrative | Writes a first draft in the checklist order, with each statement cited to a document in the case file | Edits, removes unsupported inferences, adds context the file does not hold |
Track the deadline | Starts the 30-day clock at the documented detection date and warns as it approaches | Records and defends the detection date |
Decide to file | Presents evidence for and against, and a recommendation | Makes the decision to file or not, and records the reason |
Approve the narrative | Locks the approved version and logs the approval | BSA officer or delegate gives final sign-off |
Submit and retain | Prepares the filing package and the supporting-document index | Files through the BSA E-Filing System and retains records for five years |
Citations to the case file are the control that makes a draft reviewable. If every sentence points to a transaction, document or note, the reviewer checks facts instead of rewriting prose. A sentence the AI employee cannot cite is flagged, not smoothed over.
For how a full investigation is run around this step, see AI agents for financial crime investigations. The reviewer's role is covered in the AI compliance analyst.
A SAR, and any information that would reveal its existence, is confidential. Under 31 CFR 1020.320(e), no bank and no director, officer, employee or agent of a bank may disclose a SAR or information that would reveal it, with narrow exceptions such as disclosure to FinCEN, law enforcement and the bank's examiners. The statute behind it is 31 U.S.C. 5318(g)(2).
For an AI employee this becomes a design requirement, not a policy memo:
The model's own outputs fall under the same rule. A draft narrative is SAR information from the moment it exists.
The tipping-off controls above are easiest to enforce when they sit in the agent's AOP and identity, not in a policy memo. Here is how we would configure a SAR-drafting employee.
When the BSA officer rewrites a paragraph, that edit is a candidate change to the AOP. It goes onto a branch, runs against a golden set of previously approved narratives for that SAR type, gets reviewed, and merges. Scope is deliberate: a phrasing preference for structuring cases does not leak into account-takeover drafts.
Because a draft is SAR information from the moment it exists, this job is the clearest case for running inside the bank's boundary. Our deployment models page describes BYOC on AWS, Azure or GCP, and fully on-premises, which keeps the model's inputs and outputs inside infrastructure you already audit.
A reviewer needs a short checklist that does not depend on trusting the draft:
Where the institution decides not to file, the reasoning should still be written down. That record is part of the program an examiner will ask about.
Start with one SAR type that has a consistent evidence pattern, such as structuring or an account takeover. Run the AI employee's draft in parallel with the analyst's own for the first batch, and compare them on completeness, citation quality and time to a reviewable draft. Keep the BSA officer's sign-off gate fixed from day one, and loosen only the amount of editing the draft needs, not the approval itself. The wider workflow is described in AML automation: how it works, and the remediation side in AML lookback review with AI.
Related definitions: Suspicious Activity Report (SAR) and transaction monitoring.
