A crypto SAR narrative must turn a complex investigation into a clear explanation of suspicious activity.
That can be difficult when a case involves multiple wallets, several blockchains, cross-chain bridges, rapid asset conversions and incomplete customer information.
However, the narrative should not read like a raw blockchain analytics report. It should explain who conducted the activity, what happened, when it occurred, how the funds moved and why the institution found the pattern suspicious.
This guide explains how to write a crypto SAR narrative that gives FinCEN and law enforcement useful, organized information.
Why the SAR Narrative Matters
The structured sections of FinCEN Form 111 capture names, addresses, amounts, dates and suspicious activity categories.
The narrative provides the context behind those fields. It allows the filer to explain relationships, timelines, transaction patterns and investigative findings that cannot be communicated through checkboxes alone.
A strong narrative may help investigators:
- Identify related subjects
- Trace funds across services
- Connect wallet addresses
- Compare reports from different institutions
- Understand a fraud or laundering method
- Locate supporting information
- Identify an immediate threat
Therefore, the narrative should be written for someone who has no prior knowledge of the customer, platform or case.
Use the Who, What, When, Where, Why and How Structure
A useful crypto SAR narrative should answer six questions.
Who was involved?
Identify the subject and any known related parties. Include relevant customer names, account identifiers, business details and relationships.
If several accounts appear connected through devices, wallets or funding sources, explain the connection.
What happened?
Describe the suspicious transactions and customer behavior.
For example, explain whether the customer received funds from numerous unrelated wallets, rapidly converted assets, used a mixer or transferred funds to a scam-linked address.
When did it happen?
Provide the date range of the suspicious activity. If the activity occurred over several weeks, explain the sequence in chronological order.
Where did the activity occur?
Identify the reporting platform, relevant external exchanges, wallet services, crypto ATMs, banks or jurisdictions when known.
Why was it suspicious?
Connect the activity to the customer’s expected behavior and available evidence.
A risk score alone is not enough. Explain why the pattern was inconsistent, unexplained or linked to suspected illicit activity.
How did the funds move?
Summarize the flow of funds from entry to exit. Mention conversions, transfers, bridges and other important movement without listing every irrelevant transaction.
The complete FinCEN crypto SAR guide provides additional information about thresholds, deadlines and filing requirements.
Include Crypto-Specific Identifiers
FinCEN has identified several types of crypto information that may be particularly valuable to investigators.
Where available and relevant, include:
- Virtual currency wallet addresses
- Transaction hashes
- Cryptoasset type
- Blockchain network
- Transaction date and time
- Crypto and US dollar values
- Originating and receiving services
- Relevant transaction history
- IP addresses
- Device information
- Customer account identifiers
- Publicly available online information
FinCEN’s advisory on illicit activity involving convertible virtual currency specifically identifies wallet addresses, transaction hashes, account information, IP addresses and device data as potentially useful.
Copy wallet addresses and transaction hashes carefully. A single incorrect character can make an identifier useless.
Explain Blockchain Exposure Accurately
Blockchain analytics findings should be described with appropriate context.
Avoid writing that a wallet “is criminal” simply because it has indirect exposure to a high-risk entity. Instead, explain:
- Whether the exposure was direct or indirect
- The number of transaction steps involved
- The value and percentage of exposed funds
- The date of the exposure
- The attributed entity
- The source of the attribution
- Whether other indicators supported the concern
For example:
Blockchain analysis identified a direct transfer of 1.2 BTC from an address attributed to a fraud service.
This is clearer than:
The customer had a high blockchain risk score.
The second statement gives the reader no information about the type or strength of the exposure.
Write the Narrative in Chronological Order
A chronological structure makes a complicated investigation easier to follow.
A useful order is:
- Introduce the subject and account.
- State the total suspicious amount and date range.
- Explain how the activity began.
- Describe the main transaction sequence.
- Identify relevant wallet and account connections.
- Summarize the customer’s explanation.
- Explain why the institution remained concerned.
- State whether law enforcement was contacted.
- Identify the availability of supporting documentation.
Where possible, place the most important information near the beginning. Do not make the reader search through several paragraphs to discover the suspicious amount or primary concern.
Crypto SAR Narrative Example
Consider a customer who stated that the account would be used for long-term crypto investment.
A clearer narrative could begin:
From June 2 through June 11, the subject received approximately $38,400 in USDT through 21 externally hosted wallets. The funds were converted to BTC within 30 minutes of receipt and withdrawn to three addresses. Blockchain analysis identified direct exposure between two sending wallets and addresses attributed to an online investment fraud scheme.
The narrative could then explain:
- The customer’s occupation and expected activity
- The rapid conversion and withdrawal pattern
- Wallet connections
- Device or IP links to other accounts
- The customer’s explanation
- Why the explanation did not resolve the concern
- Where supporting records are stored
The narrative should not claim that the customer committed fraud unless that fact has been established. Instead, report the observed behavior and the institution’s reason for suspicion.
Common Narrative Mistakes
Repeating the alert description
“High-risk wallet alert generated” does not explain the activity. Describe the underlying transaction.
Including unsupported conclusions
Avoid declaring that the customer is a money launderer, scammer or sanctions evader without verified evidence.
Leaving out the total amount
The narrative should clearly state the total value connected to the suspicious activity.
Listing transactions without explaining the pattern
A long series of hashes and values can be difficult to understand. Summarize the pattern and identify the most relevant transactions.
Failing to distinguish facts from analysis
State what the institution observed, what external analytics indicated and what conclusions the investigator reached.
Using unexplained internal terms
Internal alert names and abbreviations may not make sense to an external investigator. Use clear language.
Forgetting advisory key terms
Where a current FinCEN advisory requests a specific term, include it according to the advisory instructions. FinCEN maintains a current list of SAR advisory key terms. 
Crypto SAR Narrative Checklist
Before submission, confirm that the narrative:
- Identifies the subject and account
- States the total amount
- Provides the relevant date range
- Follows a logical timeline
- Explains why the activity was suspicious
- Includes relevant wallet addresses
- Includes important transaction hashes
- Distinguishes direct from indirect exposure
- Summarizes the customer’s explanation
- Avoids unsupported allegations
- Matches the structured form fields
- Identifies available supporting records
Build Stronger Crypto SAR Narratives
The Suspicious Activity Reporting (SAR) for Crypto Under FinCEN course helps analysts understand crypto investigation records, suspicious activity indicators, SAR decision-making and narrative structure.
It is designed for AML analysts, SAR teams, transaction monitoring professionals and crypto compliance officers working with digital asset activity.
Frequently Asked Questions
Should every transaction hash be included?
Include hashes that help explain or trace the suspicious activity. Avoid overwhelming the narrative with unrelated transactions.
Can a risk score be used in the narrative?
Yes, but it should not replace the underlying facts. Explain what produced the score and why it matters.
Should wallet addresses be shortened?
Generally, provide complete wallet addresses where relevant so investigators can use them.
Can the narrative say that a customer committed a crime?
The narrative should present verified facts and reasons for suspicion. Avoid unsupported criminal conclusions.
Should customer explanations be included?
Yes, when relevant. Explain what the customer said and why the response did or did not resolve the concern.
