The narratives that come back are almost never wrong about the suspicion. They are right about the suspicion but can't prove it on the page.
That is a writing failure, not an investigation failure. It is also the most fixable thing in this job, because the defects repeat.
Below are the five defects, a skeleton you can reuse on Monday morning, and one full rewrite of a weak narrative. The article serves both naming conventions. The United Arab Emirates files a suspicious transaction report, an STR, through goAML. The United States files a suspicious activity report, a SAR, with FinCEN. The craft is identical. The form is not.
SAR or STR: what a suspicious activity report is, and which one you file
Key point: the obligation is the same in both regimes, and in the UAE the two names mean two different reports.
In the United States, a bank files a SAR with the Financial Crimes Enforcement Network, FinCEN, through the BSA E-Filing System. BSA stands for Bank Secrecy Act. In the United Arab Emirates, a firm files with the UAE Financial Intelligence Unit, the FIU, through goAML, the reporting platform developed by the United Nations Office on Drugs and Crime.
Here is what catches people. In goAML, STR and SAR are not synonyms. The UAE FIU's published report type list treats a suspicious transaction report as suspicion attaching to a transaction, and a suspicious activity report as suspicion attaching to activity or to an attempted transaction that was not executed.
| Concept | United States | United Arab Emirates |
| Suspicion in an executed transaction | Suspicious activity report (SAR) | Suspicious transaction report (STR) |
| Suspicion in an attempted transaction | Still filed as a SAR | Filed as a SAR, a separate report type |
| Filing channel | BSA E-Filing System | goAML portal |
| Recipient | FinCEN | UAE Financial Intelligence Unit |
| Who owns the filing decision | BSA Officer | Compliance Officer in UAE federal law, MLRO in the DIFC and the ADGM |
That list carries further report types too, including high-risk country reports, sector reports for precious metals and real estate, name-match and funds-freeze reports, and the additional information types the FIU uses to come back to you. Choose the type before you write, because it sets what the reader expects.
Read the FIU's own goAML report types document rather than any consultancy summary, including this one. The version I read is dated April 2024 and the list changes. Our separate guide, "How to Register and File on goAML in the UAE", covers registration and submission.
SAR reporting requirements: what the law asks the narrative to do
Key point: the artefact you inspect is now cheap to produce convincingly, so it carries far less evidential weight than it did.
"Where Financial Institutions, Designated Non-Financial Businesses and Professions, or Virtual Asset Service Providers suspect, or have reasonable grounds to suspect, that a Transaction or Funds, in whole or in part, represent Proceeds or are related to or intended to be used in the Crime, regardless of their value, they shall notify the Unit without delay and directly, by providing a detailed report containing all available data and information concerning such Transaction and the relevant parties, through the electronic system designated by the Unit or by any other approved means, and shall furnish any additional information requested by the Unit, without invoking confidentiality provisions."
Three things govern drafting. Suspicion or reasonable grounds to suspect is the trigger, not proof. Value is irrelevant. And the standard is a completeness test, not a length test.
Cabinet Resolution No. 134 of 2025 carries the mechanics. Article 18(1)(a) requires you to "Immediately and without delay notify the Unit by submitting Suspicious Transaction Reports, containing all available data and information relating to such Transaction or funds, and related parties", and Article 18(1)(b) to "Promptly respond to any request from the Unit for additional information."
Note what the law does not say. It gives no number of days. Treat any day count you are handed as a house standard until someone shows you the text.
The clause that matters most for narrative quality sits in the record-keeping article. Article 25(3) of the same Resolution:
"Financial Institutions, Designated Non-Financial Businesses and Professions, and Virtual Asset Service Providers shall organize retained records, documents, and instruments in a manner sufficient to permit the reconstruction of individual Transactions, data analysis, and the tracing of financial transactions, so as to be capable, where necessary, of providing evidence for prosecution of criminal activity."
Reconstruction. That is the test your reviewer applies, whether or not they phrase it that way.
The United States expects the same in different words. The FFIEC BSA/AML Examination Manual, Appendix L, SAR Quality Guidance, states that "In general, a SAR narrative should identify the five essential elements of information (who? what? when? where? and why?) for the suspicious activity being reported", and separately that "The narrative should describe the 'modus operandi' or the method of operation of the subject conducting the suspicious activity."
Quality assurance, QA, is your firm's internal review before the report goes out. It is a rehearsal for a reader with no context at all.
The five reasons a SAR narrative comes back from quality assurance
Key point: five defects account for most rework, and each has a specific correction.
Table 2 names the five defects, what the reviewer actually sees on the page, the correction for each, and the part of the narrative where the correction belongs. Read the second column as the sentence a reviewer says when they hand the work back, and the third as the only column you can act on. Defects one to four are content failures. Defect five is a structure failure, which is why a narrative can carry every relevant fact and still be returned.
The common mistake is to treat a defect list as a final check. An AML quality assurance function that only inspects finished narratives catches errors late and expensively, because every SAR filing that comes back is a case worked twice by two people. Run the five defects against your own draft while the case is still open, when a missing counterparty name or an unrecorded baseline can still be pulled from the file rather than reconstructed from memory.
| Defect | What the reviewer sees | The correction | Where it belongs |
| 1. Suspicion asserted, not evidenced | Adjectives such as unusual or unexplained, with no facts underneath | Delete the adjective and write the fact that produced it | The reason for suspicion, last |
| 2. The money is not traced | Credits described, debits described, no link between them | Follow each inflow to its outflow, with dates and counterparties | The what and the how |
| 3. System data restated, not explained | Alert identifiers, rule codes and raw transaction dumps pasted in | Describe the pattern in words, then support it with figures | The what |
| 4. Expected activity never established | Nothing to deviate from, so nothing reads as unusual | State the recorded profile first, then the departure from it | The who, first |
| 5. Not readable in one pass | Undefined shorthand, no chronology, conclusion buried | Chronological order, no internal abbreviations, one idea per sentence | Throughout |
Liveness detection, presentation attacks and injection attacks in deepfake KYC fraud, in plain language
Key point: a face check proves either that something happened in front of a camera, or that something reached your system claiming to be a camera. Your control has to know which.
Every remote onboarding flow now has some form of face check. Practitioners call the whole problem deepfake KYC, which is shorthand rather than a definition. Two terms come up and are usually explained badly.
Liveness is a check that tries to establish that a real person was physically present at capture, rather than a still image or a recording. That is all it claims.
A presentation attack is the category where something is shown to the camera instead of a live person. The control point is the capture environment.
An injection attack is the category where the camera is bypassed and prepared content is delivered into the verification flow as though it came from one. The control point is the integrity of the channel and the device, not the picture.
I am not going to describe how either is carried out. The distinction is what matters operationally, because it tells you where the control has to sit. If your flow can only assess the image it receives, it can say something about presentation and almost nothing about injection. That is a question for your technology owner rather than your analyst. But the analyst should know which question was answered, because it changes what their approval means.
Two rules for any procedure. No control type "stops" this, and a claim that one does is marketing. And a liveness result is one input to a decision, never the decision.
The identity verification hierarchy: weakest to strongest evidence in remote onboarding
Key point: rank evidence by how hard it is for the applicant to control, not by how modern it sounds.
Ranking evidence by how hard it is for the applicant to control is the structure I teach. It is simple on purpose, because it has to survive contact with a queue on a busy afternoon.
Table 1 sets out five levels. Each row names the check, what that check genuinely proves, and what it does not prove, which is the column most procedures leave out. The most common mistake is to treat the levels as a ladder and stop climbing once one of them returns a green result.
| Level | What it is | What it proves | What it does not prove |
| 1 | Visual inspection of a submitted artefact | The file is legible and matches the application | That the document is genuine, or that the person exists |
| 2 | Automated document authentication | The artefact behaves like a document of that type under machine checks | That the identity behind it is a real person with a real history |
| 3 | Liveness and biometric binding | A capture behaved like a live person and matched the document image | That the underlying identity is genuine, or that the channel was trustworthy |
| 4 | Verification against an authoritative source | The identity data matches a record held by a body that issued or registers it | Who presented it, unless the check is bound to the session |
| 5 | Corroboration across independent data the applicant does not control | The identity has a footprint that was not created for this application | Nothing on its own. It raises or lowers confidence, it does not certify |
Reason 1: the narrative asserts suspicion instead of evidencing it
"The activity is inconsistent with the customer's profile" is a conclusion. The reader's job is to reach it from your facts. So every time you write an adjective of suspicion, ask what you saw that made you write it, and write that instead.
A reviewer puts one question to every adjective on the page: what did you see? Unusual becomes a count of deposits, a number of branches and a set of dates. Unexplained becomes a document requested on a date, requested again, and never produced. Words such as structured, layered or integrated are worse than vague, because they are legal characterisations rather than observations, and the analyst is not the person who makes them.
The same discipline applies to AML red flags. A red flag is an indicator that tells you to look, not a finding that closes the question. Naming the indicator and then setting out the facts behind it is sound. Naming the indicator and stopping there leaves the reader with your judgement and none of your evidence, which is exactly the file that cannot be defended two years later.
Reason 2: the money is not traced from source to destination
Untraced money is the most common serious defect I see in review, including in work by experienced analysts. The narrative describes deposits, then describes transfers, and never joins them. Join them: which credits funded which debits, on what dates, to which named counterparties, leaving what balance behind.
The test a reviewer applies is simple. Cover the attachments and try to rebuild the flow from the words alone. If rebuilding it needs the statement, the narrative has not done its work, and the reader at the receiving end has no statement in front of them.
Two habits fix most of it. Write inflows and outflows as one chronological sequence rather than as two blocks, so the gap between money arriving and money leaving appears on the page as a number of days. Then say what the balance did across the period, because an account that returns to near nothing after each cycle is being used to pass funds rather than to hold them, and that is an observation you can evidence rather than a conclusion you assert. Where the data you hold cannot establish which credit funded which debit, write that limitation into the narrative instead of leaving the reader to assume you checked.
Reason 3: raw system output is pasted in place of explanation
Transaction monitoring, TM, is the automated rule layer that generates alerts for human review. Its alert identifiers and rule names mean nothing to an outside reader.
FinCEN makes the same point about its own filings. Its published posting on common suspicious activity reporting errors states that "most inadequate narratives merely repeat data in the form's fixed fields", and that "Restating the information found in critical fields does not sufficiently illustrate why the transaction was suspicious."
Say the activity was identified through automated monitoring, then explain the pattern yourself. To describe detection logic in plain words you first have to understand it, and our guide to what the rule that fired this alert was actually testing covers that.
Reason 4: expected activity is never established, so nothing looks unusual
Unusual is a comparison, and without a baseline there is nothing to compare against. The baseline comes from customer due diligence, CDD, the identification and risk assessment work done at onboarding and refreshed through the relationship: stated business, expected volumes, channels, counterparties, geographies.
Where the file records no baseline, say so, because that absence is itself a finding. Where enhanced due diligence, EDD, was performed, its findings belong in the narrative.
Reason 5: it cannot be read once and understood
Read your narrative aloud. If you stop to work out what a sentence means, so will the reviewer and so will the analyst at the Financial Intelligence Unit who receives it. That reader has your page and the structured fields and nothing else. No relationship manager to call, no case system, no colleague who worked the alert last month.
Three fixes cover most of it. Expand every abbreviation the first time it appears, including the ones your firm uses hourly and assumes are universal. Put the subject in the opening sentence and put the alert reference nowhere. Tell events in date order, because a reader who has to reorder your paragraphs is reconstructing the case twice.
The failure mode here is not rejection. It is a report that is accepted, read once, understood imperfectly and acted on by nobody. A narrative nobody can follow is hard to distinguish from a narrative nobody needed. What actually happens to a report once it reaches the Financial Intelligence Unit is a fair question for anyone writing one, and we take up the AML effectiveness question and what filing achieves separately.
SAR narrative structure: the who, what, when, where, why and how skeleton
Key point: five elements are standard, and the sixth, how, is the one most writers skip.
The frame is not mine. The FFIEC passage above names the five, then separately requires the method of operation. Treat the method as a sixth element. It is where the narrative stops being a list of events and becomes an explanation.
| Element | What it must contain | Common omission |
| Who | The subject, the accounts, the signatories, the beneficial owner, and every related party including third parties who moved money | Third-party depositors and payers not on the account |
| What | The instruments and mechanisms used, in words, with amounts and totals | The link between what came in and what went out |
| When | The review period, the date the activity was first noticed, the frequency, and the dates that carry the pattern | The date suspicion was actually formed |
| Where | Branches, channels, counterparties and jurisdictions, including any foreign jurisdiction involved | Which jurisdiction the funds left for |
| Why | The recorded expected activity, then the departure from it | The expected activity itself, so there is nothing to depart from |
| How | The method, told as a sequence a reader can follow | The whole element, because it is treated as optional |
Write the elements in that order and you produce a chronological narrative almost by accident. But do not turn the skeleton into a fill-in-the-blank template with fixed sentences. Templated wording is what makes fifty narratives read identically, and identical narratives are the ones a reviewer stops trusting.
A SAR narrative example, before and after: rewriting a weak narrative
Key point: this is an invented hypothetical, and seeing two versions of the same file teaches more than any amount of structure advice.
Everything in this section is invented. It describes no real person, customer, case, institution or jurisdiction. Names, dates, account references and figures are fictional. Figures use a notional currency unit written as CU, deliberately, so that no number here can be read as a reporting threshold or as a pattern to imitate.
Read the two versions in order, with the reviewer's notes between them. The weak version is not a straw man. It sits close to the middle of what arrives in review: the suspicion is correct, real work stands behind it, and the page cannot carry the weight of either. The rewrite adds no new investigation. Every fact in it was already available to the writer of the first version and sat unrecorded in the file.
Used as a team exercise, this works better in one direction than the other. Cover the rewrite, mark the weak narrative against Table 2 yourself, then read on. The defect most people miss is the missing baseline, because its absence is invisible on the page: nothing in a narrative announces that expected activity was never stated. That is also the defect that is hardest to repair once the case is closed and the onboarding file has moved on.
The weak narrative: the version that comes back from QA
Alert 4471 triggered on rule TM-CSD-03 for Customer 1. Customer is a trading company. Multiple cash deposits were noted during the review period. The volume is high, and the pattern appears to be structuring consistent with layering. Funds were subsequently transferred out. KYC is on file and was refreshed. We contacted the RM and received no satisfactory explanation. EDD was performed. The activity is unusual and inconsistent with the profile and is therefore being reported. Please refer to the attached statement for details.
Under a hundred words, and almost nothing a reader can act on.
What a QA reviewer flags in the weak narrative
Defect 1. Unusual, inconsistent, high. Conclusions, no facts. "Structuring consistent with layering" is a legal characterisation the writer cannot make and has not supported.
Defect 2. Deposits came in, funds went out, nothing connects them. No dates, amounts, counterparties or balances.
Defect 3. Alert 4471 and rule TM-CSD-03 mean nothing to the recipient. Nor do RM, KYC and EDD, unexplained.
Defect 4. It calls the activity inconsistent with the profile without ever saying what the profile was.
Defect 5. No chronology; the subject appears after the alert, and "refer to the attached statement" pushes the analysis onto the reader.
Two more will also get it returned. "No satisfactory explanation was received" editorialises instead of recording what was said. And nobody can tell when suspicion was formed, which matters, because everything said to the customer after that moment is constrained.
The rewritten narrative: the same file, evidenced
Customer 1 is a general trading company holding Account 1, opened on 11 January of the prior year. The sole signatory and sole recorded beneficial owner is Individual
1. At onboarding the customer stated its business as wholesale supply of building materials to regional buyers. The expected activity recorded in the file is monthly receipts of CU 200,000 to CU 400,000 by bank transfer from four named buyers, and outgoing payments to two named suppliers. Cash is not recorded as an expected channel, and no cash was received in the twelve months before the period below. Between 2 March and 27 May, Account 1 received 46 cash deposits totalling CU 3,140,000. Four individuals made the deposits at nine branches across three cities. None of the four is a signatory on Account 1, an employee recorded in the customer file, or a party named at onboarding. No deposit was accompanied by an invoice, a delivery note or a sales record. Within one to three business days of each group of deposits, Customer 1 instructed outgoing transfers. Across the same period, 11 transfers totalling CU 2,980,000 were sent to five beneficiaries, two in Jurisdiction A and three in Jurisdiction B. None of the five matches a supplier recorded at onboarding. Payment references on all 11 transfers cite invoice numbers. After each group of transfers the balance returned to below CU 20,000, so the balance carried forward from March to May did not increase. On 14 May, during a scheduled periodic review and before this file was escalated, the relationship manager asked Customer 1 about the source of the cash receipts. Customer 1 stated that they were advance payments from retail buyers. Supporting invoices were requested on 14 May and again on 21 May. None were provided. No further contact has been made with the customer on this matter. The activity is reported because cash receipts of this size and frequency form no part of the expected activity recorded for this customer, the depositors have no established connection to the customer, substantially all of the cash was moved onward within days to beneficiaries who do not appear anywhere in the customer file, and the documentary support offered in explanation was not produced when requested. The account statement for 1 March to 31 May, the onboarding file and the periodic review note are held and available to the Unit on request.
What changed between the two narratives, and why the rewrite stands up
The rewrite is longer. It is not padded. Every added sentence carries a fact the reader needs.
The baseline came first. Paragraph one is entirely expected activity, so everything after it is measurable against something.
The money is traced. Cash in, dated, counted, located, attributed to people who are not on the account. Cash out, dated, counted, to named jurisdictions, with the balance behaviour showing the account was used as a conduit rather than a store of value. A reader can rebuild the flow, which Article 25(3) requires records to permit.
The conclusions went, and the facts stayed. Structuring and layering are gone, and nothing was lost.
The system data went, and the customer contact is dated and framed. No alert number, no rule code, no unexplained abbreviation. The enquiry is recorded as an ordinary periodic review question asked before escalation, with what the customer said, not whether the writer believed it. The next section explains why that framing matters.
The negative findings are recorded. No invoices. No match to recorded suppliers. No connection between depositors and customer. Absence of evidence is evidence, and it is the part most analysts leave out.
Pulling that transaction detail yourself is a skill of its own, and our guide to SQL for AML analysts covers the queries. The counterparty detail comes from research, and the OSINT research sequence behind that detail is separate again. OSINT means open-source intelligence, the public-record and open-web research behind due diligence.
Tipping off and what must never go into a narrative
Key point: tipping off is a criminal offence in the UAE, the prohibition attaches to disclosure and not to drafting, and a writer who does not understand the line is a risk to the firm.
"Financial Institutions, Designated Non-Financial Businesses and Professions, and Virtual Asset Service Providers, as well as their directors, officers, and employees shall be prohibited from disclosing, whether directly or indirectly, to the Customer or any other person that they have submitted or are about to submit a Suspicious Transaction Report, or any information or data related thereto, or that an investigation is being conducted in respect thereof, without prejudice to information sharing with branches and subsidiaries at the level of the Financial Group, in accordance with the provisions of Article (32) of this Resolution."
Article 24 of Federal Decree-Law No. 10 of 2025 makes the underlying information confidential, and Article 29(1) makes it a criminal offence to warn a person or disclose information about transactions under review in contravention of it. Read both articles rather than relying on my summary.
Three consequences at the drafting stage. Writing the narrative is not tipping off; disclosure to the customer or a third party is. Questions to the customer must stand on their own as ordinary due diligence, because a question phrased to signal a report is coming is a problem, whatever your intention. And internal circulation is need-to-know.
The counterweight is the good-faith protection. Federal Decree-Law No. 10 of 2025, Article 37(1):
"No criminal, civil, or administrative liability shall be incurred by the Supervisory Authorities, the Unit, the Law Enforcement Authorities, the Financial Institutions, the DNFBPs, the Virtual Asset Service Providers, or by the members of their Boards of Directors, employees, and legally authorized representatives, as a result of furnishing any of the required information or breaching any statutory, contractual, or administrative restriction imposed to ensure the confidentiality of information, even if they were not fully aware of the nature or actual occurrence of the Crime, unless it is proven that the reporting was made mala fide with the intent to harm others."
That answers the fear that stops junior analysts from filing. Reporting in good faith is protected, even if you turn out to be wrong.
Four more things to keep out. Do not conclude that a crime occurred: you report suspicion; a court decides crime. Do not editorialise about the customer, because evasive and uncooperative are opinions, whereas the question, the answer and the date are facts. Do not record internal disagreement, which belongs in the case file. Do not name the individual investigator.
How to know the narrative is finished
Key point: run four checks, and stop when they pass rather than when the page looks long enough.
The one-pass test. Read it aloud once without stopping. Any sentence you had to reread gets rewritten.
The stranger test. Give it to a colleague with no knowledge of the case. If they cannot say what happened and why it was reported, the FIU reader will not either.
The reconstruction test. Cover the attachments. Can a reader rebuild the flow of funds from the narrative alone. This is the Article 25(3) standard applied to your own draft.
The consistency test. Every subject, account, date, amount and jurisdiction must match the structured fields. Mismatches lose a reviewer's confidence in everything else.
There is no correct word count. There is a completeness standard, and it is the one in the statute.
Building an AML quality assurance standard your team can apply consistently
Key point: vague reviewer feedback is a management problem, and naming defects fixes it faster than rewriting analysts' work.
Practitioners in open forums repeatedly describe the same loop. Comments come back saying "needs more detail", and nothing changes, because "more detail" is not an instruction.
Give reviewers a defect list, not a style preference. A reviewer who returns work marked "defect 4, expected activity not stated" has taught something. One who rewrites the paragraph has taught nothing and absorbed the work.
Track why narratives come back, then train on the top two. Count the defect codes for a quarter. Two will dominate.
Sample rather than review everything. Reviewing every filing is how QA becomes a bottleneck and then a rubber stamp. When the queue is the real constraint, look at whether an alert backlog is a tuning, training, or headcount problem.
Keep your own log. Write down every reason your work comes back for three months. The list will be short and it will repeat.
The stakes sit outside the team as well as inside it. Published AML enforcement actions turn again and again on reports that were never filed, filed late, or filed with narratives that never said what the institution already knew, and our reading of AML enforcement actions and the reporting failures behind them works through what regulators actually wrote in those orders. A narrative defect that survives quality assurance is the same defect a supervisor reads back to you years later, with the file attached.
We sell AML training, so here is our interest in this
Pro AML Training sells applied anti-money laundering and counter-terrorist financing training. AML means anti-money laundering. CFT means counter-terrorist financing. So when I argue that narrative writing is a trainable craft rather than a talent, I am arguing for something we sell. Factor that in. Everything above works without buying anything.
If you want the structured version, AML Gatekeepers in Action: Enhancing Vigilance and Compliance works through judgement and reporting decisions. For the monitoring side that produces the alert, Advanced Transaction Monitoring for Trading, Funds and Wealth Operations is the closer fit. Or Explore Courses.
Reading this before an interview? Start with what an AML analyst actually does all day, the skills hiring managers actually test, AML and compliance careers in the UAE and the difference between AML and KYC in the UAE. KYC means know your customer.
Frequently asked questions
