Explainability: SAR narratives that pass FMU scrutiny

Three ways to see it

1. 1

   A Suspicious Activity Report, in Pakistan called a Suspicious Transaction Report or STR under the AML Act 2010, is the document a bank files with FMU when it concludes a transaction or pattern is suspicious. The STR has a regulated structure: identifying details, transactions covered, the suspicion ground, and the supporting narrative. The narrative is the heart of the document. It must be specific enough that an FMU analyst, reading it cold, can understand both what happened and why your bank concluded it was suspicious. A narrative that says 'the model scored high' fails this test. A narrative that says 'in the last 30 days, this account received 47 inbound Raast transfers from 47 distinct counterparties spanning 14 cities, all amounts between PKR 24,000 and PKR 49,000, while declared monthly turnover at onboarding was PKR 250,000' passes.

2. 2

   Explainability tools bridge the model and the narrative. The most widely used in production fraud monitoring are SHAP and LIME. SHAP, Shapley Additive Explanations, computes for each transaction the contribution of every feature to the model's score, in a way grounded in cooperative game theory. The output is a per-transaction list like 'feature counterparty_diversity_30d contributed +0.32 to the score, feature actual_to_declared_ratio contributed +0.21, feature device_recent_change contributed +0.14, all other features contributed less than +0.05'. This list is not the narrative, but it is the raw material from which the narrative is built. The investigator can read it in 60 seconds, decide which features to write up, and verify the underlying transactions before drafting the SAR.

3. 3

   A defensible SAR narrative for a Pakistani bank has six elements in this order. One: factual summary of the account and the period reviewed, with no model language. Two: enumerated transactions or transaction pattern, with dates and amounts. Three: the comparison to the customer's declared profile and prior baseline. Four: the typology this pattern matches, named explicitly (structuring, mule funnel, layering, smurfing). Five: any corroborating evidence such as device fingerprint anomalies, geographic spread, beneficial-owner red flags. Six: the reason the bank concludes there is no apparent legitimate purpose. Notice that 'the model scored 0.87' appears nowhere. The model is the prompt that made you look. The narrative is what you found when you looked.

The why-tree

Try this with Claude

AI-edge prompt: 'Take this raw SHAP output for a flagged Pakistani retail account: counterparty_diversity_30d=+0.32, actual_to_declared_ratio=+0.21, device_recent_change=+0.14, geography_entropy=+0.09, weekend_velocity=+0.06. The customer is a 52-year-old textile trader in Faisalabad with declared monthly turnover PKR 350,000. The 30-day inflow was PKR 4.2 million. Draft a six-element FMU-defensible STR narrative in plain English, then translate it to Urdu. Identify two pieces of evidence the investigator should physically verify before filing.' Compare with the human investigator's own draft.