AMLG11100 - Guidance for all sectors: Reporting Suspicious Activity
11. Reporting suspicious activity
What is Suspicious Activity Reporting (SARs)?
Suspicious activity reporting is the process by which individuals and businesses report knowledge or suspicion of money laundering or terrorist financing. These reports are submitted to the United Kingdom Financial Intelligence Unit (UKFIU) which sits within the NCA.
SARs play a vital role in supporting law enforcement efforts to combat financial crime. The intelligence gathered through SARs provides insight into both current and emerging threats to the UK’s financial system and national security.
Businesses and individuals operating in the regulated sector have a legal obligation to report suspicious activity and are uniquely positioned to identify and report potential money laundering or terrorist financing due to their access to financial transactions and customer behaviour. Submitting high quality SARs contributes directly to the UK’s ability to detect, investigate, and disrupt criminal activity.
What are the legal obligations?
All persons working in the regulated sector have legal obligations under POCA and the Terrorism Act 2000 (TACT) to disclose knowledge or suspicions of money laundering and terrorist financing.
Where a person knows, suspects, or has reasonable grounds to know or suspect that another person is engaged in money laundering or has committed, or attempted to commit, a terrorist financing offence, they must make a disclosure to their nominated officer or directly to the UKFIU. The Regulations require you to have PCPs in place that set out how and in what circumstances an internal disclosure should be made to the nominated officer. Your business’s PCPs and staff training should set out the precise process to be followed in your business.
Where a disclosure is made to the nominated officer, they must assess whether it gives rise to knowledge, suspicion or reasonable grounds for knowledge or suspicion that a person is engaged in money laundering or terrorist financing. If such grounds exist, then the nominated officer must submit a SAR to the UKFIU as soon as practicable.
Please see AMLG11000 for further guidance on appointing a nominated officer.
Important notes:It is a criminal offence for any person in your business who is carrying out regulated activity, including nominated officers, to fail to make a required disclosure of money laundering or terrorist financing as set out above. Both offences carry a maximum penalty of five years' imprisonment and/or a fine. HMRC may refer individuals to the Crown Prosecution Service (CPS) for criminal prosecution in cases of suspected failure to report money laundering or terrorist financing. In June 2021, the CPS published updated guidance confirming that prosecutions may proceed even where there is no evidence to prove that money laundering was planned or took place. For further details, see the CPS Money Laundering Offences Guidance. |
What if I am a sole practitioner or trader?
If you are a sole practitioner or sole trader with no employees, you are personally responsible for fulfilling the duties of a nominated officer. This includes the obligation to submit a SAR where required.
What steps can I take to ensure that the legal obligations are met?
You must have PCPs in place setting out how, and in what circumstances, an internal disclosure should be submitted to the nominated officer.
You must provide regular training for your staff on what suspicious activity may look like in your business and keep records of that training, who has received it, and when.
You should also train your staff on how to handle enquiries from a person who is subject to an internal report or a SAR, for example, by explaining that they are following company policy and are unable to discuss the matter further, to ensure that the staff member does not commit a ‘tipping off’ offence as set out in section 11.3 below.
Staff must report to the nominated officer as soon as practicable if they know or suspect that someone, not necessarily the customer, is involved in money laundering or terrorist financing. The nominated officer will then decide whether to make a report.
The nominated officer must know and understand the guidance on how to submit a SAR and be aware of the codes detailed in the glossary that must be used, when appropriate, in each report to the UKFIU. For further information, please see section 11.2 below.
Compliance Checklists
To support those carrying out regulated activity in your business to meet their obligations to report money laundering and terrorist financing, we recommend using the following checklists.
Checklist for the business:
- Have you appointed a nominated officer to receive internal disclosures of suspected money laundering or terrorist financing and communicated this clearly across the business?
- Have you implemented internal procedures for disclosures to be made to the nominated officer and communicated these clearly across the business?
- Do you provide regular training for staff on identifying and reporting suspicious activity?
- Do you maintain systems for documenting disclosures and retaining records?
- Are staff aware of the legal consequences of failing to disclose?
Checklist for individuals who may have knowledge or suspicion of money laundering or terrorist financing:
- Do you have knowledge, suspicion, or reasonable grounds to know or suspect money laundering or terrorist financing?
- If so, did the information giving rise to the knowledge or suspicion come to you in the course of your business in the regulated sector?
- If so, have you promptly disclosed this information to your nominated officer or the UKFIU?
- Have you documented the disclosure and retained records?
- Are you aware that a failure to disclose is a criminal offence, even if actual money laundering or terrorist financing cannot be proven?
- Do you understand that HMRC may refer cases to the CPS for prosecution if a failure to disclose is identified?
- Do you understand that the maximum penalty includes up to 5 years’ imprisonment and/or a fine?
What is knowledge, suspicion and reasonable grounds to know or suspect?
Knowledge
Having knowledge means actually knowing something to be true. If a person knows that another person is engaged in money laundering or terrorist financing, then there is an obligation to make a report. Knowledge can be inferred from surrounding circumstances, for example a failure to ask obvious questions may lead to a jury implying that a person had knowledge.
Suspicion
The threshold for forming a suspicion is very low but must be based on facts or context. You don’t need to know all the details around the suspicion. You do not need to know the exact nature of the criminal offence or that particular funds were definitely those arising from the crime, but you must be able to explain why you’re suspicious.
What you identify initially may not seem suspicious, however looking into the issue further may increase your suspicion. Feeling uneasy is not normally enough to justify making a SAR. However, you should not ignore a gut feeling or feelings of unease, instead explore them further to either resolve the feeling or to establish suspicion.
You may have noticed something unusual or unexpected and after making enquiries, the facts do not seem normal or make commercial sense. You do not have to have evidence that money laundering or terrorist financing is taking place to have suspicion or have knowledge of the underlying criminality.
Section 11.1 below contains a number of warning signs which may give you a cause for concern, however, whether you have a suspicion is a matter for your own judgment.
Reasonable grounds to know or suspect
A requirement for a person to have “reasonable grounds” to know or suspect adds an objective requirement to ensure that the suspicion has a reasonable basis for it. Whether the grounds for knowing or suspecting money laundering or terrorist financing are reasonable will depend upon the particular facts of the case.
It is important to note that you may have reasonable grounds to know or suspect money laundering or terrorist financing based on the facts as you understand them, even if those facts turn out to be wrong.
When deciding whether to make a report, you should therefore focus on whether you have knowledge or a genuinely held suspicion taking into account this guidance and the suspicious indicators in section 11.1 below.
11.1 Suspicious indicators
Please see AMLG1100 sections 1.4 and 1.5 for further guidance on what constitutes money laundering and terrorist financing to assist you in determining whether a duty to make a report arises.
There are some warning signs of potentially suspicious activity that your systems should be capable of picking up and flagging for attention.
Below are some examples which may indicate suspicious activity. They are not exhaustive lists. It depends on the circumstances of each case. However, HMRC expects to see that you have recorded the potential suspicious activity, your assessment of the risk and reasons why you have or have not submitted a suspicious activity report.
More specific examples can be found in the sector-specific guidance and risk assessments (Part 3).
New Customers
- The customer is sanctioned or linked to a proscribed terrorist group.
- If checking the customer’s identity is difficult, given their demographic group and likelihood they would have sufficient identity evidence.
- The customer is reluctant to provide details of their identity or provides fake documents.
- The customer is trying to use intermediaries to protect their identity or hide their involvement.
- The customer’s identity cannot be proven.
- There is no apparent reason for using your business's services - for example, another business is better placed to handle the transaction.
- Part or full settlement in cash or foreign currency, with weak reasons.
- The customer, or their associates, are subject to media reporting which suggests links to illicit activity or criminal groups, have been disqualified as directors or have convictions for dishonesty.
Regular and Existing Customers
- Is the transaction different from the normal business of the customer?
- Is the size and frequency of the transaction different from the customer’s normal pattern?
- Has the pattern changed since the business relationship was established?
- Has there been a significant or unexpected improvement in the customer’s financial position and the customer can't give a proper explanation of where money came from?
Transactions/Services Provided
- A third party, apparently unconnected with the customer, bears the costs or otherwise pays for the service.
- An unusually large cash or foreign currency transaction.
- The customer will not disclose the source of the funds or reasons for transfers between companies.
- Unusual involvement of third parties, or large payments from private funds, particularly where the customer appears to have a low income.
- Unusual source of funds or unexpected movement of funds into a company.
11.2 How to submit a SAR
The NCA SARs online portal (SAR Portal | Landing page) is the UKFIU’s recommended method for the submission of SARS. This securely encrypted system provided by the NCA allows you to:
- register your business and relevant contact persons
- submit a SAR at any time, and
- receive e-mail confirmations of each SAR submitted
- request a DAML or DATF (see section 11.4 below)
Detailed step-by-step guidance is available within the portal and on the NCA website.
It is important to select any glossary codes that are relevant to your suspicion. Glossary codes are used by the UKFIU and law enforcement to quickly identify SARs relating to specific threat areas that may require immediate attention, together with areas of current interest.
The UKFIU periodically provides updated glossary codes and reporting routes, and it is best to check the NCA website for the latest information.
Missing or inaccurate information reduces the overall effectiveness of the SAR. It can also have a negative impact on identifying the subjects correctly.
If your SAR is deficient, or does not contain the requisite information, the UKFIU may send you further correspondence seeking additional clarification.
You should include the information below in your SAR, where known.
Many of the fields on the SAR Portal are optional, as the amount of information you hold may depend on the sector you are in and the nature of your relationship with the subject.
Please ensure you complete all of the fields you have information for, regardless of whether they are mandatory or optional. If there is crucial information you do not know or have access to, explain the reason for this in the reason for suspicion section of the SAR.
Subject identifiers, for example:
- full name
- date of birth
- address(es)
- account numbers
- occupation
- national insurance number(s)
- passport or other relevant documentation numbers
Key points to include:
- Identify other party/parties involved in the criminal conduct or dealing with the criminal property, including their dates of birth and addresses where appropriate and known.
- Suspected predicate offences to the money laundering or terrorist financing.
- Clear descriptions of reasons for suspicion of money laundering or terrorist financing.
Important note:The system does not retain a copy of a SAR once it has been submitted. You will not be able to access, view, save or print your submission after it has been filed, and the UKFIU cannot provide a copy. You should therefore retain a copy of every SAR that you have submitted. This is important to demonstrate that you have complied with your legal obligations. HMRC also has the power to require you to produce a copy of a SAR. Any copy of a SAR must be handled and stored securely at all times. In doing so, you must have regard to your legal obligations as set out in section 11.3 below. |
Important note:Where a nominated officer suspects suspicious activity and makes a decision not to submit a SAR to the UKFIU, they should document the rationale for that decision. This document may be relevant to assist your business to provide reasons why a SAR was not submitted if the decision is later reviewed. |
11.3 Can I discuss the submission of my SAR with anyone?
No. You must not say anything about an internal disclosure or SAR which could prejudice an investigation. If you do so, you could be guilty of a criminal offence known as “tipping off”, which carries a penalty of up to five years imprisonment.
Under POCA, it is also a criminal offence for anyone who knows a confiscation investigation, a civil recovery investigation or a money laundering investigation is being (or is about to be) conducted to release information likely to prejudice that investigation. It is also a criminal offence to falsify, conceal, destroy or otherwise dispose of documents relevant to the investigation (or to cause or permit any of these offences).
Further information on “tipping off”
POCA and TACT each contains two separate offences of tipping off (sections 333A of POCA and 21D of TACT) and prejudicing an investigation (sections 342 of POCA and 39 of TACT). The first offence relates to disclosing that an internal or external report has been made; the second relates to disclosing that an investigation is being considered or is being carried out. These offences are similar and overlapping, but there are also significant differences between them. It is important for those working in the regulated sector to be aware of the conditions precedent for each offence. Each offence relates to situations where the information on which the disclosure was based came to the person making the disclosure in the course of a business in the regulated sector.
Once an internal or external suspicion report has been made, it is a criminal offence for anyone to disclose information about that report which is likely to prejudice an investigation that might be conducted following that disclosure. An offence is not committed if the person does not know or suspect that the disclosure is likely to prejudice such an investigation, or if the disclosure is a permitted disclosure under POCA or TACT. Reasonable enquiries of a customer, conducted in a tactful manner, regarding the background to a transaction or activity that is inconsistent with the normal pattern of activity is prudent practice, forms an integral part of CDD measures, and should not give rise to the tipping off offence.
Where a money laundering investigation is being considered, or being carried out, it is a criminal offence for anyone to disclose this fact if that disclosure is likely to prejudice that investigation. An offence is not committed if the person does not know or suspect that the disclosure is likely to prejudice such an investigation, or if the disclosure is a permitted disclosure under POCA or TACT.
11.4. Defence Against Money Laundering (DAML) or Terrorist Financing (DATF)
If you intend to proceed with a transaction or other activitythat may constitute a money laundering or terrorist financing offence, then your nominated officer (or their deputy) must seek consent from the UKFIU before proceeding. This consent, if granted, will provide a legal defence to any of the principal money laundering offences set out in POCA or the terrorist financing offences set out in TACT.
You will receive a response to your request from the UKFIU during the notice period if:
- The UKFIU decides to refuse your request for a defence; or
- The UKFIU decides to expressly grant your request.
In other cases, you may not get any response from the UKFIU before the end of the notice period.
You have a defence to the money laundering or terrorist financing offence you are proposing to undertake if:
- You receive a granted letter from the UFKIU in response to your request; or
- Yhe notice period expires without any response from the UKFIU.
If your DAML or DATF request is refused, then you do not have a defence to the money laundering or terrorist financing offence you are proposing to undertake and risk committing an offence if you proceed with the activity.
Can I request a defence after the transaction has taken place?
No. The UKFIU cannot provide a defence after the transaction or activity has already occurred.
What happens after I request a defence?
When you submit a SAR to the UKFIU and request a defence, a statutory waiting period begins. This is known as the notice period, and it lasts for 7 working days. The notice period starts the first working day after the SAR is submitted. During this time, the UKFIU reviews the report and decides whether to grant or refuse the defence. If you need a response to your request sooner, you should contact the UKFIU.
Examples of when to seek an expedited decision could include where a threat of harm could be prevented, or where a high value business deal will fall through if a decision is
not provided by a certain date (see UKFIU guidance for further information). Please note, that whilst the UKFIU may be able to expedite a request, a decision to grant the request is not guaranteed.
Important note:During the notice period, the activity or transaction that is the subject of the request should not be carried out, and doing so may constitute a criminal offence. |
You must wait either:
- For the UKFIU to explicitly grant the defence, or
- For the 7 working days to pass without a refusal.
If the UKFIU does not respond within the 7 working days, you may assume a defence under POCA or TACT.
Receiving a granted response from the UKFIU, or no reply within the 7 working day notice period, does mean that:
- The UKFIU approves the transaction, the people or organisations involved, or the circumstances described in your report.
- You are required or encouraged to go ahead with the transaction.
Instead, it simply means that you may have a legal defence to the specific offences under POCA or TACT outlined above, if you choose to proceed.
This defence:
- Only applies to the specific activity you sought a defence for. Any future activity involving the same person must be considered on its own merits, and in the light of the suspicions that arose from the earlier suspicious transaction. You cannot request a DAML for an ongoing business relationship.
- Does not override your professional responsibilities, such as:
- Meeting your obligations under the Regulations, including conducting customer due diligence.
- Complying with other relevant laws and ethical standards.
You should always carefully assess the risks and consider whether it is appropriate to proceed, even if a defence has been granted or assumed.
What happens if the UKFIU refuses to grant a defence?
In cases involving suspected money laundering, if the UKFIU refuses to grant a defence, you must not proceed with the activity for 31 calendar days from the date of the refusal. This is known as the moratorium period. The moratorium period can be extended by a court if further information or evidence is required.
In cases involving suspected terrorist financing, the moratorium period does not apply and you do not have a defence unless and until the UKFIU explicitly grants your request.
Important note:Allowing the transaction or activity to proceed after a defence has been refused may constitute a criminal offence. |
Exemptions to the requirement to submit a DAML
There are limited circumstances in which a business may carry out activity that would otherwise constitute a money laundering offence, without requiring a DAML. These are often referred to as the DAML exemptions or the DAML thresholds.
These exemptions apply only where specific conditions are met. They do not remove the requirement to submit a SAR where there is knowledge or suspicion of money laundering.
You should have regard to the Home Office and UK Financial Intelligence Unit (UKFIU) guidance below when applying these exemptions, and note that the UKFIU advises reporters to seek legal advice on the application of these exemptions to their business.
Important note:None of the DAML exemptions or thresholds apply to offences under TACT. |
The key exemptions are summarised below.
Exemption for operating an account
Sections 327(2C), 328(5) and 329(2C) of POCA set out exemptions from criminal liability for certain money laundering offences where a deposit-taking body, electronic money institution, or payment institution is operating an account and the value of the criminal property involved is less than the specified threshold amount. The threshold amount is determined under section 339A of POCA and, as at the date of publication of this guidance, is set at £3,000.
Exemption for exiting and paying away
The paying away exemption in ss.327(2D), 328(6), and 329(2D) of POCA allows regulated sector businesses to return or transfer property to a customer (when ending the business relationship), without committing a money laundering offence, as long as the value is below £3,000 and the business has complied with its customer due diligence duties.
Exemption for mixed property transactions
Sections 327(2F), 328(8), and 329(2F) of POCA provide exemptions for mixed-property transactions when the person is carrying on business in the regulated sector. This is intended to address situations where a person in the regulated sector deals with accounts or property containing both legitimate and criminal funds. Where the total value of the criminal property has been ‘ring-fenced’ in an account, and the value of the activity with the remaining funds does not cause the balance of the account to fall below the value of the criminal property; the person is free to manage the subject’s payments, withdrawals, or buy and sell securities, using the remaining funds without seeking a DAML to do so. Under their existing obligations, the person should still submit a SAR with details of the ‘ring fenced’ amount.
For further detailed guidance on requesting a defence against money laundering or terrorist financing, please see the information published by the UKFIU here:
UKFIU guidance - Understanding DAMLs and DATFs
For further, specific guidance on the exemptions to the requirement to submit a DAML request, please see the abovementioned guidance from the UKFIU and the following government guidance: