ECSH34225 - Suspicious activity reports

The regulatory requirement for submitting a suspicious activity report (SAR)

As shown in Making Referrals and Suspicious Activity Reports (SARs) EC-S officers have a legal duty to report suspicious activity under regulation 46(5) of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). 

When are you required to submit a SAR?

A SAR must be submitted as soon as it is practical to do so after you have formed a suspicion. 

Before making a SAR, you should consider: 

  • Who are you reporting? 

  • Why you are suspicious? 

  • What is the transaction? 

  • What is the criminal property? (See below). 

  • Whether the person or entity is a suspect or a victim? 

You can submit multiple SARs on the same issue as and when new information comes to light, simply refer to previous SAR. 

A SAR should contain an element of criminal property or criminality. The term 'criminal property' does not mean you must have evidence that the cash or asset is criminally derived or obtained. Criminal property can be an item about which you are suspicious. It could be as small as £1 ledger entries or as large as £1m undeclared cash kept in a safe. 


How is suspicion defined, what is a sufficient level of suspicion to submit a SAR

The level of suspicion required for submitting a SAR is low, and your reasons for suspicion should be based on a reasonable possibility. It does not need to be a certainty; it must simply be ‘more than fanciful’. 

Suspicion is subjective and may differ from person to person, however your suspicions should be more than just vague feelings of unease or what could be considered fanciful. 

You must submit a SAR if you know, or suspect, or have grounds for knowing or suspecting a person or entity is or has engaged in money laundering or terrorist financing. You should detail this in your SAR under reasons for suspicion. 

Your suspicion will be formed from a wide variety of sources, be that behaviours, lack of cooperation, observations, paperwork checks, data analysis and formed at different points of your contact with businesses. Your 

suspicions should be formed from the knowledge you gain during the normal course of your primary role as a compliance investigator. 

SARs are not the same as Intelligence Reports (IR). You may need to submit a SAR and an IR, but this will be dependent on the specifics of each situation.

Indicators of suspicious activity 

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

If you discover potential instances of money laundering, terrorist and proliferation financing (ML/TF/PF) during your compliance or other activity, you need to submit an internal SAR (iSAR) form and speak to your Single Point of Contact (SPOC). You can find SPOC contact details in ECS Structure & Roles. The SPOC, in conjunction with the HMRC MLRO team, will access the iSAR to determine if it meets the criteria for ML/TF and whether more information is required. The SPOC or HMRC MLRO team will contact you if further information is required. If no further information is required and the criteria is met, the iSAR will be submitted as a SAR to the NCA via the UKFIU SAR Portal. 

Link to ISAR form for EC-S staff.  


What information is required

As shown in Making Referrals and Suspicious Activity Reports (SARs), you need to consider 5WH (who, what, when, where, why, how). As a minimum you require the name of the person or entity that is the subject of the report, the reasons for your suspicion and if applicable any transactions involved. 

The more detail on the report the greater value it will have. A good quality report will include a variety of information gained from your case work or observations. If available, you should include:  

Occupations, addresses (including postal codes), telephone numbers, email addresses, websites, bank account details, debit/credit card numbers, IP addresses, company registration, sector/industry, transaction details (dates, values, beneficiaries, etc), known associates, linked legal entities/businesses, passport, or other ID details.  

Structure the reportin a logical format and keep your explanation clear, concise and in plain English. Focus on what is suspicious, your reasons for suspecting and summarise them chronologically. Limit it to 8000 characters and avoid using acronyms or jargon.  

Consider the fact that the reader may notbe as familiar as you with the subject matter. Your name will not appear on a report submitted to the NCA and should not be included under this section.  

 

Where does the SAR go and what happens to it  

When you submit your report, it will go to the mailbox of the Money Laundering Reporting Officer (MLRO) team, who will review the information and decide whether the information should be passed on to the NCA via the UKFIU portal.  

A log will be kept of all reports that are received or forwarded to the NCA, as well as maintaining a log any reasons for non-submission and any further actions. The NCA may investigate the suspicions raised, use the information to aid current investigations or store it for future investigations.  

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)

Tipping off


It’s an offence to tell the business or person you’ve submitted a SAR about them. You must never disclose outside of HMRC that you have submitted a SAR on a firm or person. You may wish to discuss the suspicion with your line manager or team SAR SPOC. 

Once a SAR is made, you must consider if and how HMRC should change the way it interacts with the business to avoid committing the offences of ‘tipping off’ and ‘prejudicing an investigation’.