Suspicious Activity Reports: The Legal Regime - POCA, DAML, Tipping Off

Introduction

The SAR: the financial system's most powerful intelligence tool

The Suspicious Activity Report (SAR) is one of the most important instruments in the fight against financial crime. In 2023/24, the UKFIU received 872,048 SARs, representing the collective financial intelligence gathered from across the UK's reporting sectors, translated into actionable information for law enforcement.

Yet the SAR regime is also one of the most legally exposed aspects of AML compliance. Filing a SAR incorrectly, failing to file when required, or tipping off a customer that a SAR has been filed can all result in criminal prosecution. For MLROs, SARs represent both the most important professional responsibility and the most significant personal legal risk in the compliance function.

872K+

SARs submitted to UKFIU 2023/24

£240M+

Assets refused under DAML 2023/24

5 years

Max sentence for failure to disclose

31 days

NCA moratorium period after DAML refusal

"A SAR is not a compliance form. It is a piece of financial intelligence that could prevent a terrorist attack, dismantle a drug network, or recover stolen public funds. The quality of what we file matters as much as the act of filing."

Section 01

The legal basis: POCA 2002 and the Terrorism Act 2000

The SAR regime in the UK is established by two pieces of legislation that run in parallel: the Proceeds of Crime Act 2002 (POCA) for money laundering, and the Terrorism Act 2000 (TA 2000) for terrorist financing. Both create disclosure obligations, though the POCA regime is the primary framework for most regulated firms.

📋

The two SAR regimes

POCA Part 7: covers money laundering and proceeds of crime. The offence of "failure to disclose" under Section 330 applies to the regulated sector. Terrorism Act 2000: covers terrorist financing. Section 21A creates the parallel obligation for the regulated sector to disclose suspicions of terrorist financing. Both regimes use the same SAR Portal: the same report covers both.

Key POCA provisions

Section	Provision	Key point
S.327	Concealing criminal property	Principal offence: concealing, disguising, converting or transferring
S.328	Arrangements	Principal offence: facilitating acquisition, retention or control of criminal property
S.329	Acquisition, use, possession	Principal offence: acquiring, using or possessing criminal property
S.330	Failure to disclose (regulated sector)	The SAR obligation: failure to report is a criminal offence
S.331	Failure to disclose (nominated officers)	MLRO-specific: failure to disclose after receiving internal report
S.333A	Tipping off (regulated sector)	Criminal offence to disclose that a SAR has been filed
S.335	Appropriate consent (DAML)	The consent/DAML regime: seeking NCA permission to proceed
S.336	Nominated officer's consent	MLRO can seek NCA consent on behalf of the firm

Section 02

The disclosure offences: what you must avoid

The SAR regime creates criminal liability in two directions: for failing to report when you should, and for reporting in a way that prejudices an investigation. Understanding both is essential.

Section 330 POCA

Failure to disclose

In the regulated sector: failing to make the required disclosure as soon as practicable to a nominated officer or a person authorised for Part 7 purposes by the NCA Director General, once the section 330(3A) conditions are met; suspicion alone, without a qualifying disclosure failure, is not sufficient.

Max: 5 years imprisonment

Section 331 POCA

Nominated officer failure

MLRO-specific: the MLRO receives an internal SAR, knows or suspects ML, and fails to disclose to the NCA without reasonable excuse.

Max: 5 years imprisonment

Section 333A POCA

Tipping off

Disclosing that a disclosure under Part 7 has been made, or that an investigation into allegations that a Part 7 offence has been committed is contemplated or underway, where that disclosure is likely to prejudice the investigation and the information arose in the course of regulated sector business. Sections 333B-333D permit certain disclosures (for example, within the same group, or between institutions for AML purposes).

Max: 2 years imprisonment on indictment; on summary conviction, up to 3 months, a level 5 fine, or both

Section 342 POCA

Prejudicing investigation

Where a person knows or suspects that an appropriate officer is acting or proposing to act in connection with a confiscation, civil recovery, detained cash, detained property, frozen funds, cryptoasset, exploitation proceeds, or money laundering investigation, it is an offence to make a disclosure likely to prejudice that investigation, or to falsify, conceal, destroy or otherwise dispose of (or cause or permit the falsification, concealment, destruction or disposal of) documents relevant to it, subject to statutory defences under section 342(3).

Max: 5 years imprisonment

The "reasonable grounds" standard

The Section 330 obligation is triggered when a person knows or suspects, or has reasonable grounds to know or suspect, that another person is engaged in money laundering. The "reasonable grounds" limb is objective: it asks what a reasonable person in the same position, with the same information, would suspect, regardless of what the individual actually thought.

This means the obligation can be triggered even if the individual genuinely did not suspect money laundering, if a reasonable compliance professional would have done so given the information available. Ignorance is not a defence if reasonable steps to identify suspicion were not taken.

🚨

The "ostrich" problem

In its 2023 Al Rayan Bank Final Notice, the FCA found that management had communicated to some frontline staff that they should accept money regardless. It also found little source of funds questioning and reluctance to request further evidence because staff misunderstood the tipping off rules.

🧠 Knowledge check

A compliance officer reviews a transaction that has features consistent with structuring (multiple cash deposits just below £10,000). They decide not to investigate further because they "don't want to assume the worst." Is this adequate?

Section 03

Who must file a SAR?

The section 330 obligation applies to persons conducting business in the regulated sector as defined by POCA Schedule 9. That scope is closely aligned with the MLR 2017 relevant person regime, but the definitions are legally distinct and must be assessed separately. However, anyone (not just those in the regulated sector) who handles the proceeds of crime can commit the principal POCA offences under Sections 327 to 329.

The two-track system

The SAR regime operates on two tracks:

Track 1: Regulated sector obligation (S.330): Employees of regulated firms who encounter suspicious activity in the course of their work must disclose it, as soon as practicable, either to the firm's nominated officer (MLRO) or directly to a person authorised for Part 7 purposes by the NCA Director General. In practice, most firms route this via an internal report to the MLRO. This is a personal obligation on the individual employee: they cannot delegate it.
Track 2: MLRO obligation (S.331): The MLRO receives internal reports and decides whether to disclose to the NCA. This is the MLRO's personal statutory obligation: they cannot simply delegate the filing decision to someone else.

The internal SAR process

👤

Employee identifies suspicious activity

During CDD, transaction monitoring, customer interaction, or any other business activity. Suspicion arises: the employee cannot ignore it.

Immediately on identification

↓

📝

Employee submits internal SAR (ISAR) to MLRO

Via the firm's internal reporting system. Must include all relevant information: who, what, when, where, why suspicious. Do NOT tell the customer or colleagues outside the need-to-know chain.

As soon as practicable

↓

🔍

MLRO investigates and makes decision

MLRO reviews the ISAR, considers all available information, may request further details. Makes decision: file with NCA, or document reasons for not filing. Both outcomes must be recorded.

↓

📤

External SAR submitted to NCA (if required)

Via the SAR Portal. If a transaction is pending, submit as a DAML (consent) SAR and await NCA response before proceeding.

As soon as practicable

Section 04

The MLRO's role: personal statutory accountability

The Money Laundering Reporting Officer occupies a uniquely exposed position in the SAR regime. Unlike most compliance functions where responsibility flows through the organisation, the MLRO's Section 331 obligation is personal, and cannot be discharged by delegation.

What the MLRO must do

Receive all internal SAR reports: the MLRO is the single point through which all internal suspicions must flow
Investigate adequately: the MLRO must consider all available information before making a filing decision
Make the filing decision: file with the NCA, or document reasons for not filing. Both are legally valid outcomes but both must be documented
Decide on DAML requests: where a transaction is pending, decide whether to request NCA consent before proceeding
Maintain adequate records: all ISARs received, all filing decisions, all reasons for not filing
Report to senior management: the MLRO must report regularly to the board or senior management on SAR activity and the firm's AML position

⚠️

Documenting non-filing decisions

The FCA expects firms to retain evidence supporting decisions about whether a SAR is justified. In TR19/4, its review of capital markets participants, the FCA stated in general terms that the rationale for a decision not to submit a SAR should be clearly documented and recorded.

🛡️ Screening as part of the MLRO's investigation

When investigating a potential SAR, screening is an essential tool

Before deciding whether to file a SAR, the MLRO should screen the subject against sanctions lists, PEP databases, and adverse media. FinCrimeRadar demonstrates this process.

Screen a name →

Section 05

Defence Against Money Laundering (DAML)

The DAML regime (sometimes called the "consent" regime) allows a person, whether an individual or a regulated firm acting through its nominated officer, to seek the NCA's permission before completing a transaction they suspect may involve criminal property. Under POCA s.338, an authorised disclosure is available to "the alleged offender" generally, it is not restricted to regulated firms, though in practice it is regulated firms that most commonly rely on it. It provides a statutory defence against the principal POCA offences if the firm proceeds after receiving consent (or after the moratorium period expires).

How the DAML process works

Stage	What happens	Timeframe
1. SAR filed	MLRO submits a DAML SAR to the NCA via the SAR Portal, requesting consent to proceed with the transaction	Before transaction
2. Notice period	NCA has 7 working days to provide a "notice of refusal"; if no notice is received, consent is deemed given	7 working days
3. Consent given	NCA issues written consent: firm may proceed with the transaction	Within 7 working days
4. Consent refused	NCA issues notice of refusal: firm cannot proceed for a further 31 calendar days (the "moratorium period")	31 days from notice
5. Moratorium expires	After 31 days, if no further restraint order obtained, the firm may proceed: the defence applies	31 days

💡

DAML: the practical challenge

In practice, most DAMLs relate to situations where a firm has identified a suspicious transaction but the customer is expecting it to proceed, for example, a large payment, an account closure, or a withdrawal. The firm cannot tell the customer why there is a delay (tipping-off risk) while simultaneously waiting up to 7 working days for the NCA to respond. Managing this "awkward gap" without tipping off the customer is one of the most challenging aspects of SAR compliance. Legal advice and a careful communication strategy are essential for high-value DAML situations.

🧠 Knowledge check

A firm submits a DAML SAR on a Monday morning. By the following Wednesday afternoon (7 working days later), they have received no response from the NCA. Can they proceed with the transaction?

Section 06

Tipping off: the most dangerous compliance mistake

Section 333A POCA makes it a criminal offence to disclose that a disclosure under Part 7 has been made, or that an investigation into allegations that a Part 7 offence has been committed is contemplated or underway, where that disclosure is likely to prejudice the investigation and the information came to the discloser in the course of business in the regulated sector. With a maximum sentence on indictment of 2 years imprisonment and an unlimited fine, tipping off is one of the most serious compliance mistakes a firm can make.

What constitutes tipping off?

Telling the customer directly that a SAR has been filed
Telling the customer that their account is "under AML investigation"
Closing an account immediately after filing a SAR without adequate cover story
Asking the customer for additional information in a way that reveals the nature of the concern
Discussing the SAR with third parties (agents, introducers, counterparties) who don't need to know
Responding to a solicitor's letter by confirming or denying a SAR exists

What is NOT tipping off?

Discussing the SAR within the firm on a need-to-know basis
Obtaining legal advice about whether to file a SAR
Disclosing within the same group of companies for the purpose of preventing ML/TF
Disclosures between regulated firms in the same sector for AML purposes (subject to conditions)
Telling a customer that a transaction cannot proceed, without explaining why

🚨

The solicitor's letter trap

A common tipping-off scenario: the subject of a SAR instructs a solicitor who then writes to the firm asking whether a SAR has been filed and requesting details of any restrictions on the account. Confirming or denying the existence of a SAR in response to such a letter may constitute tipping off. The standard response is to say that the firm cannot confirm or deny the existence of any suspicious activity report, and to seek legal advice before responding further. Never be pressured by solicitors' letters into confirming SAR activity.

Section 07

The UKFIU and the NCA: what happens to your SAR

Once a SAR is submitted via the SAR Portal, it enters the UK Financial Intelligence Unit (UKFIU), a specialist unit within the National Crime Agency. Understanding what happens next helps MLROs write better SARs and manage the process more effectively.

What the UKFIU does with SARs

Triage: SARs are categorised by type, risk level, and urgency. High-priority SARs (DAML requests, terrorism-related) are prioritised for immediate review.
Analysis: the UKFIU's analysts add value to SARs by combining them with other intelligence sources, law enforcement databases, and open-source information.
Dissemination: relevant intelligence is shared with appropriate law enforcement and partner agencies, police forces, HMRC, the FCA, overseas partners.
Feedback: the UKFIU publishes aggregate statistics and typologies but provides limited individual SAR feedback to submitters (for operational reasons).

✅

Quality matters more than quantity

FCA guidance identifies passing every internal report to the NCA without assessing whether it is genuinely suspicious as poor practice and says such defensive reports are likely to be of little value. The NCA separately warns that poor quality reporting can delay processing and impair prioritisation and investigation.

Section 08

Frequently asked questions

Can we withdraw a SAR after filing it? +

No. Once a SAR has been submitted to the NCA, it cannot be withdrawn. If you submitted a SAR in error, or if additional information changes the picture, you can submit a supplemental report via the SAR Portal to provide clarification or correction. Keep a record of the error and the corrective action taken. This is one reason why SAR quality control before submission is so important: errors cannot be undone.

Does filing a SAR provide complete protection from POCA liability? +

Making an authorised disclosure under ss327-329 (and obtaining appropriate consent before completing the transaction, where relevant) provides a defence to the principal POCA offences. Making the required disclosure under s330 prevents that offence's disclosure condition from being satisfied in the first place, rather than operating as a separate defence. However, filing a SAR does not provide blanket immunity. If a firm continues to assist money laundering after filing a SAR, for example, by continuing to process transactions while knowing they are suspicious, the defence may not apply. Separately, conduct connected with a SAR, such as a disclosure likely to prejudice a qualifying investigation, or falsifying, concealing, destroying or disposing of relevant documents, may engage the distinct section 342 POCA offence of prejudicing an investigation, subject to statutory defences, regardless of whether the SAR itself was accurate.

How do we handle a customer who demands to know why their account is restricted? +

This is one of the most operationally challenging aspects of the SAR regime. The firm cannot reveal that a SAR has been filed or that a DAML is pending (tipping off risk). Standard practice is to give a neutral explanation, for example, "we are conducting routine verification checks" or "your account is under our standard review process", that does not reveal the true reason. For high-value or time-sensitive situations, seek legal advice before communicating with the customer. The goal is to maintain the customer relationship (if appropriate) or effect an orderly exit, without disclosing the SAR activity.