Suspicious Activity Reports: The Legal Regime — POCA, DAML, Tipping Off

Introduction

The SAR — the financial system's most powerful intelligence tool

The Suspicious Activity Report (SAR) is one of the most important instruments in the fight against financial crime. Every year, over 900,000 SARs are submitted to the UK's National Crime Agency by regulated firms — representing the collective financial intelligence of the banking system, translated into actionable information for law enforcement.

Yet the SAR regime is also one of the most legally exposed aspects of AML compliance. Filing a SAR incorrectly, failing to file when required, or tipping off a customer that a SAR has been filed can all result in criminal prosecution. For MLROs, SARs represent both the most important professional responsibility and the most significant personal legal risk in the compliance function.

900K+

SARs submitted to UKFIU 2023/24

£258M+

Assets refused under DAML 2023/24

5 years

Max sentence for failure to disclose

7 days

NCA moratorium period for DAML SARs

"A SAR is not a compliance form. It is a piece of financial intelligence that could prevent a terrorist attack, dismantle a drug network, or recover stolen public funds. The quality of what we file matters as much as the act of filing."

Section 01

The legal basis — POCA 2002 and the Terrorism Act 2000

The SAR regime in the UK is established by two pieces of legislation that run in parallel — the Proceeds of Crime Act 2002 (POCA) for money laundering, and the Terrorism Act 2000 (TA 2000) for terrorist financing. Both create disclosure obligations, though the POCA regime is the primary framework for most regulated firms.

📋

The two SAR regimes

POCA Part 7: covers money laundering and proceeds of crime. The offence of "failure to disclose" under Section 330 applies to the regulated sector. Terrorism Act 2000: covers terrorist financing. Section 21A creates the parallel obligation for the regulated sector to disclose suspicions of terrorist financing. Both regimes use the same SAR Online system — the same report covers both.

Key POCA provisions

Section	Provision	Key point
S.327	Concealing criminal property	Principal offence — concealing, disguising, converting or transferring
S.328	Arrangements	Principal offence — facilitating acquisition, retention or control of criminal property
S.329	Acquisition, use, possession	Principal offence — acquiring, using or possessing criminal property
S.330	Failure to disclose (regulated sector)	The SAR obligation — failure to report is a criminal offence
S.331	Failure to disclose (nominated officers)	MLRO-specific — failure to disclose after receiving internal report
S.333A	Tipping off (regulated sector)	Criminal offence to disclose that a SAR has been filed
S.335	Appropriate consent (DAML)	The consent/DAML regime — seeking NCA permission to proceed
S.336	Nominated officer's consent	MLRO can seek NCA consent on behalf of the firm

Section 02

The disclosure offences — what you must avoid

The SAR regime creates criminal liability in two directions — for failing to report when you should, and for reporting in a way that prejudices an investigation. Understanding both is essential.

Section 330 POCA

Failure to disclose

In the regulated sector: failing to disclose when you know or suspect — or have reasonable grounds to know or suspect — that another person is engaged in money laundering.

Max: 5 years imprisonment

Section 331 POCA

Nominated officer failure

MLRO-specific: the MLRO receives an internal SAR, knows or suspects ML, and fails to disclose to the NCA without reasonable excuse.

Max: 5 years imprisonment

Section 333A POCA

Tipping off

Disclosing to a third party that a disclosure has been made, or that an investigation is underway, where that disclosure is likely to prejudice the investigation.

Max: 2 years imprisonment

Section 342 POCA

Prejudicing investigation

Knowingly making a false or misleading disclosure, or concealing, destroying or falsifying documents relevant to a confiscation investigation.

Max: 5 years imprisonment

The "reasonable grounds" standard

The Section 330 obligation is triggered when a person knows or suspects — or has reasonable grounds to know or suspect — that another person is engaged in money laundering. The "reasonable grounds" limb is objective: it asks what a reasonable person in the same position, with the same information, would suspect — regardless of what the individual actually thought.

This means the obligation can be triggered even if the individual genuinely did not suspect money laundering, if a reasonable compliance professional would have done so given the information available. Ignorance is not a defence if reasonable steps to identify suspicion were not taken.

🚨

The "ostrich" problem

Deliberately avoiding knowledge of suspicious circumstances — turning a blind eye — does not provide a defence against the Section 330 offence. A person who had reasonable grounds to suspect ML/TF but chose not to investigate cannot rely on their lack of actual suspicion. The FCA has taken enforcement action against firms whose staff were trained to avoid asking questions that might reveal suspicious activity — a practice sometimes called "wilful blindness."

🧠 Knowledge check

A compliance officer reviews a transaction that has features consistent with structuring (multiple cash deposits just below £10,000). They decide not to investigate further because they "don't want to assume the worst." Is this adequate?

Section 03

Who must file a SAR?

The Section 330 obligation applies to persons in the "regulated sector" — the same broad category as those subject to MLR 2017 obligations. However, anyone (not just those in the regulated sector) who handles the proceeds of crime can commit the principal POCA offences under Sections 327–329.

The two-track system

The SAR regime operates on two tracks:

Track 1 — Regulated sector obligation (S.330): Employees of regulated firms who encounter suspicious activity in the course of their work must make an internal report to the MLRO. This is a personal obligation on the individual employee — they cannot delegate it.
Track 2 — MLRO obligation (S.331): The MLRO receives internal reports and decides whether to disclose to the NCA. This is the MLRO's personal statutory obligation — they cannot simply delegate the filing decision to someone else.

The internal SAR process

👤

Employee identifies suspicious activity

During CDD, transaction monitoring, customer interaction, or any other business activity. Suspicion arises — the employee cannot ignore it.

Immediately on identification

↓

📝

Employee submits internal SAR (ISAR) to MLRO

Via the firm's internal reporting system. Must include all relevant information — who, what, when, where, why suspicious. Do NOT tell the customer or colleagues outside the need-to-know chain.

As soon as practicable

↓

🔍

MLRO investigates and makes decision

MLRO reviews the ISAR, considers all available information, may request further details. Makes decision: file with NCA, or document reasons for not filing. Both outcomes must be recorded.

↓

📤

External SAR submitted to NCA (if required)

Via SAR Online system. If a transaction is pending, submit as a DAML (consent) SAR and await NCA response before proceeding.

As soon as practicable

Section 04

The MLRO's role — personal statutory accountability

The Money Laundering Reporting Officer occupies a uniquely exposed position in the SAR regime. Unlike most compliance functions where responsibility flows through the organisation, the MLRO's Section 331 obligation is personal — and cannot be discharged by delegation.

What the MLRO must do

Receive all internal SAR reports — the MLRO is the single point through which all internal suspicions must flow
Investigate adequately — the MLRO must consider all available information before making a filing decision
Make the filing decision — file with the NCA, or document reasons for not filing. Both are legally valid outcomes but both must be documented
Decide on DAML requests — where a transaction is pending, decide whether to request NCA consent before proceeding
Maintain adequate records — all ISARs received, all filing decisions, all reasons for not filing
Report to senior management — the MLRO must report regularly to the board or senior management on SAR activity and the firm's AML position

⚠️

Documenting non-filing decisions

One of the most commonly missed obligations: the MLRO must document reasons for NOT filing a SAR, not just for filing one. An ISAR that is received and then disappears from the record with no filing and no documented reason creates significant personal liability for the MLRO. The FCA's review of SAR processes frequently finds inadequate documentation of non-filing decisions.

🛡️ Screening as part of the MLRO's investigation

When investigating a potential SAR, screening is an essential tool

Before deciding whether to file a SAR, the MLRO should screen the subject against sanctions lists, PEP databases, and adverse media. FinCrimeRadar demonstrates this process.

Screen a name →

Section 05

Defence Against Money Laundering (DAML)

The DAML regime — sometimes called the "consent" regime — allows regulated firms to seek the NCA's permission before completing a transaction they suspect may involve criminal property. It provides a statutory defence against the principal POCA offences if the firm proceeds after receiving consent (or after the moratorium period expires).

How the DAML process works

Stage	What happens	Timeframe
1. SAR filed	MLRO submits a DAML SAR to the NCA via SAR Online, requesting consent to proceed with the transaction	Before transaction
2. Notice period	NCA has 7 working days to provide a "notice of refusal" — if no notice is received, consent is deemed given	7 working days
3. Consent given	NCA issues written consent — firm may proceed with the transaction	Within 7 working days
4. Consent refused	NCA issues notice of refusal — firm cannot proceed for a further 31 calendar days (the "moratorium period")	31 days from notice
5. Moratorium expires	After 31 days, if no further restraint order obtained, the firm may proceed — the defence applies	31 days

💡

DAML — the practical challenge

In practice, most DAMLs relate to situations where a firm has identified a suspicious transaction but the customer is expecting it to proceed — for example, a large payment, an account closure, or a withdrawal. The firm cannot tell the customer why there is a delay (tipping-off risk) while simultaneously waiting up to 7 working days for the NCA to respond. Managing this "awkward gap" without tipping off the customer is one of the most challenging aspects of SAR compliance. Legal advice and a careful communication strategy are essential for high-value DAML situations.

🧠 Knowledge check

A firm submits a DAML SAR on a Monday morning. By the following Wednesday afternoon (7 working days later), they have received no response from the NCA. Can they proceed with the transaction?

Section 06

Tipping off — the most dangerous compliance mistake

Section 333A POCA makes it a criminal offence to disclose that a SAR has been made, or that a money laundering investigation is underway, where that disclosure is likely to prejudice the investigation. With a maximum sentence of 2 years imprisonment and unlimited fine, tipping off is one of the most serious compliance mistakes a firm can make.

What constitutes tipping off?

Telling the customer directly that a SAR has been filed
Telling the customer that their account is "under AML investigation"
Closing an account immediately after filing a SAR without adequate cover story
Asking the customer for additional information in a way that reveals the nature of the concern
Discussing the SAR with third parties (agents, introducers, counterparties) who don't need to know
Responding to a solicitor's letter by confirming or denying a SAR exists

What is NOT tipping off?

Discussing the SAR within the firm on a need-to-know basis
Obtaining legal advice about whether to file a SAR
Disclosing within the same group of companies for the purpose of preventing ML/TF
Disclosures between regulated firms in the same sector for AML purposes (subject to conditions)
Telling a customer that a transaction cannot proceed — without explaining why

🚨

The solicitor's letter trap

A common tipping-off scenario: the subject of a SAR instructs a solicitor who then writes to the firm asking whether a SAR has been filed and requesting details of any restrictions on the account. Confirming or denying the existence of a SAR in response to such a letter may constitute tipping off. The standard response is to say that the firm cannot confirm or deny the existence of any suspicious activity report, and to seek legal advice before responding further. Never be pressured by solicitors' letters into confirming SAR activity.

Section 07

The UKFIU and the NCA — what happens to your SAR

Once a SAR is submitted via SAR Online, it enters the UK Financial Intelligence Unit (UKFIU) — a specialist unit within the National Crime Agency. Understanding what happens next helps MLROs write better SARs and manage the process more effectively.

What the UKFIU does with SARs

Triage — SARs are categorised by type, risk level, and urgency. High-priority SARs (DAML requests, terrorism-related) are prioritised for immediate review.
Analysis — the UKFIU's analysts add value to SARs by combining them with other intelligence sources, law enforcement databases, and open-source information.
Dissemination — relevant intelligence is shared with appropriate law enforcement and partner agencies — police forces, HMRC, the FCA, overseas partners.
Feedback — the UKFIU publishes aggregate statistics and typologies but provides limited individual SAR feedback to submitters (for operational reasons).

✅

Quality matters more than quantity

The NCA and FCA have been explicit: the UK SAR regime suffers from an excess of defensive, low-quality SARs filed to avoid prosecution rather than to provide genuine financial intelligence. A well-researched SAR that clearly explains the suspicion, identifies the subject fully, and provides detailed transaction information is far more valuable than five defensive SARs with minimal content. MLROs should prioritise SAR quality — even if that means filing fewer SARs overall.

Can we withdraw a SAR after filing it? +

No — once a SAR has been submitted to the NCA, it cannot be withdrawn. If you submitted a SAR in error, or if additional information changes the picture, you can submit a supplemental report via SAR Online to provide clarification or correction. Keep a record of the error and the corrective action taken. This is one reason why SAR quality control before submission is so important — errors cannot be undone.

Does filing a SAR provide complete protection from POCA liability? +

Filing a SAR provides a statutory defence against the principal POCA offences (ss327–329) and the failure to disclose offence (s330), provided the disclosure was made as soon as practicable and in the prescribed form. However, filing a SAR does not provide blanket immunity. If a firm continues to assist money laundering after filing a SAR — for example, by continuing to process transactions while knowing they are suspicious — the defence may not apply. And filing a knowingly false or misleading SAR is itself a criminal offence (s342 POCA).

How do we handle a customer who demands to know why their account is restricted? +

This is one of the most operationally challenging aspects of the SAR regime. The firm cannot reveal that a SAR has been filed or that a DAML is pending (tipping off risk). Standard practice is to give a neutral explanation — for example, "we are conducting routine verification checks" or "your account is under our standard review process" — that does not reveal the true reason. For high-value or time-sensitive situations, seek legal advice before communicating with the customer. The goal is to maintain the customer relationship (if appropriate) or effect an orderly exit, without disclosing the SAR activity.