Section 01
How the NCA uses SAR intelligence
Most MLRO's never see what happens to a SAR after they file it. Understanding the intelligence cycle — from submission to law enforcement action — helps compliance professionals write better SARs and appreciate why quality matters so much.
The SAR intelligence cycle
| Stage | Who | What happens |
|---|---|---|
| Receipt | UKFIU | SAR received via SAR Online. Assigned a unique reference number. Automatically categorised by type and keyword matching. |
| Triage | UKFIU analysts | DAML requests prioritised immediately. High-value or terrorism-related SARs flagged for urgent review. Standard SARs queued for analysis. |
| Analysis | UKFIU analysts | SAR intelligence combined with other databases — PNC, Companies House, HMRC, previous SARs. Patterns identified. Links to other subjects/accounts mapped. |
| Dissemination | UKFIU | Intelligence packages sent to relevant law enforcement — local police, NCA units, HMRC, FCA, overseas partners via Egmont Group. |
| Action | Law enforcement | Investigations opened, assets restrained, prosecutions initiated. In some cases, firms are notified of outcomes. |
£258M+
Assets refused via DAML 2023/24
3,500+
Terrorism-related SARs 2023/24
170+
Law enforcement agencies using SAR data
38
Egmont Group countries receiving UK SAR intelligence
"When a SAR leads to a prosecution, the compliance officer who filed it may never know. But the intelligence they provided — the account numbers, the transaction details, the why — was the thread that unravelled the case."
What makes a SAR actionable
UKFIU analysts are explicit about what makes a SAR useful versus one that generates no investigative action:
- Specific subject information — full name, DOB, address, account details. Without this, the intelligence cannot be linked to existing records.
- Transaction detail — specific amounts, dates, counterparty accounts. Vague descriptions of "large amounts" are useless.
- Clear reasoning — why do you think this is suspicious? What typology does it match? What is the inconsistency?
- Links to other subjects — associated accounts, business partners, family members — the more connections, the more value the intelligence has.
- Prior intelligence — reference to adverse media results, previous suspicious activity, or prior SARs you have filed about the same subject.
Section 02
Measuring SAR quality — what good looks like
The FCA expects MLROs to actively manage SAR quality, not just SAR volume. A firm that files 1,000 poor-quality SARs per year is in a weaker compliance position than one that files 200 high-quality ones.
Key SAR quality metrics
| Metric | What to measure | Target |
|---|---|---|
| Subject completeness | % of SARs with full name, DOB, address, and account number | >95% |
| Narrative quality score | Internal peer review of SAR narratives against quality rubric | Review 10% of SARs monthly |
| Timeliness | Average days from suspicion identification to external SAR submission | <5 business days |
| DAML accuracy | % of DAML SARs that correctly identify the transaction at risk | 100% |
| Non-file documentation | % of internal SARs with documented non-filing rationale | 100% |
| Defensive SAR rate | % of SARs with no specific suspicion articulated in narrative | <5% |
| MLRO review time | Average time from ISAR receipt to MLRO decision | <48 hours for standard; immediate for urgent |
Peer review — the single best quality improvement
The most effective way to improve SAR quality is to introduce a peer review process — where a second compliance professional reviews a sample of SARs before submission against a quality rubric. This catches missing subject information, vague narratives, and cases where the suspicion reasoning is unclear. Even a 10% sample review, consistently applied, produces a significant improvement in quality over 6–12 months.
Section 03
The SAR reform agenda — what's changing
The UK's SAR regime is under active review. The volume of SARs has grown dramatically — from under 400,000 in 2018 to over 900,000 in 2023/24 — without a proportionate increase in UKFIU resource. The result is a system under strain, with law enforcement struggling to extract maximum value from the intelligence available.
SAR Online reform
The NCA has been working to modernise the SAR Online platform — improving the submission interface, introducing structured data fields (rather than free-text only), and developing API connectivity for high-volume submitters. Structured data fields will allow automated matching and analysis, significantly increasing the intelligence value of SARs even without improving narrative quality.
The Economic Crime and Corporate Transparency Act 2023
The ECCTA 2023 included reforms to the DAML regime — extending the moratorium period in complex cases, improving information-sharing between law enforcement and reporting firms, and streamlining the DAML consent process. These reforms aim to give law enforcement more time to investigate complex financial crime while providing firms with greater certainty about timelines.
Public-private partnership — the Financial Intelligence Public Private Partnership (FIPP)
The UK has developed enhanced public-private information-sharing arrangements — building on the Joint Money Laundering Intelligence Taskforce (JMLIT) model — to allow regulated firms and law enforcement to share typology information and intelligence about emerging financial crime threats. Firms that engage with JMLIT receive better quality typology intelligence, which in turn improves their SAR quality. Engagement with JMLIT is increasingly seen as a mark of a sophisticated AML programme.
Section 04
MLRO SAR governance — the board reporting obligation
The MLRO's obligations do not end with filing individual SARs. There is a broader governance function: keeping senior management and the board informed about the firm's SAR activity, the financial crime risks it reveals, and the adequacy of the firm's AML controls.
The MLRO annual report
The FCA expects MLROs to produce an annual report to the board covering at minimum:
- SAR volumes — internal and external, by typology and business line
- SAR quality trends — improvements or deterioration in quality metrics
- DAML activity — number filed, value of assets subject to DAML, outcomes
- Internal SAR analysis — what are staff reporting internally? What does this reveal about the firm's risk profile?
- Emerging typologies — financial crime trends affecting the firm's sector
- Control adequacy — MLRO's assessment of whether SAR processes and controls are adequate
- Resourcing — whether the MLRO and SAR team are adequately resourced
- Regulatory engagement — any FCA or NCA interaction regarding SARs
The board must genuinely engage with the MLRO report
The FCA does not just want to see that an MLRO report was produced — it expects evidence that the board genuinely engaged with it. Board minutes should show that the MLRO report was discussed, that questions were asked, and that the board understood and challenged the key findings. A board that accepts the MLRO report with no discussion provides inadequate governance. Equally, an MLRO who gives the board a report so generic that no meaningful challenge is possible has failed their reporting obligation.
🛡️ Strengthen your SAR intelligence
Screening results add intelligence value to every SAR
Run a FinCrimeRadar screen before finalising your SAR narrative — adverse media results, PEP status, and sanctions data can all strengthen the intelligence value of your filing.
Section 05
Building a high-performing SAR programme
A SAR programme is not just an MLRO function — it is a firm-wide system that spans frontline staff, compliance, technology, legal, and governance. Building one that consistently produces high-quality intelligence requires investment across all these dimensions.
1
Internal reporting culture
Staff must feel confident reporting concerns internally without fear of business pushback. The MLRO must be accessible and responsive.
2
Clear internal SAR process
Simple, documented process for staff to submit ISARs. Named MLRO deputy for cover. Target turnaround times for MLRO decisions.
3
Quality training
Staff trained specifically on what to include in an ISAR — not just when to file one. Annual refreshers that include real-world examples.
4
MLRO investigation toolkit
The MLRO needs tools to investigate ISARs before deciding to file — adverse media access, sanctions screening, CDD file access, transaction data.
5
Quality review process
Peer review of SAR narratives. Monthly quality scoring. Feedback to staff on ISAR quality. Annual benchmarking against industry standards.
6
MI and board reporting
Regular SAR MI to senior management. Annual MLRO report to board. Trend analysis. Control adequacy assessment. Resourcing review.
How should we handle a situation where a business line pushes back against filing a SAR?
This is one of the most common and most difficult situations an MLRO faces. The MLRO's Section 331 obligation is personal and statutory — it cannot be overridden by business pressure. If the MLRO has reasonable grounds to suspect ML/TF, they must file regardless of commercial considerations. Practically: the MLRO should document the business pushback, document their own assessment, and file if the grounds exist. If there is genuine dispute about whether the grounds are met, seek legal advice. The MLRO should escalate persistent business pushback to the board or chair of the risk committee. An MLRO who is consistently unable to file SARs due to business pressure should consider whether they can continue to perform the function in that environment.
Can we use AI to help write or triage SARs?
Yes — with appropriate governance. AI tools are increasingly being used in SAR programmes for: alert triage (prioritising which transaction monitoring alerts warrant ISAR submission), narrative drafting assistance (helping analysts structure narratives based on case facts), and quality checking (flagging SARs that appear to have missing fields or insufficient suspicion reasoning). However, the MLRO's filing decision must remain a human judgement — AI cannot substitute for the MLRO's personal statutory accountability. Any AI-assisted SAR process should be documented, auditable, and subject to human oversight. The FCA has flagged AI governance in financial crime as an emerging supervisory focus area for 2026.
What happens if we discover we should have filed a SAR six months ago but didn't?
File immediately. The "as soon as practicable" standard means that once you identify that a SAR should have been filed, you must file it without further delay — even if the transaction has long since completed. The late filing does not eliminate the Section 330 liability for the original failure, but it mitigates the ongoing risk and demonstrates good faith. Document the circumstances that led to the delayed identification, conduct a root cause analysis, and remediate the control weakness that caused the delay. If the failure is systematic — affecting multiple customers or a period of time — consider whether a voluntary disclosure to the FCA is appropriate and seek legal advice.
✓ Series complete
You've completed the SAR Complete Guide
You now have a comprehensive understanding of the SAR legal regime, how to write high-quality SARs, and how to build a programme that makes a real difference to financial crime intelligence.