Lesson 5 — SARs, the MLRO, and your legal obligations
By the end, you will understand how to report suspicious activity and the legal consequences of getting it wrong.
"A poor SAR wastes intelligence resources."
The NCA's window to respond to a DAML request.
No response = deemed consent. The transaction may proceed.
Spots concern
Record details
Receives report
Evaluates suspicion
Filed to NCA
"Your silence can be a crime."
Opening: Welcome to Lesson 5. We have learned to recognise red flags. Now we learn what to do about them — the reporting and escalation process, your legal obligations, and the protections available to you.
Key stat: Every year, hundreds of thousands of SARs are filed with the National Crime Agency. Each one begins with a single person noticing something that does not look right. (Source: NCA)
Transition: "Let's start with what you will learn in this lesson."
Three areas: (1) How to file a SAR and what the NCA expects. (2) Internal escalation and the MLRO's role. (3) Tipping off — the criminal offence — and the protections for honest reporters.
Learning outcome: By the end, participants will understand how to report suspicious activity and the legal consequences of getting it wrong.
Talking point: Most people find reporting daunting because they fear being wrong. This lesson will show you that the law is designed to protect honest reporters — and to punish those who stay silent.
Transition: "Let's begin with the SAR itself."
SAR definition: A Suspicious Activity Report filed with the UK Financial Intelligence Unit (UKFIU) within the National Crime Agency. SARs are the primary mechanism for alerting law enforcement to suspected ML/TF. (Source: NCA)
Legal basis: POCA s.330 (money laundering) and Terrorism Act s.21A (terrorist financing). Maximum penalty for failure to report: 5 years' imprisonment. (Source: CPS Prosecution Guidance)
Threshold: SUSPICION, not proof. The Law Society emphasises: suspicion requires more than idle speculation but less than certainty. If a transaction makes you uneasy and you cannot resolve that unease, a SAR should be filed. (Source: Law Society)
Who must file: Every person in the regulated sector. In practice, reports are channelled through the MLRO. (Source: FCA)
Transition: "Filing a SAR is important. Filing a good SAR is essential."
Quality matters: The NCA has repeatedly emphasised SAR quality. Poor SARs consume analytical resources without providing actionable intelligence. (Source: NCA)
What to include: Clear reason for suspicion (not just "seemed unusual" — specific triggers). Full identifying details (names, DOBs, account numbers). No acronyms (may be read by non-specialists). Context (customer profile and why this deviates). (Source: NCA)
Talking point: Think of it this way: the person reading your SAR may know nothing about your customer, your product, or your industry. Write as if you are explaining to an intelligent stranger why this matters.
Transition: "When a transaction is pending and you suspect it involves criminal property, there is a specific consent process."
DAML (Defence Against Money Laundering): A specific type of SAR where the reporter seeks consent from the NCA to proceed with a transaction suspected of involving criminal property. Also called a "consent SAR." (Source: Law Society)
7 working days: The NCA's window to respond. If no response = deemed consent, and the transaction may proceed. (Source: NCA)
If refused: Moratorium of up to 31 days, extendable by Crown Court to a maximum of 217 days total. During this period, the transaction must not proceed. (Source: CPS Prosecution Guidance)
Why this matters: By seeking consent via DAML, you obtain a defence against ML charges under ss.327-329 POCA. Without consent, proceeding with a suspicious transaction could expose you to criminal liability.
Transition: "Now let's walk through the internal escalation process step by step."
Walk through each step: (1) Employee spots concern. (2) Documents details — dates, amounts, senders, and WHY it concerns you. (3) MLRO receives the report. (4) MLRO assesses — may request additional information. (5) SAR filed to NCA if warranted; rationale recorded if not. (Source: ICLG UK AML guide)
MLRO role: Mandatory appointment under FCA requirements. Must have sufficient seniority and authority to act independently and escalate to the board. Must have adequate resources and access to transaction data. (Source: FCA)
Key point: You should never delay reporting to the MLRO. If your line manager may be involved, report directly to the MLRO. Firms must ensure employees feel empowered to raise concerns without fear of retaliation. (Source: ICLG)
Record keeping: All internal reports — whether or not they result in a SAR — must be retained for at least 5 years. (Source: ICLG)
Transition: "There is one thing you must absolutely never do after filing a report."
Tipping off (s.333A POCA): Disclosing that a SAR has been, is being, or will be made. OR that an investigation is being contemplated or carried out. The disclosure must be likely to prejudice the investigation. (Source: CPS Prosecution Guidance)
Examples: Telling a customer their account is "under review for compliance reasons." Warning them not to make transactions "for now." Informing a colleague outside the reporting chain. Delaying a transaction and explaining you are "waiting for authorisation." Even social media hints. (Source: Law Society)
Key warning: Even well-intentioned disclosures constitute tipping off. A relationship manager warning a long-standing client out of loyalty is committing a criminal offence. (Source: Law Society)
Maximum penalty: 2 years' imprisonment. This is a criminal offence, not just a regulatory infraction.
Transition: "Tipping off carries 2 years. But silence carries an even heavier price."
Failure to disclose (s.330): 5 years' maximum imprisonment. Applies when you know, suspect, or have reasonable grounds to suspect ML and fail to report. The "reasonable grounds" test is OBJECTIVE — ignorance is not a defence. (Source: CPS Prosecution Guidance)
Principal ML offences (ss.327-329): 14 years' maximum imprisonment. Concealing, arranging, or possessing criminal property.
Mixed assets provision: Where criminal property is mixed with legitimate funds, the ENTIRE mixed fund may be treated as criminal property under POCA. GBP 10,000 criminal + GBP 50,000 legitimate = entire GBP 60,000 subject to restraint. (Source: CPS Prosecution Guidance)
Key message: Your silence is not neutral. It is a choice with consequences.
Transition: "But there is good news. The law protects those who do the right thing."
Safe harbour protection: Good-faith reporting is protected by law. You cannot be sued for breach of confidentiality, face criminal liability for the disclosure itself, or be disciplined by your employer for reporting honestly. (Source: CPS Prosecution Guidance)
Key message: Employees should NEVER hesitate to report for fear of being wrong. The legal system protects honest reporters. It punishes those who fail to report or who tip off suspects.
Talking point: Filing a SAR that turns out to be unfounded is not a problem. Failing to file when you should have is a criminal offence. The system is deliberately designed to encourage reporting.
Transition: "Let me summarise the five key takeaways from this lesson."
Five key takeaways: (1) Suspect it? Report it. (2) The threshold is suspicion, not proof — do not try to prove it yourself. (3) Do not investigate — that is the MLRO's job. (4) Do not discuss it with anyone outside the reporting chain — tipping off is criminal. (5) You are protected by safe harbour when you report in good faith.
Practical summary: You do not need to be certain. You do not need to build a case. You just need to report your concern, document it clearly, and let the professionals handle it.
Closing: "In Lesson 6, we will bring everything together — your specific role and responsibilities within the three lines of defence, the personal consequences of non-compliance, and where to go from here in your AML learning journey."