What is a SAR?
A Suspicious Activity Report (SAR) is a disclosure made to the UK Financial Intelligence Unit (UKFIU), which sits within the National Crime Agency (NCA). SARs are the primary mechanism through which the regulated sector alerts law enforcement to suspected money laundering or terrorist financing.
They form the foundation of the UK's intelligence-led approach to combating financial crime. Each year, the UK receives hundreds of thousands of SARs, with the banking sector by far the largest contributor.
Legal Basis
The obligation to file SARs arises from two principal statutes:
- Proceeds of Crime Act 2002 (POCA), Section 330: A person in the regulated sector commits an offence if they know or suspect that another person is engaged in money laundering and fail to make a disclosure. Maximum penalty: 5 years' imprisonment.
- Terrorism Act 2000, Section 21A: Creates a parallel obligation to disclose knowledge or suspicion of terrorist financing.
The threshold is suspicion, not proof. If a transaction or relationship makes you uneasy and you cannot resolve that unease through legitimate enquiry, a SAR should be filed.
Who Must File
Every person working in the regulated sector has an obligation to report. This includes banks, investment firms, insurance companies, accountants, solicitors, estate agents, and crypto-asset firms. In practice, most organisations channel reports through their MLRO, who decides whether to submit a SAR to the NCA.
SAR Quality Requirements
The NCA has repeatedly emphasised the importance of SAR quality. A useful SAR should include:
- Clear reason for suspicion — not just "the transaction seemed unusual"
- Full identifying details — names, dates of birth, account numbers
- Transaction details — dates, amounts, counterparties, jurisdictions
- No acronyms or jargon — the SAR may be read by non-specialists
- Context — the customer's known profile and why this activity deviates from it
DAML Requests
A Defence Against Money Laundering (DAML) request is a specific type of SAR where the reporter seeks consent from the NCA to proceed with a transaction that they suspect may involve criminal property.
The process works as follows:
- The reporter files a DAML request via the SAR Portal
- The NCA has 7 working days to respond
- If the NCA grants consent, the transaction may proceed
- If the NCA refuses consent, a moratorium period of up to 31 days applies
- The NCA can apply for extensions — maximum total: 217 days
- If the NCA does not respond within 7 working days, deemed consent applies
What Happens After Filing
Once a SAR is submitted, the UKFIU analyses and disseminates it to relevant law enforcement agencies. The reporter does not typically receive feedback — this is by design, as it protects ongoing investigations. Intelligence may contribute to investigations months or years later.
SAR Filing Scenario
Complete the scenario by filling in the 6 blanks with the correct terms. Score all 6 to unlock the next section.
You work in the operations team at a UK bank. While reviewing daily transactions, you notice that a business customer has received three large transfers totalling GBP 750,000 from companies you cannot identify. The transfers have no apparent .
Your first step is to document your concerns and report them to your , who is the designated person responsible for evaluating suspicious activity at your firm.
The MLRO reviews your report and decides the concern is valid. They submit a to the NCA via the online portal, including full customer details, transaction amounts, and a clear explanation of why the activity is suspicious.
Because the customer has requested a further transfer of GBP 200,000 today, the MLRO also files a request, seeking consent from the NCA to allow the transaction to proceed.
The NCA has working days to respond. If they refuse consent, a moratorium period applies, during which the transaction must not proceed. The maximum total moratorium period is days.