Suspicious Activity Reporting

Suspicious Activity Reports (SARs) are formal reports which are filed by entities and/or private individuals to alert law enforcement to potential money laundering or terrorist financing. It is mandatory for a SAR to be filed in all or any cases where there is suspicion or knowledge of money laundering or terrorist financing.

In the UK, SARs are filed to the UK Financial Intelligence Unit (UKFIU), which is part of the National Crime Agency (NCA). When a SAR is filed, the UKFIU conducts further investigation into the known or suspected illicit activity.

SARs are confidential between the UKFIU and the party which has filed the SAR.

A SAR should not be confused with crime or fraud reports.

The term Suspicious Transaction Report (STR) is referenced in the Financial Action Task Force (FATF) Recommendations, whereas the term SAR is more commonly used in national legislation. Often, both of these terms are used interchangeably.

Strictly speaking, the term SAR is arguably considered more appropriate as it is broader than the term STR. The “T” in the term STR may imply that only transactional behaviour/activity can be deemed unusual/suspicious and indicative of potential money laundering or terrorist financing. Conversely, the “A” in the term SAR acknowledges that more general behaviour (such as a customer acting oddly in a branch) may also be of concern.

STRs should not be confused with Suspicious Transaction and Order Reports (STORs) which are reports required by EU regulation relating to insider trading and market manipulation.

There is no financial amount which triggers a SAR in the UK. A SAR should be submitted if a party has suspicion or knowledge of money laundering or terrorist financing, regardless of the amount or currency of a transaction. A SAR should also be filed even if there is no transactional value – for example if a customer is being evasive about their identity or acting oddly in a retail location).  

Some jurisdictions, like the US, adopt Currency Transaction Reports (CTR), either as well as or instead of SARs. A CTR is a mandatory report which must be filed to authorities to notify them of any and all currency transactions that exceed a certain amount. The UK does not operate an equivalent of a CTR approach.

No. SARs must be made by financial institutions as well as professionals such as solicitors, accountants and estate agents and also private individuals where they have suspicion or knowledge of money laundering or terrorist financing. Filing SARs is an obligation contained in Part 7 of the Proceeds of Crime Act 2002 (money laundering) and Part 3 of the Terrorism Act 2000 (terrorist financing).

For money laundering SARs, there are different pretences under which a SAR must be filed depending on whether the party filing the SAR is in scope for the UK Money Laundering Regulations or not. Parties in scope for the UK Money Laundering Regulations include credit and financial intuitions, casinos, legal firms and art market participants. For these parties, a SAR must be filed if there is knowledge, suspicion or reasonable knowledge for suspicion of money laundering. “Reasonable suspicion” means in instances where a party should reasonably have suspicion based on the training they receive and anti-financial crime controls which their organisation must implement to comply with the UK Money Laundering Regulations. If the party filing the SAR is not in scope for the UK Money Laundering Regulations, a SAR must be filed if there is knowledge or suspicion of money laundering.

For terrorist financing SARs, in all instances a SAR must be filed if there is knowledge or suspicion of terrorist financing.

SARs must be filed directly to the UK Financial Intelligence Unit (UKFIU). This can be done online using the UKFIU’s dedicated SARs Online system or manually using paper forms.

Both the online system and paper forms are in the same format. They contain fields which need to be populated by the submitter about the known or suspected criminal property involved in the case, the known or suspected perpetrator(s) and other involved parties and the series of events which have taken place which have given rise to the SAR.

SARs should be submitted by the Nominated Officer or their delegate(s).

Once a SAR has been filed, it remains confidential between the UKFIU and the submitter. Importantly, the subject of the SAR must not be told about the SAR, as this is an offence called ‘tipping off’.

The UK Financial Intelligence Unit (UKFIU) is part of the National Crime Agency (NCA) and sits within the National Economic Crime Command (NECC). The UKFIU receives all SARs submitted in the UK. Once it has received a SAR, the UKFIU performs further investigation and analysis and determines appropriate next steps depending on the content of the SAR. 

The UKFIU receives all SARs submitted in the UK, either via the SARs Online system or paper forms. The UKFIU has national responsibility for receiving, analysing and disseminating intelligence gained through SARs to share with law enforcement agencies domestically and internationally. The specific next steps taken by the UKFIU depends on the contents of each SAR, and so all SARs are treated on a case-by-case basis.

Some non-exhaustive examples of the next steps which may be taken by the UKFIU after receiving a SAR might be:

1. Working with domestic police to seize criminal funds and assets
2. Working with international police and/or security forces to share information/intel about organised crime operations
3. Working with domestic or international safeguarding programmes to protect crime witnesses from negative repercussions.

Yes. Most countries have a national FIU. Non-exhaustive examples of other national FIUs include:

• Australia - The Australian Transaction Reports and Analysis Centre (AUSTRAC)
• France - Intelligence Processing and Action against Illicit Financial Networks Unit (TRACFIN)
• Germany - Financial Intelligence Unit Germany (FIU)

The difference between the UKFIU and most other national FIUs is that others are usually affiliated with the national Treasury. For example, in the US, the domestic FIU is the Financial Crimes Enforcement Network (FinCEN), which is part of the US Treasury.

Conversely, in the UKFIU is affiliated with the UK Home Office.

The UKFIU acts as primarily a bureau function and rapidly disseminates SARs to police services, HMRC, the FCA, SFO, NCA colleagues and other partners for potential investigation.

The specific next steps taken by the UKFIU depends on the contents of each SAR, and so all SARs are treated on a case-by-case basis.

Some non-exhaustive examples of the next steps which may be taken by the UKFIU after receiving a SAR might be:

1. Working with domestic police to seize criminal funds and assets
2. Working with international police and/or security forces to share information/intel about organised crime operations
3. Working with domestic or international safeguarding programmes to protect crime witnesses from negative repercussions.

In the year 2020-21, the UKFIU received 742,317 SARs and in the year 2021-22 the UKFIU received 901,255 SARs.

The NCA, in its Annual SARs Report 2022, attributes this increase predominantly to new SAR reporters in the Fintech and Cryptocurrency sectors, which became in-scope for the Money Laundering regulations in January 2020.

Reporters should include details of transactions that they know, suspect or believe to be related to the money laundering or terrorist financing in SARs. Reporters therefore need to decide on a case-by-case basis which transactions are relevant to the suspicion and thus should be included. individual/entity, even Sometimes it maybe relevant to report a chain of transactions, across multiple account holders and financial institutions.

The NCA Guidance

on Submitting Better Quality SARs provides more detail about the transaction information that should be provided, if available. This notes that, when the suspicion being reported relates to a financial transaction, the reporter should:

If the reporter is suspicious because the activity deviates from the normal activity for that customer/business sector, the reporter should briefly explain how the activity differs.

If the beneficiary/remitter of the transaction is believed to be complicit in the suspicious activity, the reporter should consider providing their details as an associate subject.

• Include the relevant details of the beneficiary/remitter of the funds
• Include, if known, the destination/originating bank details e.g. sort code, correspondent bank details (this is very important as it could identify the offender)
• Accurately record the date on which the transaction has occurred/will occur
• Clarify the type of transaction (e.g. online payment/receipt, debit or credit card, ATM withdrawal, cheque, electronic transfer (BACS/CHAPS, cash etc)
• Explain why any transactions included are considered to be suspicious
• If relevant to your business, include the subject's financial details (account numbers) and details of associates
• Summarise cash amounts at the end of the report
   

If the reporter is suspicious because the activity deviates from the normal activity for that customer/business sector, the reporter should briefly explain how the activity differs.

If the beneficiary/remitter of the transaction is believed to be complicit in the suspicious activity, the reporter should consider providing their details as an associate subject.

SARs have multiple uses in the world of crime detection, because they alert law enforcement to potential money laundering or terrorist financing.

Most SARs relate to crimes that have already been committed (or ongoing 'criminal conduct’).

Some non-exhaustive examples of the uses of SARs submitted are:

• Supporting domestic and international investigations
• Helping authorities to seize criminal funds and assets
• Identifying (potential) victims which need support and safeguarding, such as child sex abuse cases or missing person investigations

SARs must be filed to the UKFIU “as soon as practicable”. This means that an internal investigation should take place promptly and without delay to determine whether a SAR should filed or not.

There is no specified timeframe in UK legislation which dictates how quickly a SAR must be filed. This is because an internal investigation undertaken by the submitter could take some time, especially if the case is particularly complex (e.g. if it involves a lot of counterparties). Therefore, the stance in the UK is that a SAR should be filed as soon as the submitter has reasonable information/evidence to develop knowledge or suspicion. 

SARs should be submitted by a firm’s Nominated Officer. This is a designated role under the Proceeds of Crime Act 2002 and Terrorism Act 2000, and must be an employee of the business or organisation (i.e. not an external consultant or contractor).

The Nominated Officer has the following responsibilities:

• Receiving internal reports of suspicious activity from any employee in the business
• Evaluating all internal reports received to determine whether there is (or is suspected to be) any indication of money laundering or terrorist financing
• Reporting SARs (including DAML and DATF SARs) to the UKFIU
• Ensuring that no transactions are executed/continued illegally

Commonly, the Nominated Officer role-holder is also the firm’s Money Laundering Reporting Officer (MLRO).

A Nominated Officer may have a designated delegate, who can also submit SARs on the Nominated Officer’s behalf when the Nominated Officer is away. This does not relieve the designated Nominated Officer of his/her duties on a permanent basis.

A Defence Against Money Laundering (DAML) can be requested from the NCA where a reporter has a suspicion that property they intend to deal with is in some way criminal, and that by dealing with it they risk committing one of the three money laundering offences set out in the Proceeds of Crime Act 2002 (POCA). An offence is not committed if consent has been received from the NCA.

As of 5 January 2023, an amendment came into force in POCA which raised the monetary threshold for which DAMLs may be requested from £250 to £1,000.

For terrorist financing, the equivalent of a DAML SAR is a Defence Against Terrorist Finance (DATF) SAR.

From 01 April 2023 a beta version of the new SAR portal is being piloted with some of the largest firms in the UK, including BDO.

The portal will be rolled out to the rest of the market during 2023 and firms will receive an invitation to register. We recommend that firms wait until they receive instructions and then start using the new portal as a priority. In the interim, firms should continue to use the SAR Online system.

Once the new SAR portal has been fully rolled out the NCA indicate that it will be available for anyone to use, including members of the public and/or regulated and unregulated organisations

The new SAR Online Portal has been designed to increase the quality and utility of SARs, and enhance the user experience for reporters, law enforcement, and government departments. It will make it easier for people to submit structured, meaningful and comprehensive SARs. This in turn will lead to increased data quality of SAR submissions, which will provide enhanced intelligence to the UKFIU, law enforcement agencies and government departments to support them in their fight to identify, disrupt and deter criminal activity. 
 
The SAR Portal will become the NCA’s recommended method for the submission of SARs. This is because it: 

• provides users with an automated acknowledgment of successful submission
• leverages an interface which assists users in structuring SARs to be high quality and comprehensive, improving processing time for law enforcement 
• offers the opportunity to request a DAML or DATF

 The new SAR portal is considered by the NCA to:

• be simpler and more intuitive than the previous platform, enabling reporters to submit higher quality SARs. It also has inbuilt help text and explanations throughout the submission process, providing guidance to reporters.
• have more detailed and targeted data fields, providing more intelligence to law enforcement and government departments and increasing the potential utility of the SARs.
• be aligned to Government Digital Standards, with embedded guidance to support reporters through their submission.

No. 

The SAR Portal enables users to save SARs in draft form. All draft SARs created by a user will be logged under a link entitled 'Manage Full List of Draft SAR(s)’. 

Draft SARs have not been submitted to the NCA, and so the user can take a break and come back to their draft SARs to edit them. There is a column called 'Last Updated' which indicates when the draft SAR was last updated/edited. A draft SAR will be automatically deleted from the Draft SAR list after 31 days of no updates.

Once submitted to the NCA, the user cannot re-access the SAR to edit it. 

The SAR process involves completion of 9 sections:

1.    Background information
2.    Main party
3.    Associated parties
4.    Glossary codes and alerts
5.    Threshold variation and reason for submission
6.    Suspicious transactions
7.    DAML or DATF
8.    Further information
9.    Report summary 

The SAR Portal guides users through all of these. Users are advised to start their SAR submission by consulting the SAR Index page. This shows all 9 sections of the SAR that will need to be navigated to and populated for all SARs. It will also display the current status of each section ('Not added', ‘In Progress’ or 'Completed’). 

Users cannot proceed to complete a section of the SAR until they have completed the previous section (i.e. the sections must be completed in chronological order from 1 to 9). 

From the SAR Index page, users can navigate to, view and make changes to each section of the SAR at any point before they submit it to the NCA.

A link back to the SAR Index Page is available at the top of each screen when crafting the SAR submission, so it is easy for the user to go save their progress and go back to the SAR Index Page at any point. 

No. Indicators for each field will instruct the user as to how and if to populate the field.

• Mandatory fields do not have any indicators. Users must populate all fields which have no markings.
• Optional fields have an indicator to state that they are optional. Users can populate optional fields if they are able to. 
• Radio buttons (circles) are either mandatory or indicated as optional, and require the user to select one of multiple options set out on the SAR Portal.
• Check boxes (squares) are either mandatory or indicated as optional, and require the user to select one or more of multiple options set out on the SAR Portal.

The NCA has published various guides to-date, and will continue to release more as the SAR Portal becomes embedded. Users should refer to the following pages for further guidance:

1. Guidance on how to register for the SAR portal
2. FAQs relating to the SAR portal
3. SAR portal overview user guide
4. NCA SAR portal welcome page