Suspicious activity reports
This guide explains when and how to make a suspicious activity report (SAR), what to include, how to request a defence against money laundering (DAML) and what happens if you fail to report suspicious activity to the National Crime Agency (NCA).
OverviewA suspicious activity report (SAR) is a disclosure made to the National Crime Agency (NCA) about known or suspected:
- money laundering – under part 7 of the Proceeds of Crime Act 2002 (POCA)
- terrorist financing – under part 3 of the Terrorism Act 2000 (TACT)
This guide explains how to report suspicious activity to the NCA. It assumes that the person making the SAR is a money laundering reporting officer (MLRO) or their deputy.
If you’re a solicitor or member of staff working in a law firm or legal practice, read our guidance on reporting money laundering.
Identifying money laundering
Before making a SAR, you need to be clear about who you’re reporting and why.
You should consider:
- why you’re suspicious
- what transaction you’re involved in
- whether the client is a suspect or a victim
When to make a SAR
If you’re an MLRO working in the regulated sector, you must make a SAR if you know or suspect, or have reasonable grounds for knowing or suspecting, that a person is engaged in money laundering.
If you're an MLRO working in the non-regulated sector, you must make a SAR if you know or suspect that money laundering is taking place.
Forming a suspicion
You’ll need to decide whether you’ve formed a suspicion before you’re obliged to make a SAR.
The threshold for suspicion is low. The leading test comes from R v Da Silva  EWCA Crim 1654.
You have a reportable suspicion if you think there’s a possibility, which is more than fanciful, that the relevant facts exist. In Da Silva, it was noted that “a vague feeling of unease would not suffice”.
You do not automatically have a suspicion because a concern is raised by an employee.
The High Court confirmed in Shah v HSBC  EWHC 1283 (QB) that, where concerns are raised by an employee, you should form your own view about whether you have a suspicion. It’s appropriate for you to:
- ask questions about those concerns
- review information held on the client
There’s no requirement for you to carry out extensive investigations to form or test a suspicion.
In order to form a suspicion, there must be existing criminal property.
‘Criminal property’ is defined in the Anti-money laundering guidance for the legal sector as:
“property which is, or represents, a person’s benefit from criminal conduct, where the alleged offender knows or suspects that it is such.”
Following the decision in Anwoir and others  EWCA Crim 1354, you may form a suspicion of existing criminal property if:
- you know or suspect that a specific type of criminal conduct is occurring (such as fraud or tax evasion) and you suspect this generated property
- there are several warning signs that cannot be satisfactorily explained, giving rise to an ‘irresistible inference’ that the property you’re being asked to handle must be criminal
In the former case, you’re more likely to have direct information from the client, law enforcement agencies, media or other third parties.
For the latter, you’re more likely to be looking at warning signs of money laundering.
Suspicion is not automatically transferred if, for example, a police officer advises you that your client is under investigation for a criminal offence.
However, you should consider any investigation in light of all the information that you have on the client’s file.
You may have information that clearly demonstrates the client’s innocence, which would mean that you do not have a suspicion of money laundering.
If not, you should carefully consider the facts given to you by the police or other law enforcement agencies to support any allegation of wrongdoing.
A court may be unsympathetic to a solicitor who disregarded specific warnings from law enforcement about a client.
If you decide that you have a suspicion as a result of contact from the police or other agencies, you should carefully consider what you put in your SAR.
You cannot include any privileged information and, for the crime/fraud exemption to apply, you’ll need strong prima facie evidence that you’re being involved in a criminal offence.
Any requests by law enforcement agencies for client files should be accompanied by an appropriate court order or notice. For more information, read our practice note on responding to a financial crime investigation.
Once you’ve formed your suspicion, it’s good practice to document the basis for your reasons. This will help to defeat any allegations of reporting in bad faith.
How to submit a SAR
You can make a SAR:
If you submit a SAR electronically, you’ll receive a confirmation email and your report will be processed in about five to seven working days.
The NCA recommends that you submit your SAR electronically if you’re requesting a defence against money laundering (DAML).
What to include
A detailed SAR helps the NCA to quickly identify whether your client is a person of interest and to fill intelligence gaps on, for example, new aliases.
The data matching process relies on having basic quality standards of information:
You should include the subject’s:
- full name and other names they’re known by
- date of birth
- phone numbers
- passport or driving licence number
If the subject is a legal entity, you should include the business’:
- company registration number
- VAT number
- business type
- addresses (including postcodes)
If you do not know any of these details, enter the word ‘UNKNOWN’. Do not use other words or symbols (such as question marks or asterisks).
It’s good practice to include any relevant glossary codes when you write a SAR. These help the NCA to:
- process your SAR accurately and efficiently
- allocate your SAR to the appropriate law enforcement agency
- analyse trends in suspected money laundering
There are glossary codes for particular criminal offences and for particular types of SARs.
For example, when submitting a DAML, you should use the code XXS99XX where the value of the suspected criminal property is greater than £3,000.
Glossary codes should be inserted at the start of the reason for suspicion section.
The free text section of the report is where you give a clear and concise explanation of the reason(s) for your knowledge or suspicion.
Your reason for suspicion should set out (in non-legal language):
- who – the identity of the party/parties involved and their connection with you
- what – the transaction that you’re involved in
- where – a description of the criminal property
- how – a description of the prohibited act(s)
- why – the criminal activity that you know or suspect they’re engaging in
- when – any critical deadlines
If you’re an MLRO working in the regulated sector, you must also give the:
- identity of the person(s) you know or suspect is involved in money laundering
- whereabouts of the known or suspected criminal property
The NCA may take longer to consider your request if you:
- send or attach files
- include unnecessary details
- supply privileged information
- ask the NCA to verify your client’s identity for you
- use complicated legal language
- ask for consent to take on a client when you haven’t carried out, or have been unable to carry out, client due diligence
If you know or suspect that you or your firm will be dealing with criminal property in a way that may amount to a principal offence, you’ll need to ask the NCA for a defence against money laundering (DAML).
The term DAML refers to ‘appropriate consent’ given by the NCA to a firm to carry out an activity that is otherwise prohibited by the principal money laundering offences under POCA.
For example, if you’re acting for a client in a property transaction and you suspect the purchase funds are criminal property, you’d need a DAML before you could exchange contracts.
In practice, you’ll need to indicate that you’re seeking 'consent’ when submitting your SAR so that your DAML is processed efficiently.
A DAML will only protect you from committing a principal money laundering offence. It will not protect you from:
- committing a tipping off offence
- civil liability claims – for example, negligence, breach of trust or breach of contract
- committing or facilitating any other criminal offence – for example, under the Money Laundering Regulations 2017 (MLR 2017), Bribery Act 2010 or Fraud Act 2006
Requesting a DAML does not replace:
- taking a risk-based approach
- fulfilling your obligations under the MLR 2017
You do not need to ask for a DAML if you’re making a report about someone else’s suspected money laundering.
When you submit a DAML SAR, make sure you:
- tick the consent box and use the appropriate glossary code
- clearly identify the ‘criminal property’
- state your reason(s) for suspecting the property is criminal
- explicitly describe the prohibited act(s) you plan to undertake involving the property
- identify the other party/parties involved in dealing with the property, including their dates of birth and addresses
- fully describe your reason for suspicion in relation to money laundering
It’s important to make explicit, where necessary, where a DAML is for both yourself and your client, and which steps will be taken by each of you.
Be specific about the work you think you’ll need a DAML for. Outline all the remaining steps in the transaction that could be prohibited, for example:
- the release of funds in account C to party D
- the drawing up of contracts between parties A and B, transferring of ownership of the property from A to B and transferring of value of the funds
Avoid using vague terms like ‘we wish consent to proceed’ or ‘we wish to maintain a business relationship’.
The NCA cannot interpret or assume the proposed money laundering offence(s) from your report, so you need to be as explicit as possible.
The UK Financial Intelligence Unit (UKFIU) has provided a summary DAML template for solicitors. It shows the key elements to describe when constructing a DAML:
- purpose of report
- prohibited act
- reason for suspicion
- criminal property
Once you’ve made a SAR, you’ll need to consider if and how you should change the way you interact with your client to avoid committing the offences of ‘tipping off’ and ‘prejudicing an investigation’.
After you’ve made a DAML SAR
The NCA has seven working days to decide whether to grant a DAML. This starts the next working day after you file your report.
Once you’ve submitted your report, it will be processed and checked against law enforcement databases.
If an investigation is needed, your SAR will be sent to the appropriate law enforcement agency.
If the NCA sends you a request for further information, you should respond as soon as possible. Consent may be refused within two working days of the information request if you do not reply.
Your DAML will be granted – or you may have ‘deemed consent’ – if after seven working days you:
- receive a letter from the NCA via SAR Online granting consent
- receive a letter in which the NCA neither grant nor refuse consent
- do not hear back from the NCA at all
If the NCA does not grant consent outright, you may want to consider whether it’s wise for you to go ahead with your transaction.
You're not obliged to carry out the specified activity or activities you described in your report if the NCA grants you a DAML.
For example, you may choose to:
- continue with the transaction
- carry out some but not all the activities described, or
- terminate the retainer
If you choose to continue, you have a defence against the principal offence(s) described in your report, but you may put yourself and your firm at risk of other criminal and/or civil consequences.
If you’ve had to file a DAML SAR for the same client on multiple occasions, you should consider your obligations under the MLR 2017 and whether you wish to continue the business relationship.
A 31-day moratorium period will begin if your DAML request is refused within the seven-day notice period.
You must not carry out the prohibited act(s), but you can carry out other activities on the file.
The NCA will use this time to gather evidence and decide whether further action, such as restraint of funds, should take place.
A senior law enforcement officer can apply to the court for an extension of this moratorium period for up to 186 days. This will be granted if the criteria in section 336A POCA are met.
If you choose to continue with the prohibited transactions, you risk committing a principal money laundering offence under POCA.
Failure to disclose
You may commit an offence if you fail to make a SAR after information your knowledge or suspicion of money laundering is based on comes to you because of a disclosure made under:
- section 330 POCA – if you work in the regulated sector
- sections 337 or 338 POCA – if you work in the non-regulated sector
These are known as the ‘failure to disclose’ offences.
You should consider the statutory defences before you decide whether to make a SAR.
If you decide not to make a SAR, make a clear note in the client’s file explaining how and why you reached that decision.
In June 2021, the Crown Prosecution Service (CPS) published guidance on prosecuting standalone cases under section 330. This makes it possible to prosecute an offence under this provision regardless of whether an offence of money laundering has been substantiated.
The guidance states:
"It is possible to charge an individual under section 330 even though there is insufficient evidence to establish that money laundering was planned or has taken place.
Section 330 therefore creates an obligation to report suspicions of money laundering to the authorities, regardless of whether money laundering actually takes place.
This means that where individuals in the regulated sector receive information giving rise to a suspicion, or provides reasonable grounds for suspecting, that another is engaged in money laundering, an offence is committed by failing to make a report under section 330, regardless of whether it subsequently transpires that the money laundering cannot be proven, or that it did not occur."
You do not commit an offence if you have a ‘reasonable excuse’ for not making a report. The scope of the defence has not been defined in POCA or by the courts.
You may be able to rely on the defence where, for example:
- the information that you’d be providing is already in the public domain
- your knowledge or suspicion is based on privileged information and the crime/fraud exception does not apply
- the suspected offending takes place entirely outside the UK and there’s no UK connection to the suspected criminal property
Clearly document your reasons for deciding that you have a reasonable excuse. You may want to seek independent legal advice before relying on the defence.
Legal professional privilege
You must consider whether the information that your suspicion is based on is subject to legal professional privilege (LPP).
You cannot make a SAR if the information is covered by LPP and the crime/fraud exemption does not apply.
You must also consider whether the information that your suspicion is based on came to you in ‘privileged circumstances’. This applies where:
- you're a professional legal adviser
- the information or material is communicated to you by:
- your client/their representative in connection with you giving legal advice
- the client/their representative in connection with them seeking legal advice
- any person for the purpose of/in connection with actual or contemplated legal proceedings
- the information cannot be communicated or given to you with a view to furthering a criminal purpose
You cannot make a SAR if you received the communication in privileged circumstances and the crime/fraud exemption does not apply.
Under the ‘crime/fraud exemption’, you cannot disclose privileged information unless either:
- the documents themselves form part of the criminal act
- communications take place in order to obtain advice with the intention of carrying out an offence
You do not need to be aware that you’re being used for a criminal or fraudulent purpose.
If the exemption applies, the information will still be confidential, but you can make a SAR.
Protect yourself and your firm from money laundering
- AML and suspicious activity (30 minutes)
- money laundering offences (30 minutes)
- risk assessment and client due diligence (1 hour)
Call our free anti-money laundering helpline on 020 7320 9544 or email firstname.lastname@example.org. Open 9am to 5pm, Monday to Friday.
The NCA regularly updates its guidance on glossary codes, submitting better quality SARs and requesting defences. Visit the NCA website
The UKFIU publishes guidance on submitting better quality SARs, as well as guidance for AML supervisors. Visit the UKFIU website
Contact the UKFIU
For general enquiries or questions about SAR Online, email email@example.com or call 0207 238 8282.
For defences against money laundering (DAMLs), email firstname.lastname@example.org.
For questions about disclosures concerning terrorist financing, email email@example.com.
To share ideas or give feedback on the UKFIU magazine, email firstname.lastname@example.org.