Suspicious activity reports

A suspicious activity report (SAR) is a disclosure made to the National Crime Agency (NCA) about known or suspected:

• money laundering – under part 7 of the Proceeds of Crime Act 2002 (POCA)
• terrorist financing – under part 3 of the Terrorism Act 2000 (TACT)

This guide explains how to report suspicious activity to the NCA. It assumes that the person making the SAR is a money laundering reporting officer (MLRO) or their deputy.

If you are a solicitor or member of staff working in a law firm or legal practice, read our guidance on reporting money laundering.

This guide covers:

• identifying money laundering
• when to make a SAR
• forming a suspicion
• how to submit a SAR
• defence against money laundering (DAML) SARs
• tipping off
• after you've made a DAML SAR
• failure to disclose
• privileged information
• the impact of SARs

Identifying money laundering

Before making a SAR, you need to be clear about who you are reporting and why.

You should consider:

• why you are suspicious
• what transaction you are involved in
• whether the client is a suspect or a victim

Read our guidance on identifying money laundering

When to make a SAR

Regulated sector

If you are an MLRO working in the regulated sector, you must make a SAR if you know or suspect, or have reasonable grounds for knowing or suspecting, that a person is engaged in money laundering.

Non-regulated sector

If you are an MLRO working in the non-regulated sector, you must make a SAR if you know or suspect that money laundering is taking place.

Forming a suspicion

You will need to decide whether you have formed a suspicion before you are obliged to make a SAR.

The threshold for suspicion is low. The leading test comes from R v Da Silva [2006] EWCA Crim 1654.

You have a reportable suspicion if you think there is a possibility, which is more than fanciful, that the relevant facts exist.

In Da Silva, it was noted that “a vague feeling of unease would not suffice”.

Once you have formed your suspicion, it is good practice to document the basis for your reasons. This will help to defeat any allegations of reporting in bad faith.

Concerns raised by an employee

You do not automatically have a suspicion because a concern is raised by an employee.

The High Court confirmed in Shah v HSBC [2012] EWHC 1283 (QB) that, where concerns are raised by an employee, you should form your own view about whether you have a suspicion.

It is appropriate for you to:

• ask questions about those concerns
• review information held on the client

There is no requirement for you to carry out extensive investigations to form or test a suspicion

Existing criminal property

To form a suspicion, there must be existing criminal property.

'Criminal property' is defined in the anti-money laundering guidance for the legal sector as:

"property which is, or represents, a person's benefit from criminal conduct, where the alleged offender knows or suspects that it is such."

Following the decision in Anwoir and others [2008] EWCA Crim 1354, you may form a suspicion of existing criminal property if:

1. you know or suspect that a specific type of criminal conduct is occurring (such as fraud or tax evasion) and you suspect this generated property
2. there are several warning signs that cannot be satisfactorily explained, giving rise to an 'irresistible inference' that the property you are being asked to handle must be criminal

In the first case, you're more likely to have direct information from the client, law enforcement agencies, media or other third parties.

For the second case, you're more likely to be looking at warning signs of money laundering.

Transferring suspicion

Suspicion is not automatically transferred if, for example, a police officer advises you that your client is under investigation for a criminal offence.

However, you should consider any investigation in light of all the information that you have on the client's file.

You may have information that clearly demonstrates the client's innocence, which would mean that you do not have a suspicion of money laundering.

If not, you should carefully consider the facts given to you by the police or other law enforcement agencies to support any allegation of wrongdoing.

A court may be unsympathetic to a solicitor who disregarded specific warnings from law enforcement about a client.

If you decide that you have a suspicion as a result of contact from the police or other agencies, you should carefully consider what you put in your SAR.

You cannot include any privileged information and, for the crime/fraud exception to apply, you'll need strong prima facie evidence that you're being involved in a criminal offence.

Any requests by law enforcement agencies for client files should be accompanied by an appropriate court order or notice.

For more information, read our practice note on responding to a financial crime investigation.

How to submit a SAR

You can make a SAR online using the NCA's SAR portal.

Use the NCA's user guides and portal guidance for help submitting a SAR.

From 4 March 2024, the old SAR Online System cannot be used to make a SAR.

What to include

A detailed SAR helps the NCA to quickly identify whether your client is a person of interest and to fill intelligence gaps on, for example, new aliases.

The data matching process relies on having basic quality standards of information:

Identity information

You should include the subject's:

• full name and other names they're known by
• date of birth
• occupation
• phone numbers
• passport or driving licence number

If the subject is a legal entity, you should include the business':

• company registration number
• VAT number
• business type
• addresses (including postcodes)

If you do not know any of these details, enter the word 'UNKNOWN'.

Do not use other words or symbols (such as question marks or asterisks).

Glossary codes

It is good practice to include any relevant glossary codes. These help the NCA to:

• process your SAR accurately and efficiently
• allocate your SAR to the appropriate law enforcement agency
• analyse trends in suspected money laundering

Consult the NCA's SAR glossary codes booklet (PDF 14.5 KB)

There are glossary codes for particular criminal offences and types of SARs.

For example, when submitting a DAML, you should use the code XXS99XX where the value of the suspected criminal property is greater than £3,000.

Glossary codes should be inserted at the start of the reason for suspicion section.

Reason for suspicion

The free text section of the report is where you give a clear and concise explanation of the reason(s) for your knowledge or suspicion.

Your reason for suspicion should set out (in non-legal language):

• who – the identity of the party/parties involved and their connection with you
• what – the transaction you're involved in
• where – a description of the criminal property
• how – a description of the prohibited act(s)
• why – the criminal activity that you know or suspect they're engaging in
• when – any critical deadlines

If you are an MLRO working in the regulated sector, you must also give the:

• identity of the person(s) you know or suspect is involved in money laundering
• whereabouts of the known or suspected criminal property

What not to include

The NCA may take longer to consider your request if you:

• send or attach files
• include unnecessary details
• supply privileged information
• ask the NCA to verify your client's identity for you
• use complicated legal language
• ask for consent to take on a client when you haven't carried out, or have been unable to carry out, client due diligence

DAML SARs

If you know or suspect that you or your firm will be dealing with criminal property in a way that may amount to a principal offence, you’ll need to ask the NCA for a defence against money laundering (DAML).

The term DAML refers to ‘appropriate consent’ given by the NCA to a firm to carry out an activity that is otherwise prohibited by the principal money laundering offences under the Proceeds of Crime Act 2002 (POCA).

For example, if you’re acting for a client in a property transaction and you suspect the purchase funds are criminal property, you’d need a DAML before you could exchange contracts.

In practice, you’ll need to indicate that you’re seeking 'consent’ when submitting your SAR so that your DAML is processed efficiently.

A DAML will only protect you from committing a principal money laundering offence. It will not protect you from:

• committing a tipping off offence
• civil liability claims – for example, negligence, breach of trust or breach of contract
• committing or facilitating any other criminal offence – for example, under the Money Laundering Regulations 2017 (MLR 2017), Bribery Act 2010 or Fraud Act 2006

Requesting a DAML does not replace:

• taking a risk-based approach
• fulfilling your obligations under the MLR 2017

You do not need to ask for a DAML if you’re making a report about someone else’s suspected money laundering.

Exemptions

From 5 January 2023, the threshold amount specified in section 339A of POCA increased from £250 to £1,000.

This is the value of criminal property below which a bank or similar firm (a deposit-taking body, electronic money or payment institution) can carry out a transaction without submitting a DAML, in operating an account for a customer, without committing a money laundering offence under POCA 2002.

It does not apply to other actions, such as returning funds when terminating a relationship with a customer.

Sections 182 and 183 of the Economic Crime and Corporate Transparency Act 2023 affect part 7 of POCA.

Exemption when exiting a relationship with a customer

Under section 182, an exemption was enacted under section 327, section 328 and section 329 (the money laundering offences) which affects paying away funds under £1,000 when exiting a relationship with a customer, where there is a suspicion of money laundering or criminal property.

For reporters caught by POCA but not by the Money Laundering Regulations 2017, there is no change.

When submitting a request for a defence, include:

“We believe section [xxx] of POCA does not apply to this DAML as the activity falls outside the regulated sector.”

You may wish to obtain legal advice as to your responsibilities under this change to POCA 2002.

Read the Home Office guidance

Exemption for mixed property transactions

Under section 183, there is an exemption for mixed-property transactions under section 327, section 328 and section 329 which enables reporters to ring-fence funds they believe are criminal property and transact with funds outside the ring-fenced funds.

Reporters may wish to obtain legal advice as to their responsibilities under this change to POCA 2002.

Read the government guidance

For reporters caught by POCA but not by the Money Laundering Regulations 2017, there is no change.

When submitting a request for a defence, include:

“We believe section [xxx] of POCA does not apply to this DAML as the activity falls outside the regulated sector.”

Check the UKFIU's detailed guide to request a DAML (PDF 222 KB)

Making a DAML SAR

When you submit a DAML SAR, make sure you:

• tick the consent box and use the appropriate glossary code
• clearly identify the 'criminal property'
• state your reason(s) for suspecting the property is criminal
• explicitly describe the prohibited act(s) you plan to undertake involving the property
• identify the other party/parties involved in dealing with the property, including their dates of birth and addresses
• fully describe your reason for suspicion in relation to money laundering

It is important to make explicit, where necessary, where a DAML is for both yourself and your client, and which steps will be taken by each of you.

Be specific about the work you think you'll need a DAML for.

Outline all the remaining steps in the transaction that could be prohibited. For example:

• the release of funds in account A to party B
• the drawing up of contracts between parties C and D, transferring of ownership of the property from C to D and transferring of value of the funds

Avoid using vague terms like "we wish consent to proceed" or "we wish to maintain a business relationship".

The NCA cannot interpret or assume the proposed money laundering offence(s) from your report, so you need to be as explicit as possible.

The UK Financial Intelligence Unit (UKFIU) has provided a summary DAML template for solicitors. It shows the key elements to describe when constructing a DAML:

• purpose of report
• prohibited act
• reason for suspicion
• criminal property
• background
• summary

Tipping off

Once you’ve made a SAR, you’ll need to consider if and how you should change the way you interact with your client to avoid committing the offences of ‘tipping off’ and ‘prejudicing an investigation’.

Read our guidance on avoiding tipping off your client

After you’ve made a DAML SAR

The NCA has seven working days to decide whether to grant a DAML. This starts the next working day after you file your report.

Once you’ve submitted your report, it will be processed and checked against law enforcement databases.

If an investigation is needed, your SAR will be sent to the appropriate law enforcement agency.

If the NCA sends you a request for further information, you should respond as soon as possible. Consent may be refused within two working days of the information request if you do not reply.

Your DAML will be granted – or you may have ‘deemed consent’ – if after seven working days you:

• receive a letter from the NCA via SAR Online granting consent
• receive a letter in which the NCA neither grant nor refuse consent
• do not hear back from the NCA at all

If the NCA does not grant consent outright, you may want to consider whether it’s wise for you to go ahead with your transaction.

If your request is accepted

You are not obliged to carry out the specified activity or activities you described in your report if the NCA grants you a DAML.

For example, you may choose to:

• continue with the transaction
• carry out some but not all the activities described, or
• terminate the retainer

If you choose to continue, you have a defence against the principal offence(s) described in your report, but you may put yourself and your firm at risk of other criminal and/or civil consequences.

If you have had to file a DAML SAR for the same client on multiple occasions, you should consider your obligations under the MLR 2017 and whether you wish to continue the business relationship.

If your request is refused

A 31-day moratorium period will begin if your DAML request is refused within the seven-day notice period.

You must not carry out the prohibited act(s), but you can carry out other activities on the file.

The NCA will use this time to gather evidence and decide whether further action, such as restraint of funds, should take place.

A senior law enforcement officer can apply to the court for an extension of this moratorium period for up to 186 days. This will be granted if the criteria in section 336A POCA are met.

If you choose to continue with the prohibited transactions, you risk committing a principal money laundering offence under POCA.

Failure to disclose

You may commit an offence if you fail to make a SAR after information your knowledge or suspicion of money laundering is based on comes to you because of a disclosure made under:

• section 330 POCA – if you work in the regulated sector
• sections 337 or 338 POCA – if you work in the non-regulated sector

These are known as the ‘failure to disclose’ offences.

You should consider the statutory defences before you decide whether to make a SAR.

If you decide not to make a SAR, make a clear note in the client’s file explaining how and why you reached that decision.

In June 2021, the Crown Prosecution Service (CPS) published guidance on prosecuting standalone cases under section 330. This makes it possible to prosecute an offence under this provision regardless of whether an offence of money laundering has been substantiated.

The guidance states:

"It is possible to charge an individual under section 330 even though there is insufficient evidence to establish that money laundering was planned or has taken place.

Section 330 therefore creates an obligation to report suspicions of money laundering to the authorities, regardless of whether money laundering actually takes place.

This means that where individuals in the regulated sector receive information giving rise to a suspicion, or provides reasonable grounds for suspecting, that another is engaged in money laundering, an offence is committed by failing to make a report under section 330, regardless of whether it subsequently transpires that the money laundering cannot be proven, or that it did not occur."

Read the CPS money laundering offences guidance

Reasonable excuse

You do not commit an offence you have a "reasonable excuse" for not making a report. The scope of the defence has not been defined in POCA or by the courts.

You may be able to rely on the defence where, for example:

• the information that you would be providing is already in the public domain
• your knowledge or suspicion is based on privileged information and the crime/fraud exception does not apply
• the suspected offending takes place entirely outside the UK and there's no UK connection to the suspected criminal property

Clearly document your reasons for deciding that you have a reasonable excuse. You may want to seek independent legal advice before relying on the defence.

For more information, see section 6.7.1 of the anti-money laundering guidance for the legal sector.

Privileged information

Legal professional privilege

You must consider whether the information your suspicion is based on is subject to legal professional privilege (LPP).

You cannot make a SAR if the information is covered by LPP and the crime/fraud exemption does not apply.

Privileged circumstances

You must also consider whether the information your suspicion is based on came to you in 'privileged circumstances'. This applies where:

• you are a professional legal adviser
• the information or material is communicated to you by:
  • your client or their representative in connection with you giving legal advice
  • your client or their representative in connection with them seeking legal advice
  • any person for the purpose of or in connection with actual or contemplated legal proceedings
• the information cannot be communicated or given to you with a view to furthering a criminal purpose

You cannot make a SAR if you received the communication in privileged circumstances and the crime/fraud exemption does not apply.

Crime/fraud exemption

Under the crime/fraud exemption, you cannot disclose privileged information unless either:

• the documents themselves form part of the criminal act
• communications take place in order to obtain advice with the intention of carrying out an offence

You do not need to be aware that you are being used for a criminal or fraudulent purpose.

If the exemption applies, the information will still be confidential but you can make a SAR.

Section 7.4.5 of the anti-money laundering guidance for the legal sector describes this in more detail.

The impact of SARs

859,905 SARs were made to the UKFIU between April 2022 and March 2024, according to the UKFIU’s 2024 SARs report.

Of these, 2,526 SARs were from independent legal professionals – 0.29% of the total.

2,121 SARs were made by solicitors, with six from barristers, 311 from other legal professionals and 88 unspecified.

Overall, the number of DAML SARs requested decreased due to changes to legislation.

The number of cases where a DAML was refused increased by 37%, leading to £272.7m being denied to suspected criminals.

Across 2022 and 2023, more funds have been denied through DAMLs than in the previous six years combined.