ECSH155000 | Making Referrals and Suspicious Activity Reports (SARs)

What is a SAR?

A suspicious activity report (SAR) is a piece of intelligence that alerts law enforcement to potential instances of money laundering or terrorist financing.

The UK Financial Intelligence Unit (UKFIU), sited within the National Crime Agency (NCA), receives, analyses, and distributes the financial intelligence gathered from SARs.

The information is then disseminated to law enforcement agencies, including HMRC, who investigate and decide what further action to take.

The SARs database is one of the largest sources of financial intelligence available for UK enforcement.

An internal SAR (iSAR) is a suspicious activity report made within a supervised entity or regulatory body, which is reviewed by the Nominated Officer or Money Laundering Reporting Officer (MLRO) before determining whether it should be submitted to the NCA.

A high-quality SAR can provide crucial intelligence for law enforcement and can help to prevent a wide range of serious organised crimes and terrorist activities. Some HMRC staff will be aware of SARs through their use in risk profiling, particularly for identifying fraud and criminal cases.

Defence against money laundering (DAML)

A DAML provides a defence to a principal money laundering offence should a business decide to carry on with a transaction; it is not permission to continue granted by the NCA. The business must decide for itself whether to continue dealing with the customer. The DAML only relates to the transaction on which it was raised. There is also a threshold in place, which is currently £3,000.

Similarly, businesses may seek a defence against terrorist financing (DATF).

Please read the NCA’s Understanding DAMLs and DATFs.

Guidance is also available on GOV.UK for exemptions to DAMLs introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCT).

Who needs to submit a SAR

SARs are generated by entities operating in sectors regulated for anti-money laundering (AML) supervision, which include:

• Banks, finance, and credit businesses.

• Legal professionals.

• Accountants and tax advisors.

• Trust or company service providers.

• Estate and letting agencies.

• High value dealers.

• Art market participants.

• Casinos.

• Crypto-exchanges.

If anyone operating in one of these sectors suspects money laundering, terrorist financing or proliferation financing (ML/TF/PF) they have a legal obligation under Section 7 of The Proceeds of Crime Act 2002 (POCA) and Part 3 of the Terrorism Act (TACT) to report their suspicion to the National Crime Agency (NCA).

These suspicions are typically reported to the NCA through the submission of SARs using the UK Financial Intelligence Unit (UKFIU) online portal. Failure to submit a SAR, if a risk has been identified, is a criminal offence.

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) require supervised businesses to have robust measures in place for identifying and reporting ML/TF/PF risks. Failure to implement these measures can result in substantial financial penalties, or in serious cases, cancellation of registration. You can find more information in ECSH33600 Checking internal reporting and suspicious activity.

Under regulation 46(5) MLR 2017 if HMRC, while carrying out its supervisory activities or otherwise, forms a suspicion that an entity or person in the regulated sector, or one of the entity’s customers or associates, is carrying out ML/TF/PF, it must inform the NCA as soon as is practicable.

No specific format is legislated for how these disclosures should be made but one of the most efficient and secure ways for HMRC to share information with the NCA is via the UKFIU online portal for SARs. Officers can absolve themselves of their individual legal obligations to report suspicions directly to the NCA by following HMRC’s internal SAR reporting process.

What is a sufficient level of suspicion to submit a SAR

The threshold for forming a ‘suspicion’ is very low with the criteria set out in ‘R v Da Silva (2006) EWCA Crim 1654’ stating it should be ‘more than fanciful’ but that ‘a vague feeling of unease would not suffice’.

A SAR must be submitted if a person knows or suspects or has grounds for knowing or suspecting a person or entity in the regulated sector is or has engaged in ML/TF/PF.

Here are some indicators that signal the possibility of suspicious activity.

• Transactions: Are any transactions unusual because of their size, frequency, or the manner of their execution, in relation to the business or any of its clients?

• Means test: is the individual’s lifestyle or asset ownership high relative to their declared income? If a business, does it have revenue streams that seem insufficient to justify large balance sheet items (assets or liabilities).

• Trading Profit and Loss (P&L) or Balance Sheet items: are there erratic or unusual patterns on the P&L or Balance Sheet e.g. rapidly increasing revenue streams year on year or erratic fluctuations in debt or equity levels.

• Trade Based Money Laundering: are the cost of inputs or outputs significantly different to the average cost for that sector or type of business? Or are the costs of business or any other financial variable unusually high or low compared to the ‘average’ for that sector?

• Insolvency: Does the business appear to be trading whilst being insolvent, if so, where is it getting funds to continue trading?

• Structures: Do any activities involve complex or illogical business structures that make it unclear who is conducting a transaction or purchase? For example, intra-group loans or acquisitions from jurisdictions that have laws aiding financial secrecy.

• Source of funds: Is there evidence of large amounts of cash or funding being recorded where the source is unknown, bank statements revealing large deposits or withdrawals with no explanation, and inconsistent with what is known about the business or individual. Is a business receiving significant funding from a jurisdiction where beneficial ownership is obfuscated or unavailable?

• Resources: Are any businesses funds disproportionately private relative to their stated revenue streams?

• Behaviour: Has the business, individual or agent been unusually anxious to complete a transaction or are unable to justify why they need completion to be undertaken quickly?

• Documents: Has the entity withheld information or documents or do provided documents appear to have been falsified?

• Geographical Area: Is the business or individual native to, resident or operating in a high-risk country, or trading with other entities in high-risk areas – if so, are high-value transactions involved?

• Cryptocurrency: Any evidence of funds being transferred to or from crypto-wallets or on crypto-exchange platforms?

What information is required

SARs should give a clear and concise explanation of the reason(s) for the suspicion, identifying:

• Who – the identity of the party, or parties involved

• What – the transaction they are involved in

• Where – a description of the criminal property

• How – a description of the prohibited act(s)

• Why – the criminal activity suspected

• When – any critical deadlines

Tipping off

Under section 333A POCA and 21D TACT, it is a criminal offence that could result in imprisonment or a fine for:

• telling a person that a report has been made (if you know or suspect that you’re likely to prejudice an investigation by disclosing this information); or

• an investigation into money laundering is being considered or carried out (if that disclosure will prejudice the investigation).

If a person knows or suspects that a money laundering investigation is being or is about to be concluded, it’s a criminal offence under section 342 POCA to make a disclosure that’s likely to prejudice the investigation.

More Information about SARs

The NCA provides further guidance on SARs here.

More information about information sharing and referrals can be found in the Sharing information: contents section.

(This content has been withheld because of exemptions in the Freedom of Information Act 2000)