Suspicious Activity Report (SAR) — the complete UK guide
When to file, how the SAR Online portal works, the SAR vs DAML distinction, how to draft a useful SAR, and the tipping-off rules every reporter must understand.
By Mehmood Rajoka · Last updated 2026-06-08
TL;DR — Quick Summary
- •A Suspicious Activity Report (SAR) is a formal disclosure to the National Crime Agency (NCA) under POCA 2002 when a person in a regulated sector knows or suspects money laundering or terrorist financing.
- •Filing a SAR is mandatory under POCA s.330 — failure to report when grounds exist is itself a criminal offence carrying up to 5 years' imprisonment.
- •SARs are submitted via the NCA's SAR Online portal. Most SARs are intelligence-only; a Defence Against Money Laundering (DAML) request seeks consent to continue with a specific transaction.
- •The reporting threshold is 'knowledge or suspicion' — lower than the criminal standard of proof. You do not need to identify the predicate offence.
- •Tipping off — telling the client a SAR has been filed — is a separate criminal offence under POCA s.333A carrying up to 5 years' imprisonment.
Answer-first summary
What is a Suspicious Activity Report (SAR)?
A Suspicious Activity Report is a formal disclosure to the UK's National Crime Agency (NCA) under POCA 2002 — or the Terrorism Act 2000 for terrorist financing — when a person in a regulated sector knows or suspects another person is engaged in money laundering. Filing a SAR discharges the reporter's statutory duty under POCA s.330 and provides a defence against the substantive money laundering offences in POCA ss.327-329. SARs are submitted electronically via the NCA's SAR Online portal.
- Statutory duty under POCA s.330 — failure to report is itself an offence
- Threshold is 'knowledge or suspicion' — lower than criminal standard
- Most SARs are intelligence-only; DAML requests seek transaction consent
- Tipping off the subject is a separate POCA s.333A offence (5 years)
When you must file a SAR
Four trigger categories drawn from POCA 2002 and supervisory-body AML guidance:
You know or suspect money laundering
The threshold is lower than the criminal standard. If you would describe the situation to a colleague as 'something feels off here', that is usually enough to qualify as suspicion under POCA s.330(2).
You receive funds you suspect are criminal proceeds
Even where no formal CDD trigger has been hit, receiving funds where the explanation doesn't add up — value inconsistent with stated business, source can't be evidenced, payment routing is unusual — should trigger an internal disclosure to the MLRO.
A client refuses to evidence source of funds or wealth
Refusal to engage with reasonable EDD enquiries is itself a suspicion indicator. Combined with any other red flag, it almost always justifies a SAR.
You suspect terrorist financing
Suspicion of terrorist financing — under the Terrorism Act 2000 — must be reported to the NCA via the same SAR Online portal, with the terrorism marker selected. Time-critical suspicion may require a phone call to the NCA Duty Officer.
SAR vs DAML — the distinction that catches firms out
A SAR discharges the reporting duty. A DAML asks for permission to act. They are not interchangeable.
SAR (intelligence-only)
- Purpose:
- Discharge the POCA s.330 reporting duty when suspicion exists but no specific transaction needs to proceed urgently.
- NCA response:
- No NCA response required — the SAR sits in intelligence. The firm can continue acting unless its own suspicion makes that inappropriate.
- When to file:
- Most cases. The default form of SAR.
DAML (Defence Against Money Laundering)
- Purpose:
- Request NCA consent under POCA s.335 to complete a specific transaction that would otherwise be a principal money laundering offence (e.g. completing a property sale, releasing client funds, distributing profits).
- NCA response:
- 7 working days' 'notice period'. If no refusal, consent is implied. Refusal triggers a further 31-day 'moratorium period'.
- When to file:
- When a specific transaction is imminent and proceeding without consent would expose the firm to a POCA offence.
What to include in the SAR
The NCA prioritises concrete, factual SARs. Eight content elements:
- Subject details — name, date of birth, address, identifiers (NINO, passport, company number) where known
- Nature of the suspicion — what facts give rise to it, expressed in concrete terms not legal conclusions
- Timeline of events — when each transaction or instruction occurred
- Amounts involved — specific figures, not ranges
- Other parties — payees, intermediaries, jurisdictions
- Source documents — bank statements, instructions, identification, communications (where consent and privilege allow)
- The reporter's role and the firm's relationship to the subject
- Glossary codes — XXSARXX for SAR, XXDAMLXX for DAML, plus the relevant subject-matter codes published by the NCA
Five common SAR mistakes
Filing too late
POCA s.330 requires reporting 'as soon as practicable' after the suspicion arises. Delays measured in weeks are increasingly treated by the NCA and supervisors as evidence the firm's internal escalation is broken.
Drafting in legal conclusions, not facts
A SAR that says 'we believe the client is laundering money' is less useful to the NCA than one that lists the seven specific transactions, dates, amounts, and counterparties that gave rise to the suspicion. Drafters often over-conclude and under-describe.
Missing the DAML request when needed
A SAR is not a DAML. If the firm needs to proceed with a transaction (a property completion, a profit distribution) and continuing would otherwise be a POCA offence, the SAR must explicitly request consent under POCA s.335.
Telling the client
Once a SAR is being prepared or has been filed, the client must not be told. Even 'we cannot proceed for regulatory reasons' can amount to tipping off under POCA s.333A if the client could reasonably infer a SAR has been made. Coded language is not safe.
Storing the SAR on the client matter file
The SAR, internal disclosure, and MLRO reasoning must be in a confidential register accessible only to the MLRO chain. Storing them in the client matter folder where any colleague can read them is both a tipping-off risk and a supervisory failing.
FAQ
Answer-first summary
What is a Suspicious Activity Report (SAR)?
A Suspicious Activity Report is a formal disclosure made to the UK's National Crime Agency under POCA 2002 (or the Terrorism Act 2000) when a person in a regulated sector knows or suspects that another person is engaged in money laundering or terrorist financing. Filing a SAR discharges the reporter's duty under POCA s.330 and provides a defence against the substantive money laundering offences in POCA ss.327-329. Failure to file when grounds exist is itself a criminal offence.
Answer-first summary
Who files SARs?
Within a regulated firm, internal disclosures are made by any staff member with knowledge or suspicion to the MLRO (or Nominated Officer). The MLRO then decides whether to file an external SAR with the NCA on behalf of the firm. SARs are submitted electronically via the NCA's SAR Online portal. The MLRO retains personal criminal liability if the firm fails to report when grounds exist.
Answer-first summary
What's the difference between a SAR and a DAML?
A SAR is intelligence-only — it discharges the reporting duty but does not require an NCA response, and the firm can continue acting unless its own suspicion makes that inappropriate. A DAML (Defence Against Money Laundering) — sometimes called a 'consent SAR' — is a request under POCA s.335 for the NCA's permission to complete a specific transaction that would otherwise be a money laundering offence. A DAML triggers a 7-day notice period; consent is implied if there is no refusal. A refusal triggers a further 31-day moratorium period.
Answer-first summary
What is the threshold for filing a SAR?
'Knowledge or suspicion' — lower than the criminal standard of proof, lower than 'belief'. Case law (notably K Ltd v National Westminster Bank) treats suspicion as 'a possibility, which is more than fanciful, that the relevant facts exist'. You do not need to identify the predicate offence, and you do not need evidence that would stand up in court. If you would describe the situation to a colleague as 'something feels off here', that is usually enough.
Answer-first summary
How long do I have to file a SAR?
POCA s.330 requires reporting 'as soon as practicable' after the information giving rise to suspicion comes to you. There is no fixed deadline, but supervisors and the NCA increasingly treat delays of weeks (rather than days) as evidence of inadequate internal escalation. Internal MLRO escalation should aim for same-day or next-working-day; external filing should follow within days, not weeks.
Answer-first summary
Can I tell the client a SAR has been filed?
No. Disclosing — to the client or anyone else — that a SAR has been or is being filed, where the disclosure is likely to prejudice an investigation, is the criminal offence of tipping off under POCA s.333A. It carries up to 5 years' imprisonment. Even hinted communications ('we cannot proceed for regulatory reasons') can amount to tipping off if the client could infer a SAR has been made. Communications must be controlled by the MLRO chain.
Answer-first summary
What happens after a SAR is filed?
Most SARs are intelligence-only — they sit in the NCA's database and may contribute to investigations across UK law enforcement, but no specific response is sent to the reporter. DAML requests get an explicit response within the notice period. The reporter receives a confirmation reference on submission, which should be retained in the firm's SAR register. The NCA may contact the reporter for clarification, particularly on high-value or time-sensitive matters.