SAR Filing Guide: AML Compliance for UK Obliged Entities 2026

Every UK obliged entity — from banks and estate agents to lawyers and accountants — must submit a Suspicious Activity Report (SAR) to the National Crime Agency's UK Financial Intelligence Unit (UKFIU) when they know, suspect, or have reasonable grounds to suspect that a person is engaged in money laundering or terrorist financing. This obligation flows directly from sections 330–332 of the Proceeds of Crime Act 2002 (POCA) and sections 19 and 21A of the Terrorism Act 2000. Failure to disclose is a criminal offence punishable by up to five years' imprisonment. This guide explains the legal threshold for suspicion, the SAR filing process, Defence Against Money Laundering (DAML) consent requests, and the documentation you must retain.

Regulatory disclaimer: This guide is provided for informational purposes only. AML obligations are subject to change. Seek qualified legal advice for specific situations.

When does the legal obligation to file a SAR arise?

The obligation to file a SAR is triggered when a person knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in money laundering (s.330 POCA 2002) or terrorist financing (s.19 Terrorism Act 2000). The threshold is intentionally low: the Court of Appeal has held that suspicion requires no more than "a possibility, which is more than fanciful, that the relevant facts exist" (R v Da Silva [2006] EWCA Crim 1654).

This standard is far below the civil "balance of probabilities" test. A compliance professional does not need to be certain, nor even think it more likely than not. A nagging doubt, unexplained wealth, or a transaction pattern that does not fit the client's profile may be sufficient to reach the threshold.

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017, as amended) and the Economic Crime (Transparency and Enforcement) Act 2022 underpin the supervisory framework. As of January 2026, the government has confirmed that UK AML regulations will maintain close alignment with the FATF Recommendations following the post-Brexit review.

Who must file SARs in the UK?

The obligation applies to the "regulated sector" as defined in Schedule 9 to POCA 2002. This covers:

Professionals outside the regulated sector — for example, ordinary employers observing fraud — may file a voluntary SAR but face no criminal liability for non-disclosure. Inside the regulated sector, the obligation is absolute once suspicion is formed.

The AMLD6 compliance guide for obliged entities provides context on how EU-origin AML rules continue to influence UK supervisory expectations despite Brexit.

How to file a SAR: the SARs Online portal

All SARs must be submitted electronically through SARs Online, the portal operated by the NCA's UKFIU (accessible via nationalcrimeagency.gov.uk). Paper submission is no longer accepted.

A complete SAR should include:

1. Subject details: full name, date of birth, address, nationality, and any business name for the individual or entity concerned
2. Transaction details: dates, amounts, currency, accounts, and counterparties
3. Grounds for suspicion: a clear narrative explaining why the reporter suspects money laundering or terrorist financing — vague descriptions such as "unusual transaction" are insufficient and may result in the SAR being returned
4. Supporting evidence references: note relevant KYC documents, bank statements, land registry data, or company filings held on file

The NCA's SAR glossary provides definitions of every data field. Reporters should consult it to avoid the most common errors — incorrect subject type, missing address fields, and ambiguous narratives — that cause processing delays.

Defence Against Money Laundering (DAML) consent

If an obliged entity suspects a transaction but has not yet executed it, they may seek consent from the NCA to proceed without incurring criminal liability. This is called a DAML SAR (previously "consent SAR"). Under s.335 POCA 2002, the NCA has seven working days from the date of the DAML request to refuse consent; if no response is received within seven days, the entity may proceed. If the NCA refuses, a 31-calendar-day moratorium period begins, during which it can seek a court restraint order.

DAML requests must be clearly flagged in SARs Online to ensure routing to the NCA's consent team. Filing a standard SAR instead of a DAML SAR for a pending transaction is a common compliance error.

Documentation: what to keep and for how long

The AML red flags and suspicious activity indicators guide helps identify which transactions warrant a SAR — but once filed, robust documentation is equally critical. The MLR 2017 (reg. 40) requires records to be retained for five years from the end of the business relationship or the date of the transaction, whichever is later.

Mandatory records include:

• Copies of customer due diligence (CDD) documents: passport, driving licence, proof of address, and company formation documents
• Transaction records and account statements covering the period of concern
• Internal notes or committee minutes documenting the reasoning behind the SAR
• Confirmation of the SAR submission from SARs Online (acknowledgement number)
• Any subsequent correspondence with the UKFIU

CheckFile supports over 3,200 document types across 32 jurisdictions, enabling obliged entities to centralise AML evidence files with automated verification. The CheckFile document verification platform uses multi-layer analysis to confirm document authenticity — structural, metadata, and cross-document coherence checks — reducing the risk of accepting fraudulent CDD evidence that would undermine an SAR investigation.

According to the ACFE 2024 Report to the Nations, manual fraud detection reaches only 37% of cases, with an average detection lag of 87 days. Automated document checks close this gap by surfacing anomalies at the point of onboarding or transaction.

The tipping-off prohibition

Section 333A of POCA 2002 makes it a criminal offence — punishable by up to two years' imprisonment — to disclose to the subject of a SAR, or to any third party, that a SAR has been or may be filed. This "tipping-off" prohibition applies from the moment suspicion arises. Obligations under the prohibition extend to employees, contractors, and group companies outside the regulated sector.

A key professional challenge arises when a client asks why their transaction is delayed or why enhanced due diligence is being applied. The standard response is to cite internal compliance procedures without mentioning any SAR. The Law Society's SAR guidance for solicitors offers model language.

Penalties for failure to disclose

Non-disclosure under s.330 POCA 2002 carries penalties of up to five years' imprisonment on conviction on indictment, or 12 months on summary conviction, plus an unlimited fine. Individuals and their employing organisations can both face prosecution.

Regulatory sanctions run in parallel. The FCA has fined firms tens of millions of pounds for systematic SAR failures; HMRC has used civil penalties under the MLR 2017 against accountants and estate agents. For high-value cases, the Serious Fraud Office and the National Crime Agency can launch parallel criminal investigations.

Frequently Asked Questions

What is the difference between a standard SAR and a DAML SAR?

A standard SAR discloses past or ongoing suspected money laundering but does not seek permission to proceed with a transaction. A DAML SAR is filed when an entity wants to carry out a transaction it suspects is tainted and seeks the NCA's consent before proceeding. Both are submitted via SARs Online, but DAML requests require a specific flag and trigger the seven-day consent window under s.335 POCA 2002.

Can I file a SAR based purely on open-source information?

Yes. Suspicion may arise from any source: transaction patterns, news reports, sanctions list hits, or adverse media. You do not need direct evidence of a predicate offence — only a genuine suspicion that funds may be the proceeds of crime. Document the basis for your suspicion carefully in the SAR narrative.

Does a SAR protect me from civil liability to the customer?

Section 337 of POCA 2002 provides a safe harbour: disclosure to the NCA in good faith is not a breach of any contractual obligation or duty of confidentiality. This protection applies even if the suspicion later proves to be unfounded, provided it was raised honestly and not for an improper purpose.

How quickly must I file a SAR after suspicion arises?

There is no fixed statutory deadline for standard SARs, but regulatory guidance consistently emphasises filing "as soon as practicable" after suspicion forms. Delay without justification can be treated as a failure to disclose. For DAML SARs, the filing must precede execution of the transaction.

What happens if a SAR results in a prosecution?

After submitting a SAR, you may be contacted by law enforcement for further information. Your identity as the reporter is protected and cannot be disclosed in criminal proceedings without your consent. The NCA may issue a production order under s.345 POCA 2002 requesting copies of the evidence underlying your SAR.