What should an MLRO do after receiving an internal suspicious activity report?
Last updated: July 24, 2026
When an internal suspicious activity report (SAR) reaches the money laundering reporting office (MLRO), they become responsible for deciding how the practice should respond.
This process includes managing any immediate risk to current engagements, and independently determining whether the information supports an external SAR or a separate defence against money laundering (DAML) request.
Importantly, the MLRO in a small firm is usually also the nominated officer who handles external reporting. If one person holds both roles, well-documented decisions help keep the suspicion analysis, reporting process, and ongoing work properly controlled.
Key takeaways
- An internal report requires a documented reporting decision and does not automatically lead to an external SAR.
- The initial response must address any specific planned activity that may have to be paused.
- The reporting decision should reflect the MLRO’s own evaluation of the available information.
- Internal enquiries should remain focused on establishing the reporting position.
- An external SAR and a DAML request require separate decisions.
- A traceable audit trail should run from receipt of the report to the final outcome.
Immediate control issues following an internal SAR
When the internal SAR is received, the MLRO should place it under restricted access and make a brief note of the concern, so any immediate risk to the practice can be controlled before a reporting decision is made.
It should make clear when the concern was received, and whether any urgent action has already been taken.
The initial handling note must also address whether any relevant activity is due to happen before the MLRO reaches a decision, because an imminent act arising from the engagement may need attention.
Even then, a blanket stop on all work is rarely the right starting point. The key consideration at this stage is whether a particular act could involve criminal property and expose the practice or an individual to a principal money laundering offence.
If that risk is credible, the specific activity should be held long enough to decide whether an external SAR or DAML is required; other work can continue if lawful. That said, while the DAML issue is being resolved, the MLRO should control how any affected work is handled.
Information control is part of the same immediate response. Knowledge of the internal SAR should be restricted to people who need it, and the internal report or possible external reporting should not be disclosed to the client or any other person named in the concern.
Any explanation for the delay should also be controlled, including who may give it.
The MLRO’s independent suspicion analysis
The MLRO must form their own view rather than simply accepting or rejecting the conclusion in the internal report. In a sole practice, the same AML responsibilities still apply when the concern arises from the practitioner’s own work.
Nevertheless, the facts should be separated from any explanation or assumption, so the reporting decision is based on the information available rather than the initial reaction to it.
The central issue is whether the reporting threshold is met. This depends on whether the MLRO knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in money laundering.
The same analysis should also consider whether the information identifies the person involved or could help law enforcement locate the suspected criminal property.
At this stage, proof of the underlying offence is unnecessary. Equally, an unexplained error or irregular transaction should not be converted automatically into an external SAR.
The MLRO should be able to state the basis for the suspicion and why the account presented does not dispel it.
Proportionate internal enquiries before a reporting decision
Reasonable fact-checking can support the reporting decision by using material already available to the practice, including the engagement records.
Focused questions to the reporter or relevant colleagues can then clarify the key facts and the reasons offered.
Those enquiries can confirm the suspicion or provide a credible explanation that eliminates it, but their scope should remain no wider than necessary. The purpose is to decide the practice’s reporting obligation; it should not expand into a criminal investigation.
Client contact is particularly sensitive, not least because an unusual enquiry could reveal that reporting is being considered. It could also prejudice any investigation by alerting the client or another person connected with the concern.
If the privilege reporting exemption genuinely applies, specialist legal or supervisory guidance should be sought before the firm proceeds. Ordinary accountancy or tax confidentiality should not be assumed to fall within that restricted exemption.
External SAR reporting decision after an internal report
When the available information meets the applicable reporting conditions, an external SAR should be submitted as soon as practicable without waiting for a complete evidential picture. The submission should follow current UK Financial Intelligence Unit (UKFIU) guidance.
When deciding what to include in a SAR, the MLRO should ensure that the report clearly explains the basis for the suspicion.
If the threshold is not met, closing the internal report remains an active compliance decision, and the reasons should be recorded.
Practical takeaway: The SAR must reflect genuine knowledge or suspicion. Submitting one solely to create a defensive regulatory record is inconsistent with CCAB guidance.
DAML analysis for a proposed act involving criminal property
| Question | External SAR | DAML |
|---|---|---|
| What is being decided? | Whether the information should be reported externally. | Whether a specific future act needs a defence. |
| What triggers it? | Knowledge or suspicion of money laundering. | A proposed act involving suspected criminal property. |
| What should the MLRO focus on? | The basis for the suspicion and the information available. | The property, value, timing, and exact activity proposed. |
| What is the practical effect? | It reports the suspicion to UKFIU. | It may provide a defence for the specified activity only. |
A DAML request is relevant only if the practice proposes a future, specified act that could amount to an offence under sections 327 to 329 of the Proceeds of Crime Act 2002.
For that reason, the DAML analysis should describe the proposed act precisely, covering the property involved and the transaction in practical terms, including its value, timing, and intended destination or outcome.
Broad wording, such as continuing to act for the client or following the client’s instructions, does not describe a sufficient prohibited act. Moreover, the UKFIU will not use the DAML process to advise the reporter what action to take.
It should be mentioned that the effect of a DAML is limited. While it can provide a defence for the specified activity against the relevant principal money laundering offence, it does not validate the funds or endorse continued engagement.
Therefore, wider duties, including due diligence and tipping-off restrictions, remain unchanged.
Once submitted, that activity must not proceed during the seven-working-day notice period. If the request is refused, the statutory moratorium keeps the activity on hold until the legal position changes or the period ends.
Note that for terrorist financing, the corresponding mechanism is a defence against terrorist financing (DATF).
Decision records and controls after the internal SAR has been reviewed
The decision note should show the evidence considered and the reasons for the reporting conclusion, with any DAML issue addressed separately. The chronology should remain current, recording any UKFIU reference and later material developments.
Access control must continue after the reporting decision. Reporting records need to be stored in a restricted location accessible only to those handling the issue, so staff should be given clear compliance parameters, including which activities must be paused and the limits on client communication.
The client relationship should be considered on its own terms, as a SAR does not by itself require resignation.
Any continued engagement should be supported by a reassessment of the client’s risk and any control changes needed. The reporting decision also needs to be revisited if significant new information emerges.
Genuine uncertainty about the scope of a proposed DAML should be referred to a legal adviser or the relevant AML supervisor.
The wider response should remain controlled, so the facts, reporting outcome, and any DAML position are documented before the next steps are kept under review.
In summary
The MLRO’s response should be controlled and evidence-led, with the activity and property concerned kept at the centre of the assessment.
Enquiries must remain limited to the reporting decision, and relevant staff need to have clear compliance parameters on the work that may proceed.
The SAR record should then explain the MLRO’s response as the matter developed. This creates a reliable professional account of the practice’s response and supports appropriate review as the matter progresses.
FAQs
Each internal report requires review and a decision by the MLRO, but that decision does not automatically lead to an external SAR. Submission can be appropriate when the information gives the MLRO the required level of knowledge or suspicion about money laundering. Yet, if the reporting threshold is not reached, the internal SAR should be closed with the reasons recorded.
Work can continue if it is separate from the activity causing concern and remains lawful. The first step should be to establish whether any planned act involves suspected criminal property and whether that activity should be paused. Staff communications should make clear which work is affected and what can be said to the client if a delay arises.
The MLRO’s enquiries should be proportionate to the task of deciding whether an external SAR is required. This may involve reviewing material the firm already holds and asking targeted questions to the person who raised the concern. The review should stay within that purpose rather than becoming a wider investigation into the client’s conduct.
A defence against money laundering request could be needed when the firm plans to carry out a specific act that could involve criminal property. The proposed act must be described clearly enough for assessment. The MLRO should then determine whether a DAML request is appropriate, as many SARs do not involve a planned act requiring consent.
A brief client enquiry can be appropriate if it clarifies the facts, provided the risk of revealing that suspicious activity reporting is under consideration has been assessed. Questions that appear unusual or disclose too much could create further problems. In an uncertain case, specialist or supervisory input is appropriate before the client is contacted.
Filing a SAR does not determine whether the engagement should continue. That decision should be considered separately, taking account of the client’s AML risk profile and any further compliance measures required. If a DAML request is involved, particular work might need to remain paused while the MLRO allows other lawful tasks to proceed.
References and Source Material
- HMRC, Risks common to accountancy service providers
- Money Laundering Regulations 2017
- Proceeds of Crime Act 2002, Part 7
- CCAB, Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector
- NCA/UKFIU, Chapter 2: Submitting a SAR
- NCA/UKFIU, Chapter 3: Understanding DAMLs and DATFs
- HMRC, Appoint a nominated officer and train staff for money laundering supervision
- HMRC, Tell us about suspicious activity that may be linked to money laundering
