Suspicious transaction reporting: A practical guide

When is the threshold crossed?

The legislation sets three standards, and they are not the same thing:

• Knowledge. You know.
• Suspicion. More than speculation, less than proof. A degree of satisfaction that something is not right.
• Reasonable grounds to suspect. An objective test. Would a reasonable person, with your training and the facts in front of you, have suspected?

That third limb catches firms who tell themselves they were not sure. The law does not require certainty. It requires reasonable grounds, assessed on the facts available at the time.

The duty attaches to information obtained in the course of the firm’s business, and it does not switch off because the transaction never happened. A prospective client who walks away when asked for source-of-funds evidence, or an instruction withdrawn once questions start, can be exactly the point at which the grounds exist. The Act says so in terms: where due diligence cannot be completed because the customer will not provide the documents or information, that failure can itself amount to reasonable grounds to suspect, and a stalled file becomes a decision for the MLRO.

What suspicion looks like in practice

Staff escalate what they have been taught to recognise. The patterns below come up across every sector the Act covers; the product-specific versions belong in the firm’s own training.

• Activity that does not fit the profile. Turnover, lodgements or transfers out of proportion to what the firm knows about the client’s business or income.
• Structuring. Amounts kept just under a threshold, or one sum split across several payments, accounts or days for no commercial reason.
• Source of funds that cannot be explained. Vague answers, changing answers, or a refusal to answer at all.
• Third parties in the money flow. Funds arriving from, or sent to, people and entities with no apparent connection to the client.
• Unusual urgency or indifference. Pressure to complete quickly, or a client untroubled by fees, losses or early-surrender penalties.
• Reluctance over CDD. Documents that arrive late, incomplete, or that do not match other information the firm already holds.
• Odd routing. Payments through jurisdictions on the high-risk list, or instructions to pay a different account from the one on file.
• Patterns across the book. Several clients sharing an address, a device, a director or an adviser, where none of them should.

A sanctions match is a different thing. It has to be notified to the sanctions authority under the EU restrictive measures regime, which for regulated financial firms is the Central Bank, and it may also warrant an STR. The two are not alternatives.

The internal escalation step

Staff do not file STRs. Staff escalate to the MLRO, who decides. That step does three jobs:

1. It protects the member of staff, who has discharged their obligation by reporting internally.
2. It centralises the decision with the person who can see the whole client picture.
3. It creates the audit trail showing when the firm first knew.

What the internal report should capture

An internal report is a short document, but it is the one an inspector reads first when reconstructing a case. It should record:

• The date and time it was raised, and by whom
• The client, account or matter, and any connected parties
• What was observed, as facts: amounts, dates, what was said, what was asked for
• Why it did not fit, in the reporter’s own words
• What documents or screenshots are attached, and where the originals sit

Set an internal clock and keep to it. Escalation to the MLRO the same working day, and a recorded decision within a fixed number of working days, is the kind of standard a policy should state and a log should evidence.

The MLRO’s decision

The MLRO assesses the internal report and either files or does not. No STR filed is a valid outcome, provided the reasoning is recorded. An internal report log with decisions and dates against every entry is exactly what an inspector wants to see. A log with escalations and no recorded outcomes is a finding.

Record the decision in the same place as the report: the date, who decided, the outcome, the reasons, and, where a report was filed, the goAML and Revenue references. If the decision was to wait for more information, record what information and by when.

How and where to file

Ireland requires dual reporting. One filing is not enough:

• FIU Ireland, through the Garda online system, goAML.
• The Revenue Commissioners, through their own channel.

The statutory test is as soon as practicable. In practice, a filing made within 24 to 72 hours of the MLRO’s decision is defensible. Weeks later is not, and the gap will be the first thing anyone asks about.

Filing on goAML

goAML is FIU Ireland’s reporting portal, and the firm has to be registered on it before the first report, with the MLRO set up as the reporting officer. Registration is not instant, so a firm that has never filed should register now rather than on the day it needs to.

1. Log in and open a new suspicious transaction report.
2. Enter the subjects: the person or entity, and any accounts and connected parties the firm can identify.
3. Enter the transactions or activity: amounts, dates, counterparties, and whether the transaction completed, was declined or was never carried out.
4. Write the grounds of suspicion in the free-text field, as facts in date order.
5. Attach the supporting documents: identification, account statements, correspondence, screenshots.
6. Submit, and keep the report reference goAML issues. That reference, with the date, is the firm’s evidence of when it reported.

Anything the FIU wants afterwards comes through the goAML message board rather than by post, so someone has to be watching it. Requests for further information carry their own deadlines.

Filing with Revenue

Revenue accepts suspicious transaction reports online through the Revenue Online Service. The report should carry the same facts as the goAML filing and refer to it, so the two can be matched. Keep the acknowledgement with the goAML reference. A file that holds one and not the other is the third failure on the list below, and it is common.

Do not proceed: the transaction while the report is pending

Where the suspicion attaches to a transaction or a service the firm has been asked to carry out, the Act expects the firm not to proceed until the report has been made. The exception is where delaying is not practicable, or would itself alert the client or frustrate an investigation; in that case the firm proceeds and reports immediately afterwards, recording why.

Once a report is in, a Garda superintendent can direct the firm not to carry out the transaction for up to seven days, and the District Court can extend it by orders of up to 28 days at a time. Complying with a direction is not a breach of any duty the firm owes the client. Plan for it before it happens: who in the firm receives the direction, what the client is told about the delay, and in what words. The client is told that the transaction is delayed, nothing about why, and nothing about a report.

What goes in an STR

• Identification of the subject, and of any connected parties
• The transaction or activity: amounts, dates, accounts, counterparties
• Where the funds or property are, if the firm knows
• The specific grounds of suspicion, written as facts rather than conclusions
• What documents the firm holds, and where
• Any earlier reports on the same subject, cross-referenced

“The client seemed evasive” is not grounds. “The client declined three times to explain the source of a €240,000 lodgement, then withdrew the instruction” is.

Writing the grounds

The free-text grounds are what an analyst reads first and what, years later, a court or an inspector may read too. A structure that works every time:

1. Who. The subject, their relationship with the firm, and since when.
2. What. The transaction or activity, with amounts and dates, in order.
3. Why it does not fit. What the firm knows about the client that makes the activity unexplained.
4. What the firm did. Questions asked, answers given, documents requested and what arrived.
5. What else is held. Earlier reports, related accounts, and where the file sits.

Name people and entities exactly as they appear on the documents, give dates in full, and do not speculate about the predicate offence. The FIU decides what the money is; the firm reports what it saw.

Tipping off: The hardest part

Section 49 makes it an offence to disclose anything likely to prejudice an investigation. That includes telling the client, and it includes telling colleagues who have no need to know.

The practical difficulty is that the relationship usually continues while the report sits with the FIU. Staff have to carry on normally, answer the phone as they always would, and say nothing. Firms that have never rehearsed this are the ones where somebody says too much.

What you can still say

The offence is narrower than most people assume, and the Act carves out the disclosures a firm needs to make:

• To the FIU, the Garda Síochána or Revenue, and to your own supervisor where it asks
• To the firm’s legal adviser, for advice
• Within the firm, to the people who need to know in order to handle the matter: the MLRO, senior management, the staff dealing with the client
• Within a group, between entities that apply equivalent AML standards, so a parent or sister company can act on the same information
• Between two regulated firms involved in the same transaction with the same client, in the limited circumstances the Act allows

A professional adviser who tries to dissuade a client from going ahead with something unlawful is not tipping off. Telling that client a report has been made, or hinting at it, is. Write the permitted disclosures into the policy, so that nobody has to work them out under pressure.

Watch the quiet channels. A note on the CRM visible to the whole firm, a comment on a shared ticket, or a colleague told over coffee can each amount to a disclosure to someone with no need to know.

What happens after you file

Usually very little, visibly. The FIU may acknowledge receipt, may come back for more information, or may issue a direction not to proceed with a transaction. Silence is the normal case and does not mean the report was wrong.

Filing does not oblige a firm to end the relationship, and ending it abruptly can itself amount to tipping off. That decision is separate, and should be taken and recorded on its own terms.

Protection, records and the board

• Protection. A report made in good faith does not breach client confidentiality or any other restriction on disclosure, and attracts no liability under the Act for having been made.
• Records. The internal report, the MLRO’s decision, the goAML and Revenue references and acknowledgements, and the documents behind them are kept for at least five years, the Act’s general retention period, and longer if a request from the FIU or a supervisor is open.
• The board. STR volumes, the time from suspicion to filing, and decisions not to file belong in the MLRO’s regular report to the board. A firm that has filed nothing in three years should be asked why, by its own board before anyone else asks.

A defensible timeline, start to finish

What a good file looks like when it is reconstructed afterwards:

1. Day 0. A member of staff notices the activity and raises an internal report the same day, with the facts and attachments.
2. Day 0 to 1. The MLRO reviews the client file, asks the business for anything missing, and records a decision.
3. Day 1 to 3. The STR is filed on goAML and with Revenue, and both references go on the internal log. If a transaction is pending, it does not proceed until the report is in.
4. Ongoing. The relationship continues normally, with the people who need to know told and nobody else. The goAML message board is checked for requests.
5. Afterwards. Any decision to exit the relationship is taken and recorded on its own merits, and the file is retained for five years.

Every step has a date against it. That is the whole difference between a defensible file and an indefensible one.

Six failures that come up repeatedly

1. Filing weeks after the suspicion arose, with no explanation for the gap
2. Grounds written so vaguely the report cannot be acted on
3. Filing to FIU Ireland and forgetting Revenue, or the reverse
4. MLRO decisions not to file that were never written down
5. Tipping off, usually by a well-meaning member of staff
6. Staff who did not escalate because nobody had told them what suspicion looks like in their own product

Training is the fix

Every failure on that list except the third is a training failure. Staff report what they have been taught to recognise, and stay quiet about what they have been taught to keep quiet about.