Tipping Off and Confidentiality of Reports

1. Why This Topic Matters

Tipping off and the confidentiality of suspicious activity reports sit at the heart of the anti-financial crime (AFC) framework. The entire value of a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) depends on secrecy. If a customer learns that they are the subject of a report or an investigation, they can move funds, destroy records, coach associates, flee the jurisdiction, or alter their behaviour to avoid detection. In short, a single careless disclosure can destroy months of law enforcement work and expose the institution, and the individual employee, to criminal liability.

For the CAMS exam, this topic is tested frequently because it combines law, ethics, operational controls, and judgment under pressure. Questions typically present a realistic scenario (a relationship manager faces an angry customer, a compliance officer receives a subpoena, a bank wants to close an account) and ask you to pick the response that protects confidentiality while still complying with other obligations. Understanding the underlying logic, not just the rules, is what allows you to answer these consistently.

2. What Is Tipping Off?

Tipping off is the unauthorized disclosure, directly or indirectly, that a suspicious activity report has been filed, is being considered, or that an investigation into money laundering or terrorist financing is underway or contemplated, where that disclosure is likely to prejudice the investigation. It is a criminal offence in most jurisdictions.

Key elements usually found in the legal definition:
- A report has been made (or information has come to the person's attention in the course of their work that one has been or will be made).
- The person discloses this fact to any third party, including the customer, the customer's associates, or even unauthorized colleagues.
- The disclosure is likely to prejudice an investigation, or in some jurisdictions the offence is strict and the mere disclosure is enough.

Confidentiality of reports is the broader principle: the existence and contents of a SAR/STR, any supporting documentation that would reveal the filing, and communications with the Financial Intelligence Unit (FIU) must be protected and shared only with authorized parties.

3. The International and Legal Framework

FATF Recommendation 21 (Tipping-off and confidentiality) requires that financial institutions, their directors, officers and employees be:
(a) protected by law from criminal and civil liability for breach of any restriction on disclosure of information when they report suspicions in good faith to the FIU (the so-called safe harbor); and
(b) prohibited by law from disclosing the fact that an STR or related information is being filed with the FIU.

The FATF notes that this prohibition is not intended to inhibit information sharing within a financial group where permitted, nor to prevent sharing with competent authorities.

United States: Under the Bank Secrecy Act (31 U.S.C. 5318(g)(2)) and FinCEN regulations, a financial institution and its directors, officers, employees and agents may not notify any person involved in the transaction that a SAR has been filed. SAR confidentiality extends to any information that would reveal the existence of a SAR. A SAR may be disclosed to FinCEN, law enforcement, federal and state banking regulators, and (under specific FinCEN guidance) to a parent entity or controlling company for enterprise-wide risk management. The safe harbor in 5318(g)(3) protects institutions from civil liability for filing. Importantly, Section 314(b) of the USA PATRIOT Act allows institutions to share information about possible money laundering or terrorist financing with each other, but it does not permit sharing the SAR itself or the fact that one was filed. Unauthorized SAR disclosure can result in civil penalties and criminal prosecution.

United Kingdom: Section 333A of the Proceeds of Crime Act 2002 (POCA) creates the tipping-off offence for the regulated sector, punishable by up to two years imprisonment and/or a fine. Section 342 covers prejudicing an investigation. There are defences for disclosures within a group, to supervisory authorities, to legal advisers, and where the person did not know or suspect the disclosure would prejudice an investigation.

European Union: The Anti-Money Laundering Directives (notably Article 39 of the 4th AMLD, carried forward in later directives and the new AML Regulation) prohibit disclosing to the customer or third parties that information has been or will be transmitted to the FIU, with carve-outs for disclosures to competent authorities, within groups, and between professionals in defined circumstances.

Most other jurisdictions (Canada under PCMLTFA, Australia under the AML/CTF Act, Singapore under the CDSA, Hong Kong under the OSCO/DTROP, and others) have parallel provisions. The common thread is the same: report in good faith, keep it secret, and enjoy legal protection for doing so.

4. How It Works in Practice

a) Who is bound? Everyone who learns of a report in the course of their work: compliance and MLRO staff, front-line employees who raised an internal alert, senior management, board members, IT staff with system access, auditors, and third-party service providers. The obligation does not end when the person leaves the institution.

b) What counts as a disclosure? Tipping off can be direct (telling the customer a SAR has been filed) or indirect (telling the customer that 'compliance is looking into your account and you may hear from the authorities', suddenly freezing a transaction with an explanation that points to a report, placing a note visible to tellers, or confirming a filing to a journalist, lawyer or family member). Even a hint or careless remark can constitute the offence.

c) The internal flow of information. Well-designed AFC programmes restrict SAR knowledge on a strict need-to-know basis:
- Front-line staff raise an internal unusual activity report to the compliance function and are generally not told whether a SAR was subsequently filed.
- Case management systems have role-based access controls and audit trails.
- SAR files, supporting documentation and FIU correspondence are stored separately from general customer files so they are never inadvertently disclosed in response to a customer records request or discovery.
- Training reminds all staff that they must not discuss cases with the customer or unauthorized colleagues.

d) Dealing with the customer after a report. The institution must often continue the relationship to avoid alerting the customer. If a transaction is delayed or declined, staff use neutral, pre-approved language that cites general policy, documentation requirements, or risk appetite without referencing suspicion, investigation, or authorities. If asked directly whether a SAR was filed, the correct response is neither confirmation nor denial but a statement that the institution does not comment on such matters.

e) Exiting the relationship. Account closure is permitted, but timing and communication must be coordinated with compliance and, where appropriate, law enforcement, who may request that the account remain open to monitor activity. Closure letters should never reference a SAR or investigation.

f) Subpoenas, litigation and regulators. If an institution receives a subpoena or a civil discovery request for SAR-related material, it should not produce the SAR or confirm its existence; instead it should notify the FIU (e.g., FinCEN in the US) and seek legal guidance. Disclosure to the FIU, law enforcement, and prudential or AML supervisors in the course of their examination duties is permitted and expected.

g) Group-wide and cross-border sharing. Many regimes allow sharing of SAR information within a corporate group for risk management purposes, subject to conditions (e.g., the recipient is also subject to confidentiality, and the sharing is not to a branch in a jurisdiction that would re-disclose it). Sharing with unrelated institutions is generally limited to statutory mechanisms such as US Section 314(b), which excludes the SAR itself.

h) Law enforcement requests to keep accounts open. When law enforcement asks an institution to keep an account open, the institution should obtain the request in writing, keep it confidential, and continue to file SARs on ongoing activity, typically on a continuing-activity schedule.

i) The relationship with the safe harbor. The confidentiality duty and the safe harbor are two sides of one bargain: the law protects the reporter from liability for reporting, and in exchange the reporter protects the secrecy of the report. Loss of confidentiality can undermine the protection.

5. Common Scenarios and the Correct Response

Scenario: An angry customer demands to know why his wire was delayed and asks whether he is being reported. Correct response: do not confirm or deny; refer to internal policy or documentation requirements; escalate to compliance; document the interaction. Incorrect: telling him 'compliance flagged it' or 'we had to report it'.

Scenario: The relationship manager who raised the internal alert asks the MLRO whether a SAR was filed. Correct response: the MLRO should not confirm; the RM does not need to know the outcome to perform his job and the need-to-know principle applies.

Scenario: A customer's lawyer sends a letter asking for all records including any reports to authorities. Correct response: provide ordinary records as legally required, exclude any SAR or SAR-revealing documents, do not confirm existence of a SAR, notify the FIU and legal counsel.

Scenario: The institution wants to close a high-risk account that is the subject of a SAR. Correct response: coordinate with compliance; consider contacting law enforcement about whether they want the account kept open; use a neutral closure letter.

Scenario: A bank's foreign parent requests details of SARs filed by the subsidiary. Correct response: determine whether the jurisdiction permits group sharing for risk management purposes, ensure the recipient is bound by confidentiality, and document the legal basis before sharing; where not permitted, share only underlying transactional information without reference to the SAR.

Scenario: Another bank calls to ask whether you filed a SAR on a shared customer. Correct response: do not confirm; if both institutions are registered under a formal information-sharing mechanism such as US 314(b), share underlying suspicions and facts, but never the SAR or the fact of filing.

6. Consequences of Breach

Individuals face criminal prosecution, imprisonment, fines, and loss of professional standing. Institutions face regulatory enforcement, significant penalties, reputational harm, and potential loss of safe harbor protection. Investigations may be compromised, criminals may escape, and victims may lose any chance of recovering funds. Regulators also view tipping-off incidents as evidence of weak culture and inadequate controls, often triggering broader programme reviews.

7. Controls That Prevent Tipping Off

- Clear written policies and procedures on SAR confidentiality.
- Role-based access and segregation of SAR data within case management systems.
- Scripted, neutral language for customer-facing staff when transactions are delayed or declined.
- Mandatory escalation of customer questions about investigations to compliance.
- Regular, role-specific training with real-life examples.
- Processes for handling subpoenas and legal requests involving SARs.
- Documented protocols for law enforcement 'keep open' requests.
- Independent testing by internal audit of confidentiality controls.

8. Exam Tips: Answering Questions on Tipping Off and Confidentiality of Reports

Tip 1: Default to silence. Whenever an answer option involves telling the customer, the customer's representative, a colleague without a need to know, or an outside party anything that hints at a report or investigation, eliminate it. The exam rarely rewards disclosure.

Tip 2: Distinguish 'neither confirm nor deny' from lying. The correct approach is not to deny that a SAR was filed (a lie could itself be problematic) but to decline to comment and refer to policy. Watch for options that have the employee reassure the customer that 'nothing has been reported'; this is wrong.

Tip 3: Know the permitted recipients. Memorize the groups to whom disclosure is allowed: the FIU, law enforcement, prudential and AML supervisors in their official capacity, legal counsel advising the institution, and (where law permits) group entities for risk management. Everyone else is off-limits.

Tip 4: Remember that 314(b) is not a SAR-sharing channel. A classic distractor states that two registered institutions may share the SAR itself. They may share information about suspected activity, but not the SAR or the fact of its filing.

Tip 5: Separate the duty to report from the duty to keep secret. Questions may ask about the safe harbor; recall that it protects good-faith reporting and that confidentiality is the companion obligation. Good faith plus confidentiality equals full protection.

Tip 6: In account closure questions, look for coordination. The best answer usually involves consulting compliance and considering whether law enforcement wants the account kept open, and sending a neutral letter. Options that close the account immediately with an explanatory reference to suspicious activity are wrong.

Tip 7: In subpoena or discovery questions, the FIU is your friend. The best answer involves withholding SAR material, not confirming its existence, and notifying the FIU and legal counsel.

Tip 8: Apply the need-to-know test internally. If an option has the MLRO telling the branch staff who filed the internal alert that a SAR went to the FIU, that is a breach. Internal disclosure is limited to those who require the information to manage the risk or the case.

Tip 9: Indirect disclosure counts. Be alert to scenarios where no one says 'SAR' but the customer is effectively alerted, for example by an unusual freeze with a pointed explanation, a sudden visit from senior staff, or a comment that 'the authorities may contact you'. These are tipping-off.

Tip 10: Use the exam's risk-based lens. When two options both seem compliant, choose the one that best balances confidentiality with continuing other obligations such as ongoing monitoring, continued reporting of further suspicious activity, and cooperation with law enforcement.

Tip 11: Watch for jurisdiction-neutral language. CAMS is an international exam. Unless a question specifies a country, reason from FATF Recommendation 21 principles rather than a single national statute.

Tip 12: Read for the role. Identify who the question is about: a teller, a relationship manager, an MLRO, a board member, or outside counsel. The right action depends on the role, but the principle of confidentiality binds all of them equally.

9. Quick Revision Summary

- Tipping off = disclosing that a SAR/STR has been or will be filed or that an investigation is underway, in a way likely to prejudice it.
- Governed internationally by FATF Recommendation 21; nationally by laws such as US BSA 31 U.S.C. 5318(g)(2), UK POCA s.333A, and EU AMLD provisions.
- Confidentiality extends to the SAR, its supporting documents that reveal filing, and FIU correspondence.
- Permitted disclosures: FIU, law enforcement, regulators, legal counsel, and in many regimes, group entities for risk management.
- Safe harbor protects good-faith reporters; confidentiality is the reciprocal duty.
- Never confirm or deny to customers; use neutral language; escalate; document.
- 314(b) sharing excludes the SAR itself.
- Handle subpoenas by notifying the FIU and counsel, not by producing the SAR.
- Coordinate account closures and law enforcement 'keep open' requests through compliance.
- Penalties include imprisonment, fines, regulatory action, and compromised investigations.

Master these principles, practise applying them to scenario-based questions, and you will be well prepared for anything the CAMS exam presents on tipping off and the confidentiality of reports.