Suspicious activity reporting: stages and deadlines
Suspicious activity reporting moves through four stages: detection, internal escalation, a filing decision, and submission to the financial intelligence unit. Each stage has its own actor and its own point of no return. Miss the internal deadline and the file stalls; miss the point of no return and the underlying transaction may already be irreversible. This page sets out the stages, the documents each one needs, and where the process actually decides itself.
How the escalation moves internally
An alert rarely starts as a report. It starts as an observation: a transaction monitoring flag, a mismatch in onboarding data, or a front-line employee noticing something that does not fit the client's stated profile. Under the applicable anti-money laundering framework, that observation has to reach a designated reporting officer before anyone decides whether it becomes a formal report.
The reporting officer's task is narrow. They assess whether the pattern meets the internal threshold for suspicion, not whether it proves wrongdoing. That distinction matters: staff are trained to escalate on suspicion, not on certainty, and the officer is the one who converts a raw alert into a decision.
Stages, in order
| Stage | What happens | Who acts | Typical duration |
|---|---|---|---|
| Detection | Alert generated or observation logged | Front-line staff, monitoring system | Immediate, on occurrence |
| Internal escalation | Alert routed to the reporting officer with supporting data | Line manager or compliance analyst | Same working day where the pattern is active |
| Assessment | Officer decides report, dismiss, or request more information | Reporting officer (MLRO) | As long as the assessment reasonably requires |
| Filing | Report submitted to the financial intelligence unit | Reporting officer | Without undue delay once suspicion is confirmed |
| Hold or freeze | Execution suspended if the point of no return has not passed | Reporting officer, operations team | Until the unit responds or the statutory window lapses |
The point of no return
Before a transaction executes, the file is still open: the officer can hold it, ask questions, or file and wait. Once the transaction executes, the report becomes a notification of something that already happened rather than a request to intervene in it. The deadline for filing is set by the applicable reporting rules and starts running from the moment suspicion is confirmed, not from the moment the alert first appeared.
Tipping off the client during this window is treated as a separate breach, independent of whether the underlying suspicion turns out to be correct. Staff are told what they can say to a client and what they cannot, and that instruction does not change once a report is filed.
What to do
- Front-line staff log the observation immediately, without alerting the client.
- The line manager escalates to the reporting officer the same day.
- The reporting officer gathers the transaction history, the client file, and any prior alerts on the same counterparty.
- The reporting officer records the assessment decision, including the reasoning for filing or dismissing.
- If filing, the reporting officer submits to the financial intelligence unit and holds execution where the point of no return has not passed.
- Senior management is informed of the filing without being told to interfere in the assessment.
Who decides and by when
The reporting officer decides whether to file. That decision is not delegated upward and it is not reviewed by the client-facing team. Once filed, the financial intelligence unit decides whether to request a longer hold, ask for further information, or take no further action. The length of any hold is set by the unit and communicated to the reporting officer directly, not negotiated with the client.
Senior management's role is limited to resourcing and oversight of the reporting function. It is not a party to the individual filing decision, and inserting itself into that decision is itself a governance gap worth documenting.
If your situation differs
If the suspicious pattern involves a service extended into another member state, the question of Cross-border services are added authorisation who decides and when affects which authority ultimately receives the escalation.
If the flagged asset was pledged as collateral, establish first When a licence is used as security, because control over the underlying rights changes who can instruct a hold.
If the alert originates from a technical audit rather than transaction monitoring, and When open source is found in the delivery is the trigger, keep the AML assessment and the contract review as two separate files with two separate owners.
What this page does not cover
This page sets out the internal stages and the deadline mechanism. It does not set out the specific number of days for filing, the form of the report, or the penalty for a late filing — those depend on the national implementing rules for your entity and are not summarised here. It also does not cover onboarding due diligence or the retention period for the underlying file once the report is closed.
Related reading
For the retention side of the same file, once the report is closed, see Record keeping review step by step.
Verified
Reviewed: 6 January 2025. Sources: internal AML escalation register, the compliance function's standard operating procedure, and retained case files reviewed at the date above. No external instrument is cited on this page because the procedural description does not depend on a specific statutory reference.
If the outcome of a filing leads to a decision you intend to contest, read When the deadline for appeal has started before the window closes.
If a supervisor raises the same escalation as part of a wider governance review, prepare using When a supervisor asks about governance in practice.
FAQ
How long does suspicious activity reporting take in practice?
The internal stages, from detection to filing, usually move within days when the reporting officer has full access to the transaction history. The unit's own review afterwards runs on its own schedule and is not controlled by the reporting entity.
Which documents are needed to start?
The transaction history, the client onboarding file, any prior alerts on the same counterparty, and a written record of why the pattern was escalated. Missing documents do not stop escalation; they delay the assessment stage.
What happens if the other side does not respond?
If the financial intelligence unit does not respond within its own working period, the hold does not lift automatically. The reporting officer keeps the file open and documents the absence of a response as part of the record.