Suspicious activity reporting: what the decision maker looks at
A suspicious activity report passes through two decision points, not one. The compliance officer decides whether the file is complete enough to file; the financial intelligence unit decides whether the file is complete enough to act on. Both look for the same thing first: a documented chronology, not a single flagged transaction. A report that shows continuous monitoring over time is read differently from a report built around one alert.
How the assessment is structured
The duty to report follows from the anti-money laundering framework that applies to the entity's licence and to the jurisdiction where it operates. That framework does not hand the obliged entity a fixed checklist. It requires the entity to set out, in its own internal procedure, how a suspicion is identified, escalated, and recorded. This is why two different readers can look at the same file and ask different questions. The compliance officer inside the company checks whether the internal procedure was actually followed. The financial intelligence unit checks whether the description of the activity is specific enough to justify further work on its side.
Neither reader is interested in intent as a legal concept at this stage. Both are interested in pattern: dates, counterparties, amounts, and whether the activity deviates from what the customer's profile predicted at onboarding.
What changes once a suspicion is logged
Once an internal suspicion is logged, the clock inside the organisation starts differently from the clock at the authority. Internally, the file moves towards a filing decision within the timeframe the entity's own procedure sets. Externally, the authority's timeline depends on how it triages incoming reports against everything else in its queue that week. A well-documented file does not guarantee a fast outcome, but a poorly documented one almost always guarantees a request for more information, which resets the clock rather than closes it.
| Stage | Who decides | Typical timing | Document produced |
|---|---|---|---|
| Internal escalation | Compliance officer | Same business day to 48 hours after the alert | Internal suspicion memo |
| Filing decision | Compliance officer, sometimes with senior management sign-off | Within the entity's internal procedural deadline | Suspicious activity report |
| Receipt and triage | Financial intelligence unit | Days to several weeks | Acknowledgement or request for information |
| Freeze or further request | Financial intelligence unit, occasionally a court | Case-specific | Freezing instruction or document request |
| Closure or referral | Financial intelligence unit or law enforcement | Weeks to months | Closure notice or referral for investigation |
What to do
The steps below describe the internal side of the process, where the entity controls the pace.
- Compliance officer isolates the account or transaction chain flagged by monitoring and freezes internal access to it, without alerting the customer.
- Compliance officer compiles a chronology of transactions, onboarding data, and any prior alerts on the same relationship.
- Senior management reviews the file where the internal procedure requires sign-off before filing.
- Compliance officer files the report with the financial intelligence unit and records the filing internally.
- Entity continues ordinary monitoring of the relationship. The prohibition on tipping off the customer applies from the point suspicion was first logged, not from the point the report was filed.
- Compliance officer responds to any follow-up request from the authority within the deadline stated in that specific request.
Who decides, and where the process stops being reversible
Inside the organisation, the compliance officer decides whether to escalate and, subject to sign-off rules, whether to file. Once filed, the decision moves entirely to the financial intelligence unit; the entity cannot withdraw a report or edit it after submission. That point, not the internal escalation, is the point of no return. A similar logic applies whenever a regulator, rather than a reporting body, is the one asking for proof rather than paperwork: The applicant is asked to prove substance authorisation who sets out how that separate assessment is decided and by whom.
Common forks
If the flagged activity involves a counterparty who stops responding to information requests during enhanced due diligence, the file is filed on the evidence available; silence from a counterparty is not itself a reason to delay filing once the internal deadline is reached.
If your entity licenses its transaction-monitoring tooling from a third party and a dispute arises over who improved that tooling, that question is decided on a separate track and does not pause the reporting file: When improvements are claimed by both sides.
If a vendor's downstream licensee keeps distributing a monitoring tool after its own licence has lapsed, that dispute also runs on its own timeline: When a licensee stops paying and keeps selling.
If the renewal cost of compliance software jumps sharply mid-contract while a reporting file is still open, the two issues are handled separately: When the renewal price doubles.
What this page does not resolve
This page describes the process and the decision points inside it. It does not state a fixed statutory deadline for filing, because that deadline depends on the entity's home jurisdiction and licence type, and it does not predict whether a specific report will result in a freeze. It also does not cover engagement terms or cost; those questions belong to a separate conversation once the facts of a specific file are known.
Verified
This page describes internal process and does not rely on a cited statutory provision, in line with how procedural material is handled on this site. Reviewed by Aleks Vaher, current as of the publication date shown on this page.
Related reading
For the parallel discipline of keeping the underlying file defensible before a suspicion ever arises, see Record keeping review step by step.
FAQ
How long does suspicious activity reporting take in practice?
The internal stage usually takes hours to a few days. The stage at the financial intelligence unit varies widely and depends on the quality of the file and the authority's own workload; a well-documented file is less likely to trigger a delaying request for more information.
Which documents are needed to start?
A chronology of the flagged transactions, the customer's onboarding file, any prior alerts on the same relationship, and a record of who reviewed the file internally before filing.
What happens if the other side does not respond?
If a counterparty does not respond to a request made during enhanced due diligence, the entity files on the evidence it already holds once its internal deadline is reached. Non-response is treated as a data point, not as grounds to postpone the filing decision.