When a suspicious activity report is considered: what to do first
When your compliance function files a suspicious activity report, the priority shifts from analysis to protection of the file. The first task is not further investigation. It is to stop tipping off the client, preserve the underlying records, and identify which clock is already running before the financial intelligence unit responds.
Basis
For a crypto-asset service provider, the transaction behind the report usually sits within two regulations already in force. Regulation (EU) 2023/1114 (MiCA) sets the authorisation regime under which the provider operates. Regulation (EU) 2023/1113 (TFR) requires information to accompany a transfer of crypto-assets, which is why the identifiers needed for a report are usually already on file before the report is drafted.
Neither regulation names the suspicious activity report itself. The reporting duty sits in the national law that implements the anti-money-laundering directives, and that national record is not yet part of this registry. What MiCA and the TFR fix is the trail a suspicious transfer leaves, not the report that follows it.
Practical consequence
Once the report is filed, several things happen at once. The flagged activity becomes a record the provider must retain rather than clean up. Any client request to explain, cancel, or expedite the same transaction becomes a tipping-off risk. A suspension window may also open; its length is set by the receiving financial intelligence unit and published in its own guidance, not by the entity that filed the report.
If the transaction monitoring that flagged the activity is itself outsourced, the tipping-off restriction travels with the file, not with the provider. When the outsourcing provider subcontracts abroad sets out how that restriction binds a subcontractor who never dealt with the client directly.
What to do
- The compliance officer freezes further action on the flagged transaction. Do not process, reverse, or explain it to the client.
- The compliance officer isolates and time-stamps the underlying records: the onboarding file, the transaction history, and any TFR-required originator or beneficiary data.
- Legal or compliance counsel checks whether a parallel notification duty exists under the entity's MiCA authorisation conditions, and confirms which supervisor, besides the financial intelligence unit, needs informing.
- Management restricts circulation of the report to the people who filed it. Tipping off is a personal exposure, not only a corporate one.
- The compliance officer logs the filing date. That date starts every subsequent clock in the file, including any suspension period.
- If the client asks about the funds or requests an update, the front-line team gives a neutral, standard response, not a status update on the report.
Who decides
| Question | Who decides | On what basis |
|---|---|---|
| Whether the transaction is suspended | Financial intelligence unit | Its statutory suspension power, exercised on the filed report |
| Whether the report requires a follow-up | Financial intelligence unit | Its own risk assessment of the file submitted |
| Whether the entity's authorisation is affected | National competent authority for the MiCA authorisation | Whether the pattern points to a systemic control failure |
If the supervising regulator changes while the report is still open, the two notifications do not merge automatically. When the regulator changes during the project: what to explains how the two clocks interact.
Forks
If the flagged counterparty is also disputing an audit clause under a licence, keep the two files procedurally separate. When an audit clause is refused covers how to sequence that dispute without stalling the AML file.
If the same business also moves physical goods and a shipment is held at the border, the two clocks run independently of each other. When a customs authority detains a shipment sets out the separate procedure for that file.
If there is no parallel dispute or detention, the file stays simple: preserve, restrict circulation, and wait for the financial intelligence unit to move first.
Limits
This page does not tell you whether your specific transaction meets the threshold for reporting. That judgement sits with your compliance officer and, ultimately, with the financial intelligence unit. It does not cover jurisdiction-specific suspension periods or filing formats, because the national implementing act for the relevant anti-money-laundering directive is not yet part of this registry. It does not replace the report itself, and it does not tell you what to write in it.
Related situations
When the risk assessment is out of date looks at the adjacent failure that a suspicious activity report often uncovers.
Checked
Checked: 15 March 2025. Primary sources: Regulation (EU) 2023/1114 (MiCA), Official Journal text; Regulation (EU) 2023/1113 (TFR), Official Journal text. The national suspicious activity report procedure is pending inclusion once the relevant implementing act is confirmed for this registry.
FAQ
What is the first step when a suspicious activity report is considered?
Freeze further action on the flagged transaction and preserve the underlying records, without letting the client know a report exists.
Which deadline is already running?
The filing date itself. It fixes the start of any suspension window the financial intelligence unit applies, and of any internal retention period the entity must observe.
Who decides, and on what evidence?
The financial intelligence unit decides whether to act, based on the file as submitted. A separate competent authority may review the pattern if it affects the entity's MiCA authorisation.
If you need this sequenced now
If a report is already open and you need the sequencing checked, our compliance team responds within minutes during business hours. A scoped estimate for the wider file follows within one working day.