The Government has published Circular 004/2021 ‘Money laundering: the confidentiality and sensitivity of suspicious activity reports (SARs) in the context of disclosure in private civil litigation.

It sets out the Governments position on the use of SARS in private civil litigation matters and provides guidance to help protect reporters of SARs, the subject of SARs and the integrity of the SARs regime. Firms should consider how they can apply the guidance to protect themselves and to maintain the wider effectiveness of the SARs regime.

It should be read in conjunction with Home Office Circular 022/2015 sets out the standard procedures followed by the police, other law enforcement agencies and the NCA in relation to the disclosure of SARs.

Reporters should not disclose SARs and the disclosure of the fact that a SAR has been made, or that a money laundering investigation is taking place, where that disclosure may prejudice an investigation may amount to an offence of tipping off or prejudicing an investigation under the Proceeds of Crime Act.

It is important that the confidentiality of SARs is maintained:

• to protect the reporters and subjects of SARs,
• to minimise the risk of prejudicing current or future law enforcement investigations; and
• to maintain the integrity of the SARs regime. 

The revised guidance sets out the steps that will help prevent SARs becoming disclosable in civil litigation cases. In particular, it helps to address the circumstances that arose from a civil case in 2019, where the court ordered that a SAR should be disclosed to the subject of that SAR as it was relevant to a breach of contract, breach of the Data Protection Act 1998 and defamation claim by a client.

Mr Lonsdale was both a personal and business customer of Natwest Bank. In March 2017, the bank had grown suspicious about the activity on a joint business account and the account was frozen for eight days while Natwest sought a Defence Against Money Laundering (DAML) from the NCA to process transactions on the account. In December 2017, the bank froze all of his accounts having once again become suspicious about the activity on the accounts.

Litigation immediately followed, and the bank served notice that it would close the accounts within 60 days. Mr Lonsdale filed a Data Subject Access Request (DSAR) and sued the bank for:

• breach of contract, when it froze his accounts and failed to execute his instructions
• breach of the Data Protection Act 1998 relating to the Bank’s failure to provide Mr Lonsdale with his personal data following his DSAR, and
• defamation, as it was assumed by Mr Lonsdale that the bank had stated in both the SAR and internal communications that the money in his accounts derived from crime.

The bank defended the action and, in its defence, it referred to the SARs. Mr Lonsdale applied to inspect the SARs. Natwest argued that the Court should exercise its discretion to withhold the SAR on the basis that the SARs were reported in strictest confidence to the NCA, and disclosure may cause the bank to commit the tipping off offences.

The judgement held important implications for the regulated sector. The Court concluded that the content of the SARs were relevant to the determination of the issues at trial.

The Court also agreed that there was no evidence that should make it depart from the ordinary position to order inspection of the SARs. The bank had not supported its concerns that it would commit either of the tipping off offences with any evidence. Disclosure of the SARs was proportionate and necessary for the fair disposal of the claim and should not be refused on grounds of confidentiality.

• Reporters should avoid referring to SARs when documenting their internal decision-making processes. Instead, the documents supporting a decision to exit or terminate a customer relationship should focus upon the basis for the decision eg.
  • the fact pattern which led to decision (set out in a factual matter)
  • the associated commercial factors;
  • the associated risk appetite reasons;
  • any non-compliance with agreed terms and conditions; or
  • where the reporter is unable to apply the customer due diligence measures required by regulation 28 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (which might then have been followed by the making of a SAR).

Reference to the basis for the decision may help reporters to explain and justify their decision to a customer, before reaching the point of litigation wherever possible, without reliance upon or reference to a SAR. It may also remove any subsequent need for reliance on the SAR in litigation that arises and reduce the relevance of SARs to such litigation.

• Submitting a SAR should not oblige a firm to terminate a client relationship. Firms should seek to defend the challenge based on the processes that gave rise to the decision to terminate the relationship, rather than upon the fact of submitting a SAR.

As soon as a firm is obliged to disclose a SAR under the Civil Procedure Rules or under an order of the court the firm should follow the procedure set out below:

• contact the NCA at the first opportunity, at UKFIUSARs@nca.gov.uk.
• provide the following information:
• all of the SARs they anticipate will be disclosable;
• a summary of any claim/defence;
• the reason why it is anticipated that SARs will be required to be disclosed;
• relevant court deadlines; and
• any other relevant material.

The NCA will endeavour to respond within a reasonable timeframe and will consider any potential risks to the public interest. The NCA can make representations to the firm and/or to the court as to how it may be possible to mitigate such risks if it wishes to do so.

The NCA/law enforcement is not able to provide reporters with assurances on the tipping off offence. SARs exist on the NCA’s database for six years and could become relevant to a current or future investigation at any point during those six years; SARs could also remain relevant to ongoing investigations after this time. The NCA does not, as a matter of course, comment on the existence of any operational matters.

Any SARs made under the provisions of the Terrorism Act 2000 are outside the scope of this guidance but if a reporter considers that such SARs may be disclosable in private civil proceedings, they should contact the NCA in the manner set out above.

If a firm receives a Data Subject Access Request under the Data Protection Act 2018 (DPA 2018) they will need to consider, as the data controller, their disclosure obligations and how they handle material. Firms should be aware of the available exemptions under the DPA 2018 (for example, the crime and taxation exemption) when considering whether to make the subject of a SAR aware that a SAR has been submitted on them; and the reporters may also wish to consider whether any of the exemptions apply to the SARs related material that they hold. Detailed guidance on relevant exemptions to the DPA 2018 is provided by the Information Commissioner’s Office.