What is ‘tipping off’?

In anti-money laundering (AML) compliance, tipping off means telling someone that they’re the subject of a money laundering investigation, or that a suspicious activity report, known as a SAR in the UK, an SMR in Australia and an STR in many other countries, has been filed about them.

FATF Recommendation 21 requires countries to prohibit this by law. It applies to anyone working in a regulated business, from accountants and lawyers to property agents. The exact penalty depends on where you’re based but the principle is the same everywhere: once you’ve reported a suspicion, or you’re considering it, you can’t let the subject know.

The law is strict because even a subtle hint could compromise an investigation. Once a report has been filed, your national financial intelligence unit (FIU) may already be monitoring the individual or transaction. Alerting them gives them the chance to destroy evidence or move money out of reach.

When tipping off occurs

Tipping off happens when someone:

• tells or implies to a client or third party that a report has been or will be made;
• reveals that law enforcement is investigating the client or their transaction;
• discloses information that might prejudice an ongoing or proposed investigation.

Even well-intentioned comments can cross the line. For example:

• Mentioning that a client’s transaction has been “flagged” or “put on hold” because of a report
• Asking for extra documents, then explaining afterwards that it’s for a money laundering check
• Warning a client that authorities might be in touch soon

Once a report is submitted, communication about it needs to stop unless your FIU tells you otherwise.

The difference between tipping off and good AML communication

Don’t confuse tipping off with your normal AML process. You’re still expected to:

• ask questions to complete due diligence;
• request information to verify identity, source of funds or ownership;
• decline or delay work if you can’t complete your checks.

These are part of a lawful, risk-based approach. The issue starts once you’ve submitted an internal or external report. From that point, you need to avoid saying anything that could make the client aware of the report or what it contains.

Penalties for tipping off

Tipping off is treated as a serious criminal offence in most jurisdictions. Penalties vary by country, but they typically combine a prison sentence with a substantial or unlimited fine. Your own supervisor or professional body may add further sanctions on top of whatever the courts impose.

There can be consequences beyond the legal penalty too. Regulators treat tipping off as evidence of weak AML governance, so even an unintentional disclosure can trigger a full compliance review. 

The reputational fallout can be just as damaging as the fine itself. Once trust in your confidentiality and competence is questioned, it’s hard to rebuild.

How to avoid tipping off

1. Keep reports confidential

Only your compliance officer or MLRO and those directly involved in the issue should know a report exists. Avoid discussing it in team meetings, client calls and emails.

2. Train your team

Everyone should understand what counts as tipping off, when it applies and how to handle client queries. Annual training and refresher sessions are essential.

3. Build a clear internal escalation route

Staff should know exactly how to raise internal reports and when to stop communicating with the client once suspicion has been reported.

4. Record your actions

Keep audit trails showing when suspicions arose, who was informed and when the report was filed. Strong documentation supports your defence if challenged.

If you think you’ve inadvertently revealed information, contact your MLRO or compliance officer straight away. They may need to file a supplementary report or inform your FIU. Don’t try to fix it yourself by contacting the client again.

Final thoughts

Tipping off is one of those parts of AML that can catch even the most diligent professionals out. It usually happens not through carelessness but through instinct, wanting to reassure a client or explain a delay. But once a report is made, the safest thing you can do is step back, stay silent and let the process work.

In my experience, businesses that handle this well are the ones that prepare early. They make sure staff know what to say (and what not to) and build a culture where reporting suspicion isn’t treated as a drama. It’s just part of doing things properly.

That’s what good AML really comes down to: awareness, consistency and employees that properly understand their responsibilities.