What’s the difference between a SAR and an internal escalation report?

When it comes to anti-money laundering (AML) reporting, two types of report play a central role: the internal escalation report and the Suspicious Activity Report (SAR).

Both deal with suspicions of potential criminal activity but they serve distinct purposes at different stages of your AML process. One alerts your firm’s Money Laundering Reporting Officer (MLRO) to a potential issue. The other alerts the National Crime Agency (NCA) once the suspicion has been assessed by the MLRO and they have decided that they need to disclose the information.

What is a Suspicious Activity Report (SAR)?

A Suspicious Activity Report (SAR) is the formal notification sent to the National Crime Agency (NCA) when you know or suspect that someone is engaged in money laundering, terrorist financing or proliferation financing.

Filing a SAR is a legal obligation under the Proceeds of Crime Act 2002 (POCA) and the Terrorism Act 2000. It can’t be skipped or delayed once suspicion exists.

Your SAR must include:

• the details of the individual or business involved
• a clear description of the suspicious activity
• supporting evidence or context (dates, transaction values, behaviour), and
• your contact information as the reporting professional.

What is an internal escalation report?

An internal escalation report (also called an Internal SAR) is what you file within your firm, to the Money Laundering Reporting Officer (MLRO). It’s the first step in the reporting process, and as an employee this is where your obligation ends. Once you have raised your concerns with the MLRO in writing, it is then up to the MLRO to act from there.

Every member of staff must raise an internal report if they have knowledge or suspicion of money laundering, terrorist financing or proliferation financing, even if they’re not 100% sure. The MLRO then decides whether a formal SAR should be submitted to the NCA.

An internal escalation report should record:

• Who raised the concern
• Who or what the concern relates to
• The reason for suspicion
• Any documentation or communications that support it

You must never discuss the report with the client or anyone outside the AML reporting chain. Doing so could amount to tipping off, which is a criminal offence under POCA.

How the two reports differ

The difference between an internal escalation report and a SAR lies in who receives it, what triggers it and the legal consequences that follow.

An internal escalation report stays within your business and is sent to your MLRO as soon as you have any suspicion of money laundering, terrorist financing or proliferation financing. It’s an internal warning designed to trigger a review by the MLRO

A SAR, on the other hand, is the external step, submitted by the MLRO to the NCA once they have assessed the suspicion. It’s a formal disclosure to law enforcement under POCA and the Terrorism Act. 

In simple terms, one raises a concern internally while the other reports it officially to the authorities. Both are mandatory and both form critical parts of your AML reporting chain. 

Why the distinction matters

Failing to report internally signals a weak culture of AML compliance and can lead to disciplinary action or financial penalties from your supervisor. Any inspector will expect to see these internal reports and documentation on the steps your MLRO took after receiving them, with the reasoning for their decisions. 

Your process should therefore ensure:

Frontline awareness: Staff know how and when to escalate concerns internally.

MLRO oversight: The MLRO documents their reasoning for whether a SAR is made or not.

Audit trails: Every decision, from initial suspicion to outcome, is logged and accessible.

How AMLCC helps

AMLCC builds the full reporting chain into one secure system that mirrors the NCA’s SAR portal in the structure and questions it asks. This means that staff can submit detailed internal escalation reports directly through the platform, and your MLRO can quickly and easily file an external SAR with the NCA.

This means nothing slips through the cracks and your business can demonstrate a robust, inspection-ready reporting process at any time.

Final thoughts

An internal escalation report raises the alarm within your business. A SAR takes that alarm to law enforcement. Both are essential parts of your AML defence but they serve different audiences and carry different thresholds. Understanding when, and how, to make each one is the foundation of effective compliance.