Anti-Tipping-Off Rule

The anti-tipping-off rule is the legal prohibition on disclosing to a customer, or to anyone else not entitled to know, that a suspicious activity report has been made about them, or that a money laundering or terrorist financing investigation is being carried out or contemplated. It applies to banks, payment firms, lawyers, accountants and other regulated businesses, and their staff.

The rule exists so that suspects cannot move funds, destroy evidence or disappear before authorities act on a report. It is set out in FATF Recommendation 21, which also requires that people who report suspicions in good faith be protected from liability. National laws implement it differently: the United Kingdom has a specific criminal offence of tipping off, the United States relies on the confidentiality of SARs under the Bank Secrecy Act, and the European Union sets a prohibition on disclosure in its anti-money laundering rules.

Imagine a shopkeeper who quietly calls the police about a customer acting suspiciously. If the shopkeeper then tells the customer, "I've just reported you," the customer will leave before the police arrive, and the call will have been wasted.

Financial firms face the same situation. When staff report a suspicious customer to the authorities, the law forbids them from telling that customer, or anyone who might warn them, about the report. Staff must carry on with normal, polite service and not hint that anything is wrong, even if the customer asks directly why a payment is delayed.

• United Kingdom. Section 333A of the Proceeds of Crime Act 2002 makes it an offence, in the regulated sector, to disclose that a suspicious activity disclosure has been made, or that an investigation is under way or contemplated, where the disclosure is likely to prejudice an investigation. Section 21D of the Terrorism Act 2000 contains the equivalent for terrorist financing, and a separate offence of prejudicing an investigation applies more widely.
• United States. Federal law and FinCEN's SAR rules, such as 31 CFR 1020.320(e) for banks, prohibit a financial institution and its staff from notifying any person involved in a transaction that it has been reported, and from disclosing a SAR or information that would reveal its existence, except in limited cases such as sharing with FinCEN, law enforcement or supervisors.
• European Union. The anti-money laundering directives, including AMLD5, prohibit obliged entities from disclosing to the customer or third parties that information is being or has been sent to the financial intelligence unit, a prohibition carried into the EU's single anti-money laundering regulation.

Laws allow limited sharing so that firms can manage risk. Common exceptions include disclosures within the same company or group, to supervisors and law enforcement agencies, between financial institutions of the same kind to prevent money laundering where both are subject to equivalent rules, and, for lawyers and accountants, attempts to dissuade a client from committing an offence. US guidance allows banks to share SARs with head offices and controlling companies. Any disclosure outside these exceptions risks breaching the rule, so most firms route all questions through the money laundering reporting officer or equivalent.

Tipping-off risk is highest for front-line staff who deal with customers whose payments are held or whose accounts are under review. Firms therefore train staff, give them neutral scripts and keep reports confidential, limiting access to SAR records. Particular challenges include:

• Consent and delays. In the UK, a firm seeking a defence to proceed with a suspicious transaction must wait for the authorities, which may delay a payment for days; the customer must not be told why.
• Account closure. Firms that decide to exit a customer after reporting usually give a general reason or none, as permitted by their terms, which is one reason offboarding and de-risking decisions can seem unexplained to customers.
• Data access requests. Customers may use data protection rights to ask for records about them. Data protection laws, including the UK's, contain exemptions so that firms can withhold information whose disclosure would prejudice crime prevention.
• Complaints and disputes. Responses to complaints and ombudsman cases must be drafted without revealing the report.

Breaches can lead to prosecution of individuals, including imprisonment in the UK, and regulatory action against firms, which supervisors treat as a sign of weak controls. Critics argue that strict tipping-off rules leave innocent customers without explanation for frozen funds or closed accounts, and make it harder for firms to share information that could stop money laundering across institutions. Reforms in several countries, such as information-sharing gateways between regulated firms, try to balance confidentiality with better collective detection.