Suspicious activity report: what to write before you escalate

A suspicious activity report is the written record of why someone in your firm concluded that a transaction or a relationship did not add up. Filing with the regulator is a separate, tightly defined step handled by your nominated officer. Everything before that is your own paperwork, and it is where most reports fall apart: a suspicious activity report that reaches the money laundering reporting officer with half the facts missing costs a week of chasing, and by then the person who noticed has forgotten what they saw.

What a suspicious activity report has to contain

Strip out the adjectives. A reviewer needs facts they can verify without calling you.

• Who: the customer or counterparty, the account, and how long the relationship has run.
• What: the transactions in question, with dates, amounts, currencies and the route the money took.
• Why it stood out: the specific mismatch — an amount that does not fit the stated business, a country that never appeared before, a pattern of payments just under a reporting threshold.
• What the customer said: the explanation offered, quoted rather than summarised, and when it was given.
• What you already hold: the identity documents and source-of-funds evidence gathered during client due diligence, so the reviewer is not asked to re-collect them.
• Who noticed and when: the name of the person raising it and the date they first saw the activity.

Separate the escalation from the decision

The person who spots something and the person who decides whether it is reportable should not be the same person, and their records should not be the same record. Mixing them produces a document that reads as if the outcome was decided before the facts were gathered.

1. The staff member files an internal escalation with the facts only, no conclusion.
2. The nominated officer acknowledges it the same day, so the clock is visible.
3. The officer records their own assessment as a separate entry, referencing the escalation.
4. The decision — report or do not report — is recorded with a reason either way, because a decision not to report is the one you will be asked to justify.
5. The internal case is closed with a date, and the underlying customer file is annotated so the next reviewer sees the history.

Do not tell the customer. Warning someone that a report has been made is a criminal offence in most jurisdictions, and an internal system that emails status updates to account managers can create that exposure by accident. Restrict who can read escalations before you turn one on.

Where the reports go wrong

• Written weeks later from memory, so amounts and dates are approximate and the report is worth little.
• Conclusion first, evidence assembled afterwards to support it.
• No record of the negative decisions, leaving a file that suggests nothing was ever considered.
• Escalations sitting in a shared inbox with no acknowledgement, so nobody can show when the firm knew.
• The same risk logged in the risk register and in the case file with different wording, so the two disagree under examination.

Keeping the internal record

Ettex Forms handles the intake side: a short structured form the staff member fills in at the moment they notice something, with required fields for dates and amounts so an incomplete escalation cannot be submitted. Each submission lands as a dated record with the submitter attached, which is the audit trail an examiner asks for. Ettex is not a screening vendor and is not a filing channel to any financial intelligence unit — the regulatory submission goes through your national portal. What it gives you is the internal history that has to exist before and after that submission.