What is tipping off: guide to avoid risks

Tipping off can occur when a customer or another person is informed that suspicious activity has been reported or is being investigated. Even an indirect disclosure may create serious compliance risks if it could prejudice an AML investigation. The risk is particularly relevant for banks, fintech companies, payment providers, and crypto businesses. Employees may trigger a violation through client communications, transaction explanations, or the improper handling of confidential information. In this article, we explain what tipping off means, which information must remain confidential, how the rules differ across key jurisdictions, and what businesses can do to reduce the risk.

Definition of tipping off and its meaning

Tipping off is the unauthorised disclosure of information that may alert a customer or another person that suspicious activity has been reported, is being reviewed, or is under investigation. The risk often arises after a SAR or STR has been filed or while suspicious activity is still being assessed.

The disclosure may be intentional or accidental. Common examples of tipping off include:

1. Verbal or written messages – telling a customer, directly or indirectly, that their activity has raised suspicion or attracted regulatory attention.
2. Disclosure of confidential information – revealing that an account, payment, or transaction has been restricted because of suspected money laundering or other financial crime.
3. Information about an investigation – mentioning an internal AML review, a request from an FIU, or an ongoing investigation.
4. Actions that interfere with an investigation – deleting records, altering data, destroying documents, or helping a person avoid further scrutiny.

The purpose of tipping-off restrictions is to prevent suspects from concealing assets, changing their behaviour, destroying evidence, or obstructing an investigation. The rules can apply even where an employee never explicitly confirms that a report has been filed.

Tipping-off risks may arise during transaction monitoring, enhanced due diligence, internal escalation, or communication with a customer whose activity has raised concerns. Businesses should therefore keep customer-facing explanations separate from confidential AML decision-making.

A customer may notice additional checks, payment delays, or account restrictions, but this does not automatically confirm that a report exists. Similar confidentiality issues may also arise where a business suspects that a SAR has been submitted against it.

Types of information protected from disclosure

Tipping-off restrictions usually protect information that could reveal the existence of a suspicious activity report, internal AML review, or investigation. The exact scope depends on the jurisdiction, but several categories are particularly sensitive.

Protected information may include:

• The fact that a report has been filed – a customer should not be told that the institution has submitted suspicious activity information to a financial intelligence unit or other competent authority.
• Information about an internal or external investigation – this includes details of an AML review, regulatory request, or law enforcement inquiry.
• The reasons behind certain transaction restrictions – explaining that a payment was delayed or blocked specifically because of suspected money laundering may reveal protected information.
• Details about employees involved in the review – names, roles, internal decisions, and escalation paths should be disclosed only where necessary and permitted.
• Internal AML controls and monitoring methods – revealing alert thresholds, escalation logic, or investigation procedures may help customers circumvent compliance controls.
• Information collected through enhanced due diligence – sensitive findings from EDD should remain accessible only to authorised personnel where confidentiality rules apply.

Companies should therefore control who can access suspicious activity reports, case files, investigation notes, and regulator communications. Staff also need clear guidance on what may be disclosed to customers when transactions are delayed, restricted, or rejected.

Access to this information should be limited on a need-to-know basis and supported by documented AML procedures. This reduces both accidental tipping off and unnecessary exposure of confidential AML data.

Legislative framework in key jurisdictions

Tipping-off rules differ by jurisdiction, but the core principle is similar: institutions must not reveal information that could expose a suspicious activity report or prejudice an AML investigation.

European Union

In the EU, the current prohibition on disclosure is set out in Article 39 of Directive (EU) 2015/849. Obliged entities, directors, and employees must not tell a customer or third party that information has been or will be transmitted to an FIU, or that a money laundering or terrorist financing analysis is taking place.

The EU framework is now moving toward a more harmonised system. Regulation (EU) 2024/1624 introduces a similar prohibition in Article 73 and will apply from 10 July 2027. The new regime will operate alongside AMLA, the EU Anti-Money Laundering Authority, which became operational in 2025 and is expanding its supervisory and coordination role.

For crypto businesses, these obligations also need to be considered together with MiCA compliance and other AML/CFT requirements.

United Kingdom

In the UK, tipping off in the regulated sector is covered by Section 333A of the Proceeds of Crime Act 2002. An offence may arise where a person discloses that a relevant report has been made or that an investigation is being contemplated or conducted, and the disclosure is likely to prejudice that investigation.

A conviction on indictment under Section 333A may result in imprisonment for up to two years, a fine, or both. Separate offences may apply where a person interferes with or prejudices an investigation.

United States

In the US, SAR confidentiality is governed by the Bank Secrecy Act framework and FinCEN regulations on SAR confidentiality. A SAR itself, as well as information that would reveal its existence, generally cannot be disclosed to the person involved in the reported activity.

At the same time, SAR confidentiality does not mean that institutions must stop all communication with customers. FinCEN guidance allows institutions to communicate about suspicious or potentially fraudulent transactions and account restrictions, provided they do not disclose the existence of a SAR.

Businesses operating across several markets should therefore avoid relying on one standard communication policy. Internal procedures should reflect the disclosure rules, exceptions, and enforcement risks in each jurisdiction.

Criminal liability for tipping off

Tipping off can lead to criminal, regulatory, and disciplinary consequences. The exact liability depends on the jurisdiction, the person involved, the information disclosed, and whether the disclosure actually prejudiced an investigation.

In the UK, for example, a tipping-off offence under POCA can result in imprisonment for up to two years, a fine, or both. Other offences may apply where a person deliberately destroys evidence, falsifies records, or interferes with an investigation. In the US and EU, consequences depend on the applicable AML framework and national enforcement rules.

Liability may become more serious where the disclosure was intentional or formed part of a broader attempt to help a customer avoid scrutiny. Regulators may also examine whether the company had adequate compliance controls, staff training, access restrictions, and escalation procedures.

When assessing an individual case, relevant factors may include:

• Whether the disclosure was deliberate or accidental;
• The employee’s role and access to confidential information;
• Whether an investigation was actually prejudiced;
• Cooperation with the authorities;
• Corrective action taken by the company;
• Previous compliance or disciplinary history.

Businesses should also preserve relevant records once an investigation begins. Deleting messages, altering files, or obstructing a regulator can create separate risks, particularly during an inspection or dawn raid.

A tipping-off allegation therefore requires more than checking whether confidential information was disclosed. The circumstances, intent, applicable legislation, and actual impact on the investigation all matter when determining potential liability.

How to minimise the risk of tipping off

For financial institutions, fintech companies, and crypto businesses, tipping off often results from weak internal procedures rather than deliberate misconduct. The most effective prevention measures focus on access controls, staff communication, documentation, and clear escalation rules.

Establish internal procedures

Businesses should define how suspicious activity is identified, escalated, documented, and reported. Only authorised employees should have access to SAR or STR-related information and communications with regulators or financial intelligence units.

Internal procedures should clearly specify:

• Who can review suspicious activity alerts;
• Who is authorised to submit reports;
• How confidential information must be stored;
• When a matter should be escalated to the MLRO or compliance team;
• How customer-facing teams should respond when transactions are delayed or restricted.

These controls should form part of a broader AML compliance programme and be reviewed whenever regulatory requirements or business processes change.

Limit communication with clients

Employees should never speculate about why a transaction has been delayed, rejected, or placed under additional review. Customer-facing explanations should be predefined and should not reveal whether suspicious activity has been reported.

This is particularly important during KYC, source-of-funds checks, account reviews, and payment investigations. Support teams and account managers should know which information they may disclose and when a case must be transferred to the compliance team.

Train your staff

Regular training helps employees recognise situations where an innocent-looking comment could amount to tipping off. Training should cover not only compliance personnel but also customer support, operations, sales, account management, and senior management.

Companies should also restrict access to confidential AML files through role-based permissions and maintain records showing who accessed sensitive information. Internal audits can help identify weaknesses before they lead to a disclosure incident.

Tipping-off prevention should therefore be treated as part of the company’s wider AML governance framework. Clear procedures, controlled communication, staff training, and restricted access significantly reduce the risk of accidental disclosure.

How Key2Law can help reduce tipping-off risks

Tipping-off risk is closely connected with the quality of a company’s AML controls, internal communication, and staff training. Key2Law team helps financial institutions, fintech companies, crypto businesses, brokers, and payment providers strengthen these areas and align internal procedures with current regulatory requirements.

Our team can help you:

• Review AML policies, reporting procedures, and internal escalation rules;
• Assess how suspicious activity is handled across customer support, operations, and compliance teams;
• Update procedures for customer due diligence;
• Introduce clearer access controls for confidential AML information;
• Prepare staff guidance and training for high-risk communication scenarios;
• Assess regulatory exposure where a disclosure incident has already occurred;
• Provide broader Business Support for AML, compliance, and operational matters.

Where a business is already facing an inspection, investigation, or enforcement action, the team can also review the circumstances of the incident and help prepare an appropriate response.

Strong tipping-off controls should prevent accidental disclosures before they become a regulatory issue. If you need to review your AML framework or internal communication procedures, contact Key2Law to discuss the risks relevant to your business.
____________________________________________________________________________________________________________________________________________________

This article is provided for general informational purposes only and does not constitute legal advice. Tipping-off rules, reporting obligations, confidentiality requirements, and potential liability vary by jurisdiction and depend on the facts of each case. Businesses should obtain professional advice before making decisions related to suspicious activity reporting, customer communication, or regulatory investigations.