SAR Portal Guide: How Accountants Submit a SAR to the NCA

Most guidance on suspicious activity reports (SARs) explains when you must report. Far less explains how to file one well. This guide covers the practical side for accountancy firms: how a SAR is submitted through the National Crime Agency (NCA) SAR Portal, what the UK Financial Intelligence Unit (UKFIU) expects in the report, and what to keep for your own records. It is based on the UKFIU's guidance document "Chapter 2: Submitting a SAR" (version 1.1, December 2025), and it is general information, not legal advice.

If you are still working out whether you have a duty to report, start with our guides to SARs and the tipping off offence and the MLRO's role in an accountancy firm. This article picks up after the decision to report has been made.

The SAR Portal is the route to use

The UKFIU guidance states that the SAR Portal is the most secure and efficient way to submit SARs, and that SARs should never be emailed to the UKFIU. The Law Society's SARs reform page records that the portal opened to all organisations on 18 September 2023, replacing the older SAR Online system, and that SAR Online stopped accepting submissions on 4 March 2024. If your firm's procedures or templates still refer to SAR Online, they are out of date and should be updated.

ICAS reports that first-time submitters need to register on the portal, and that organisations that used the old system had to re-register because the move was not automatic. According to ICAS, the first person to register provides the organisation's details, including its AML supervisory body, and later users can join by invitation from a registered user. In our suggestion, the MLRO or nominated officer should hold the main login, with a named deputy, so that a report is not delayed by absence.

Writing the reason for suspicion

The reason for suspicion is the heart of the report. The UKFIU guidance sets out what it expects to see. In summary, you should:

• give a one- or two-sentence summary of the key suspicion in its own field;
• identify the main party and any associated parties, and explain how each is linked to the activity;
• set out a chronology of how the circumstances arose, when they happened and when any planned activity is due;
• explain the basis for the suspicion, including how the activity departs from what is normal for the customer or the sector;
• summarise any open-source research that added to your suspicion;
• describe the suspected criminal or terrorist property, its value (estimates are acceptable if labelled as estimates, and cryptocurrency values should also be given in pounds sterling), where it is and why you suspect it;
• make the UK link clear, and say where funds went where you know;
• say what further information you hold and what you intend to do next, for example exit, monitor or continue the relationship.

The guidance also lists things to avoid. Do not write in capitals, use undefined jargon or acronyms, or submit dense unbroken text. Do not rely on a link to an article without summarising it. Your suspicion must be your own: the guidance says not to inherit suspicion from a court order, production order or contact from law enforcement. It also asks reporters not to split one subject's suspicion across several SARs to get around the 8,000-character limit on the field, and not to hold details only in the free-text box when a structured field exists for them.

Structured fields, glossary codes and other details

The guidance asks reporters to complete the structured subject fields wherever they hold the information. Examples it gives include sort codes and account numbers or IBANs, full addresses with postcodes, dates of birth in DD/MM/YYYY format, and the numbers of any earlier SARs on the same subject (up to 19). Non-Roman addresses need an English translation, and the guidance warns that SARs containing non-Roman characters may be rejected by the portal's firewall.

Glossary codes help the UKFIU and law enforcement triage reports by threat area. According to the guidance, you should select them from the portal's list rather than typing them, you may select more than one if the reason for suspicion explains why each applies, and the list is updated periodically so you should check it each time. Choosing a code does not turn the SAR into a crime report. You must also choose whether the report falls under the Proceeds of Crime Act 2002 (POCA) or the Terrorism Act 2000, because a defence only applies to offences under the legislation you select.

Asking for a defence against money laundering (DAML)

If you need consent to carry out an act that would otherwise be an offence, the UKFIU guidance says to answer "Yes" to the DAML question in the portal. A request written into the reason for suspicion field will not be considered. The guidance refers to a notice period of seven working days, during which you must not carry out the act unless the UKFIU grants consent or the period ends without a response. Questions about live requests go to the UKFIU's dedicated DAML inbox rather than individual officers, and the detailed procedures sit in a separate chapter of the UKFIU guidance. For the circumstances where no DAML is needed, see our guide to DAML exemptions for accountants.

What happens after you submit

The UKFIU guidance is clear that you cannot view, save or print a SAR once it has been submitted, and the UKFIU cannot send you a copy. Our suggestion is therefore to save or print a copy before you submit, and to keep it securely with the file note recording the decision to report. The guidance also says that:

• the portal does not allow attachments, so everything relevant must be in the report itself, with a note that further material is available on request;
• draft SARs are deleted after 31 days of inactivity;
• submitted SARs are held on a central database for six years;
• the UKFIU cannot give progress updates or feedback on individual SARs; and
• a SAR can be marked private, so that other users in your organisation cannot view, edit or submit it, which changes only how it appears inside your organisation.

The tipping off offences continue to apply after you file. The guidance reminds reporters not to discuss a SAR with the client or any third party where that could prejudice an investigation, and to take advice from their supervisor or a legal adviser on the limited exceptions.

A short checklist for your firm

These are our suggestions rather than requirements in the guidance:

• Check that every internal template and procedure points to the SAR Portal.
• Keep a report-writing checklist based on the points above, so each narrative covers who, what, when, where and why.
• Keep the portal login details and access list under review, with a trained deputy.
• Record the decision to report, the date and the copy retained, without recording anything that would tip off the client.
• Re-read the UKFIU guidance when it is updated, because version numbers and details change.

Frequently asked questions

Can I email a SAR to the NCA?

No. The UKFIU guidance says SARs should never be emailed to it and should be submitted through the SAR Portal.

Can I attach documents to a SAR?

No. The portal does not permit uploads, so include the key information in the report and state that more is available on request.

Can I get a copy of the SAR after I submit it?

Not from the portal or the UKFIU, according to the guidance. Take a copy before submission.

Where can I see how SARs fit into the wider framework?

Our AML and KYC guides hub links to our guides on customer due diligence, supervision, sanctions and reporting.