What you need to know from the JFSC's 2025 Thematic Examination feedback on SARs
The JFSC's 2025 thematic examination on suspicious activity reporting has identified gaps that were consistent, and avoidable. Here is what compliance teams and boards need to know.
โ
๐or Compliance Teams:
๐ฃ๐ผ๐น๐ถ๐ฐ๐ถ๐ฒ๐ ๐ฎ๐ป๐ฑ ๐ฝ๐ฟ๐ผ๐ฐ๐ฒ๐ฑ๐๐ฟ๐ฒ๐
Your SAR policies need to be current, clear and accessible.
Common gaps included:
- No requirement for the MLRO to notify the FIU when additional information emerges
- No disciplinary process for employees who fail to submit an iSAR
- Employees not knowing where to find the iSAR form
- No requirement for the MLRO to acknowledge receipt of an iSAR
๐ฆ๐๐ฅ ๐ฟ๐ฒ๐ด๐ถ๐๐๐ฒ๐ฟ ๐ฎ๐ป๐ฑ ๐ฟ๐ฒ๐ฐ๐ผ๐ฟ๐ฑ๐
Registers were missing critical data points:
- Date the information came to the employee's attention
- Name and capacity of the person submitting to the FIU
- Comprehensive customer/transaction details
- Clear records of enquiries made and decisions reached
๐ ๐๐ฅ๐ข ๐๐ฟ๐ฎ๐ถ๐ป๐ถ๐ป๐ด
Role-specific training was lacking. MLROs need training covering:
- Handling and validating iSARs
- Liaising with the FIU, JFSC and law enforcement
- Managing tipping-off risk
- Handling production and restraining orders
๐๐ผ๐บ๐ฝ๐น๐ถ๐ฎ๐ป๐ฐ๐ฒ ๐บ๐ผ๐ป๐ถ๐๐ผ๐ฟ๐ถ๐ป๐ด
Testing of SAR controls wasn't robust enough to identify weaknesses. When issues are found, they must be reported to the board and tracked to completion.
โ
For Boards:
๐ข๐๐ฒ๐ฟ๐๐ถ๐ด๐ต๐ ๐ผ๐ณ ๐๐ถ๐บ๐ฒ๐น๐ถ๐ป๐ฒ๐๐
Boards couldn't demonstrate adequate oversight of how quickly the MLRO decides whether to file an eSAR.
Board minutes should document scrutiny and challenge of the MLRO report, with enough detail to understand whether reporting obligations are being met promptly.
๐ ๐๐ฅ๐ข ๐ถ๐ป๐ฑ๐ฒ๐ฝ๐ฒ๐ป๐ฑ๐ฒ๐ป๐ฐ๐ฒ ๐ฎ๐ป๐ฑ ๐๐๐ฝ๐ฝ๐ผ๐ฟ๐
Where the MLRO also has client-facing duties, conflicts weren't being recorded or mitigated. And where DMLROs were active, there was no evidence of regular oversight meetings between MLRO and Deputy.
๐๐ฒ๐ฒ๐ฑ๐ฏ๐ฎ๐ฐ๐ธ ๐น๐ผ๐ผ๐ฝ
Is there a proactive feedback loop between the MLRO and the board?
Reports need to contain the information the board actually needs for robust oversight.
โ
JFSC has signalled it may revisit this theme to assess whether guidance has been acted on in the future.
It is worth asking yourself: โIf the regulator knocked on your door tomorrow, could you demonstrate your SAR processes are working?โ