Advanced Audit and Assurance (International) · Code of Ethics for Professional Accountants

NOCLAR, Whistleblowing and Money Laundering for ACCA AAA

Updated 11 October 2026 · Fact-checked

NOCLAR is non-compliance with laws and regulations. When an auditor finds or suspects it, the IESBA Code requires them to understand the matter, raise it with management and those charged with governance, assess the response, and consider further action, including disclosure. Money laundering adds reporting duties and a ban on tipping off.

Understand NOCLAR, Whistleblowing and Money Laundering

NOCLAR stands for non-compliance with laws and regulations. It means acts of omission or commission, intentional or not, by the client, those charged with governance, management or people working for the client, that go against laws and regulations. The Code covers acts that cause substantial harm to investors, creditors, employees or the public. It does not cover matters that are clearly inconsequential or personal misconduct unrelated to the business.

The auditor's response follows a logical path. First, obtain an understanding of the matter and the circumstances. Then discuss it with management and, where appropriate, those charged with governance. Next, assess whether the response was appropriate. Finally, decide whether further action is needed, such as disclosing to an appropriate authority, informing the external auditor of a group, or withdrawing from the engagement.

The key judgement is confidentiality versus the public interest. Confidentiality is a fundamental principle, so you cannot disclose client information freely. The Code permits disclosure of NOCLAR to an appropriate authority in some circumstances, even where it breaches a duty of confidentiality, and doing so is not treated as a breach of the confidentiality principle. You must still consider the law in your jurisdiction, which may require disclosure or may protect it. Take legal advice when unsure.

Whistleblowing is a person raising concerns about wrongdoing. For an auditor, it can mean reporting to a regulator or other authority outside the client. Many jurisdictions protect whistleblowers from retaliation. In an exam, link it to confidentiality: you can only disclose when the law requires it, permits it, or the public interest and the Code support it.

Money laundering is the process of disguising the proceeds of crime so they look legitimate. The auditor must follow the local anti-money laundering law. Typical duties are to report suspicions to the firm's nominated officer (often called the MLRO), who decides whether to report to the national authority. Tipping off is warning the person suspected that a report has been or may be made, or that an investigation is under way. It is usually an offence, so you must not discuss it with the client in a way that alerts them. This creates real tension with communicating with those charged with governance, so you take advice before you say anything.

Key rules to remember

NOCLAR response sequence: Understand → Discuss with management/TCWG → Assess response → Consider further action → Document; Use this order as the skeleton for any NOCLAR requirement.
Further action options: Disclose to an appropriate authority | Inform group/component auditor | Withdraw from engagement | Seek legal advice; Which option fits depends on the seriousness of the matter, the response of management and local law.
Reporting chain for money laundering: Staff member → MLRO (nominated officer) → national authority; Staff report internally. The MLRO decides on the external report. The exact title and body depend on the jurisdiction.
Tipping off rule: Do not alert the suspect that a report has been or may be made; Applies to the fact of the report and to an investigation. Avoid inconsistent communication with the client.
Disclosure test for confidentiality: Legal requirement, or legal permission, or public interest consideration under the Code; Always check local law first. Consider legal advice before disclosing.

How to solve NOCLAR, Whistleblowing and Money Laundering questions

Use the same method for any NOCLAR, whistleblowing or money laundering requirement. Tie each step to the facts in the scenario.

1Identify the issue: is it NOCLAR, suspected money laundering, or both? State which law or regulation seems to be breached.
2Assess significance: who is harmed, how seriously, and whether the act is intentional. Say whether it is inconsequential or substantial.
3Set out the immediate response: gather facts, discuss with management, and escalate to those charged with governance if management is involved.
4Consider the ethical issues: confidentiality, integrity and professional behaviour. Note any threats such as self-interest from fees or intimidation.
5Decide on further action: reporting duty, permitted disclosure, withdrawal, or informing the group auditor. Link each to the scenario.
6Deal with tipping off: say who you report to internally and what you must not tell the client.
7Explain the impact on the audit: risk assessment, evidence, written representations, the audit opinion and communication.
8Document the matter, the judgements, the discussions and the legal advice taken.

Quickest way: Four-line answer frame

When to use it: Use it when time is short and the requirement asks what the auditor should do about suspected non-compliance or money laundering.

Name it: NOCLAR or money laundering, and the law it may breach.
Act: understand the facts, raise with management and TCWG, and report internally to the MLRO where it is laundering.
Protect: confidentiality and no tipping off, and take legal advice.
Decide: further action, effect on the opinion, possible withdrawal, and document.

Common mistakes in NOCLAR, Whistleblowing and Money Laundering

Telling the client that a suspicion report has been made to the MLRO or authority.
Students think openness with management is always good practice.
Fix: State clearly that tipping off is prohibited. Advise the team to take guidance from the MLRO before any discussion with the client.
Saying confidentiality always stops the auditor from disclosing.
Confidentiality is learned as an absolute principle.
Fix: Explain that confidentiality has exceptions: legal requirement, legal permission and, under the Code, disclosure of NOCLAR to an appropriate authority. Check local law.
Jumping straight to reporting to an authority.
Students focus on the dramatic outcome and skip the process.
Fix: Follow the sequence: understand, discuss with management and TCWG, assess the response, then decide on further action.
Reporting the money laundering suspicion straight to the authority from the audit team.
Students ignore firm procedures.
Fix: Say the team member reports to the MLRO, who decides on the external report.
Ignoring the effect on the audit.
Students treat ethics and audit as separate subjects.
Fix: Add the audit consequences: risk assessment, more procedures, management integrity and representations, and a possible modified opinion or withdrawal.
Giving generic answers without using scenario facts.
Memorised lists feel safe.
Fix: Quote the facts, such as who is involved, the amounts and the jurisdiction, and apply each point. This also earns professional skills marks.

Worked examples

Example 1

During the audit of Zenith Ltd, a junior finds that the finance director appears to have paid bribes to a foreign official to win a contract. The payments were recorded as consultancy fees. Explain how the audit engagement partner should respond.

Show the solution

Identify the issue: possible NOCLAR, as bribery breaks anti-corruption law. It also affects the financial statements through misdescribed payments and possible fines, so it is significant.
Understand the matter: obtain facts about the payments, the contract, who approved them and the law that applies.
Management involved: the finance director seems to be involved, so discuss with another member of management and escalate to those charged with governance, such as the audit committee or board.
Assess the response: check whether they investigate, stop the conduct, correct the accounting and report to the authority if required.
Consider further action: if the response is inadequate, consider disclosure to an appropriate authority, taking legal advice on local law and confidentiality. Consider withdrawing from the engagement.
Consider money laundering: if the payments are proceeds of crime or conceal it, report internally to the MLRO and avoid tipping off.
Audit impact: reassess management integrity and fraud risk, extend procedures on similar payments, seek written representations, and consider the effect on the opinion.
Document all discussions, judgements and advice.

Answer: The partner should understand the facts, escalate to those charged with governance because the finance director is involved, assess their response, and then consider disclosure or withdrawal after legal advice. They should also report internally to the MLRO, avoid tipping off, adjust the audit approach and document everything.

Example 2

A staff member of an audit firm suspects that a client's large cash receipts from a new customer are laundered funds. The client's finance manager asks the staff member why more questions are being asked about the customer. What should the staff member do and say?

Show the solution

Report the suspicion to the firm's MLRO promptly, as internal reporting is required under firm procedures.
Do not tell the finance manager that a report has been made or that the matter may be investigated, because this would be tipping off.
Reply with a neutral explanation that the questions are routine audit procedures on new customers.
Stop further work on the matter if the MLRO advises, and follow MLRO guidance on how to proceed.
Keep a record of the suspicion, the report, and the MLRO's decision in a way that follows firm policy and avoids exposing the report to the client.
The MLRO decides whether to report to the national authority and whether consent is needed to continue the work.

Answer: Report to the MLRO straight away, give the finance manager only a neutral routine explanation, avoid any hint of a report, and follow the MLRO's direction. Tipping off is an offence and could harm any investigation.

Exam tips

Always give the sequence of response. Examiners reward a structured process, not just the outcome.
Use both threats and safeguards language when confidentiality conflicts with disclosure, and say you would seek legal advice.
Separate NOCLAR under the Code from money laundering reporting under local law. Mention both when the scenario could fit both.
Quote scenario facts in every point to earn professional skills marks for analysis and scepticism.
Finish with the audit impact and documentation, which many students forget.

Practice questions from Code of Ethics for Professional Accountants

NOCLAR, Whistleblowing and Money Laundering: frequently asked questions

What does NOCLAR mean in ACCA AAA?

It means non-compliance with laws and regulations, as addressed in the IESBA Code. It sets out how a professional accountant should respond when they become aware of such non-compliance by a client or employer. The response is a process of understanding, discussion, assessment and further action.

Can an auditor breach confidentiality to report NOCLAR?

Sometimes. Disclosure may be required or permitted by law, and the Code allows disclosure of NOCLAR to an appropriate authority in certain circumstances. You should consider local law and take legal advice before disclosing.

What is tipping off in money laundering?

Tipping off is alerting a suspect that a suspicion report has been made or that an investigation is under way. It is usually a criminal offence under anti-money laundering law. Auditors must avoid it, so they take guidance from the MLRO before saying anything to the client.

Who should an audit staff member report money laundering suspicions to?

They report to the firm's nominated officer, often called the MLRO. The MLRO considers the report and decides whether to report externally to the national authority. The title and authority vary by jurisdiction.