Advanced Audit and Assurance (International) · Money laundering

Reporting Suspicions and Auditor Responsibilities for Money Laundering

Updated 11 October 2026 · Fact-checked

When an auditor suspects money laundering, they report internally to the firm's MLRO, who decides whether to file a suspicious activity report with the authorities. The auditor must not tip off the client, must document the matter, and can usually continue the audit with care. Local law overrides client confidentiality.

Understand Reporting Suspicions and Auditor Responsibilities

Money laundering is the process of making money from crime look legitimate. Auditors are not investigators. But in many jurisdictions, auditors are inside the regulated sector. That means the law makes them report suspicion. The duty comes from local anti-money laundering law, not from ISAs alone. ACCA expects you to apply the principles to the scenario, not to quote one country's statute.

The usual route is internal first. Any partner or staff member who has knowledge or suspicion, or reasonable grounds for suspicion, reports to the firm's Money Laundering Reporting Officer (MLRO). The MLRO assesses the report. If suspicion stands, the MLRO files a suspicious activity report (SAR) with the national financial intelligence unit or equivalent authority. The MLRO decides this, not the engagement team. The test is suspicion, not proof. You do not need to be sure a crime took place.

Confidentiality is a fundamental principle. But it is not absolute. The IESBA Code allows or requires disclosure where law requires it. Reporting a SAR in good faith under the law is a legally permitted disclosure. Normally the law also protects the reporter from breach of confidentiality claims. Client consent is not needed, and you must not seek it.

Tipping off is the key trap. You must not tell the client or anyone else that a report has been made or that an investigation is under way, if this could prejudice it. Doing so is typically a criminal offence. Related is prejudicing an investigation, such as destroying documents or alerting the suspect. In practice this makes the audit awkward. You may still need to complete the audit, ask questions and consider the opinion. But you must plan what you say, who says it, and when.

Continuing the engagement needs thought. The MLRO may need to seek consent from the authority before the firm carries on with certain transactions or services. Delay can itself raise suspicion. You should also consider whether the matter affects risk assessment, management integrity, the audit opinion, communication with those charged with governance (TCWG), and whether to resign. Each of these must be handled without tipping off. Take legal advice where unsure.

Key rules to remember

Trigger for internal report: Knowledge OR suspicion OR reasonable grounds for suspicion → report to MLRO; Exact wording depends on local law. Proof is not needed. Report as soon as practicable.
Reporting chain: Engagement team → MLRO → authority (SAR); The MLRO decides whether to file. The team does not contact the authority or client directly.
Tipping off rule: Disclosure to client that a report was made or an investigation exists, likely to prejudice it = offence; Applies to the SAR, the investigation and the content. Check the exact local offence.
Confidentiality override: Legal requirement to disclose > duty of confidentiality; Disclosure under law is permitted. Do not disclose beyond what the law requires.
Documentation: Record the facts, the report date and the MLRO's decision on a restricted file; Keep SAR details out of the normal audit file that the client or others could see.

How to solve Reporting Suspicions and Auditor Responsibilities questions

Use this method for any money laundering reporting question in AAA. It keeps you on the requirement and earns professional skills marks.

1Read the requirement. Decide if you are asked to identify red flags, state the reporting duty, discuss confidentiality, or advise on next steps.
2Pick out the facts that create suspicion: unusual transactions, unclear source of funds, cash, complex structures, high-risk countries, reluctant management.
3State that these facts could give rise to suspicion and that the test is suspicion, not proof.
4Explain the reporting route: report to the MLRO promptly, who decides on a SAR to the authority. Say who reports and who decides.
5Deal with confidentiality: law overrides the duty, disclosure is permitted and no client consent is sought.
6Deal with tipping off: do not tell the client or anyone who could alert them, and plan what to say if asked.
7Cover continuing the engagement: consider the audit risk assessment, opinion, TCWG communication, MLRO consent issues, legal advice and possible resignation.
8Finish with documentation and a clear recommendation. Use the scenario's names and figures.

Quickest way: Suspect, Report, Stay Silent, Document

When to use it: Use it when time is short and the question asks what the auditor should do on finding suspicious transactions.

Suspect: name the red flag from the scenario.
Report: tell the MLRO now, in writing. Do not decide yourself.
Silent: no tipping off, no hints, no client consent.
Protect: confidentiality is overridden by law for this report.
Continue: assess audit impact and ask the MLRO before proceeding where needed.
Document: restricted record of facts and decisions.

Common mistakes in Reporting Suspicions and Auditor Responsibilities

Saying the auditor reports the SAR directly to the authority.
Students focus on the end result and skip the firm's internal structure.
Fix: Write the chain: team member to MLRO, then MLRO to authority. Say the MLRO decides.
Waiting for proof before reporting.
Students treat it like a fraud conclusion that needs evidence.
Fix: State that suspicion or reasonable grounds is enough. The authorities investigate.
Telling the client's management about the report or asking them to explain a SAR.
Students mix up communicating with TCWG under ISAs and tipping off.
Fix: Say no disclosure of the report or investigation. Ask routine audit questions only, and take MLRO or legal advice first.
Claiming confidentiality stops the auditor from reporting.
Ethics rules on confidentiality are learned as absolute.
Fix: Say confidentiality is overridden where the law requires disclosure, and that client consent is not needed.
Resigning immediately as the answer.
Students want a decisive action.
Fix: Resignation is an option after MLRO and legal advice. It must not tip off and cannot cancel the duty to report.
Giving a generic list of red flags with no link to the scenario.
Students recall a textbook list.
Fix: Quote the scenario facts, explain why each raises suspicion and tie each to an action.

Worked examples

Example 1

During the audit of Zenith Trading, a $ client, you find several large cash receipts from unrelated third parties in a high-risk country. They were credited to revenue with no invoices. The finance director says they are 'customer deposits' and asks you not to probe. Explain your responsibilities in relation to money laundering.

Show the solution

Identify the suspicion: large cash receipts, third-party payers, high-risk country, no invoices, and an evasive finance director. Together these could give reasonable grounds to suspect money laundering.
State the test: suspicion or reasonable grounds is enough. Proof of crime is not needed.
Report: tell the firm's MLRO as soon as practicable, in writing, with the facts. Do not contact the authority yourself.
MLRO role: the MLRO assesses and decides whether to file a SAR with the national authority.
Confidentiality: the duty is overridden by the legal requirement. No client consent is needed and none should be sought.
Tipping off: do not tell the finance director or anyone at the client about the report or any investigation. Keep any further questions routine and consistent with the audit.
Audit impact: consider the risk of material misstatement, completeness and occurrence of revenue, and management integrity. Extend procedures on the receipts.
Continuing: ask the MLRO whether authority consent is needed before proceeding. Take legal advice if unsure. Consider TCWG communication and resignation only after advice.
Document the facts and decisions on a restricted file.

Answer: Report the suspicion to the MLRO immediately, let the MLRO decide on a SAR, do not tip off the finance director, treat confidentiality as overridden by law, extend audit procedures on the receipts, and seek MLRO and legal advice before continuing or considering resignation.

Example 2

A junior auditor tells you she has reported her suspicions about Orion Ltd to the MLRO. The client's chief accountant then asks her whether the firm has 'sent anything to the authorities'. The audit manager wants to tell the client's audit committee chair everything so that trust is kept. Advise the manager.

Show the solution

Identify the issue: the manager proposes disclosing the report to the client. This risks tipping off.
Explain tipping off: telling the client or others that a report was made or an investigation exists, where this could prejudice it, is typically a criminal offence.
Reject the proposal: the audit committee chair is part of the client. Telling them could alert persons involved. Trust is not a defence.
Answer the chief accountant: the junior should not confirm or deny. She should say she cannot discuss the matter and refer the question to the manager or MLRO.
Confidentiality: this is not a conflict between confidentiality and transparency. Law protects the report and forbids disclosing it.
TCWG communication: any ISA communication must be agreed with the MLRO first and must not reveal the SAR. Legal advice may be needed.
Document the question and the response on a restricted file.

Answer: Advise the manager not to disclose the report to the audit committee chair or anyone at the client. Disclosure risks tipping off. The junior should neither confirm nor deny and should refer enquiries to the MLRO. Any TCWG communication must be cleared by the MLRO first.

Exam tips

Always name the MLRO and show the chain. Many answers lose marks by skipping it.
Use the scenario's facts. Generic answers score low on professional skills marks.
Write 'suspicion, not proof' once and make it clear.
Treat tipping off as a core point whenever the scenario mentions management asking questions or an audit committee.
If asked about continuing the engagement, give a balanced answer: MLRO advice, legal advice, audit impact, then resignation as one option.

Practice questions from Money laundering

Reporting Suspicions and Auditor Responsibilities: frequently asked questions

Does the auditor report money laundering to the client first?

No. The auditor reports internally to the firm's MLRO. Telling the client could amount to tipping off, which is typically an offence.

Does client confidentiality stop an auditor reporting suspicion?

No. Confidentiality is not absolute. Where the law requires disclosure, the auditor must report, and the disclosure is permitted under the ethics rules. Client consent is not needed.

Can the audit continue after a SAR is made?

Often yes, but the MLRO may need to seek consent from the authority first, and the team must avoid tipping off. Assess the effect on risk, the opinion and management integrity, and take legal advice where needed.

What is tipping off in the AAA exam?

It is disclosing to the client or a third party that a report has been made or an investigation is under way, where this could prejudice it. Say it is typically a criminal offence under local law and must be avoided.