Reporting suspicions — the AMLR duty and its clocks
Article 69 replaces twenty-seven national versions of the reporting duty with one, and it carries deadlines that most national regimes did not. Regulation (EU) 2024/1624 requires obliged entities — and, where applicable, their directors and employees — to cooperate fully with the FIU by promptly reporting on their own initiative, and by answering FIU requests within five working days, a period the FIU may shorten to less than 24 hours in justified and urgent cases.
1. The reporting test
The duty arises where the obliged entity knows, suspects or has reasonable grounds to suspect that funds or activities — regardless of the amount involved — are the proceeds of criminal activity, or are related to terrorist financing or criminal activity.
| Element | What it means in practice |
|---|---|
| Knows, suspects, or has reasonable grounds to suspect | Three thresholds, the third of which is objective — what a reasonable entity in your position would have suspected, not what yours actually did |
| Regardless of the amount | No de minimis. An internal materiality threshold for reporting is not available |
| On their own initiative | The duty does not wait for a request |
| Promptly | Delay is itself a compliance failure, separate from the decision to report |
2. The response clocks
Two obligations run alongside the own-initiative duty. The entity must provide the FIU, at its request, with all necessary information, including information on transaction records, within the deadlines imposed. And the default deadline is set in the article itself:
- Five working days to reply to FIU requests for information;
- in justified and urgent cases, the FIU may shorten that — including to less than 24 hours;
- by derogation, the FIU may extend the deadline beyond five working days where it considers it justified, provided the extension does not undermine its analysis.
The sub-24-hour possibility is the one to design for, because it cannot be met by a process that depends on one named individual being available. Retrieval capability is separately mandated by Article 78, which requires systems enabling a full and speedy response to enquiries about whether a business relationship exists or existed during the preceding five years, and its nature.
3. Refraining, and the three-working-day rule
Article 71 governs what happens to the transaction itself. Obliged entities must refrain from carrying out transactions they know or suspect to be related to proceeds of criminal activity or terrorist financing until they have submitted the report and complied with any further specific instructions from the FIU or another competent authority.
Then the release valve: entities may carry out the transaction after assessing the risks of proceeding if they have not received instructions to the contrary from the FIU within three working days of submitting the report. Note the wording — proceeding is permitted after a risk assessment, not automatically on the clock expiring, and the assessment should be recorded.
Article 71(2) covers the practical exception: where refraining is not possible, or would be likely to frustrate efforts to pursue the beneficiaries of a suspected transaction, the entity must inform the FIU immediately after carrying it out.
4. What has to be kept
Article 77(1)(b) requires retention of a record of the Article 69(2) assessment — the information and circumstances considered and the results — whether or not it resulted in a report, together with a copy of any report made. The negative decisions are therefore part of the evidence base, and in most inspections they are the more interesting half.
Article 73 then closes the loop on confidentiality: the entity may not disclose that activity is being or has been assessed, that information is being or will be transmitted, or that an analysis may be carried out.
FAQ
Is there a monetary threshold for reporting?
No. The duty applies regardless of the amount involved.
Do we report transactions that never happened?
Yes — attempted transactions are expressly within the duty, as are suspicions arising from the inability to conduct customer due diligence.
How long must we hold a transaction after reporting?
Until you have reported and complied with any specific instructions. You may proceed after assessing the risks if the FIU has not instructed otherwise within three working days of the report.
How quickly must we answer an FIU request?
Within five working days by default, which the FIU may shorten in justified and urgent cases to less than 24 hours, or extend where justified.
Related: The AMLA STR format · Tipping-off · AML record retention
