CAML CME-2B: The Guide to Suspicious Activity Reporting (SAR)

For the CME-2B material, use the Saudi term Suspicious Transaction Report (STR). “Suspicious Activity Report” or SAR is useful as a broader international search phrase, but candidates should not substitute it for the terminology used in the Saudi rules and exam material.

The Role of the MLRO

Every regulated financial institution must appoint a Money Laundering Reporting Officer (MLRO). This individual holds a highly sensitive, senior position and acts as the central hub for all AML concerns within the firm.

The reporting chain involves two distinct steps:

1. Internal Reporting: A front-line employee records and escalates the facts giving rise to suspicion to the MLRO under the firm’s procedure.
2. External Reporting: The MLRO reviews the internal report. If there are reasonable grounds for suspicion, the MLRO files an external STR with the Saudi Financial Intelligence Unit.

Recognizing Red Flags

Employees are not expected to be detectives, but they are expected to recognize ‘red flags’—behaviors that deviate from the client’s normal profile. Exam questions will often present scenarios and ask if they warrant an internal SAR.

Common red flags include:

• A client suddenly depositing large amounts of cash when their business does not typically handle cash.
• Transactions involving high-risk jurisdictions with no clear economic rationale.
• A client attempting to make a transaction just below the reporting threshold (known as ‘smurfing’ or structuring).
• A client becoming highly defensive or evasive when asked standard KYC/CDD questions.

The Offense of Tipping Off

One of the most serious criminal offenses in AML regulation is Tipping Off.

After an internal report, the employee must follow the MLRO’s instructions and avoid disclosing the report or any related investigation to the client. The prohibition is about unauthorized disclosure, not about using “SAR” as the name of the internal escalation.

Conclusion

For CME-2B, remember the sequence: employee internal report, MLRO assessment, external STR when the threshold is met, then Saudi FIU. Keep the internal escalation and the external statutory report distinct.