Update

Protecting the anonymity of employees who file a suspicious activity report

The confidentiality of Suspicious Activity Reports (SAR) is a key area of attention. This briefing analyses the current situation in Guernsey on disclosing the identity of someone who submits an internal SAR to its Money Laundering Reporting Officer.

In Guernsey, financial institutions and other regulated businesses must comply with the legal framework imposed in respect of reporting knowledge or suspicion of money laundering or that certain property is, or is derived from the proceeds of criminal conduct or terrorist activity. Employees in regulated businesses are required under various legislative provisions, eg under the Disclosure (Bailiwick of Guernsey) Law, 2007, to raise a suspicious activity report (SAR) as soon as they become aware of facts which raise their suspicions. From the moment those suspicions are shared with the Financial Investigation Unit in Guernsey (FIU), there is a possibility that the reporting employee may be called as a witness in any subsequent criminal proceedings.

The confidentiality of SARs is a key area of interest. This update analyses the current position in Guernsey as regards the disclosure of the identity of someone who files an SAR (hereafter an SAR reporter).

SARs are submitted for the prevention, detection and prosecution of crime. This cannot be done without the relay, when appropriate, of the information contained in those SARs to the investigating authorities. In subsequent criminal proceedings, the prosecution may wish to rely on the information contained in the SAR in making its case or on the oral evidence of the SAR reporter. Whilst SARs themselves are transmitted to the FIU authorities by the firm's Money Laundering Reporting Officer (MLRO), the majority of SARs are made to the MLRO by employees of the regulated business in the course of their employment. Employees may therefore find themselves obliged to give evidence in criminal cases as a direct result of the position they hold and the regulatory framework operating in Guernsey.

The public disclosure of information about reporting staff members may give rise to concerns about staff safety, eg in connection with suspicions relating to potentially dangerous suspects. But even where there are no genuine concerns about the safety of the reporter. In addition, institutions may be uneasy about existing and potential clients uncovering their working practices in the detection of fraud.

There is no law allowing secrecy of such information or permitting any guarantee to be given to the employee in respect of their confidentiality. Regulated businesses must support the proper operation of the SARs regime, including the making of SARs by their employees, in a positive and cooperative manner, whenever they are required to do so.

In the UK, the Home Office provided useful guidance for investigating and prosecuting authorities to take into account before disclosing the identity of an SAR reporter (Circular 022/2015: Money laundering: the confidentiality and sensitivity of suspicious activity reports (SARs) and the identity of those who make them). According to this guidance, where an SAR is regarded by an investigator as relevant to an investigation, the disclosure officer should consider, on a case by case basis, whether the SAR's disclosure would give rise to a real risk of serious prejudice to an important public interest, eg the right to life. A risk assessment must be made of the real risk of harm to the reporter from the suspect. If a real risk exists, the prosecution should seek that the disclosure of the SAR and/or the identity of the reporter be withheld on the ground of public interest immunity.

There is no such guidance in Guernsey. The local SAR regime does not afford any specific protection to individuals when they may be required to give evidence.

The manner in which SAR evidence is given and how it is reported are instead matters for the Royal Court.

The starting point is that a defendant should have an opportunity to face his or her accusers in public and to put their honesty and truthfulness to test. Guernsey operates on the fundamental principle that justice must be administered in public. The media must be able to play their vital role of 'public watchdog' and reporting of court proceedings by them must not be discouraged unless strictly necessary, (usually where publicity would prejudice the interests of justice).

In some cases, legislation automatically restricts the giving of certain details in reports of court proceedings, eg family matters. Common law powers enable the Court in other circumstances to exclude the public and the media and to impose temporary or permanent restrictions on the media's reporting of court proceedings. However, the applicable legal tests are difficult to overcome and those making SARs will find it difficult to convince the Court that it is in the public interest to protect their identity from public disclosure. It must be expected that the public interest in the fair administration of justice will often outweigh the public interest in protecting the identity of intelligence sources, where the withholding of such information is likely to deny a defendant an opportunity to cast doubt on the case against him.

There are, however, other steps an employer can take to protect an SAR reporter and reduce the likelihood of public disclosure, for example:

1. mentioning only the name of the business and its MLRO in the SAR reporting form submitted to the FIU (including in the 'reasons for suspicion' box) will reduce the risk that the identity of the reporter is transmitted to the prosecution authorities;

2. if required to comply with a document production order which covers the internal SAR, provide the document to the FIU on a separate schedule of sensitive material explaining the reasons for doing so. In some cases, it may be possible to disclose an SAR in redacted form;

3. raise any concerns as to the use of an SAR or disclosure of the reporter's identity to the FIU as early as possible and engage closely with them;

4. whilst keeping a record of internal reports, ensure that personal data which may be contained in SARs is only retained where it continues to be of value for the prevention or detection of crime and for the required statutory period (five years). Otherwise, you may be required to disclose such information if the client makes a valid request under the Data Protection Law and;

5. seek legal advice immediately upon receipt of a document production order. 

This update is only intended to give a summary and general overview of the subject matter. It is not intended to be comprehensive and does not constitute, and should not be taken to be, legal advice. If you would like legal advice or further information on any issue raised by this update, please get in touch with one of your usual Mourant Ozannes contacts.

© 2016 MOURANT OZANNES ALL RIGHTS RESERVED