You're in the middle of a normal working week when the bank freezes a payment, your MLRO forwards an unexpected request, or a letter from the National Crime Agency lands in the inbox. The transaction may relate to a genuine customer, a supplier you've used for years, or a cross-border payment that made perfect commercial sense at the time. Suddenly, directors, staff, clients, cash flow and reputation all sit inside the same unresolved question: when does a suspicious transaction pattern justify a money laundering investigation?
That question matters to more than banks. SMEs, accountants, solicitors, estate agents, payment businesses, importers, exporters, cryptoasset firms and professional advisers can all face scrutiny. The right response isn't to panic, delete messages or ask the customer for an explanation before taking advice. It's to preserve evidence, control communications and establish what the transactions show.
When a Money Laundering Investigation Knocks on Your Door
It's Monday morning in London. A finance director opens an email referring to the National Crime Agency, or receives a call from the bank's financial crime team saying an outgoing payment has been placed on hold. The wording sounds measured. The effect isn't. Your stomach tightens, the boardroom goes quiet and every recent payment suddenly looks capable of being misread.
The first decisions arrive quickly. Who needs to know? Should the business stop a payment? Which records must it preserve? Can someone contact the customer? Should the firm instruct a solicitor, a forensic accountant, or both? A business that answers those questions informally can create a second problem while trying to solve the first.
A UK money laundering investigation rarely begins with officers at the door. It often starts with a bank referral, a suspicious activity report, a Defence Against Money Laundering request, an information request, or an internal escalation by an MLRO. The UK Financial Intelligence Unit receives, analyses and disseminates SAR intelligence to law-enforcement agencies, including HMRC, so a report can become part of a wider intelligence picture rather than remain a routine compliance record. UK operational guidance on SAR handling explains the practical role of this channel.
The first response shapes the investigation
Your team should create a controlled response group immediately. That usually includes a director, the MLRO or compliance lead, legal counsel and an independent financial investigator. Keep the group small. Wider internal discussion increases the risk of inconsistent explanations, accidental disclosure and evidence contamination.
Preserve accounting data, bank statements, payment messages, contracts, invoices, customer files, onboarding records and relevant email correspondence. Don't ask staff to “tidy up” files, change descriptions or reconstruct missing records without documenting what they did. A forensic accountant can create a defensible evidence register and identify which records require lawful imaging.
The HMRC investigations guide is also useful when the matter may involve tax, trading records or a parallel HMRC review. The immediate objective isn't to prove innocence through a hurried email. It's to understand the facts before the business commits to a position.
Practical rule: Treat the first working day as an evidence and decision-control exercise, not a public-relations exercise.
What the bank hold means
A transaction hold doesn't, by itself, prove criminal conduct. It means the bank or another regulated firm has identified a risk it can't clear through ordinary review. The underlying issue may involve a counterparty, payment route, beneficial owner, source of funds, sanctions concern or pattern across multiple accounts.
The business still needs to protect payroll, suppliers and customers, but it must do so without moving suspicious funds, alerting a subject or destroying relevant material. That balance requires an organised factual review, not guesswork.
Why UK Businesses Delay and What That Really Costs
The first objection is usually cost. Directors worry that professional advice will add another bill during a period when the bank has already restricted cash. That calculation misses the true exposure. A short, fixed-scope review can prevent the business from giving an inaccurate explanation, mishandling a SAR, releasing funds without consent or overlooking a connected transaction.
The second objection is time. An owner may say, “I can't spend a week answering questions when I need to run the company.” In practice, an unmanaged investigation consumes more senior time. Staff repeat interviews, advisers receive incomplete documents, and the bank asks for information in several rounds because nobody has built a coherent transaction narrative.
Delay creates avoidable risk
Confidentiality creates another barrier. Businesses fear that involving an adviser will spread the issue among staff or customers. A controlled investigation does the opposite when the team defines access, preserves communications and routes sensitive discussions through the appropriate legal advisers. It also helps separate people who need operational information from those who only need a carefully worded instruction.
Then there's tipping off. Under POCA, a business must not prejudice an investigation by disclosing protected information improperly. That doesn't mean directors must stop operating, abandon legal advice or refuse every conversation with a customer. It means communications require discipline, especially where a disclosure or consent request may be active.
The safest response is controlled openness. Tell the people who must act, record why they know, and don't speculate with the person whose activity may be under review.
A delay can also allow assets to move, records to disappear and explanations to become less reliable. Senior managers and MLROs should understand their own responsibilities rather than assuming that a company instruction protects every individual. If the facts indicate consent, connivance or a failure to act on known risk, personal exposure can become part of the matter.
A sensible first instruction doesn't need to cover every historic transaction. It should define the suspected pattern, the relevant accounts and counterparties, the records to preserve, the people to interview and the decisions that require legal input. That structure reduces disruption while giving the business a clearer route through the investigation.
The UK Legal Framework You Cannot Afford to Misread
The Proceeds of Crime Act 2002, or POCA, creates the central criminal framework. Sections 327, 328 and 329 address dealing with, arranging or possessing criminal property. The issue isn't limited to money physically obtained through a crime. A transaction can create risk where a person knows or suspects that property represents a benefit from criminal conduct.
| Section | Type of conduct | Maximum penalty |
|---|---|---|
| s.327 | Concealing, disguising, converting, transferring or removing criminal property | Up to 14 years' imprisonment, a fine, or both |
| s.328 | Becoming concerned in an arrangement that facilitates the acquisition, retention, use or control of criminal property | Up to 14 years' imprisonment, a fine, or both |
| s.329 | Acquiring, using or possessing criminal property | Up to 14 years' imprisonment, a fine, or both |
A regulated business must also understand the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. The regulated sector includes relevant financial businesses and professions such as accountants, legal professionals, estate agents, trust and company service providers, and high-value dealers. The exact duties vary, but the core expectations include customer due diligence, risk assessment, record keeping, internal controls and escalation.
CDD, EDD and beneficial ownership
Customer due diligence, or CDD, establishes who the customer is, what they do and who ultimately owns or controls the relationship. Enhanced due diligence, or EDD, applies where the risk is higher. That may require deeper source-of-funds work, more information about ownership, closer monitoring and stronger approval controls. A practical explanation of the distinction appears in this CDD and EDD guide.
Companies House records can help, but they don't replace independent verification. A business should test ownership against incorporation documents, control rights, payment instructions, commercial activity and, where relevant, overseas registries. A nominee director or apparently unrelated intermediary can change the risk assessment without changing the customer's formal paperwork.
SARs and DAML consent
A regulated firm that knows or suspects money laundering normally considers an authorised disclosure to the NCA. A Defence Against Money Laundering request, commonly called a DAML SAR, seeks consent to proceed with a transaction that could otherwise create POCA risk. The disclosure doesn't mean the NCA has certified the transaction as legitimate. It creates a statutory process for managing the proposed act.
After an authorised disclosure, the NCA has seven working days to refuse consent. If it doesn't refuse within that notice period, deemed consent arises and the business can proceed without committing the principal money laundering offence. If consent is refused, a 31-calendar-day moratorium can follow, as explained in UK POCA guidance from the Gambling Commission.
From 31 July 2025, the POCA section 339A threshold increased from £1,000 to £3,000, subject to the statutory conditions. The Law Society's SAR guidance explains how the threshold affects certain account activity and customer exits. Never treat the threshold as a general permission to ignore suspicious conduct.
The Economic Crime and Corporate Transparency Act also belongs in the wider governance conversation. Directors should understand that corporate transparency, controls and reporting decisions can affect how investigators interpret the business's conduct.
How a Money Laundering Investigation Actually Unfolds
A typical investigation follows a logical sequence, even when the first contact feels chaotic. Each stage protects a different asset: evidence, legal options, operational continuity or credibility.
Intake and risk triage. The team records who contacted the business, what transaction or customer triggered concern, what funds remain restricted and whether any deadline applies. The investigator then separates confirmed facts from assumptions.
Evidence preservation. The business suspends routine deletion and preserves accounting exports, bank records, payment messages, ledgers, contracts, customer files and communications. Lawful imaging protects metadata and reduces arguments about later alteration.
Intelligence gathering. The team maps the customer, directors, beneficial owners, counterparties, jurisdictions and payment routes. Public records can help, but investigators should distinguish open-source intelligence from verified evidence.
Formal interviews. Directors and staff may need interviews under caution or without caution, depending on the legal context. A solicitor should determine the interview framework. A forensic accountant can identify inconsistencies without turning the interview into an unstructured conversation.
Financial analysis. Investigators reconcile bank statements to ledgers, invoices, contracts and payment messages such as MT103 records. They identify unexplained gaps, circular movement, unusual timing and transactions that lack a credible commercial purpose.
Asset tracing. The analysis follows value through intermediaries, related entities and assets. Cross-border work may require overseas corporate records and specialist advice. The investigator documents each inference rather than presenting a visually attractive but unauditable chart.
Case resolution. The matter may result in a report to the NCA, FCA or HMRC, a bank response, remediation, a disciplinary process, civil recovery work or a handover to defence counsel. The outcome depends on evidence and legal advice, not solely on how suspicious the first transaction appeared.
Why sequence matters
If the business interviews staff before preserving their records, it may lose context or encourage people to align accounts. If it traces payments without securing source documents, it may mistake a ledger description for proof. If it prepares a customer explanation before deciding whether a tipping-off risk exists, it can prejudice the investigation.
Technology can assist, particularly where payment and identity information spans platforms. For background on how blockchain improves KYC efficiency, consider how verification records might support onboarding and audit trails. Technology doesn't replace judgement. A reliable investigation still requires a clear chain from source document to conclusion.
Red Flags and Forensic Accounting Techniques That Hold Up
A red flag isn't a verdict. It's a reason to ask a better question. The strongest escalation decisions arise when several indicators converge and the business can't reconcile them with a credible commercial explanation.
Common typologies include:
- Unusual transaction patterns: Funds move in and out rapidly, payments arrive from unrelated parties, or the account activity doesn't match the customer's stated business.
- Complex layering: Several intermediaries, jurisdictions or accounts obscure the route between the payer and recipient.
- Shell-company use: A counterparty has little visible trading activity, opaque ownership or directors connected to other high-risk entities.
- Trade-based manipulation: Invoices appear overvalued, undervalued, duplicated or inconsistent with shipping and inventory records.
- Cash inconsistency: A cash-heavy business reports activity that doesn't fit its premises, staffing, customer base or declared turnover.
The plan notes for this article refer to a £10,000 structuring threshold. That figure must not be presented as a universal legal safe harbour. A business should assess the full pattern, because repeated lower-value transactions can still carry significance and the absence of a threshold breach doesn't remove suspicion.
Turning suspicion into defensible analysis
A forensic accountant starts with the data, not the preferred conclusion. They reconcile source-of-funds claims to bank records, test invoices against contracts and delivery records, trace beneficial ownership through Companies House and overseas registries, and build a link analysis showing relationships among people, accounts and entities.
Analytical tools can include Benford analysis, payment-value outlier testing, duplicate-invoice checks, timing analysis and network mapping. None proves laundering alone. Each technique helps identify where the investigator should examine primary records and challenge an explanation.
A useful introduction to what is forensic accounting helps distinguish forensic work from ordinary bookkeeping. The important difference is reproducibility. Another competent reviewer should be able to follow the data extraction, assumptions, calculations and source references.
Use the source of funds verification process to build that record. Keep original files, document adjustments, preserve timestamps and record who approved each conclusion.
Escalation rule: If two distinct typologies point to the same counterparty, stop treating the matter as an isolated anomaly and commission a documented review.
A UK Case Study of a Suspicious Transaction Pattern
The following example is a composite teaching scenario, not a claim about a real company. Maple & Cole Trading Ltd, a mid-sized London import-export business, found its accounts frozen after the bank identified approximately £2.4 million in round-trip payments routed through three jurisdictions over 14 months.
The directors initially described the payments as supplier settlements and short-term trade finance. The bank saw a different pattern. Funds left the UK, passed through intermediaries and returned to connected accounts without a clear relationship to inventory, shipping or margin.
The forensic accountant first arranged an MLRA-protected interview with the finance director through the company's solicitor. The team then preserved the ledgers, Xero exports, bank statements and relevant emails. That order mattered. It allowed the investigator to compare what the finance director believed had happened with the records created when each payment was authorised.
Following the payment references
The analysis matched SWIFT references between outgoing and incoming payments. It identified two British Virgin Islands entities owned by a former employee, which had not appeared in the company's original commercial explanation. The review also found an unexplained £180,000 that didn't reconcile to inventory.
| Counterparty | Jurisdiction | Approx. value, 14 months | Transaction pattern | Red flag triggered |
|---|---|---|---|---|
| Maple & Cole Trading Ltd | UK | £2.4 million routed overall | Funds left and returned through intermediaries | Round-tripping and rapid movement |
| Intermediary A | British Virgin Islands | Included in overall flow | Received supplier-style payments and passed funds onward | Opaque ownership and layering |
| Intermediary B | British Virgin Islands | Included in overall flow | Returned funds through connected payment routes | Related-party link and circular flow |
| Inventory records | UK operations | £180,000 unexplained balance | Payments lacked matching stock evidence | Source-of-funds and ledger mismatch |
The findings did not automatically establish that every payment represented criminal property. They did establish that the original explanation was incomplete and that the counterparty relationships required formal escalation.
What changed after the review
The business prepared a SAR with a consent request through the appropriate legal and compliance channels. The transaction remained subject to the seven-working-day NCA notice period before deemed consent could arise, while the team maintained a controlled record of decisions and communications.
Maple & Cole then rebuilt its CDD process. It required stronger beneficial-owner verification, independent checks on related parties and documentary support for trade finance. The lesson is practical: a suspicious pattern becomes actionable when the business cannot reconcile the money to a credible commercial purpose and the surrounding evidence points in the same direction.
How a Money Laundering Investigation Works for UK Firms
A bank asks for the source of funds. The NCA sends a letter. An internal escalation identifies payments that no longer fit the commercial explanation. At that point, Lighthouse Consultants gives the business a controlled engagement model, separating immediate decisions from the financial analysis that follows.
Lighthouse is a London-based forensic accounting and advisory team supporting firms facing unexplained payments, fraud concerns, regulatory pressure and disputes. Its work can cover transaction tracing, source-of-funds reviews, evidence preservation, control testing and structured reporting.
Begin with a confidential discovery call
The first call should establish the trigger, entities involved, operational impact and any reporting or response deadline. A free, confidential discussion lets the business explain the facts before committing to a wider investigation.
Send the letter, bank message or internal escalation record securely. Where possible criminal conduct is involved, bring in a solicitor early. That allows the team to address legal advice, privilege and sensitive communications through the proper route.
Set a fixed-scope plan
The engagement should specify the accounts, period, counterparties and questions under review. A written plan should state:
- Deliverables: An evidence register, transaction schedule, source-of-funds analysis, ownership map and findings report, where relevant.
- Responsibilities: Who supplies records, who approves communications and which matters require the solicitor's direction.
- Fees and timing: The defined initial scope and the events that would require further instruction.
- Reporting audience: Whether the report supports the MLRO file, a bank response, the NCA, HMRC, the FCA, external counsel or an internal remediation plan.
A clear scope keeps directors focused on running the organisation while the financial work proceeds. It also prevents a general concern from becoming an uncontrolled review with no agreed decision point.
Use fieldwork to answer the agreed questions
The forensic accountant reviews the records and tests the explanations against the available financial evidence. Work may include transaction tracing, invoice testing, source-of-funds reconciliation, beneficial-ownership research, interviews and control testing. A larger cross-border matter can be expanded with specialist advisers where the evidence or jurisdictions require it.
Privilege belongs to the legal advice process. Copying an accountant into an email does not create privilege. Lighthouse can work alongside the firm's solicitors, with legal advisers directing appropriate work while the forensic team maintains an independent financial analysis.
The engagement should also record assumptions, missing documents and limitations as they arise. That gives the MLRO and counsel a reliable basis for deciding whether the pattern justifies escalation, rather than treating every unusual payment as proof of criminal property.
Produce a report for the decision-maker
A usable report explains the question, evidence reviewed, methodology, transactions tested, limitations, findings and recommended actions. It should help an MLRO decide what to escalate, help counsel assess exposure and help a bank understand the commercial evidence without receiving speculation.
The wider UK position makes disciplined analysis necessary. The NCA recorded 872,048 SARs received between April 2023 and March 2024, a 1.5% year-on-year increase, while DAML requests fell 23% to 57,081. DAML refusals rose 44% to 2,881, and funds denied to suspected criminals declined to £190.3 million from £240.9 million. These figures appear in the NCA annual reporting summary.
Recovery outcomes also matter. Authorities recovered £243.3 million through confiscation, forfeiture and civil recovery orders in the financial year ending March 2024, including £128.5 million in money-laundering-linked confiscation-order receipts and £107.3 million from forfeiture orders. The official UK asset-recovery statistics show why evidence quality and recoverability belong in the same decision.
Do not wait for another bank call. Book a no-obligation discovery call, send the letter or transaction notice through secure channels, and expect a same-working-day acknowledgement from a named adviser rather than a generic inbox.
Lighthouse Consultants offers UK businesses focused forensic accounting support for transaction tracing, source-of-funds reviews, evidence preservation and SAR or DAML decision support. Visit Lighthouse Consultants to arrange a confidential discovery call before an unexplained payment becomes a wider investigation.
