SAR Filed, CEO Says Nothing Changes
Bay EMI is a Gibraltar electronic money institution with 45 employees. Its largest corporate customer, Atlas Digital Ltd, generates £3.1m per month, about 22% of Bay EMI's revenue. Atlas's beneficial owner is the brother of a serving overseas minister, and most payments route through a Cypriot payment processor with no clear commercial rationale. Bay EMI's risk appetite statement says it will not accept more than 10% of revenue from high-risk jurisdictions. The compliance officer filed a suspicious activity report with the GFIU three days ago. The CEO, who has just returned from leave, tells the CO and two relationship managers that 'nothing changes until the GFIU responds; do not discuss the report with anyone, especially Atlas'. A relationship manager has already asked Atlas for 'clarification' of the Cyprus flows. Atlas is due to receive a £600,000 top-up on Friday. The board meets tomorrow.
1. Was the SAR timely, and what should happen now?
Read the worked answer
Three days is not automatically too late, but timeliness depends on when the suspicion first arose and how quickly the CO escalated internally. The firm must be able to show a clear process: internal reporting, prompt assessment, and submission to the GFIU without undue delay. The CO should now check that the SAR contains the full picture, including Atlas's ownership, the Cypriot processor, the revenue concentration and the proposed £600,000 top-up. If new facts have emerged, a further or supplementary SAR should be considered.
The firm must keep the SAR confidential on a need-to-know basis. The board should be informed at an appropriate level of generality so that it can exercise oversight without widening disclosure. The CO should continue monitoring the relationship, document all decisions, and ensure that no one destroys or alters records. The firm should not wait for the GFIU before taking prudent risk measures, but it must not disclose the SAR or the suspicion to Atlas.
2. Analyse the CEO's instruction and the relationship manager's request for clarification against tipping-off and confidentiality rules.
Read the worked answer
The CEO's instruction mixes a legitimate confidentiality point with a dangerous one. It is correct that the SAR should not be discussed with Atlas or with staff who do not need to know. It is not correct to suggest that nothing can be done or that the firm must simply wait passively. More importantly, the relationship manager's request for 'clarification' of the Cyprus flows is risky. If the request hints that the firm has suspicions or has made a report, it could amount to tipping off, which is a criminal offence under Gibraltar's proceeds-of-crime framework. Even without an express reference to the SAR, the timing and wording may prejudice an investigation.
The CO should stop all client contact about the flows, preserve the messages, and take legal advice. The CEO should be told that confidentiality is not the same as obstruction and that instructions must not prevent the CO from dealing with the GFIU. If there is a risk that Atlas has already been tipped off, the GFIU should be informed. The firm should also remind staff that they must not disclose SAR information except to the GFIU, law enforcement, legal advisers or others who genuinely need to know.
3. Should Bay EMI continue the relationship, and what board governance steps are needed?
Read the worked answer
The relationship already breaches the firm's own risk appetite: 22% of revenue exceeds the 10% high-risk-jurisdiction limit. That does not automatically require immediate termination, but it requires a board-level decision and a documented rationale. Continuing while the GFIU considers the SAR may be permissible, but the firm should pause the £600,000 top-up, apply enhanced monitoring, restrict new products and consider whether suspension or exit is the prudent course. If the GFIU refuses consent or the firm cannot manage the risk, exit should follow.
The board should minute the conflict between revenue and risk, approve a clear action plan, and require the CO to report directly. It should review why the risk appetite was breached without escalation, whether the CEO's instruction interfered with the CO, and whether a further SAR is needed. It should also consider notifying the GFSC of the material risk-appetite breach if the circumstances meet the firm's notification obligations. Commercial pressure must not override the suspicion.