The Suspicious Order Flow
You are a compliance officer at a UK investment firm. A junior dealer reports that a client, an offshore company, has placed a series of buy orders in a small-cap AIM stock over three days totalling £1.8m - unusually large for this client, whose prior activity was £50k–£100k trades. The orders were placed shortly before the company announced a contract win that moved the share price up 22%. The client's account was opened six weeks ago with minimal due diligence; the beneficial owner is listed as a nominee in a jurisdiction with weak AML controls. The dealer also notes the client asked whether trades could be 'split across several brokers to avoid attention'. The company's announcement was made at 07:00; the first order was placed at 16:45 the previous day.
1. Identify the money-laundering and market-abuse red flags in this scenario and classify each.
Read the worked answer
Market abuse (insider dealing) red flags:
- Timing: first order at 16:45 the day before a 07:00 announcement - classic pre-announcement positioning.
- Size anomaly: £1.8m vs prior £50k–£100k - a step-change inconsistent with the client's profile.
- Concentration: repeated buys in one small-cap over three days ahead of price-sensitive news.
Money-laundering red flags:
- Weak KYC: account opened six weeks ago with minimal due diligence; beneficial owner is a nominee in a weak-AML jurisdiction - opaque ownership.
- Structuring intent: request to 'split across several brokers to avoid attention' is a textbook structuring/smurfing indicator.
- Jurisdiction risk: offshore nominee + weak controls = elevated geographic and ownership risk.
Classification: The timing and size point to insider dealing (a criminal offence under UK MAR/criminal law). The KYC gaps and structuring request point to money laundering (POCA 2002). The two may be linked - proceeds of insider dealing being laundered.
2. What are your immediate regulatory obligations, and to whom, and in what sequence?
Read the worked answer
Sequence matters - do not tip off the client.
- Do not execute further orders on the account pending review; consider a temporary block (justified on risk grounds, not disclosed as a suspicion).
- Internal escalation to the MLRO (Money Laundering Reporting Officer) - mandatory under POCA and the firm's AML policy.
- Suspicious Activity Report (SAR) to the National Crime Agency (NCA) via the MLRO. Do not tell the client a SAR has been filed - tipping off is a criminal offence under POCA s.333A.
- Market-abuse reporting: the firm must consider reporting suspicious transaction/order reports (STORs) to the FCA, and must not execute orders it suspects are insider dealing. Under UK MAR, firms must have arrangements to detect and report market abuse.
- Preserve records - order logs, communications, KYC file - for the investigation.
- Escalate KYC remediation - the account should be re-reviewed; the six-week-old file with minimal DD is itself a control failure.
Order of priority: stop the activity → escalate internally → SAR to NCA → STOR/market-abuse report to FCA → preserve evidence. Never confront the client first.
3. The dealer wants to 'just ask the client for an explanation' before escalating. Evaluate this suggestion.
Read the worked answer
Reject it. Asking the client to explain before escalation risks:
- Tipping off (POCA s.333A) - alerting a suspect to a disclosure or investigation is a criminal offence.
- Compromising the investigation - the client could move funds, destroy records, or coordinate with others.
- No evidential value - a self-serving explanation from a client with opaque ownership does not discharge the firm's reporting duty. The obligation is to report suspicion, not to resolve it first.
The correct path is escalate to the MLRO first; any client contact must be cleared by compliance/MLRO and framed neutrally (e.g. routine KYC refresh), never as 'we are worried about your trades'. The dealer's instinct to investigate is understandable but legally dangerous - the firm's duty is to report, not to adjudicate.