Tipping Off in Saudi Arabia: The AML Compliance Risk Financial Institutions Cannot Ignore
In Saudi Arabia, detecting suspicious activity is only one part of an effective AML program. Financial institutions must also protect the confidentiality of suspicious transaction reports and criminal investigations. This is known as tipping off, and Saudi Arabia’s Anti-Money Laundering Law prohibits financial institutions, their directors, managers, and employees from informing customers or others that a report has been or will be submitted, or that a criminal investigation is taking place.
Sources: SAMA, Anti-Money Laundering Law, Article 16; Umm Al-Qura Gazette, 2026 amendments. SAMA – Article 16; [Source]
Four Tipping-Off Risks Financial Institutions Should Control
1. Direct Customer Disclosure
The most obvious tipping-off risk occurs when an employee tells a customer that their account or transaction is being investigated or that an STR has been submitted. The disclosure does not have to be direct; revealing information that allows the customer to understand that a suspicious activity report or criminal investigation exists can also create confidentiality concerns. Sources: Saudi Anti-Money Laundering Law, Article 16; SAMA Section 8, Paragraph 8.13. [Source]
Practical approach: Customer-facing employees should use neutral explanations when requesting documents, reviewing transactions, or applying account controls without referring to an internal AML investigation or suspicious transaction report.
2. Accidental Disclosure Through Internal Processes
Tipping off does not only happen through conversations. Poorly designed procedures, unrestricted access to investigation records, or inappropriate customer notifications can unintentionally reveal sensitive information. SAMA requires financial institutions to maintain confidentiality measures, define authorized access to investigation records, and ensure customers are not alerted. Source: SAMA Section 8, Paragraphs 8.1(f), 8.11 and 8.13. (SAMA – Reporting Suspicious Transactions)
Practical approach: AML cases, investigation notes, internal reports, and STR-related information should only be accessible to authorized employees.
3. Reporting Without Alerting the Customer
Confidentiality does not remove the obligation to report suspicious activity. Under Article 15, covered entities must promptly report transactions where there is suspicion or reasonable grounds to suspect money laundering or proceeds of crime, including attempted transactions. The reporting obligation applies regardless of the transaction value. Sources: SAMA, Anti-Money Laundering Law, Article 15; SAMA Section 8, Paragraphs 8.3–8.4. [Source]
Key takeaway: There is no minimum transaction amount that must be reached before a suspicious transaction becomes reportable when reasonable grounds for suspicion exist.
4. Employee Training and Controlled Workflows
Tipping-off controls should be incorporated into employee training and AML investigation procedures. SAMA requires institutions to establish documented procedures for handling suspicious cases, internal investigations, reporting responsibilities, and confidentiality. Employees, senior management, and board members should also understand the requirements relating to reporting and not alerting customers. Source: SAMA Section 8, Paragraphs 8.1 and 8.13. (SAMA – Reporting Suspicious Transactions)
Practical approach: Training should cover compliance officers, investigators, branch staff, customer-service teams, and other employees who may communicate with customers during an AML review.
Technology Can Help Prevent Tipping Off
Technology can reduce accidental disclosure when internal AML investigations are separated from customer-facing systems. Institutions can use controlled access, case-management workflows, audit trails, and restricted investigation records to ensure sensitive information remains available only to authorized personnel. SAMA requires financial institutions to maintain records of suspicious reports and investigation documents while specifying who is authorized to access them. Source: SAMA Section 8, Paragraphs 8.10–8.12. [Source]
Tipping off is more than a communication mistake; it can undermine the confidentiality and effectiveness of financial crime investigations. Saudi financial institutions should combine clear confidentiality procedures, employee training, restricted access, controlled investigation workflows, and secure technology to ensure suspicious activity can be reported without unnecessarily alerting customers. Sources: Saudi Anti-Money Laundering Law, Articles 15–16; SAMA Section 8 – Reporting of Suspicious Transactions. [Source] [Source]
FACEKI AML Service, based in Riyadh, Saudi Arabia, supports organizations with AML screening, sanctions screening, identity verification, transaction monitoring, and risk-management solutions designed to help strengthen financial crime compliance frameworks and support alignment with applicable SAMA, CMA, and IA requirements in KSA.
