Tipping off and confidentiality
In short
Section titled “In short”Tipping off means letting someone know, directly or by hint, that they are being investigated for money laundering or terrorist financing, or that a suspicious transaction report has been or may be made. In most AML regimes, Ghana’s included, tipping off is a criminal offence for the person who does it.
The rule protects investigations: a warned suspect moves the money, destroys evidence or disappears.
What counts as tipping off
Section titled “What counts as tipping off”| Tipping off | Not tipping off |
|---|---|
| “Compliance has flagged your account for suspicious activity.” | “Can you tell us more about the purpose of these payments?” asked as normal due diligence |
| “We have to report this to the FIC.” | Updating KYC information as part of a routine review |
| “Stop sending money from those people or you’ll be reported.” | Declining a transaction under your normal terms, without mentioning suspicion |
| Telling the customer’s relative, an agent or a colleague in another company about the report | Discussing the case with your MLRO, your investigation team, or others inside your institution who need to know |
| Hinting: “You know why we’re asking.” | Asking neutral, factual questions |
How to ask a customer questions safely
Section titled “How to ask a customer questions safely”Sometimes you need information only the customer has: what a payment was for, where funds came from. That’s normal due diligence, and you can ask, carefully.
- Agree with your MLRO first whether to contact the customer at all. In some cases (fraud networks, PEPs, terrorist financing) any contact is too risky.
- Use routine framing. “As part of keeping our records up to date…” or “We review accounts regularly…”. Never mention suspicion, compliance investigations, the FIC or reports.
- Ask open, factual questions. “What is the nature of your business?” “What were these payments for?”
- Don’t coach. Never suggest an answer, and never explain what would or wouldn’t trigger a review.
- Record the conversation on the case: who asked, when, what was said.
When the customer asks for their data
Section titled “When the customer asks for their data”A customer under investigation may send a data protection request: to see their data, have it erased, or object to its use. Answering carelessly is one of the easiest ways to tip someone off.
SpeculaPro guards against it in Privacy → Requests: a request from a customer under an open case or the subject of an STR is flagged for the MLRO without saying why, can’t be answered until the MLRO has reviewed it, and the data export never contains alerts, cases, reports or risk information, for any customer. An erasure is decided on retention alone, so the customer receives the answer any customer would. See Data subject requests: the tipping-off safeguard.
Front-line staff, agents and call centres
Section titled “Front-line staff, agents and call centres”The people customers actually talk to usually know nothing about the case, and that is the safest arrangement.
- Front-line and call centre staff should have standard, neutral responses for blocked or delayed transactions. Your MLRO should approve the scripts.
- Agents are external partners. Don’t share investigation details with them, even if they are helping with an agent-related case. See Agent abuse.
- If a customer asks “Have I been reported?”, staff should neither confirm nor deny, and should refer the question to a supervisor.
Confidentiality inside your institution
Section titled “Confidentiality inside your institution”- Share case details only with people who need them for their role. SpeculaPro’s roles and permissions enforce this in the system; apply the same principle in conversation, email and chat.
- Personal data in clear (full ID numbers, phone numbers) is visible only to roles that hold the view personal data permission. See Data protection.
- Don’t copy case details into email, chat or spreadsheets. Keep them in the case, where access is controlled and audited.