New Tipping-Off Guidance
AUSTRAC has updated its guidance on tipping-off offences, which are summarised in this blog post.
Tipping off: What your business needs to know
Tipping off is the unauthorised disclosure of certain information where the disclosure would, or could reasonably be expected to, prejudice an investigation. Tipping off is a criminal offence.
Importantly, you do not need to know or believe that an investigation is underway for the offence to apply. You must consider whether disclosing information could prejudice an investigation, whether it is already underway or may occur in the future.
What information is protected?
The offence covers information relating to suspicious matter reports (SMRs), including:
Information indicating that an SMR has been submitted or that an obligation to submit one has been triggered.
An SMR, or any report prepared to meet SMR obligations, including copies.
Documents that purport to reproduce or set out information contained in an SMR.
When could a disclosure prejudice an investigation?
Prejudicing an investigation means doing something that could negatively affect it. Whether a disclosure creates a tipping-off risk will depend on what information is disclosed, to whom, how and when.
Examples of potentially prohibited disclosures include:
Telling a customer or their associate that you have submitted, or need to submit, an SMR to AUSTRAC about their activities.
Telling a customer that you suspect they are using your services for criminal purposes.
Accidentally publishing sensitive information on your website or otherwise making it publicly available.
Sharing information with a third party who may pass it on, such as a journalist.
Are there circumstances where disclosure is permitted?
Not every disclosure of information relating to an SMR constitutes tipping off. Certain disclosures will generally not breach the offence, including disclosures made:
To comply with requirements under Commonwealth, state or territory law.
To appropriately manage money laundering and terrorism financing risks within the business.
To support due diligence in a merger or acquisition.
To meet AML/CTF obligations or manage ML/TF risks, including seeking advice from an AML/CTF consultant or a lawyer.
To Australian law enforcement, intelligence and regulatory agencies such as the Australian Taxation Office, the National Anti-Corruption Commission, the Australian Border Force and the Australian Criminal Intelligence Commission.
These examples should not be treated as blanket exemptions. The circumstances of the disclosure and the applicable legal requirements remain important.
Sharing information with external service providers
Reporting entities often rely on external service providers to support their AML/CTF compliance. Before disclosing information, consider whether the disclosure could reasonably be expected to prejudice an investigation. If it could, the information must not be disclosed.
Depending on the nature of the information and the services provided by the third party, reporting entities should consider these controls:
Restricting access to people with a genuine need to know.
De-identifying information where customer-specific details are unnecessary.
Sharing general trends and patterns rather than identifiable customer or transaction details.
Maintaining audit trails showing who accessed information and when.
Using enforceable confidentiality obligations for employees and third-party service providers.
What about scams and identity fraud?
If a reporting entity files an SMR in relation to a scam, information may need to be shared with a person who has been targeted by a scam or identity fraud to help them recover their losses. In these situations, appropriate controls should ensure that information is disclosed only to people with a genuine need to know and that the disclosure is limited to what is necessary to assist them.
Managing customer relationships without tipping off
If you have filed an SMR, AUSTRAC suggests that you provide genuine reasons to the customer of why you are conducting enhanced customer due diligence or why you are discontinuing the business relationship. Some examples are below.
If a reporting entity needs to ask for more information, it may explain that it needs to:
Meet its AML/CTF or other legal obligations.
Ensure customer information is accurate and up to date.
Obtain additional information under its standard procedures.
Resolve inconsistencies in customer information or identification documents.
If a reporting entity needs to interrupt the business relationship with the client, it may wish to explain that:
the customer's activities fall outside its risk appetite.
the requested information has not been provided satisfactorily within a reasonable timeframe,
the reporting entity has decided not to maintain the systems and controls necessary to support the relationship.
What’s next?
Review your procedures and staff guidance to ensure your team knows what can, and cannot, be communicated.
Get in touch if you have any questions.
