A firm's financial crime monitoring systems will generate what is often called an unusual activity report or UAR from their transaction monitoring efforts, or from the things seen and heard by human eyes and ears. This is strictly an internal report, and the content will be restricted, so it will only be seen and discussed amongst a very limited number of people within the firm. Typically only financial crime risk investigators, money laundering, reporting officers, or line manager, and the reporting employee to minimize the risk of tipping off the customer.

The strictly internal UAR may become its external counterpart. If a firm's investigations find there is substance to the UAR known either as a suspicious activity report or SAR, or suspicious transaction report, or STR. If internal investigations substantiate the concerns, the firm is bound by law to report them through an STR to the National Financial Intelligence Unit.

Tipping off can occur at any stage during this process before or after an STR has been created. Tipping off is a criminal offense in many jurisdictions, so it's important to ensure the client isn't made aware or becomes suspicious that an investigation into possible money laundering is being carried out. Why does the law make tipping off and failing to report suspicions of money laundering criminal offenses? It's because either one can prejudice police work. Financial intelligence units are where the financial services sector meets the police, and it's the point at which a police investigation can be triggered. An STR is much less useful to the police if the firm tells the customer that they are being investigated. Knowing this, the customer might run away evading the police. Is there a one for one relationship between UARs and STRs? No. False positives and legitimate explanations mean not every UAR is converted into an STR.