Both the firm and its employees have a legal obligation to report suspicious activity, but an employee's legal obligation is discharged by following the firm's internal reporting procedures. Not all employee suspicions are substantiated or warranted. Investigations sometimes lead to perfectly legitimate explanations, in which case they are simply closed. Some firms use different names to distinguish between internal and external reports. For example, Unusual Activity Report or UAR. To denote the internal report, financial services firms have a legal obligation to detect and escalate unusual or suspicious activity. Escalation can be to the line manager, a designated financial crime investigations team, or to the firm's money laundering reporting officer or MLRO.

If an investigation of the internal report substantiates concerns, the firm must raise the concerns through an external report known either as a Suspicious Activity Report, SAR, or a Suspicious Transaction Report, or STR to the National Financial Intelligence Unit. This is where the financial sector meets the police, and it's the point at which a police investigation can be triggered. National Financial Intelligence units or fis exist to receive and take action on the external reports. They are in the front line of the fight against financial crime. Depending on the jurisdiction, they may be operated by the police, by Customs and Exiss or by the Central bank. In the US the FIU is known as FinCen, in Singapore it is the Suspicious Transactions Reporting Office. While in the UK it is known as the UK FIU, and is a part of the National Crime Agency.