866k SARs at risk: Reform demands NCA probe into insider data leak

Leaking a Suspicious Activity Report is not just a legal violation – it’s a classic insider threat event. The Reform UK case points to a potentially severe cybersecurity failure at the NCA: an employee or third party may have exfiltrated one of the UK’s most sensitive classes of financial intelligence and fed it to a journalist. For CISOs and threat analysts, this scenario raises urgent questions about access controls, logging, and monitoring within law enforcement’s data-sharing ecosystems.

Reform UK Deputy leader Richard Tice has formally written to the National Crime Agency (NCA) Director General, requesting an investigation into whether the agency itself is the source of a leak of his private financial information to the Guardian newspaper. The alleged leak concerns Suspicious Activity Reports (SARs) filed under the UK's anti-money laundering regime – a system designed to flag potential money laundering in complete confidence. Tice claims he only learned that his organisations' payments had been flagged when approached by the Guardian, and Reform UK believes the newspaper's information likely originated from within the NCA.

“

In late 2024, his company Tisun Investment received a £80,000 loan from George Cottrell, a close ally of Reform leader Nigel Farage.

The payments in question involve two entities linked to Tice. In late 2024, his company Tisun Investment received a £80,000 loan from George Cottrell, a close ally of Reform leader Nigel Farage. Separately, in June 2024, Tice's think tank Britain Means Business received a £1 million donation from Cottrell's mother, Fiona. The same month, the think tank donated £500,000 to Reform UK, according to Electoral Commission data. These transactions triggered SARs notifications to the NCA – one of 866,616 such reports received in 2024/25. The SARs system is foundational to the UK's financial crime detection infrastructure, yet its effectiveness depends on absolute confidentiality; breaching that confidentiality constitutes a 'tipping off' offence under the Proceeds of Crime Act (POCA), which can itself be a criminal matter.

The NCA's response has been one of firm institutional opacity: "The NCA does not confirm or deny the receipt of suspicious activity reports, nor comment on how any SAR is used. SARs are confidential and breaching that confidentiality risks committing a tipping off offence under the Proceeds of Crime Act." This standard posture, while legally proper, leaves unanswered the question of whether an internal breach occurred. If the leaked information did come from the NCA, it would represent a serious violation of POCA and could undermine confidence in the SARs regime among the financial institutions, lawyers and accountants required to file reports. It would also expose the agency to potential legal liability and reputational damage.