NOCLAR is the part of the code of ethics that tells an accountant what to do on discovering that a client may have broken a law or regulation. You first meet any legal duty, such as reporting suspected money laundering, without tipping the client off. You then get an understanding of the issue, raise it with the right level of management, judge how they respond and decide whether further action, such as reporting to an appropriate authority or resigning, is needed in the public interest.

Where do the NOCLAR rules come from?

NOCLAR stands for non compliance with laws and regulations. The ICAEW Code of Ethics, in the version that applies from 1 July 2026, contains two sections on it: section 260 for accountants in business and section 360 for accountants in practice. This page concentrates on section 360. ICAEW also publishes separate guidance on defaults or unlawful acts, which covers a wider range of situations and continues to apply alongside NOCLAR. That guidance points out that a client’s taxation affairs are dealt with in Professional Conduct in Relation to Taxation, so tax irregularities need to be read against PCRT as well.

Paragraph 360.2 explains why the rules exist: becoming aware of suspected non compliance creates a self interest or intimidation threat to integrity and professional behaviour, two of the fundamental principles. Paragraph 360.4 sets three objectives: comply with those principles; alert management or those charged with governance so they can put things right or stop a breach before it happens; and take further action where appropriate in the public interest.

Which laws and whose breaches does it cover?

Section 360 covers two kinds of law (360.3): laws with a direct effect on material amounts and disclosures in the financial statements, and other laws that are fundamental to the client’s operations, its ability to continue in business or avoiding material penalties. The examples in 360.5 A2 include fraud, corruption and bribery; money laundering and proceeds of crime; data protection; tax and pension liabilities and payments; environmental protection; and public health and safety.

The breach must be by the client, its management, those charged with governance, or other people working for or under the direction of the client (360.5 A1). It applies to every client, whether or not it is a public interest entity (360.7 A1). Three things fall outside it:

  • clearly inconsequential issues, judged by their nature and impact on the client, its stakeholders and the public (360.7 A2);
  • personal misconduct unrelated to the client’s business (360.7 A3);
  • breaches by third parties, for example the target company in a due diligence assignment (360.7 A3).

You are not expected to know more law than the engagement requires, and whether something actually breaks the law is ultimately for a court to decide (360.29 A1).

What must you check before raising it with the client?

Paragraph R360.6 requires you to understand and comply with any legal or regulatory provisions that apply, including any duty to report to an authority and any prohibition on alerting the client. The code gives anti money laundering law as the example of such a prohibition. ICAEW’s NOCLAR guidance says the first step is to establish whether a legal obligation is triggered, such as a suspicious activity report, and to consider the tipping off rules before saying anything further.

In UK practice this is often the deciding point. Under section 330 of the Proceeds of Crime Act 2002, a person in the regulated sector who knows or suspects money laundering must report it to the nominated officer or the National Crime Agency. Because the proceeds of tax evasion, fraud or bribery are criminal property, many NOCLAR situations are also money laundering situations. See suspicious activity reports, tipping off and tax evasion as money laundering. Take the MLRO’s view on what can safely be said to the client before following the steps below.

What steps does an accountant in practice take?

For services other than audit, section 360 sets out a sequence:

  1. Understand the issue. R360.29 requires you to seek an understanding of what the suspected breach is and the circumstances in which it occurred or might occur. You may consult confidentially within the firm, with a professional body or with lawyers (360.29 A2).
  2. Discuss it with management. R360.30 requires you to discuss it with the appropriate level of management, and with those charged with governance where you have access to them. Factors include who is involved, the likelihood of collusion and whether that level of management can investigate (360.30 A2).
  3. Tell the auditor where required. If the client is an audit client of your firm, R360.31 requires you to communicate the issue within the firm, usually to the audit engagement partner. If another firm audits the client, R360.33 requires you to consider telling that auditor.
  4. Decide on further action. R360.36 requires you to consider whether further action is needed in the public interest. That might be disclosure to an appropriate authority even without a legal duty, or withdrawing from the engagement (360.36 A2).

Documentation is encouraged rather than required for non audit work: the issue, the discussions, management’s response, the options considered and how you satisfied yourself on further action (360.40 A1).

What extra duties apply to auditors?

Auditors follow a stricter version. If management is involved, R360.12 requires the discussion to be with those charged with governance. R360.13 requires the auditor to advise management to rectify or mitigate the breach, deter it if it has not yet happened, or disclose it to an appropriate authority. R360.15 requires compliance with auditing standards as well; ICAEW’s guidance on the duty to report points auditors to ISA (UK) 250A on laws and regulations.

The auditor must assess management’s response (R360.19): was it timely, was the issue properly investigated, has it been put right and reported where appropriate? R360.21 then applies the reasonable and informed third party test to whether the auditor has acted appropriately in the public interest. Paragraph 360.21 A2 is explicit that withdrawing is not a substitute for other action. If the auditor does withdraw, R360.22 requires them to give the incoming accountant all relevant facts about the suspected breach on request, even if the client refuses permission, unless the law prohibits it. Documentation is mandatory for audits under R360.28.

When should you report to an appropriate authority?

The code does not set a list of mandatory reports beyond what the law requires. Instead, 360.25 A2 says disclosure may be appropriate where, for example, the client is engaged in bribery, the issue threatens a regulated entity’s licence, it could disrupt the market in a listed company’s shares, the entity is likely to sell products harmful to health or safety, or the entity is promoting a scheme to help its clients evade tax. External factors also count (360.25 A3): whether there is an authority able to act, whether there is credible legal protection against liability or retaliation, and any threat to anyone’s physical safety.

Where you decide to disclose, R360.37 confirms that the disclosure is permitted under R114.3, the exception to confidentiality. You must act in good faith, be cautious in what you assert and consider whether to tell the client first. Disclosure is precluded where it would itself be unlawful (360.25 A1). In exceptional cases of an imminent breach causing substantial harm, R360.38 allows disclosure straight away. HMRC is a prescribed body for whistleblowing about the administration of UK taxes, and the HMRC Standard for Agents expects agents to report suspicions of tax fraud or evasion to HMRC where client confidentiality does not apply. For the wider position on confidential information, see confidentiality and when accountants can disclose.

How does this work in a typical case?

Illustration only. A firm prepares accounts and payroll for a small manufacturer. A bookkeeper notices that some staff appear to be paid in cash outside the payroll. The bookkeeper reports the suspicion to the firm’s MLRO, because unpaid PAYE and National Insurance would be criminal property. The MLRO decides whether to submit a report and advises what can be said to the client without tipping off. The engagement partner then raises the issue with the managing director, who is senior to the payroll manager involved, and advises the company to correct its payroll filings with HMRC. If the director refuses, the partner considers whether further action is needed and whether to cease acting, recording the options and the decision. The HMRC Standard for Agents warns that continuing to act for a client who will not correct inaccuracies could risk enabling tax evasion.

What mistakes do firms make?

  • Raising it with the wrong person. 360.11 A3 says the appropriate level of management is usually at least one level above those involved.
  • Resigning and doing nothing else. Disengagement does not discharge the public interest objective.
  • Forgetting the money laundering overlay. A conversation with the client before the MLRO has considered the facts can create tipping off risk.
  • Treating small clients as out of scope. The section applies to all clients; only clearly inconsequential issues are excluded.
  • Keeping no record. If a regulator or court later asks why you acted as you did, a contemporaneous note of the judgements made is the best evidence you have. Your engagement letter can also explain to clients that legal and professional reporting duties override confidentiality.

For how accountants who report wrongdoing are protected, see whistleblowing for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.