goAML Reporting in the UAE: STRs, SARs and Common Mistakes

What goAML reporting covers

goAML is the reporting system run by the UAE Financial Intelligence Unit. Regulated businesses use it to send the FIU the reports the law and supervisory guidance require. Financial institutions report through it, and so do designated non-financial businesses and professions such as real estate agents, dealers in precious metals and stones, company service providers, accountants, auditors and legal professionals, together with other categories such as virtual asset service providers.

This article is about reporting: choosing the right report, deciding when to file and writing a report that stands up to review. Registration has to be in place first. If your business is not registered yet, or your users are out of date, start with our goAML registration guide.

The reports you may need to file

goAML supports several report types. Which ones are open to you depends on your type of entity, so confirm against the FIU's current guidance for your sector. The table lists those most commonly discussed and what each is for.

The thresholds and conditions attached to the sector-specific reports are set out in official guidance and can change. Build the current rules into your procedure and check them periodically, rather than relying on memory.

Choosing the right report type

• A transaction or an attempt: if the concern centres on a payment, transfer or purchase, including one that was attempted or declined, it is usually an STR.
• Behaviour without a transaction: if the concern is about conduct, such as a customer who walks away when asked for source of funds, or information that does not add up before any money moves, it is usually a SAR.
• A sanctions match: CNMR and PNMR cover the UAE Local Terrorist List and the UN Consolidated List only. A hit on another list, such as OFAC, EU or UK lists, is handled under your own sanctions policy, and you then consider separately whether it gives grounds for a suspicion report.
• A sector report: REAR and DPMSR are triggered by the defined conditions for your sector, not by suspicion. Meeting the conditions means filing, even when nothing looks wrong.
• Not sure: record the facts, the options you considered and why you chose one, and check the FIU's current guidance. A reasoned choice is easier to defend than a guess.

When to file a suspicion report

The test is suspicion, or reasonable grounds to suspect, not proof. You are not expected to investigate a customer, establish that a crime has happened or be certain. You are expected to notice that something does not add up, to look at it with proportionate care and to report promptly if it still concerns you. Waiting for certainty is a common reason reports are late.

Staff should know that they can raise a concern internally without needing a manager's permission, and managers should never discourage a report. The compliance officer then assesses the concern, decides whether to file and records the reasoning either way. The law prohibits tipping off, which means warning the customer, or anyone connected, that a report has been made or is being considered. Check the precise wording and exceptions with your adviser or supervisor, and make sure every member of staff understands the basic rule: do not discuss it with the customer.

What a good report contains

The FIU receives a great many reports. The ones that help are specific, coherent and supported. Structure your narrative so a stranger can follow it in two minutes.

1. Who: the customer and any connected parties, with identification details and their relationship to your business.
2. What: the activity or transaction in question, including dates, amounts, currencies, accounts and counterparties.
3. Why it is suspicious: the specific features that do not fit, such as activity inconsistent with the customer's profile, an explanation that does not hold, or structuring to avoid thresholds.
4. What you did: checks already made, explanations requested and any decision about the relationship.
5. Supporting material: the documents and records that back the narrative, attached or referenced.

Avoid vague wording such as “unusual activity noted”. Say what was unusual and why it matters. Equally, avoid padding the report with every fact you hold. Clear, relevant detail is more useful than volume.

From alert to report: a process that works

1. A member of staff or a monitoring alert raises a concern through an internal report form, with the facts as they know them.
2. The compliance officer logs it with a date and reference and gathers the relevant file.
3. The officer assesses whether there are grounds to suspect, speaking to staff where needed, and without alerting the customer.
4. The decision to file or not to file is recorded with its reasoning, signed and dated.
5. If filing, the report is completed and submitted promptly through goAML and the confirmation is kept.
6. The officer considers whether the relationship should continue and what extra controls apply, then follows up on any request from the FIU.

Step four is the one most often missing. A recorded decision not to file, with clear reasons, is evidence that your process works. A concern that vanished without a record looks, to a reviewer, like a concern that was ignored.

A final check before you submit

• Could someone outside your business follow the narrative without calling you?
• Do the dates, amounts and names match your own records exactly?
• Is it the right report type for what you found?
• Are the supporting documents attached or clearly referenced?
• Is the decision record signed and dated, and kept with the file?
• Has knowledge of the report stayed with the people who need to know?

Mistakes that cause trouble

• No working access. If nobody can log in when a suspicion arises, the report is late before it starts. Keep users current, as set out in the registration guide.
• Vague narratives. A report that cannot be understood without calling you is a weak report.
• Waiting for proof. Suspicion is the test. Delay can itself become the problem.
• Choosing the wrong report type. Know the difference between a transaction-based and an activity-based suspicion, and between a confirmed and a partial sanctions match.
• No record of decisions not to file. You cannot show your reasoning later if you did not write it down.
• Telling the customer. Never discuss a report or a possible report with the person concerned.
• Ignoring follow-up requests. If the FIU asks for more information, respond fully and on time.

Records and ongoing quality

Keep each report, its confirmation and the supporting file together, for at least as long as the rules require. Five years is commonly cited, but confirm the period that applies to you. Keep a simple log of internal reports received, decisions taken and reports filed, with dates, so you can show your volumes and your turnaround times. Review the log every quarter. A sudden rise or fall in internal reports can reveal a training gap or a process problem.

Run a short test once or twice a year. Pick a hypothetical concern, walk it through your process with the people involved and see where it stalls. It takes an hour and reveals more than reading the procedure.

Where Adventant fits

Adventant supports goAML registration and regulatory reporting, including designing the internal escalation process and helping compliance officers choose the right report and structure it. Where alert volumes are the challenge, our operational outsourcing service can help review and record alerts. Use the form below to tell us what you need. This article is general information, not legal advice, and reporting requirements change, so always check current guidance from the FIU, the EOCN and your supervisor.

About the author

Rajesh Kumar

Director and Founder, Adventant · ADGM-Approved MLRO · Ex-Standard Chartered (25+ years)

Helping banks and fintechs strengthen AML, financial crime, risk and regulatory compliance.

Connect on LinkedIn