From suspicion to goAML report: the full journey
A suspicion has a route. It starts with a person on the front line, passes through your compliance officer and, where there are grounds to suspect, ends as a report to the UAE Financial Intelligence Unit (FIU) through goAML. The illustration shows who does what at each stage, where the decisions are made and where the records belong.
At a glance
- Three parties are involved: front-line staff, your compliance officer or MLRO, and the FIU.
- The test for filing is suspicion, or reasonable grounds to suspect. It is not proof.
- Every outcome needs a record, including a decision not to file.
- Never discuss a report, or a possible report, with the customer. This is called tipping off.
The seven steps from a concern on the front line to a goAML report, and who owns each one.
The detail, step by step
A concern is noticed
A member of staff, or a monitoring alert, sees something that does not add up. The concern does not need to be proven. It only needs to be raised.
- Activity that does not fit what you know about the customer.
- An explanation that does not hold together.
- Transactions arranged to stay below a limit.
It is raised internally
The concern goes to the compliance officer through an internal report form, with the facts as the person knows them. Staff should never need a manager's permission to do this, and managers should never discourage it.
The compliance officer logs it and gathers the file
The report is logged with a date and a reference. The officer pulls the relevant customer file, transactions and any earlier concerns, so the assessment rests on the full picture.
Grounds to suspect are assessed
The officer decides whether there are grounds to suspect, speaking to staff where needed and without alerting the customer. The assessment is proportionate: enough work to decide, not a full investigation.
The decision is recorded either way
If the officer files, the reasons are written down. If the officer decides not to file, the reasons are written down too, signed and dated. A recorded decision not to file shows that the process works. A concern that simply vanishes looks like one that was ignored.
The report is submitted through goAML
A good report lets a stranger follow it in two minutes. Choose the right report type: for example a suspicious transaction report for a transaction, a suspicious activity report for behaviour, and the sanctions-related reports where those apply. Check the FIU's current guidance for your sector.
- Who: the customer and connected parties, with identification details.
- What: the activity, with dates, amounts, accounts and counterparties.
- Why it is suspicious: the specific features that do not fit.
- What you did: checks made, explanations requested, decisions on the relationship.
- Supporting material: documents and records attached or referenced.
Follow-up, on both sides
The FIU may ask for more information, and you should respond fully and on time. Your compliance officer also considers whether the relationship should continue and what extra controls now apply, then keeps the report, its confirmation and the supporting file together for the period the rules require. Five years is commonly cited, but confirm the period that applies to you.
Mistakes to avoid
- Registering on goAML only when the first suspicion arrives.
- Leaving former employees with access, or having no authorised person available.
- Vague narratives such as “unusual activity noted”.
- Waiting for proof before filing.
- Choosing the wrong report type.
- Keeping no record of decisions not to file.
- Telling the customer, or anyone connected, about a report.
- Ignoring follow-up requests from the FIU.
Evidence to keep
- The internal report form, with date and reference.
- The log of concerns received and decisions taken.
- The compliance officer's assessment notes.
- The signed and dated decision, with reasons.
- The goAML submission confirmation.
- The supporting customer file and any follow-up correspondence.
Where Adventant can help
General information only, not legal or compliance advice. The examples and figures are invented for illustration. Your obligations depend on your activities and your regulator, so check the current rules that apply to you or speak to Adventant about your situation.