Financial institutions and DNFBPs must report to the UAE Financial Intelligence Unit through goAML, without delay, any transaction or attempted transaction they suspect or have reasonable grounds to suspect relates to the proceeds of crime, terrorist financing or proliferation financing. The MLRO decides, records the reasoning either way, and nobody tells the customer. Tipping off is an offence under the Decree-Law.
The obligation
Under Federal Decree-Law No. 10 of 2025 and its Executive Regulations, financial institutions and designated non-financial businesses and professions must report to the Financial Intelligence Unit, without delay, any transaction, attempted transaction or funds that they suspect or have reasonable grounds to suspect are connected to the proceeds of crime, the financing of terrorism or the financing of proliferation. The threshold is suspicion, not knowledge and not proof. The report is made whether or not the transaction proceeds and whatever its amount. Sector rulebooks add internal escalation and record-keeping requirements but do not change the test.
goAML
All reports are filed through the Financial Intelligence Unit's goAML portal. Access requires registration, which begins with pre-registration on the SACM portal using the firm's licence and the compliance officer's or MLRO's identity documents. The registered user files reports, receives feedback and responds to Financial Intelligence Unit requests through the same system. Report types include the suspicious transaction report, the suspicious activity report for conduct without a completed transaction, and specific templates such as the high-risk jurisdiction reports that the Ministry of Economy and Tourism's Circular No. 2 of 2026 requires DNFBPs to use for activity linked to FATF call-for-action countries. Filing under the wrong template is a recurring inspection finding.
The decision
An alert from transaction monitoring, a screening hit, a front-line concern or a media report reaches the MLRO as an internal escalation. The MLRO investigates: the customer file, the transaction pattern, the explanation offered, open-source checks and, for virtual assets, the on-chain trail. The question at the end is binary: is there suspicion or reasonable grounds for it? If yes, file. If no, record why not. The record of a reasoned decision not to report is the MLRO's protection; an alert closed with no reasoning is an unreported suspicion in an inspector's eyes.
Common errors: treating a plausible explanation from the customer as resolving suspicion without verifying it; waiting for a second event before reporting the first; declining to report because the amount is small; and reporting defensively on every alert so the register shows activity, which dilutes the real reports and tells the Financial Intelligence Unit the firm cannot distinguish.
After filing
The firm continues to monitor the relationship and files further reports on new suspicious activity. Whether to exit the relationship is a separate risk decision, made in a way that does not reveal the report. The Financial Intelligence Unit may request further information, which must be provided within the time it sets, and may instruct that a transaction be held. The report and the underlying analysis are retained for the statutory period.
Tipping off
It is an offence under the Decree-Law to disclose to the customer or any third party that a report has been or may be made, or that an investigation is underway. The offence catches the obvious disclosure and the indirect one: a relationship manager who tells the customer "compliance has flagged this", a decline letter that gives the real reason, or an exit that is explained by reference to the report. Front-line staff must have scripted responses that are truthful without being revealing, and the MLRO's communications must be confined to those who need to know.
Where we come in
We give MLROs a second opinion on the hard cases, document the reasoning so it survives inspection, draft the firm's escalation and reporting procedure, train front-line staff on tipping off, and handle Financial Intelligence Unit and regulator correspondence that follows a report. See the AML compliance practice page and our note on MLRO support.
Frequently asked questions
What is the threshold for filing an STR in the UAE?
Suspicion or reasonable grounds to suspect that a transaction, attempted transaction or funds relate to the proceeds of crime, terrorist financing or proliferation financing. Proof is not required and there is no minimum amount. The report must be filed without delay through goAML.
How do we register on goAML?
Pre-register on the Financial Intelligence Unit's SACM portal with the firm's trade licence and the MLRO's or compliance officer's identity documents, then complete the goAML registration. The MLRO is usually the registered user who files reports and receives Financial Intelligence Unit requests.
Is it an offence to tell a customer that we filed an STR?
Yes. Tipping off is a criminal offence under Federal Decree-Law No. 10 of 2025. It covers direct disclosure and indirect disclosure, such as explaining a decline or an account closure by reference to a compliance report.
Should we record decisions not to file a report?
Yes, with the same care as a decision to file. The reasoned record of why an alert did not amount to suspicion is the MLRO's protection on inspection. An alert closed without reasoning reads as an unreported suspicion.
Which goAML template do DNFBPs use for FATF black-list activity?
The Ministry of Economy and Tourism's Circular No. 2 of 2026 directs DNFBPs to use the goAML high-risk jurisdiction and high-risk jurisdiction activity report templates for activity linked to countries on the FATF call-for-action list.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
