FIU Reporting UAE: Complete Guide

FIU reporting in the UAE is an important part of the country’s Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and related financial-crime compliance framework. The UAE Financial Intelligence Unit (UAE FIU) receives and analyses financial intelligence and suspicious transaction information submitted by reporting entities. For businesses that are required to report, the goAML platform is the primary electronic system used to submit suspicious transaction and activity reports. For Designated Non-Financial Businesses and Professions (DNFBPs), understanding when to report, which report type to use and how to prepare an effective submission is essential. A business should also have internal procedures for identifying suspicious activity, escalating concerns to its Compliance Officer or MLRO and maintaining appropriate records.

What Is the UAE Financial Intelligence Unit?

The Financial Intelligence Unit (FIU) is the UAE’s central national centre for receiving, analysing and disseminating financial intelligence relating to suspected money laundering, terrorist financing and related financial crimes. The FIU works with reporting entities and relevant authorities to identify financial crime risks and support the investigation and prevention of financial crime. Businesses subject to reporting requirements provide relevant information to the FIU through the prescribed reporting channels, including goAML. The UAE FIU’s goAML system is designed to allow reporting entities to register and submit suspicious reports.

What Is FIU Reporting in the UAE?

FIU reporting UAE refers to the process through which reporting entities provide information about suspicious transactions, suspicious activities and other applicable matters to the UAE Financial Intelligence Unit. For relevant DNFBPs, the main reports used for new suspicions are: Suspicious Transaction Report (STR) Suspicious Activity Report (SAR) Other reports can be used when the FIU requests additional information or when specific reporting requirements apply. The UAE’s current DNFBP guidance identifies STRs and SARs as the primary report types for new suspicions.

Who Needs to Report to the UAE FIU?

FIU reporting obligations depend on the nature of the business and its regulatory classification. Relevant DNFBP sectors can include: Real estate brokers and agents Dealers in precious metals and precious stones Independent accountants Auditors Trust and company service providers The UAE Ministry of Economy & Tourism provides sector-specific AML/CFT guidance and reporting resources for these businesses. Financial institutions and other reporting entities supervised by different UAE authorities can also have FIU reporting obligations under the applicable regulatory framework. Therefore, a business should determine its reporting obligations based on its actual activities and supervisory authority rather than assuming that every UAE company follows the same process.

What Is goAML?

goAML is the electronic reporting platform used by the UAE Financial Intelligence Unit for applicable suspicious transaction and activity reporting. The UAE FIU’s registration portal states that reporting entities use goAML to file Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). The Ministry of Economy & Tourism also provides goAML registration and submission guidance for DNFBPs. For a business subject to the reporting requirement, goAML is therefore an important part of its AML/CFT compliance framework.

Is goAML Registration Required Before FIU Reporting?

For reporting entities that are required to use goAML, registration needs to be completed so the organisation can access the reporting system. The UAE FIU’s registration guidance explains that accountable and reporting entities use the goAML registration process to obtain access to the reporting platform and submit suspicious reports. The current Ministry guidance provides a registration process that includes pre-registration, authentication and organisation registration before the reporting entity can use the system.

What Is an STR?

STR stands for Suspicious Transaction Report. A relevant DNFBP should submit an STR when it suspects that a transaction may be connected with: Money laundering A predicate offence Terrorist financing Illegal organisations or financing The UAE’s current DNFBP guidance states that an STR applies where the relevant suspicion arises during the establishment or course of a business relationship or while carrying out a transaction for a customer or occasional customer.

What Is a SAR?

SAR stands for Suspicious Activity Report. A SAR is used when a DNFBP suspects that an activity or attempted transaction that was not completed may be linked to money laundering, predicate offences, terrorist financing or illegal financing. The current UAE guidance distinguishes SARs from STRs based on the nature of the suspicious conduct.

STR vs SAR: What Is the Difference?

Report Main purpose STR Reporting a suspicious transaction SAR Reporting suspicious activity or an attempted transaction AIF Providing additional information without transaction details AIFT Providing additional information that includes transaction details RFI Responding to a Request for Information HRC Applicable high-risk-country transaction reporting

The appropriate report type should be selected based on the circumstances and the requirements applicable to the reporting entity.

What Are the Common Reasons for FIU Reporting?

A business may identify potential suspicion through different AML red flags. Examples include: Transactions inconsistent with the customer’s profile Unexplained third-party payments Unusual cash activity Unnecessarily complex transactions Unclear economic purpose Unexplained source of funds Difficulty identifying the beneficial owner False or misleading documents Unexplained changes in ownership Sudden changes in business activity Exposure to high-risk jurisdictions Transactions inconsistent with the customer’s expected activity A red flag does not automatically mean that a report must be filed. The business should investigate the circumstances and assess the customer’s overall risk. The UAE’s current DNFBP guidance states that potentially suspicious indicators may require internal investigation, but the investigation should begin immediately and continue without unnecessary interruption until the matter is appropriately reported where required.

How Does the FIU Reporting Process Work?

A typical internal FIU reporting process can involve the following stages.

Identify Suspicious Activity

An employee, Compliance Officer or monitoring system identifies unusual activity or an AML red flag.

Review Customer Information

The business reviews relevant KYC, CDD, UBO and customer-risk information.

Investigate the Activity

The Compliance Officer or MLRO examines the transaction, parties involved, purpose, source and destination of funds and other relevant information.

Determine Whether Suspicion Exists

The MLRO assesses whether there are reasonable grounds for suspicion based on the available information.

Select the Appropriate Report

Where reporting is required, the appropriate report type is selected, such as an STR or SAR.

Submit Through goAML

The report is submitted through the UAE FIU’s goAML platform.

Maintain Records

The business should retain appropriate records relating to the investigation, decision-making and report.

What Information Should Be Included in an FIU Report?

A report should provide sufficient information for the FIU to understand the activity and the reason for suspicion. Depending on the circumstances, this can include: Customer identification information Beneficial ownership information Transaction details Dates Amounts Parties involved Source of funds Destination of funds Relevant jurisdictions Suspicious indicators Reason for suspicion Supporting information Actions taken by the business The UAE’s goAML reporting guidance provides a structured approach for submitting reports and defines the information that may be required for different report types.

How to Write an Effective FIU Report Narrative

The narrative should explain the facts clearly rather than simply stating that a transaction is “suspicious.” A useful report should answer: Who? Who are the customer and other relevant parties? What? What transaction or activity occurred? When? When did the activity take place? Where? Where did the funds originate and where were they sent? Why? Why does the activity create suspicion? How? How was the transaction or activity structured? What happened next? What action did the business take? The narrative should be factual, clear and supported by the information available to the reporting entity.

What Is the Role of the MLRO in FIU Reporting?

The Money Laundering Reporting Officer (MLRO) or Compliance Officer has an important role in the internal reporting process. The MLRO may be responsible for: Reviewing AML alerts Assessing customer risk Investigating suspicious activity Reviewing KYC and CDD information Assessing source of funds Reviewing beneficial ownership Deciding whether an STR or SAR is required Submitting applicable reports through goAML Responding to FIU information requests Maintaining reporting records The current UAE DNFBP guidance expects relevant Compliance Officers and MLROs using goAML to understand the different report types and select the appropriate report when submitting information.

What Happens After an STR or SAR Is Submitted?

Submitting an STR or SAR does not necessarily mean the reporting relationship ends immediately. The FIU may request additional information while assessing the report. The current DNFBP guidance identifies several mechanisms for providing additional information through goAML. AIF Additional Information File without Transactions is used when the FIU requests additional information that does not contain transaction details. AIFT Additional Information File with Transactions is used when additional information requested by the FIU includes transaction details. RFI Request for Information reports are used when the FIU requests information from reporting entities. The relevant report should reference the original report where required.

What Is an RFI From the UAE FIU?

RFI means Request for Information. The FIU may send a request through the goAML Message Board when additional information is required. A business receiving an RFI should: Review the request carefully Identify the information requested Gather relevant records Coordinate with the Compliance Officer or MLRO Submit the required response through goAML Maintain evidence of the response The current DNFBP guidance states that RFIs can be issued to multiple DNFBPs, not only the entity that originally submitted an STR or SAR.

What Is High-Risk Country Reporting?

Geographic risk is an important part of AML/CFT compliance. Where applicable requirements are triggered by transactions involving high-risk countries or jurisdictions, reporting entities may have additional reporting obligations. The UAE Ministry of Economy & Tourism publishes updates concerning high-risk jurisdictions and applicable AML/CFT measures. Businesses should therefore ensure that their geographic-risk procedures are regularly updated.

FIU Reporting for Real Estate Businesses

Real estate brokers and agents can face specific AML risks because property transactions can involve high-value assets, international customers and complex ownership structures. Potential red flags include: Property purchases inconsistent with customer wealth Unexplained third-party payments Unusual cash payments Complex ownership structures High-risk jurisdictions Rapid transactions without an obvious commercial purpose Unclear source of funds The Ministry provides dedicated AML/CFT red flags and reporting resources for real estate brokers and agents.

FIU Reporting for Precious Metals and Stones Businesses

Dealers in precious metals and stones may face risks associated with high-value and easily transferable assets. Potential concerns include: Large unexplained purchases Unusual cash activity Third-party payments Transactions inconsistent with the customer’s profile Unexplained geographic exposure Customers refusing required information The Ministry provides sector-specific AML/CFT guidance and red flags for dealers in precious metals and precious stones.

FIU Reporting for Accountants and Auditors

Accountants and auditors may encounter complex corporate structures and financial arrangements. Potential concerns can include: Unclear beneficial ownership Unexplained financial structures Transactions without a clear economic purpose Unusual third-party arrangements Inconsistent customer information Sudden changes in business activity The Ministry provides specific AML resources for independent accountants and auditors.

FIU Reporting for Company Service Providers

Trust and company service providers can encounter AML risks through their involvement in corporate structures and company formation. Potential indicators can include: Complex ownership structures Difficulty identifying the UBO Unexplained nominee arrangements Companies with no apparent commercial purpose Frequent ownership changes Multiple jurisdictions with no clear business reason These risks should be incorporated into the company’s customer due diligence and risk-assessment procedures.

Confidentiality and Tipping Off

Confidentiality is an important part of FIU reporting. A business should not disclose the existence or contents of a suspicious transaction or activity report to the customer or another unauthorised person where doing so would constitute prohibited tipping off. Employees should therefore understand: Who can access STR/SAR information How investigations should be documented Who can communicate with customers How confidential reporting information should be stored When information can be shared internally The UAE’s AML/CFT guidance addresses confidentiality and tipping-off requirements associated with suspicious transaction reporting.

Common FIU Reporting Mistakes

Filing Without Proper Investigation

A red flag should be assessed in context. Businesses should have documented internal procedures for investigation and escalation.

Providing an Unclear Narrative

The report should explain why the activity is suspicious rather than simply describing the transaction.

Choosing the Wrong Report Type

Compliance teams should understand the differences between STR, SAR, AIF, AIFT and RFI reports.

Ignoring FIU Requests

Businesses should monitor their goAML Message Board and respond to applicable requests for additional information.

Poor Record Keeping

The business should maintain appropriate documentation supporting its investigation and reporting decisions.

Breaching Confidentiality

Employees should understand tipping-off restrictions and handle STR/SAR information carefully.

FIU Reporting UAE Compliance Checklist

Businesses subject to applicable reporting requirements should consider whether they have: Completed applicable goAML registration Appointed a Compliance Officer/MLRO AML/CFT risk assessment Customer risk classification KYC procedures CDD procedures UBO verification Transaction monitoring Suspicious activity escalation procedures STR/SAR reporting procedures goAML access Staff AML training Confidentiality procedures Record-keeping procedures RFI response procedures High-risk-country monitoring

Final Thoughts

FIU reporting UAE is a fundamental part of the country’s AML/CFT framework for businesses subject to reporting obligations. For relevant DNFBPs, effective reporting requires more than having a goAML account. Businesses need a structured process for identifying red flags, reviewing customer information, investigating suspicious activity and escalating matters to the MLRO or Compliance Officer. The UAE’s current guidance identifies STRs and SARs as the primary reports for new suspicions, while AIF, AIFT and RFI mechanisms can be used when additional information is required. Businesses should also understand their confidentiality obligations, maintain appropriate records and ensure that their compliance team can respond to requests from the FIU. For companies operating in regulated sectors, FIU reporting should therefore be treated as part of an ongoing AML/CFT programme covering KYC, CDD, UBO verification, risk assessment, transaction monitoring, sanctions screening, MLRO oversight and goAML reporting.

Frequently Asked Questions

What is FIU reporting in the UAE?

FIU reporting is the process through which applicable reporting entities provide suspicious transaction, suspicious activity and other required information to the UAE Financial Intelligence Unit.

What is the UAE FIU?

The UAE Financial Intelligence Unit is the country’s financial intelligence authority responsible for receiving and analysing financial information relating to suspected financial crime.

Is FIU reporting done through goAML?

For applicable reporting entities, suspicious reports are submitted through the UAE FIU’s goAML platform. The FIU’s portal provides access for reporting entities to file STRs and SARs.

What is an STR?

An STR, or Suspicious Transaction Report, is used to report a suspicious transaction that may be connected with money laundering, a predicate offence, terrorist financing or illegal financing.

What is a SAR?

A SAR, or Suspicious Activity Report, is used for applicable suspicious activity or attempted transactions.

Who is responsible for FIU reporting?

The Compliance Officer or MLRO generally manages the internal suspicious reporting process and applicable submissions through goAML.

What happens if the FIU requests additional information?

The reporting entity may receive an AIF, AIFT or RFI request through goAML and should provide the requested information through the appropriate reporting mechanism.

Do all UAE companies need to submit FIU reports?

No. Reporting obligations depend on the business activity, regulatory classification and applicable AML/CFT requirements.

Can a business tell a customer that an STR was filed?

Businesses must comply with applicable confidentiality and tipping-off restrictions. STR/SAR information should not be disclosed to customers or unauthorised persons where prohibited.

Is FIU reporting the same as goAML registration?

No. goAML registration provides the reporting entity with access to the reporting platform, while FIU reporting refers to the submission of applicable reports and information to the FIU.

Why is FIU reporting important for DNFBPs?

It provides the formal reporting mechanism through which relevant DNFBPs can communicate suspicious transactions and activities to the UAE FIU and meet their applicable AML/CFT reporting obligations.