How to Build a Transaction Timeline for an STR Investigation in the UAE

When a business identifies potentially suspicious financial activity, reviewing a single transaction may not provide enough information to understand what happened. Several transactions that appear ordinary when viewed separately may reveal a concerning pattern when examined together.

A transaction timeline helps compliance teams organise financial activity chronologically and understand how transactions relate to one another. It can show when activity began, how money moved between accounts, which individuals or entities were involved and what changes occurred during the period under review.

For UAE reporting entities, a clear transaction timeline can support an internal suspicious transaction investigation and help explain relevant facts when preparing a Suspicious Transaction Report (STR) through the goAML platform.

The UAE Central Bank's guidance on suspicious transaction reporting highlights the importance of explaining the nature of suspicious activity, the movement of funds and the individual transactions involved. A well-organised timeline can help present these details clearly.

This guide explains how to build a transaction timeline for an STR investigation in the UAE, organise supporting evidence and identify relationships between transactions without making unsupported assumptions.

What Is a Transaction Timeline in an STR Investigation?

A transaction timeline is a chronological record of financial transactions and related events relevant to a suspicious activity investigation.

It arranges information by date and time so that investigators can understand the sequence of events rather than reviewing transactions as isolated entries.

Depending on the case, a timeline may include:

The date and time of each transaction.
The amount and currency involved.
The sending and receiving accounts.
The originator, beneficiary and relevant counterparties.
The transaction channel or payment method.
The stated purpose of the transaction.
Related customer activity or account events.
Supporting documents and investigation findings.
The reason a particular event may be relevant to the investigation.

A timeline is an investigative tool, not proof of criminal activity by itself. Its purpose is to organise verified facts and highlight questions that require further examination.

Why Is a Transaction Timeline Important Before Filing an STR?

A transaction timeline helps compliance officers understand the history and context of potentially suspicious activity. It also makes it easier to explain the basis for suspicion in a clear and logical manner.

1. Identifying Patterns Across Multiple Transactions

A transaction may not appear unusual on its own. However, a series of transfers involving similar amounts, multiple counterparties or repeated movements between accounts may require closer examination.

A timeline allows investigators to identify the frequency, sequence and relationships between transactions.

2. Understanding the Movement of Funds

Tracing the movement of funds can help establish where money originated, which accounts received it and whether it was subsequently transferred elsewhere.

The timeline should distinguish confirmed movements from suspected connections. If information about an external account or beneficiary is unavailable, that limitation should be recorded rather than filled with assumptions.

3. Comparing Activity With the Customer Profile

Compliance teams can compare observed activity with the customer's expected business activity, known source of funds, occupation, business model and available customer due diligence information.

A significant change in transaction behaviour may require further investigation, particularly when the explanation provided does not adequately account for the activity.

4. Supporting a Clear STR Narrative

A chronological record helps investigators explain what happened, when it happened and why the sequence of transactions raised concerns.

This can reduce confusion, prevent important events from being overlooked and help the receiving authority understand the reported activity.

For a broader explanation of reporting requirements, see our guide to STR Reporting in the UAE.

How to Build a Transaction Timeline Step by Step

Step 1: Define the Investigation Period

Start by identifying the period relevant to the alert or suspicious activity.

Record the earliest known transaction or event that appears relevant and the latest event reviewed. The investigation period may need to expand if earlier or later activity provides important context.

For example, a transfer identified in September may be connected to earlier payments made in July and August. Reviewing only the September transaction could leave the broader pattern unexplained.

Document why the selected period was used and note any limitations in the available data.

Step 2: Collect the Relevant Transaction Data

Gather available records from the systems and sources relevant to the investigation.

Depending on the case, these may include account statements, transaction monitoring alerts, payment records, invoices, contracts, customer due diligence information, communications and supporting business documents.

Capture the original transaction references wherever possible. This makes it easier to trace each timeline entry back to its source.

Check that the information is sufficiently complete to establish the transaction date, amount, currency, counterparties and payment details. If a field is missing or unverified, identify it clearly.

Step 3: Arrange Transactions Chronologically

Sort the relevant transactions by date and, where available, time.

Each entry should describe what occurred without adding unsupported conclusions. Include the transaction reference, amount, currency, originator, beneficiary, payment method and any relevant explanation.

For transactions occurring on the same date, use timestamps where available. If the timestamps use different time zones or the source systems apply different time conventions, record the relevant basis so that the sequence is not misleading.

Do not change original records simply to make the timeline easier to read. Preserve the source information and explain any normalisation applied to the working timeline.

Step 4: Identify Relationships Between Transactions

Once the events are arranged, examine whether the transactions appear connected.

Potential connections may include:

Transfers between accounts linked to the same customer or business.
Payments involving recurring counterparties.
Funds received and transferred onward within a short period.
Transactions that collectively relate to the same invoice, contract or business purpose.
Repeated transfers that differ from the customer's historical activity.
Payments for which the stated purpose does not appear consistent with the available evidence.

These indicators do not automatically establish wrongdoing. Investigators should assess the customer's profile, available documentation, commercial context and other relevant information before reaching a conclusion.

Step 5: Trace the Flow of Funds

Where the information is available, record the movement of funds from the originating account through intermediary accounts to the final known destination.

For each movement, document the transaction reference, amount, date, sender, recipient and supporting evidence.

If multiple transfers occur, explain how they relate to one another. For example, a receipt of AED 80,000 followed by two outgoing transfers may be relevant if the timing, amounts and counterparties suggest a connection.

Do not assume that the outgoing transfers came from the original funds unless the available account records support that conclusion. Where funds are pooled or mixed with other balances, describe the limitation.

Step 6: Compare Transactions With the Customer's Expected Activity

Review the timeline alongside available customer due diligence information and the customer's known business or personal activity.

Questions may include:

Does the transaction volume correspond with the customer's expected activity?
Are the amounts and frequency consistent with the stated purpose?
Are the counterparties relevant to the customer's business?
Has the customer's activity changed significantly?
Do invoices, contracts or other documents support the explanation provided?
Are there unexplained gaps or inconsistencies in the transaction sequence?

Document both the information that supports the customer's explanation and the information that remains unexplained. A balanced investigation should not ignore relevant evidence simply because it does not support the initial concern.

Step 7: Link Each Event to Supporting Evidence

Every material timeline entry should be traceable to a reliable source.

Supporting evidence may include transaction records, bank statements, invoices, contracts, customer records, internal communications and relevant investigation notes.

Use consistent references to connect the timeline entries with the underlying evidence. This enables an authorised reviewer to verify the facts without searching through unrelated files.

If a document is unavailable, record that limitation and any steps taken to obtain or verify the information.

Step 8: Document the Findings and Outstanding Questions

After arranging the events, prepare a concise explanation of the pattern identified.

Separate confirmed facts from analytical observations and unresolved questions. Explain why the sequence of transactions may be relevant and whether the available information supports or contradicts the stated purpose.

The findings should help the designated compliance officer assess whether the activity meets the applicable reporting threshold.

The investigation must not create unnecessary delays to a required report. UAE rules require suspicious transactions to be reported without delay when the applicable reporting threshold is met. The timeline supports the decision; it should not become a reason to postpone required reporting.

Example of a Transaction Timeline

Consider a hypothetical UAE business that receives payments from several counterparties and transfers funds to another company shortly afterwards.

The following example illustrates how an investigator might organise the available information. It does not represent a real case or establish that the activity is criminal.

Event 1 — 3 September: The business receives AED 45,000 from Customer A. The payment reference states that it relates to a service invoice.

Event 2 — 4 September: The business receives AED 42,000 from Customer B. The invoice and commercial purpose require verification.

Event 3 — 5 September: The business transfers AED 70,000 to Company C. The investigator records the transfer reference and reviews the relationship between the parties.

Event 4 — 6 September: The remaining account activity is reviewed alongside the business's expected transaction profile and supporting documents.

The investigator would then examine whether the receipts and outgoing transfer are connected, whether the stated business purpose is supported by evidence and whether the overall activity is consistent with the customer's profile.

The investigation should not assume that the incoming funds directly financed the outgoing payment unless the records support that conclusion. Any unresolved questions should be documented and assessed by the compliance officer.

Common Mistakes When Preparing a Transaction Timeline

Including Transactions Without Explaining Their Relevance

Adding large amounts of unrelated account activity can make an investigation difficult to follow. Include relevant transactions and explain why each event matters to the case.

Leaving Out Important Counterparty Information

Missing sender or beneficiary details can make it difficult to understand the movement of funds. Capture available identifying information and clearly mark information that could not be verified.

Mixing Facts With Assumptions

A timeline should not describe a transaction as criminal simply because it appears unusual. Record the facts, explain the concern and identify the evidence supporting the assessment.

Ignoring the Customer's Explanation

An investigation should consider available explanations and supporting documents. If the explanation is inconsistent or incomplete, document the specific gaps rather than simply dismissing it.

Using Inconsistent Dates, Amounts or Currencies

Inconsistent formats can create confusion and affect the interpretation of the transaction sequence. Apply consistent presentation standards while preserving the original source records and noting any currency conversions.

Delaying a Required STR

A timeline can improve the quality of an investigation, but it should not delay a report when the applicable threshold has been met. Follow the reporting procedures and deadlines relevant to the entity and case.

How Does a Transaction Timeline Support goAML Reporting?

A transaction timeline can help a reporting entity prepare a clear and coherent STR narrative by organising the underlying events before the report is completed.

The narrative should explain the relevant activity, the parties involved, the sequence of transactions and the grounds for suspicion. It should focus on material facts and provide enough context for the receiving authority to understand the concern.

The timeline can also help the compliance officer identify which supporting documents are available and whether further information is needed. Where additional information is unavailable, the limitation should be accurately described.

The timeline is an internal investigative aid. It does not replace the required goAML fields, reporting procedures or the entity's responsibility to select the appropriate report type.

For practical guidance on the submission process, read How to File an STR Through goAML in the UAE.

Frequently Asked Questions

1. What is a transaction timeline for an STR?

It is a chronological record of transactions and related events used to understand potentially suspicious activity. It helps investigators explain the sequence of events, identify relevant connections and organise supporting evidence.

2. What information should an STR transaction timeline include?

It should include relevant transaction dates, amounts, currencies, originators, beneficiaries, account or transaction references, payment methods, supporting documents and material investigation findings. The information included should reflect the facts available in the specific case.

3. Is a transaction timeline mandatory for every STR in the UAE?

A separate document titled “transaction timeline” is not necessarily required in every case. However, applicable reporting guidance expects reporting entities to provide a clear account of the relevant suspicious activity and its chronology. A timeline can be a useful way to prepare that information.

4. Can multiple transactions be included in one STR?

Related transactions may be explained together where appropriate under the applicable reporting procedures and goAML requirements. The reporting entity should ensure that the relevant transactions, parties and reasons for suspicion are clearly explained and that the correct report type is selected.

5. Should a timeline include transactions that appear legitimate?

Relevant transactions may need to be included to provide context, explain normal customer activity or show how the suspicious pattern developed. The investigator should distinguish routine activity from events that raise concerns and explain why the selected transactions matter.

6. Should a business wait until the timeline is complete before filing an STR?

No. The preparation of a timeline should not delay reporting when the applicable threshold has been met. Follow the relevant UAE reporting requirements and internal escalation procedures, and document any further investigation separately where appropriate.

Conclusion

A well-prepared transaction timeline helps UAE compliance teams understand potentially suspicious activity by organising transactions into a clear sequence. It can reveal relationships between payments, support the review of fund movements and make the grounds for suspicion easier to explain.

To prepare a reliable timeline, use verified source records, maintain consistent transaction details, document the relationship between relevant events and distinguish facts from assumptions. Link each material entry to its supporting evidence and record any important information gaps.

When used as part of a risk-based investigation process, a transaction timeline can improve the quality of internal reviews and help reporting entities prepare clearer STR narratives through goAML.