goAML reporting

STR and SAR filing on goAML: a practical guide for UAE DNFBPs

“Without delay” is the whole rule. Here is what that means in practice, which report you file for which situation, and what a filing has to hold up to look like afterwards.

groAML compliance team Grovisor Business Consultants FZE
Published Updated 10 min read

Checked against the Central Bank Rulebook's goAML reporting guidance and the Ministry of Economy's STR/SAR red-flag indicator guidance

On this page

At a glance

  • goAML is the UAE FIU's reporting platform. DNFBPs register and file directly on it, not through an intermediary.
  • An STR covers a transaction — completed, attempted or ongoing. An SAR covers suspicious activity or behaviour that isn't tied to one specific transaction.
  • “Reasonable grounds to suspect” is the trigger, not proof. Waiting for certainty before filing is itself a compliance failure.
  • “Without delay” has no fixed day-count in the law. Treat same-day filing as your internal goal, and be ready to explain to your supervisor any gap between forming a suspicion and filing.
  • Filing late or not at all can be an offence under UAE federal AML law, with criminal and administrative consequences. Confirm the current penalties with your supervisory authority or a UAE-qualified adviser.
Who this is for:Real estate brokers and agentsDealers in precious metals and stonesCorporate service providersAuditors and accountantsLawyers and notaries

What goAML actually is

goAML is the reporting platform run by the UAE's Financial Intelligence Unit (the FIU, part of the Central Bank of the UAE). It is not a form you fill in and email somewhere — it is the designated electronic channel. Financial institutions, DNFBPs and VASPs register directly on it and file every suspicion-based report through it, which is also how the FIU receives, triages and acts on reports across the whole regulated sector in one system.

Registration comes first You cannot file a report you haven't set up an account for. Registering on goAML, and keeping that registration current (correct compliance-officer contact, correct entity details), is itself a compliance obligation, not just plumbing.

STR vs SAR: the real difference

These two get used almost interchangeably in conversation, but they cover different things:

ReportCoversExample
STR (Suspicious Transaction Report)A specific transaction — completed, ongoing or attempted — that you suspect involves proceeds of crime or lacks an apparent lawful or economic purposeA property buyer insists on paying 80% in cash with no plausible source, then the deal falls through when you ask for documentation
SAR (Suspicious Activity Report)Suspicious behaviour or circumstances that aren't tied to one transaction — customer conduct, attempted misuse of your services, or adverse information you receiveA prospective client tries repeatedly to avoid identifying their beneficial owners, or adverse media surfaces a fraud allegation against an existing customer with no specific transaction in question

Both go through goAML; which one you file depends on whether a specific transaction is the subject of the suspicion.

The other report types you'll see

STR and SAR are the general-purpose reports. goAML UAE also has report types for more specific situations, several of which overlap with sanctions screening and country-risk obligations:

  • CNMR (Confirmed Name Match Report, the current name for what used to be called the Funds Freeze Report) and PNMR (Partial Name Match Report) — for sanctions and Local Terrorist List hits. Covered in full in our 24-hour rule guide.
  • HRCT / HRCA (High Risk Country Transaction / Activity Report) — for dealings connected to a FATF high-risk or increased-monitoring jurisdiction.
  • Sector-specific reports for DNFBPs, such as DPMSR (dealers in precious metals and stones) and REAR (real estate activity).

Filing the wrong report type, or filing an STR when the facts call for a CNMR, is a common and avoidable mistake — the trigger for each is different, and so is the clock that starts running.

What actually triggers a filing obligation

The legal trigger is reasonable grounds to suspect, not certainty. Common fact patterns that should make you stop and consider a filing include:

  • a transaction with no clear business, economic or lawful purpose for that customer;
  • structuring — breaking a larger amount into smaller transactions to stay under a threshold;
  • a customer who is unusually insistent on cash, speed, or avoiding documentation;
  • a customer or counterparty connected to a high-risk jurisdiction with no business rationale for the connection;
  • inconsistency between a customer's stated profile (occupation, declared income, stated purpose) and their actual activity; and
  • adverse media alleging financial crime, surfacing after onboarding.
Don't wait to be sure If you catch yourself gathering more evidence specifically to decide whether you're suspicious enough to file, that's usually a sign you already have reasonable grounds. The legal bar is suspicion, not proof — proving it is the FIU's job once you report it.

“Without delay”: realistic timelines

Unlike the sanctions freeze rule, UAE law doesn't attach a fixed number of hours or days to STR/SAR filing — the standard is "without delay." In practice, that is read narrowly:

  • File the same business day you form reasonable grounds to suspect, wherever practical.
  • A suggested internal standard, not a legal deadline: treat anything stretching past a day or two after you had grounds to suspect as a gap you would need to explain to your supervisory authority or in an inspection.
  • Internal escalation (front-line staff to compliance officer) should itself be fast — a filing delayed because the report sat in an inbox for a week is not defensible, whatever the underlying facts were.

Build the internal path — who notices, who decides, who files — before you need it under pressure.

How a report gets filed

  1. Someone notices — front-line staff flag a transaction or pattern that doesn't fit, or a periodic review surfaces one.
  2. The compliance officer assesses it against the reasonable-grounds standard, and decides which report type applies.
  3. The report is filed on goAML, with full supporting detail: the parties involved, the transaction or activity in question, why it's suspicious, and the red flags that applied.
  4. The customer relationship continues normally unless a separate freeze, suspension or other FIU/supervisory direction says otherwise — filing a report is not itself a reason to refuse service, and doing so without a lawful basis can create its own problems.

Tipping off and confidentiality

You may not tell the customer, directly or indirectly, that a report has been or will be filed about them. This is "tipping off," and it's treated as seriously as the reporting duty itself, because it defeats the purpose of reporting at all. Internal access to who has been reported should be limited to those who need it for that reason.

Record-keeping after you file

  • Keep a copy of the report as filed, the supporting evidence, and the internal decision trail — who assessed it, when, and why — for the period the law requires (groAML's default retention plan is 10 years).
  • Record the outcome of internal escalation even where you decide not to file, with the reasoning. A documented "we considered it and here's why we didn't report" is a defensible position; a silent decision not to file is not.
  • Keep this separate from, but cross-referenced to, the customer's ordinary CDD file (see our CDD & KYC guide) — an inspector will often ask for both together.

What a missed filing costs

Criminal and administrative exposure

Failing to report a suspicious transaction or activity in time can be a criminal offence under UAE federal AML law, on top of whatever administrative action your supervisory authority takes separately. The penalty amounts are set by the law, so we do not quote a figure here; confirm the current penalties with your supervisory authority or a UAE-qualified adviser.

How groAML handles this

groAML exports goAML 5.x-format STR/SAR XML pre-filled straight from the customer's existing case file, which you should validate before filing. The identity, ownership and transaction history you've already captured carries through, instead of being re-typed into the goAML form under time pressure.

See how it works

Your filing-readiness checklist

Tick these off for your firm. Your progress is saved in this browser, and the page prints cleanly as a handout.

goAML filing readiness9 items

Saved only on this device. Nothing is sent to us.

Frequently asked questions

Do I need proof before filing an STR?
No. The legal test is reasonable grounds to suspect, not proof. If you have grounds to suspect a transaction involves proceeds of crime, or lacks an apparent lawful or economic purpose, you file — the FIU's job, not yours, is to investigate and establish facts.
What happens if I tell the customer I filed a report?
That is tipping off, which can itself be an offence, separate from the reporting failure. You continue to deal with the customer normally (unless a freeze or suspension order from the FIU or EOCN says otherwise) and say nothing about the report.
Is there a fixed number of days to file an STR?
The law's standard is “without delay.” It does not set a fixed day-count the way the 24-hour sanctions freeze does. Treat same-day filing as the goal. As a suggested internal standard (not a legal deadline), treat a gap of more than a day or two after you form the suspicion as something you would have to justify to your supervisory authority.
What if the suspicious transaction never actually completed?
File anyway. An STR covers completed, ongoing and attempted transactions — a transaction you refused or that the customer abandoned once you asked questions is still reportable if it met the suspicion threshold.
Can one customer generate more than one report type?
Yes. A single relationship can produce a CNMR from a sanctions list hit, an STR from a suspicious transaction, and an SAR from suspicious behaviour that never became a transaction — they are not mutually exclusive, and each is assessed on its own facts.
Which report covers a sanctions or Local Terrorist List match?
Not an STR or SAR — that's a CNMR (confirmed match) or PNMR (partial match), with its own 24-hour freeze obligation and five-business-day filing window. See our guide to the 24-hour rule for that process specifically.

Sources

  1. 4.3 Reporting Suspicious Transactions and Registration to goAML, Central Bank of the UAE Rulebook
  2. Guidance on Suspicious Transactions (STR/SAR Red Flag Indicators), UAE Ministry of Economy and Tourism
  3. Register in goAML, UAE Ministry of Economy and Tourism
  4. Suspicious Activity Report (SAR) Filing Requirements Under UAE AML Laws, Farahat & Co.. Secondary commentary (law-firm blog) on the STR/SAR distinction; not a primary source, and not relied on for penalty amounts

This guide is general information, not legal advice. It reflects the sources listed above as of 4 Oct 2026. Check the current EOCN guidance and confirm with your supervisory authority or a UAE-qualified adviser how these obligations apply to your business.

Sanctions & TFS

The 24-hour freezing rule: a practical guide to sanctions screening for UAE DNFBPs

Which lists trigger the 24-hour freeze, what to do in the first day after a match, how to report it on goAML, and how to build a screening process that holds up in an inspection.

11 min read
 CDD & KYC

Customer due diligence for UAE DNFBPs: identity, beneficial ownership and the risk-based approach

What CDD and KYC actually require in practice: verifying identity, tracing beneficial ownership to a natural person, when a customer needs simplified, standard or enhanced due diligence, and the ongoing monitoring that doesn't stop once onboarding is done.

11 min read
 Risk assessment

AML/CFT risk assessment for UAE DNFBPs: what it must cover, and why it is never finished

What a business-wide and customer risk assessment actually has to cover under Cabinet Resolution No. 134 of 2025, how risk scoring feeds the CDD tier, and why risk-scoring methodology is changing industry-wide.

11 min read

Make the 24-hour rule routine

groAML screens against the UAE Local Terrorist List and the UN Consolidated List, matches Arabic names properly, and keeps a dated record of every check, match and decision.

See how groAML works Talk to Grovisor