Suspicious Transaction Reporting Workflows for UAE VASPs
Suspicious Transaction Reports (STRs) are the primary mechanism through which UAE virtual asset service providers communicate potential money laundering, terrorist financing, or proliferation financing activity to the UAE Financial Intelligence Unit (FIU). STR filing is a legal obligation under UAE Federal Decree-Law No. 20 of 2018, and failure to report suspicious activity is itself a criminal offense. This guide provides the operational workflow for STR identification, assessment, preparation, and filing within UAE-regulated VASPs.
The goAML System
The UAE FIU receives STRs through the goAML platform, an automated reporting system developed by the United Nations Office on Drugs and Crime (UNODC). All regulated entities, including VARA-licensed VASPs, ADGM-authorized firms, and DFSA-authorized firms, must register with goAML and use it for STR filing.
Registration requirements include designation of a goAML administrator (typically the MLRO), system access credentials, and entity identification details. The MLRO is responsible for maintaining goAML access and ensuring the filing process operates without interruption.
STR Workflow: Step by Step
Step 1: Suspicious Activity Identification
Suspicious activity may be identified through multiple channels:
Transaction Monitoring Alerts: Automated alerts generated by transaction monitoring systems, including blockchain analytics platforms (Chainalysis, Elliptic, Crystal Blockchain). Alert types include threshold breaches, unusual patterns, sanctions hits, and high-risk indicator matches.
Staff Observations: Front-line staff may observe unusual customer behavior, inconsistent information, or transaction requests that raise suspicion. Staff must be trained to recognize red flags and know how to escalate internally.
KYC Triggers: Adverse media results, PEP screening hits, or discrepancies identified during KYC/CDD procedures or enhanced due diligence.
External Information: Law enforcement requests, regulatory notifications, or information from other financial institutions regarding shared customers.
Step 2: Internal Escalation
All suspicious activity identifications must be escalated to the MLRO through defined internal channels. The escalation process must:
- Document the basis for suspicion (specific observations, transaction data, screening results)
- Preserve all supporting evidence
- Maintain confidentiality (restrict knowledge of the suspected activity to those with a need to know)
- Follow established escalation timeframes (same-day escalation for urgent matters)
The internal escalation should not be delayed pending additional investigation. If there is a reasonable basis for suspicion, escalation should proceed immediately, with additional investigation running in parallel.
Step 3: MLRO Assessment
The MLRO reviews the escalated information and determines whether a suspicious activity report is warranted. The MLRO assessment should consider:
- The strength and specificity of the suspicion indicators
- The customer’s risk profile and CDD information
- The transaction context and any explanations available (without tipping off the customer)
- The entity’s prior experience with similar patterns
- Relevant enforcement case precedents (see our enforcement cases section for patterns)
The MLRO’s assessment must be documented regardless of whether an STR is filed. If the MLRO decides not to file, the documentation must explain the rationale.
Step 4: STR Preparation
If the MLRO determines that an STR is warranted, the report must be prepared in the goAML system format. STR content includes:
- Reporting entity identification
- Subject identification (customer details from KYC records)
- Transaction details (dates, amounts, virtual asset types, counterparty information)
- Narrative description of the suspicious activity and the basis for suspicion
- Supporting documentation (transaction records, screening results, investigation notes)
- Risk indicators identified
- Actions taken by the entity (account restrictions, enhanced monitoring)
The STR narrative should be clear, factual, and comprehensive. It should explain why the activity is suspicious, not merely describe the transactions.
Step 5: Filing via goAML
The completed STR is submitted through the goAML platform. Key filing requirements include:
- Filing within the mandated timeframe (the UAE requires prompt filing upon formation of suspicion)
- Maintaining a filing reference number for internal tracking
- Storing a copy of the filed STR and all supporting documentation
- Confirming successful transmission through goAML
Step 6: Post-Filing Actions
After STR filing, the entity must:
- Continue monitoring the customer’s activity with enhanced scrutiny
- Not terminate the customer relationship solely based on the STR filing without MLRO assessment (premature termination could tip off the customer or obstruct investigation)
- Respond promptly to any follow-up requests from the FIU
- Document all post-filing monitoring and decisions
- Consider whether the activity warrants additional measures such as account restrictions
Tipping-Off Controls
UAE law prohibits informing the customer (or any other person) that an STR has been or will be filed. Tipping-off controls are critical compliance requirements:
- Restrict knowledge of STR filings to the MLRO, compliance staff directly involved, and senior management on a need-to-know basis
- Train all staff on tipping-off prohibitions
- Design customer communication procedures that avoid inadvertently disclosing STR-related activity (e.g., when declining transactions or requesting additional information)
- Document tipping-off control procedures and test compliance regularly
Record Keeping
All STR-related documentation must be retained for the period specified by applicable regulation (minimum five years, potentially longer). Records include:
- Internal escalation documentation
- MLRO assessment records
- Filed STR copies with goAML reference numbers
- Supporting evidence packages
- Post-filing monitoring records
- FIU correspondence
Quality Assurance
STR quality directly affects the FIU’s ability to process and act on reported intelligence. Compliance officers should implement quality assurance procedures including:
- Periodic review of filed STRs for completeness and clarity
- Analysis of STR filing patterns (volume, timing, subject types) to identify potential gaps
- Comparison of STR filing statistics with industry benchmarks
- Internal audit review of the STR process as part of AML program testing
Enforcement Context
Failure to file STRs when suspicious activity is present represents a significant compliance failure. While no published VARA enforcement action has specifically cited STR filing failure, the broad language of the Morpheus Software (Fuze) case — “Failures in AML programme controls” — encompasses STR process deficiencies. The VARA enforcement powers deep dive covers the full range of enforcement measures available for compliance failures.
STR Filing Technology Infrastructure
Effective STR filing requires technology support at multiple stages:
Alert generation: Blockchain analytics platforms (Chainalysis, Elliptic, Crystal Blockchain) generate the initial alerts that trigger investigation and potential STR filing. The monitoring system must be properly calibrated to produce actionable alerts — too many false positives overwhelm the compliance team, while too few alerts risk missing genuine suspicious activity. See our transaction monitoring guide for calibration guidance.
Investigation tools: When an alert is generated, compliance analysts use investigation tools to assess whether the activity is genuinely suspicious. This includes blockchain analytics investigation features (Chainalysis Reactor, Crystal flow visualization, Elliptic investigation tools), KYC records showing the customer’s known profile and expected activity, transaction history analysis, and open-source intelligence.
Case management: A case management system tracks investigations from alert generation through disposition (false positive clearance, continued monitoring, or STR filing). The case management record provides the audit trail that demonstrates AML programme operational effectiveness during regulatory examinations.
goAML submission: The STR is filed through the goAML portal operated by the UAE Financial Intelligence Unit. The goAML system accepts structured data submissions including subject information, transaction details, and narrative descriptions. Compliance teams should be trained on the goAML interface and filing requirements.
STR Obligations Across UAE Jurisdictions
STR filing obligations are consistent across UAE jurisdictions — all VASPs file through the same goAML system to the same UAE FIU. However, each regulator’s framework establishes its own supervisory expectations:
VARA: The March 2026 AML/CFT/CPF circular reinforces STR obligations for VARA-licensed VASPs. The Full Market Product Regulations establish the compliance program framework that includes STR procedures.
ADGM-FSRA: The FSMR AML Rules require ADGM-licensed firms to file STRs when suspicious activity is identified. The FSRA may request information on STR filing statistics during supervisory engagement.
DFSA: The DFSA’s AML module imposes STR obligations for authorized firms handling investment tokens, consistent with the federal baseline.
Common STR Triggers for UAE VASPs
Virtual asset-specific STR triggers include:
- Transactions involving addresses flagged by blockchain analytics as connected to sanctioned entities or illicit services
- Customer transactions inconsistent with their stated source of funds or declared activity
- Rapid fund pass-through (deposits immediately followed by withdrawals with no genuine trading activity)
- Structuring patterns designed to avoid monitoring thresholds
- Transactions involving FATF high-risk jurisdictions without adequate business justification
- Requests for cryptocurrency-to-fiat conversion of assets with unclear origins
- Enhanced due diligence findings revealing undisclosed risk factors
For the complete AML program framework, see our AML program design guide. For compliance scheduling, see our compliance calendar. For enforcement tracking, see the enforcement action dashboard.
For advisory support on STR procedures, consider engaging Deloitte Middle East or PwC Middle East for independent compliance program assessment.
For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.