The UAE has established a strong legal and regulatory framework to combat money laundering (AML) and the financing of terrorism (CTF). A key part of this framework is the requirement for obligated entities to report suspicious activities promptly, through a formal Suspicious Activity Report (SAR), before potential criminal activity has a chance to fully unfold.
This guide covers the current legal basis for SAR filing, who’s obligated to file, how to identify suspicious activity, the goAML reporting process, a worked filing example, and post-filing obligations.
The Current Legal Framework Governing SAR Filing
UAE AML/CFT obligations are currently governed by Federal Decree-Law No. 10 of 2025, effective 14 October 2025, with its implementing regulation set out in Cabinet Resolution No. 134 of 2025, effective 14 December 2025. These replaced the earlier Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, which many older compliance materials still reference. A Suspicious Activity Report is a formal notification submitted to the UAE Financial Intelligence Unit (FIU) when an obligated entity identifies activity linked to money laundering, terrorism financing, or other financial crimes. SARs allow for early intervention, requiring obligated entities to report suspicious behavior even before a formal business relationship or finalized transaction, reflecting the UAE’s proactive approach to preventing financial crime.
The Central Bank of the UAE (CBUAE), the FIU, the Ministry of Economy, and other regulatory authorities provide guidance and circulars clarifying SAR filing requirements in practice.
Also check: AML Compliance Services
Which Entities Are Obligated to File SARs?
The following categories are required to file SARs, promptly informing the FIU if they suspect or have reason to suspect money laundering or funds connected to a crime:
- Financial Institutions
- Designated Non-Financial Businesses and Professions (DNFBPs)
- Virtual Asset Service Providers (VASPs)
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
How to Identify Suspicious Activity Requiring a SAR
Identifying suspicious activity is the critical first step. Several scenarios commonly trigger the requirement:
- A potential customer decides against opening an account after learning about Customer Due Diligence (CDD) requirements, a genuine red flag on its own.
- An existing customer can’t provide necessary information about their business operations or beneficial owners.
- The customer can’t explain transactions, provide supporting documents, or offer satisfactory information about counterparties.
Generally, any suspicion of money laundering, fraud, or terrorism financing arising from a customer’s actions, including information they provided or refused to provide, should prompt further scrutiny and a potential report.
Must check: Ultimate Beneficial Ownership (UBO) Declaration
Guidelines for goAML Reporting
The primary platform for filing SARs in the UAE is the goAML portal, operated by the FIU. Registration is mandatory for Financial Institutions, DNFBPs, and VASPs, and follows a two-step process: registering in the goAML portal’s protection system (SACM) to get a username, then obtaining a password from the Google Authenticator app to access the portal.
A comprehensive SAR submission requires detailed identity information, background information, the reason for suspicion, a description of the activity, available transaction details, information about the potential source of funds, and identification of the compliance officer. The narrative section, explaining the who, what, when, where, and why of the suspicious activity, is genuinely crucial to a usable report. Obligated entities are legally required to file a SAR “without delay” as soon as a reasonable suspicion forms.
Worked Example: Filing a SAR After a Red Flag
A DNFBP conducting standard customer due diligence for a new corporate client asks for details on the company’s beneficial ownership structure. The client provides vague, inconsistent answers across two separate requests and then withdraws the account opening application entirely once pressed for supporting incorporation documents. This pattern, refusal to complete CDD combined with abrupt withdrawal once documentation was requested, is itself a recognized red flag, even though no actual transaction occurred and no formal business relationship was ever established. The compliance officer documents the specific inconsistencies in the client’s answers, the timeline of the withdrawal relative to the CDD request, and files a SAR through goAML without delay, including this narrative in the required “who, what, when, where, why” section rather than a vague general suspicion.
What Are the Penalties for Non-Compliance?
Failure to report a suspicious transaction or activity without delay can result in imprisonment and/or a fine ranging from AED 100,000 to AED 1,000,000. Failure to register on the goAML portal can also lead to separate penalties.
Common Mistakes in SAR Filing
- Waiting for a completed transaction before filing. The obligation to report can arise from suspicious behavior alone, even before a formal relationship or transaction is finalized.
- Vague or incomplete narrative sections. A SAR without a clear who/what/when/where/why explanation gives the FIU far less to act on.
- Delaying filing to gather more evidence. The legal standard is filing “without delay” once reasonable suspicion forms, not once the case is fully proven.
- Not following through on post-filing risk reassessment. Filing the SAR isn’t the final step, the business relationship itself needs to be reassessed afterward.
Post-Filing Procedures and Considerations
After filing, obligated entities should reassess the risk associated with the business relationship, consider enhanced customer due diligence, review related accounts, classify the customer as high-risk where appropriate, consider transaction restrictions, decide whether to continue or terminate the relationship, add the subject to internal watch lists, and be prepared for feedback from the FIU. Record retention throughout this process is also essential.
Frequently Asked Questions (FAQs)
What law currently governs SAR filing requirements in the UAE?
Which entities must file Suspicious Activity Reports in the UAE?
Does a SAR require a completed transaction to trigger filing?
How quickly must a SAR be filed once suspicion arises?
What happens after a SAR is filed?
What are the penalties for failing to file a required SAR?
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
How Farahat & Co. Can Help
Farahat & Co., a trusted Auditors in UAE firm, supports businesses with AML compliance, SAR preparation and filing, and goAML registration.
Contact Farahat & Co. today to discuss your SAR filing and AML compliance requirements.
 Filing Requirements Under UAE AML Laws){kind=link}