Financial Intelligence Unit (FIU)
What is a Financial Intelligence Unit?
A Financial Intelligence Unit (FIU) is the national central agency responsible for receiving, analysing, and disseminating Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs) and other information related to money laundering, terrorist financing (TF) and proliferation financing (PF). It sits between reporting entities on one side and law enforcement, regulators and international partners on the other, converting raw compliance data into actionable financial intelligence.
In the United Arab Emirates, the UAE Financial Intelligence Unit (UAE FIU) is established within the Central Bank of the UAE and is the sole authority mandated to receive Suspicious Transaction Reports and related AML/CFT/CPF information from Financial Institutions, DNFBPs and Virtual Asset Service Providers through the goAML portal (Federal Decree-Law No. 10 of 2025, Article 11; Cabinet Resolution No. 134 of 2025, Article 44). For every regulated entity operating in the UAE, goAML registration with the FIU is the mandatory first step towards fulfilling AML compliance UAE obligations, and it is the primary bridge between the private sector and law enforcement.
The UAE Financial Intelligence Unit under the AML/CFT/CPF Framework
The role, independence and powers of the UAE FIU are anchored in Federal Decree-Law No. 10 of 2025 on AML/CFT and CPF and its Executive Regulations, issued under Cabinet Resolution No. 134 of 2025. These instruments, specifically FDL 10/2025, Article 11 and CR 134/2025, Articles 44–47, confirm the FIU as the sole national authority to receive, request, analyse and disseminate financial intelligence relating to suspected proceeds of crime, terrorist financing and proliferation financing.
DNFBPs supervised by the Ministry of Economy and Tourism (MoET), such as real estate brokers, precious metals and stones dealers, auditors, corporate service providers and legal professionals, are obliged to register on the goAML portal and file STRs directly with the FIU, without delay, whenever suspicion is formed (FDL 10/2025, Article 18(1)).
Financial institutions supervised by the Central Bank of the UAE (CBUAE), including banks, exchange houses, finance companies, insurance firms and payment service providers, must maintain automated screening and monitoring systems capable of generating high-quality FIU reports. Entities operating inside the DIFC (DFSA) and ADGM (FSRA) free zones face equivalent expectations, while securities-related activities align with the SCA framework and legal professionals operate under the Ministry of Justice (MoJ) supervisory context.
Across all these supervisors, expectations converge on FATF Recommendations 20, 23 and 29: timely reporting, protection of reporting persons, and an operationally independent FIU. Whether an entity is a bank, a virtual asset service provider (VASP) or a jewellery retailer, the obligation to report to the UAE FIU is identical in substance.
Why the FIU Matters for AML/CFT/CPF Compliance
From an AML/CFT/CPF perspective, the FIU is not simply a report inbox. It is the operational hub that determines whether private-sector suspicion translates into law-enforcement action, sanctions enforcement or international cooperation.
- The FIU converts fragmented reports from thousands of entities into consolidated intelligence products used by law enforcement, regulators and foreign FIUs.
- It provides feedback, typologies and strategic reports that shape the UAE’s National Risk Assessment (NRA) and each firm’s Enterprise-Wide Risk Assessment (EWRA).
- Non-reporting, late reporting or defensive reporting to the FIU is treated as a supervisory failure and can trigger administrative penalties ranging from AED 10,000 to AED 5,000,000 per violation (FDL 10/2025, Article 17), as well as criminal liability for deliberate or grossly negligent breach of the STR duty, imprisonment and a fine of AED 100,000 to AED 1,000,000 (FDL 10/2025, Article 28).
Your goAML Reporting Only Works if the FIU Can Use It
We design STR narratives, screening and escalation pathways that meet UAE FIU expectations end-to-end.
Core Functions and Powers of the UAE FIU
The FIU sits at the centre of the goAML ecosystem. Its statutory functions extend well beyond receiving reports; they include analytical, dissemination, cooperation, provisional-measures and supervisory-support roles, set out in FDL 10/2025, Article 11 and CR 134/2025, Articles 44–47 and 51.
- Receiving STRs and related information from FIs, DNFBPs and VASPs through the goAML platform, and retaining them in the FIU database (CR 134/2025, Article 46(1)).
- Conducting operational and strategic analysis to identify persons, funds and criminal networks, and to detect crime trends and patterns (CR 134/2025, Article 46(3)).
- Disseminating financial intelligence to law-enforcement authorities through dedicated, secure channels where sufficient grounds exist to suspect a link to the Crime (CR 134/2025, Article 46(6)).
- Requesting additional information or documents from any FI, DNFBP, VASP or Concerned Authority, whether or not that entity previously filed a report (FDL 10/2025, Article 11(1); CR 134/2025, Article 46(2)).
- Ordering the suspension or cessation of a suspicious transaction for up to ten (10) working days, and freezing funds suspected of being linked to a Crime for thirty (30) days (FDL 10/2025, Article 5; CR 134/2025, Article 51).
- Exchanging information with foreign counterpart FIUs and concluding Memoranda of Understanding, and following the requirements of the Egmont Group as a member (CR 134/2025, Article 47).
- Providing feedback to reporting entities on the quality of reports received, and issuing annual reports, typologies and analysis for public and supervisory use (CR 134/2025, Articles 45(6) and 46(4)).
The goAML Reporting Flow: How Information Reaches the FIU
Understanding the reporting flow helps compliance teams design controls that produce FIU-usable intelligence rather than volume for its own sake.
Step 1: Detection at the entity level
Front-line staff, transaction monitoring rules, sanctions screening tools or adverse-media alerts identify unusual activity. The Compliance Officer or MLRO reviews internal escalations and gathers supporting evidence.
Step 2: Analysis and decision by the MLRO
The MLRO assesses whether reasonable grounds to suspect exist. If suspicion is formed, the entity must notify the FIU without delay and directly, by providing a detailed report through the goAML system, and must furnish any additional information the FIU requests, without invoking confidentiality (FDL 10/2025, Article 18(1)). Tipping off the customer, or anyone else, that a report has been filed or that inquiries are underway is a criminal offence punishable by imprisonment and a fine of not less than AED 50,000 (FDL 10/2025, Article 29(1); confidentiality basis in Article 24).
Step 3: FIU receipt, analysis and dissemination
The FIU examines, analyses and retains the report in its database, and may request follow-up information from any reporting entity or Concerned Authority (CR 134/2025, Article 46(1)–(2)). Where sufficient grounds exist to suspect a link to the Crime, it disseminates the analysis to law-enforcement authorities via secure channels (CR 134/2025, Article 46(6)) and may share information with foreign counterpart FIUs through Egmont channels (CR 134/2025, Article 47).
When Should Reporting Entities Escalate a Matter to the FIU?
Reporting is triggered by suspicion, not certainty. Reporting entities do not investigate crimes; they raise reasonable suspicion and let the FIU perform intelligence analysis.
- A transaction, attempted transaction or customer behaviour appears inconsistent with the customer’s known profile, expected activity or stated source of funds.
- Screening produces a confirmed or partial match against UN, Local Terrorist List or targeted financial sanctions designations.
- Adverse media, whistle-blower information or law-enforcement enquiries suggest links to predicate offences under UAE law.
- Structuring, layering, unusual use of virtual assets, shell companies or high-risk jurisdictions is observed.
- A customer or beneficial owner refuses to provide CDD information, provides falsified documents or attempts to influence staff.
FIU-Relevant Red Flags and Behavioural Indicators
The following indicators are commonly referenced by the UAE FIU and international bodies. They do not prove wrongdoing, but they warrant escalation, enhanced due diligence and, where suspicion is formed, a report.
- Sudden or unexplained changes in transaction volume, geography, counterparties or product mix.
- Complex ownership layers with no clear commercial rationale, especially those linked to secrecy jurisdictions.
- Use of nominee directors, undisclosed beneficial owners or corporate service arrangements that obscure control.
- Frequent movement of funds to or from jurisdictions subject to FATF grey- or black-listing.
- Reluctance to provide standard KYC information, or provision of documents that cannot be independently verified.
- Transactions structured to fall just below internal thresholds, or repeated round-figure remittances lacking economic purpose.
Turn FIU Red Flags into a Repeatable Detection System
From EWRA to monitoring rules and MLRO playbooks, we operationalise FIU expectations across your firm.
Practical Checklist: Preparing Your Firm for goAML Reporting and FIU Interaction
- A live goAML registration with up-to-date organisation, MLRO and alternate-MLRO records.
- Documented STR/SAR decision-making standards, including timelines, escalation matrices and quality checks.
- Report templates that focus on the five Ws, who, what, when, where and why, with clear narrative structure.
- A defined process for responding to FIU information requests and freezing instructions within statutory timeframes.
- Regular reconciliation of goAML acknowledgements, follow-up questions and closed cases.
- Board and senior-management oversight of reporting volumes, quality metrics and FIU feedback.
Related Phrases and Connected Concepts for the FIU
In daily compliance conversations, the FIU is referred to using several terms that all point back to the same authority and reporting pathway. Teams may talk about the UAE FIU, the goAML FIU, the national FIU, the AML reporting authority, or simply “the regulator inbox.” Regardless of the label, the underlying obligation and reporting channel are identical: any suspicion of money laundering, terrorist financing or proliferation financing must be routed to the UAE FIU via the goAML portal, without tipping off the subject.
The FIU also sits inside a wider ecosystem of connected concepts that typically appear together in an AML compliance UAE programme, an Enterprise-Wide Risk Assessment or an MLRO report. These include Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), goAML registration, goAML reporting workflows, Partial Name Match reports, high-risk country reports, sanctions screening, funds-freeze obligations, tipping-off restrictions, the Egmont Group, FATF Recommendations, the UAE National Risk Assessment and the wider UAE AML law framework anchored in FDL 10/2025 and CR 134/2025. Treating these as one coherent framework, rather than isolated tasks, is what allows an organisation to demonstrate a genuine risk-based approach when the FIU or supervisor comes calling.
Why Documentation Is Essential to Defend FIU-Related Decisions
Every interaction with the FIU can, in principle, be revisited months or years later during a supervisory inspection, external audit or law-enforcement enquiry. In that moment, the quality of the underlying documentation determines whether the firm can defend its judgment or is left explaining gaps.
A defensible file should capture the customer profile at onboarding, subsequent updates, all screening results and how any true or partial matches were resolved. Transaction monitoring alerts, MLRO analysis, decisions to file or not file a report, and copies of every goAML submission (including reference numbers and acknowledgements) must be retained for a period of not less than five (5) years from the date of completion of the transaction or termination of the business relationship, and made available to the concerned authorities promptly upon request (Cabinet Resolution No. 134 of 2025, Article 25).
Where the FIU issues a request for further information, a freeze order or feedback, that correspondence, together with the internal handling steps, must be logged, time-stamped and linked to a named responsible officer. Well-documented FIU interaction is often the difference between a satisfactory inspection outcome and an administrative penalty.
Common Compliance Mistakes When Dealing with the FIU
- Defensive reporting: filing large volumes of low-quality STRs to “cover the firm” rather than reporting genuine, well-analysed suspicion.
- Late filing: waiting until an internal investigation is complete instead of reporting when reasonable grounds to suspect first arise.
- Weak narratives: submitting reports that lack context, timeline or a clear articulation of why the activity is suspicious.
- Tipping off: inadvertently alerting the customer that a report has been filed or is being considered, in breach of statutory prohibitions.
- Ignoring FIU feedback: failing to feed the FIU’s typologies, guidance and information requests back into policies, training and monitoring rules.
- Poor record-keeping: not retaining goAML acknowledgements, MLRO decisions and screening evidence in a way that can be reconstructed on demand.
- Treating the FIU as “someone else’s problem”: leaving reporting knowledge with a single person, so that any absence disrupts the firm’s ability to meet statutory deadlines.
How goAMLregistration.ae Helps You Engage the FIU with Confidence
The Financial Intelligence Unit is not just a destination for reports; it is a supervisory lens on the quality of your entire AML/CFT/CPF programme. That is why FIU engagement must be treated as a control-design and governance issue, not a filing task.
goAMLregistration.ae supports organisations end-to-end, starting with goAML Registration so that MLRO, alternate MLRO and organisation records are correctly aligned with UAE FIU expectations. Reporting readiness is then embedded into a robust Enterprise-Wide Risk Assessment (EWRA), ensuring that detection triggers, escalation paths and reporting decisions are grounded in the firm’s specific risk profile.
Support extends to drafting fit-for-purpose AML policy manuals and STR/SAR procedures, tuning KYC and sanctions-screening tools, and configuring transaction-monitoring rules so that alerts translate into high-quality goAML submissions. Role-based training equips frontline staff, MLROs and boards to recognise reportable activity and respond to FIU requests correctly. Finally, independent AML audits confirm that reporting, record-keeping and FIU-interaction controls actually operate as designed, not just as documented.
Frequently Asked Questions
The UAE Financial Intelligence Unit is an independent unit established within the Central Bank of the UAE and is the sole national authority responsible for receiving, analysing and disseminating Suspicious Transaction Reports and related AML/CFT/CPF information filed through the goAML portal (Federal Decree-Law No. 10 of 2025, Article 11; Cabinet Resolution No. 134 of 2025, Article 44).
All licensed financial institutions, DNFBPs and virtual asset service providers operating in the UAE, including those inside the DIFC and ADGM, are required to register on goAML and report suspicion of money laundering, terrorist financing or proliferation financing to the FIU.
The FIU receives Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), high-risk country reports, Partial Name Match (PNM) reports, funds-freeze reports and other AML/CFT/CPF filings prescribed by the regulator.
The statute requires reporting entities to notify the FIU “without delay and directly” as soon as they suspect, or have reasonable grounds to suspect, that a transaction or funds are related to the Crime, regardless of value (Federal Decree-Law No. 10 of 2025, Article 18(1)). There is no fixed statutory countdown, but supervisors interpret delay strictly and reporting entities must be able to justify the time taken from detection to submission.
Yes. The UAE FIU is expressly empowered to request additional information or documents from Financial Institutions, DNFBPs, VASPs and Concerned Authorities, whether or not that entity previously filed a report, and firms must respond within the timeframes and in the form prescribed by the Unit (FDL 10/2025, Article 11(1); CR 134/2025, Article 46(2)).
The FIU is an intelligence and analytical body focused on financial-crime data. Supervisors, such as the Central Bank, MoET, DFSA, FSRA, SCA or MoJ, focus on licensing, prudential and AML/CFT compliance oversight. The two work closely together but perform different statutory functions.
Yes. The UAE FIU exchanges information, both spontaneously and on request, with foreign counterpart units and other competent authorities, may conclude Memoranda of Understanding to regulate such cooperation, and follows the requirements of the Egmont Group as a member (Cabinet Resolution No. 134 of 2025, Article 47). Information exchanged may only be used for combating the Crime and may not be disclosed to third parties without the Unit’s consent.
Failure to report exposes the firm to administrative penalties ranging from a warning to a fine of AED 10,000 to AED 5,000,000 per violation, and ultimately to licence revocation (FDL 10/2025, Article 17). Deliberate or grossly negligent breach of the STR duty in Article 18 also carries criminal liability: imprisonment and a fine of AED 100,000 to AED 1,000,000, or either penalty (FDL 10/2025, Article 28). Tipping off a customer that a report has been made is a separate offence punishable by imprisonment and a fine of not less than AED 50,000 (FDL 10/2025, Article 29(1)).