goAML Report Types in the UAE: STR, SAR, DPMSR, REAR, CNMR, PNMR, HRC and More (2026)

Short answer: UAE reporting entities file several report types on goAML. Suspicious transaction reports (STRs) and suspicious activity reports (SARs) go to the Financial Intelligence Unit (FIU) without delay, whatever the amount. Dealers in precious metals and stones and real estate brokers file DPMSRs and REARs from AED 55,000. Sanctions matches go in a CNMR or PNMR within five business days. Dealings linked to high-risk countries are reported in an HRC or HRCA at least three working days before they go ahead.

This guide is for compliance officers and money laundering reporting officers (MLROs) at UAE financial institutions, virtual asset service providers and designated non-financial businesses and professions (DNFBPs). It draws on Federal Decree by Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and the Ministry of Economy & Tourism's (MoET's) March 2026 guidance on STRs and SARs for DNFBPs, whose annex lists the report types "currently available on the goAML portal as defined by the FIU". It is a practical guide, not legal advice.

---

The report types at a glance

---

STRs and SARs

The duty. Where a financial institution, DNFBP or virtual asset service provider suspects, or has reasonable grounds to suspect, that a transaction or funds are proceeds of crime, or related to or intended for money laundering, terrorist financing or proliferation financing, "regardless of their value", it notifies the FIU "without delay and directly" with a detailed report (Article 18 of the Decree by Law). The regulations add "Immediately and without delay", cover attempted transactions, and set aside banking and professional secrecy (Article 18 of Cabinet Resolution 134). Lawyers, notaries, other legal professionals and independent auditors are exempt for information covered by legal privilege.

STR or SAR. MoET's guidance draws the line this way:

• STR: the suspicion is about a transaction. It needs full transaction data and supporting documents. Completed, attempted, unexecuted and past transactions are all reportable once there are reasonable grounds.
• SAR: the suspicion is about conduct, not a transaction. Examples are falsified documents before onboarding, adverse information during onboarding, or suspicious behaviour, declarations or screening results while monitoring a customer with no transactions. A SAR carries the customer's details and a narrative.

Reasonable grounds are enough. You do not need evidence that a predicate offence happened, or knowledge of the underlying crime. MoET also warns against reports based on a customer's high-risk nationality alone.

Timing. Report once reasonable grounds exist. MoET treats unjustified delays, failure to escalate, and "batching of reports" as inconsistent with supervisory expectations. Terrorist financing and sanctions indicators call for immediate reporting.

Who decides. The compliance officer or MLRO decides whether to report. The regulations require them to decide whether to notify the FIU "or to retain the matter stating the reasons therefor" (Article 22). MoET expects that decision documented either way.

What a report contains. MoET asks for a chronological narrative covering who is involved, what is suspicious, when and where it happened, how the suspicion arose and why it is suspicious, with supporting documents. Choose the reasons for reporting (RFRs) that match the narrative.

---

Threshold reports: DPMSR and REAR

These are sector reports, not suspicion reports. They come from MoET circulars, which stay in force under the 2025 law where they are consistent with it.

• DPMSR. A dealer in precious metals or stones files one for any transaction with a resident or non-resident individual paid in cash of AED 55,000 or more (or the foreign-currency equivalent). It also files one for any transaction with a company or entity of AED 55,000 or more, in cash or by wire.
• REAR. A real estate broker or agent files one for any freehold purchase or sale where:
  • the payment includes cash of AED 55,000 or more, in one payment or several;
  • any part of the price is paid in a virtual asset; or
  • the funds were converted to or from a virtual asset.

A threshold report is not a suspicion report. If a transaction you report in a DPMSR or REAR is also suspicious, the Article 18 duty to file an STR still applies. See our articles on AML for gold and jewellery dealers and AML for real estate brokers.

---

Sanctions reports: CNMR and PNMR

Institutions must "implement forthwith" the targeted financial sanctions instructions of the Executive Office for Control and Non-Proliferation (Article 19). goAML has two reports for sanctions screening. The steps below are as MoET's guidance for DNFBPs sets them out, referring to the Executive Office's guidelines; financial institutions and virtual asset service providers should check those guidelines and their own supervisor's rules.

• CNMR (Confirmed Name Match Report). MoET notes it was "previously known as Funds Freeze Report (FFR)". If an existing customer is a confirmed match with the UAE Local Terrorist List or the UN Consolidated List, freeze without delay (within 24 hours) and stop making funds, assets or services available. Then file a CNMR within five business days of freezing. If the match is a prospective customer, or a counterparty in a customer's transaction, reject the transaction and file a CNMR within five business days of rejecting it. The report states what you did and what you froze.
• PNMR (Partial Name Match Report). If a match is partial and you cannot verify it as a confirmed match or a false positive, suspend the transaction immediately, or withhold the funds or services, or reject the transaction. File a PNMR within five business days of the rejection or suspension.

Breaching sanctions instructions is a crime punishable by imprisonment and a fine of at least AED 20,000, or either (Article 33).

---

High-risk country reports: HRC and HRCA

If, when setting up or running a customer relationship or carrying out a transaction for a customer or prospective customer, you identify transactions related to the countries the National Committee lists as high risk, file an HRC. MoET's guidance says the transactions may be executed only three working days after the report, and only if the FIU does not object in that time. The HRCA works the same way for activities rather than transactions.

The high-risk country list is published by the National Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations Committee. The regulations also require enhanced due diligence, and any countermeasures the supervisor sets, for business with high-risk countries (Article 23).

---

Information reports: AIF, AIFT, RFI and RFIT

The FIU can ask for "any additional information or documents" within the timeframe and in the form it prescribes (Article 11 of the Decree by Law), and the regulations require you to respond promptly:

• AIF and AIFT. Additional information on a report you filed earlier, without or with transaction data, sent when the FIU asks through the goAML Message Board.
• RFI and RFIT. Answers to a request the FIU sends to several reporting entities at once, not only the one that filed the original report, without or with transactions.

---

After you file

• Tipping off is a crime. You, your directors, officers and employees must not tell the customer or anyone else that a report has been or will be filed, or that an investigation is under way (Article 19 of the regulations). It is punishable by imprisonment and a fine of at least AED 50,000, or either (Article 29 of the Decree by Law).
• Follow the FIU's instructions on the transaction and the relationship. The FIU can order a transaction stopped for up to 10 working days and funds frozen for up to 30 days (Article 5).
• Treat the customer as high risk. Classify the customer as high risk and apply enhanced due diligence and monitoring. MoET does not require you to end the relationship unless the risks cannot be mitigated.
• Good-faith protection. No criminal, civil or administrative liability attaches to reporting in good faith (Article 37).
• Records. Keep records for at least five years.

---

Penalties

---

Report types checklist

1. Map each of your products and customer types to the report types that can apply to them.
2. Separate suspicion reports (STR, SAR) from sanctions reports (CNMR, PNMR) and threshold reports (DPMSR, REAR), as MoET asks.
3. For DPMSR and REAR, aggregate linked payments and track virtual-asset payments and conversions.
4. Screen against the UAE Local Terrorist List and the UN Consolidated List, and time-stamp each freeze, suspension and rejection so the five-business-day deadline can be met.
5. Check transactions against the National Committee's high-risk list, and hold them for three working days after an HRC or HRCA.
6. Watch the goAML Message Board for AIF and RFI requests, and answer them promptly.
7. Document every decision to report or not to report, with reasons.

---

Frequently asked questions

What is a CNMR in goAML?

A Confirmed Name Match Report, filed after a confirmed match with the UAE Local Terrorist List or the UN Consolidated List. You freeze within 24 hours and file the CNMR within five business days of freezing, or of rejecting the transaction if the match is a prospective customer or a counterparty.

What replaced the Funds Freeze Report (FFR)?

The Confirmed Name Match Report (CNMR). MoET's March 2026 guidance describes the CNMR as "previously known as Funds Freeze Report (FFR)".

What is a PNMR?

A Partial Name Match Report, filed when a sanctions match is partial and you cannot verify it as a confirmed match or a false positive. You suspend or reject the transaction and file the PNMR within five business days.

What is an HRC report in the UAE?

A High Risk Country Transaction Report, filed for transactions linked to the high-risk countries the National Committee lists. The transaction may go ahead only after three working days, and only if the FIU does not object. The HRCA is the equivalent for activities.

What is the difference between an STR and a SAR?

An STR reports a suspicious transaction and needs full transaction data. A SAR reports suspicious behaviour or information, such as falsified documents or adverse media, where there is no full transaction to report. Both are filed without delay on the same "reasonable grounds" test.

What are AIF and RFI reports?

They answer the FIU's requests for more information. An AIF (or AIFT, with transactions) adds information to a report you filed earlier. An RFI (or RFIT) answers a request the FIU sends to several reporting entities. Both requests arrive through the goAML Message Board.

---

Filing goAML reports with Creodata

Creodata's goAML Reporting Platform generates schema-valid goAML XML for STRs and SARs, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. It can be configured to support DPMSR and REAR reports. See goAML reporting software for the UAE, our goAML registration guide for the UAE, and AML compliance software in the UAE for the sanctions screening and transaction monitoring that raise these reports.

See it on your own report types — request a demo.