Suspicious Transaction Reports in Nigeria: The NFIU's 24-Hour Rule and How to Write an STR (2026)
Short answer: Under section 7 of the Money Laundering (Prevention and Prohibition) Act, 2022 (MLPPA), a financial institution or designated non-financial business or profession (DNFBP) reports a suspicious transaction to the Nigerian Financial Intelligence Unit (NFIU) immediately and, within 24 hours after the transaction, draws up a written report, acts to prevent the laundering and reports what it did. There is no minimum amount, and the duty applies whether or not the transaction was completed. The NFIU's guidelines add that the 24 hours run once the transaction has been examined and found suspicious, within 72 hours, and that a report which does not follow its guidance counts as not reported. For software that drafts and validates NFIU STR files, see goAML reporting software for Nigeria.
This guide is for chief compliance officers, money laundering reporting officers and transaction-monitoring teams at Nigerian banks, microfinance banks, payment service providers, insurers, capital-market operators, virtual asset service providers and DNFBPs. It draws on the Act, the NFIU's May 2023 guidance on preparing a complete STR and its December 2024 guidelines for financial institutions. It is a practical guide, not legal advice.
What makes a transaction suspicious
Section 7(1) of the MLPPA 2022 deems a transaction suspicious where it:
- involves a frequency that is unjustifiable or unreasonable;
- is surrounded by conditions of unusual or unjustified complexity;
- appears to have no economic justification or lawful objective;
- is inconsistent with the known transaction pattern of the account or business relationship; or
- in the institution's opinion involves the proceeds of a criminal activity, an unlawful act, money laundering or terrorist financing.
Terrorist-financing suspicions are also reportable within 24 hours under section 84 of the Terrorism (Prevention and Prohibition) Act, 2022.
The 24-hour rule
Within 24 hours after the transaction, section 7(2) requires the institution to:
- draw up a written report containing all relevant information, with the reasons and the identity of the principal and, where applicable, the beneficiaries;
- take appropriate action to prevent the laundering of the proceeds; and
- report the suspicious transaction, and the action taken, to the NFIU.
The duty applies whether the transaction is complete or not (section 7(3)), and there is no amount threshold. The NFIU's 2023 guidance puts it as filing "promptly (within 24 hours from when the STR/SAR occurred)".
The NFIU's December 2024 guidelines for financial institutions explain when the clock starts: the 24-hour period is activated once a transaction is termed suspicious after meeting the section 7(1) criteria, and the examination and screening that reach that conclusion should take no more than 72 hours. Alerts that are investigated and found not suspicious are filed internally with written reasons, so examiners can review them later.
In practice, that means timestamps: when the alert fired, when the investigation concluded that the transaction was suspicious, when the MLRO approved the report, and when it was filed.
What happens after you file
The NFIU acknowledges receipt and may ask for more information. The acknowledgement can carry a notice deferring the transaction for up to 72 hours, and the NFIU or the EFCC can place a stop order of up to 72 hours on an account or transaction; where the origin of the funds cannot be established in that time, the Federal High Court may order them blocked (section 7(4)–(8)). If no stop notice arrives, or it expires without a blocking order, the institution may carry out the transaction.
How to write the narrative
The narrative is the only free-text section of the goAML STR form, and the NFIU has said that incomplete, inaccurate and disorganised narratives undermine its analysis. Its 2023 guidance asks for the five Ws and an H:
| Element | What to include |
|---|---|
| Who | Every suspect and their relationships: occupation, role in the business, addresses in full, and identifiers such as the Bank Verification Number, National Identification Number, passport or driver's licence number, e-mail addresses and phone numbers |
| What | The instruments or mechanisms used — cash, wire transfers, letters of credit, correspondent accounts, shell companies, securities, insurance policies, cheques, drafts, cards, property documents, precious metals and stones, digital assets — and the channel, such as online, phone, agents or couriers |
| When | When the activity was first noticed and how long it ran, with specific dates and amounts rather than only totals; tables and spreadsheets go in the attachments, not the narrative |
| Where | The offices or branches of every institution involved, with addresses, and any foreign jurisdiction, institution or person involved |
| Why | Your sector, why the activity is unusual for this customer compared with its known pattern, any unusual behaviour or requests, and any resistance to giving information; the goAML STR template lists the NFIU's indicators |
| How | The method of operation |
The guidance asks for the narrative in three parts. The introduction states the purpose of the report and the suspected violation (for example structuring, shell entities or layering), the dates of any earlier STRs on the same subjects, any link to a watchlist, and a summary of the red flags. The body sets out the facts and the results of the internal investigation in chronological order. The conclusion summarises the findings and records the follow-up action, such as a post-no-debit restriction, blocking an account, terminating an insurance policy or ongoing monitoring, with a liaison contact, any further information the institution can give law enforcement, and any other agency already investigating.
The December 2024 guidelines add three expectations: name the predicate offence you suspect, such as corruption, kidnapping, fraud or terrorist financing; give the alerts that triggered the investigation and the subject's earlier alerts and STRs, with any law-enforcement requests; and describe the remedial action taken. Our guide to writing an STR narrative for goAML covers narrative technique in general.
Documents to attach
| Source | Documents |
|---|---|
| NFIU guidance, May 2023 | A summary of the internal investigation report; the account or policy opening package; statements of account, converted to Excel; the instruments used in the transaction |
| NFIU guidelines, December 2024 | Customer identification (identity document, proof of address, business registration, beneficial owner's and legal representative's IDs); transaction slips or receipts; statements or account activity logs; electronic payment records such as SWIFT messages; account opening or closing records; deposits, treasury bills and bonds; loan records; remittance evidence |
Filing the report
- goAML, by web form or XML. STRs go to the NFIU's goAML portal as a WEB Report or by XML Upload of files built to the NFIU's schema. The web form suits institutions without software that generates XML, and lets the officer write reasons for suspicion and action taken in full.
- RapidAML for some filers. Bureaux de change and DNFBPs supervised by SCUML file STRs on the NFIU's RapidAML portal, which also takes nil reports.
- E-mail only with permission. When goAML fails, the NFIU accepts STRs at sector e-mail addresses only after a formal application and its permission, and the report must be re-sent on goAML once the system is restored.
- Conformity counts. The 2023 guidance is blunt: "Any STR filed to the NFIU that is not in conformity with this guideline shall be not valid and considered as not reported at all."
Registration comes first: see our NFIU goAML registration guide.
Tipping off, protection and penalties
- Tipping off. Warning the owner of the funds about a report, or the action taken on it, is an offence under section 19 of the MLPPA 2022. The NFIU's 2024 guidelines summarise the penalty for an employee or director who tips off the subject as a minimum of two years' imprisonment and a fine of at least ₦10,000,000.
- Failure to report. An institution that fails to report under section 7 is liable to a fine of ₦1,000,000 for each day the offence continues (section 7(10)).
- Protection. Directors, officers and employees who report in good faith are protected from civil and criminal liability (section 7(11)).
STR checklist
- Screen alerts against the section 7(1) criteria and conclude within 72 hours.
- Once a transaction is suspicious, file within 24 hours, and record the time at each step.
- Record the reasons for closing alerts you find not suspicious.
- Write the narrative in three parts, answering who, what, when, where, why and how, and name the suspected predicate offence.
- Attach the investigation summary, the opening package, statements in Excel and transaction evidence.
- File on goAML (or RapidAML if that is your portal), and check the message board for rejections.
- Keep the subject unaware, and keep copies for at least five years (section 8).
Frequently asked questions
What is the STR deadline in Nigeria?
Within 24 hours after the transaction under section 7(2) of the MLPPA 2022, with an immediate report to the NFIU. The NFIU's 2024 guidelines say the 24 hours run once the transaction has been examined and termed suspicious, and that examination should take no more than 72 hours.
Is there a minimum amount for an STR in Nigeria?
No. The duty applies to any amount, and to transactions that were attempted but not completed.
What should an STR narrative include?
Who, what, when, where, why and how, in an introduction, a body and a conclusion, with the suspected predicate offence, the alerts and earlier STRs on the subject, and the action the institution took. Attach the investigation summary, the account opening package and statements of account in Excel.
Where are STRs filed in Nigeria?
On the NFIU's goAML portal, by web form or XML upload. Bureaux de change and DNFBPs supervised by SCUML file them on the RapidAML portal.
What is the penalty for not filing an STR in Nigeria?
A fine of ₦1,000,000 for each day the failure continues under section 7(10) of the MLPPA 2022, and an STR that does not follow the NFIU's guidance is treated as not reported.
STR reporting for Nigerian institutions with Creodata
Creodata's goAML Reporting Platform compiles parties, accounts and narrative in one STR workspace, so the MLRO reviews a complete report rather than assembling one against the 24-hour clock. It generates schema-valid goAML XML, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for Nigeria, and AML compliance software in Nigeria for the monitoring and case management that produce the alerts.
See it on your own report types — request a demo.