Suspicious Transaction Reports in Rwanda: The 24-Hour Rule, goAML Filing and Penalties (2026)

Short answer: A reporting person in Rwanda must report to the Financial Intelligence Centre (FIC) when it suspects, or has reasonable grounds to suspect, that funds or other assets are the proceeds of crime or are linked to money laundering, terrorist financing or proliferation financing. The duty covers attempted transactions and applies whatever the amount. The FIC's Regulations N° 002/FIC/2026 require the report "within 24 hours from its occurrence", on the FIC's template, and reports keyed in by hand go through the FIC's goAML portal. Failing to report and tipping off are crimes under Law N° 001/2025.

This guide is for compliance officers, investigators and operations teams at Rwandan banks, microfinance institutions, insurers, forex bureaus, payment and remittance providers and the other reporting persons in Law N° 001/2025. It is a practical guide, not legal advice: the Law, the FIC's Regulations and its guidance are the authoritative texts.

---

The duty

Article 32(1) of Law N° 001/2025 of 22 January 2025 says that if a reporting person "suspects or has reasonable grounds to suspect that funds or other assets are the proceeds of crime, related or linked to, or are to be used for, terrorist financing or terrorist acts, or by a terrorist or a terrorist organization or persons who finance terrorism, it must promptly submit a report setting forth the suspicion to the Centre."

• No minimum amount. "A reporting person must report all suspicious transactions, including an attempted transaction, regardless of the amount of the transaction" (Article 32(2)).
• The FIC sets the procedure. The Law leaves the "procedures and time limits" to the FIC's guidelines (Article 32(3)).
• Proliferation financing too. The FIC's Regulations N° 002/FIC/2026 of 22 June 2026 cover funds or other assets "related or linked to money laundering, to terrorist financing, or financing the proliferation of weapons of mass destruction, regardless of the amount involved" (Article 39(1)).
• Activities as well as transactions. The Regulations define a suspicious transaction or activity as "a transaction or attempted transaction, activity or attempted activity" that a reporting person suspects is related to money laundering, terrorist financing or proliferation financing (Article 2(n)).
• Secrecy is no excuse. Reporting persons "are not liable for a breach of secrecy or confidentiality provisions in any law or contract where they are fulfilling an obligation under this Law" (Law, Article 10(3)).

---

The 24-hour clock

When does the clock start? Read literally, "from its occurrence" counts the 24 hours from the suspicious transaction or activity itself, not from the moment someone suspects it. The Regulations do not say how that applies when the suspicion forms later, for example after a periodic review. Monitor as close to real time as you can, record when each alert, suspicion and decision happened, and ask the FIC how it reads the rule for cases found late.

The guidance is dated. The FIC's only published STR guidance is its Guidance Note of 6 July 2023, which still cites the repealed Law N° 028/2023. It confirms that "there is no monetary threshold which applies to the reporting of suspicious transaction or activity".

---

Other situations that call for a report

---

What goes in the report

The FIC's template. The Regulations require the template established by the FIC (Article 39(2)). The FIC's "Suspicious Transaction/Activity Report" form can be an initial, amended or supplemental report, and either an STR or a suspicious activity report (SAR). It has nine parts:

1. the reporting entity;
2. the persons or entities engaging in the suspicious transactions or activities;
3. the suspicious transaction or activity, including the amount, the source of funds and, for a transfer, the sender's country;
4. a description of the suspicious or attempted activity or transaction;
5. the indicators of money laundering, terrorist financing or proliferation financing;
6. the suspected offences;
7. the action taken by the reporting person;
8. the documents available;
9. the money laundering reporting officer.

On goAML. The FIC's guide to submitting STRs and SARs on its goAML portal asks for:

• a reason for suspicion, which "shall include a summary of the facts at the disposal of the reporting entity allowing the presumption of a potential criminal offence to be established";
• the action taken;
• one or more report indicators, used "to specify the nature or type of suspicious or unusual transaction";
• each transaction in a series "listed separately on the STR form", or uploaded as XML;
• each subject recorded as "My Client" or "Not My Client".

A SAR "is similar to an STR except it does not contain any transactional data". The FIC advises saving the report while you work, so that a time-out does not lose the draft, and it posts a formal confirmation of acceptance, rejection or partial acceptance on your goAML message board.

The channel. STRs and SARs "that require manual data entry" go to the FIC's goAML production environment, goweb.fic.gov.rw. The FIC's guidance on targeted financial sanctions sends sanctions reports to its dedicated e-mail address, report@fic.gov.rw. If you are not registered yet, see our FIC goAML registration guide.

---

Indicators

The FIC must establish "indicators that assist in identifying suspicious financial transactions" (Law N° 045/2021 governing the FIC, as amended in 2025), and the Regulations say it provides "indicators and technics" for the purpose (Article 40). The appendix to its 2023 Guidance Note groups indicators under seven headings:

• general indicators;
• knowledge of AML/CFT requirements;
• identity documents;
• cash transactions;
• legal persons and legal arrangements;
• economic purpose;
• transactions involving accounts.

One describes structuring: a client who "consistently makes large numbers of cash transactions that are below the reporting threshold amount in an apparent attempt to avoid triggering the identification and reporting requirements". For institutions the National Bank of Rwanda (BNR) supervises, its 2023 AML/CFT guidelines add that where their indicators conflict with the FIC's, "the latter shall prevail".

Indicators are reasons to look closer, not proof of an offence.

---

Tipping off and protection

• Tipping off is prohibited. A reporting person, its directors, senior managers and other employees "are prohibited from disclosing the fact that a suspicious transaction report or related information has been filed with the Centre" (Law, Article 34(1)). Revealing a report to a third party is an offence, and so is informing someone of money laundering or terrorist financing intelligence about them that you learned through your office or profession (Article 63).
• Good-faith reporters are protected "from both criminal and civil liability" for breaching any restriction on disclosure. The protection applies "even if they did not know precisely what the underlying criminal activity was, and regardless of whether illegal activity actually occurred" (Article 34(2)–(3)).

---

Penalties

Criminal penalties under Law N° 001/2025:

The Law does not say how the two articles apply when both could cover the same failure.

Administrative sanctions:

---

How many reports the FIC receives

We found no FIC annual report with STR statistics. ESAAMLG's 2024 mutual evaluation of Rwanda reported that the FIC received 789 STRs in 2021/22 and 2022/23 together, 84% of them from banks and 15% from money or value transfer providers, and that the number fell by 28% between 2022 and 2023. At the time of the evaluators' visit in mid-2023, STRs arrived by encrypted e-mail and goAML was "not yet operational". Rwanda's 2024 National Risk Assessment, which says the FIC "has started using" goAML, counts 575 STRs from banks between 2019 and 2024, and 44 STRs related to virtual assets: 24 from mobile money service providers and 20 from banks.

---

STR checklist

1. Write down how your monitoring detects suspicious transactions and activities, including attempts, and which FIC indicators it covers.
2. Time-stamp each alert, the moment of suspicion, the compliance officer's decision and the filing.
3. Aim to file within 24 hours of the transaction or activity, and escalate cases found later to the compliance officer at once.
4. Complete the FIC's fields: subjects, transactions, a reason for suspicion that summarises the facts, indicators, suspected offences and the action taken.
5. File on the goAML production environment, and watch your message board for acceptance or rejection.
6. Handle sanctions matches separately: freeze without notice, file the STR and report to the FIC.
7. Keep the report confidential, and train staff that tipping off is a crime.
8. Keep copies of reports, and your internal memos on decisions whether to report, for at least 10 years.

---

Frequently asked questions

What is the STR deadline in Rwanda?

24 hours. Law N° 001/2025 requires reports to be made promptly, and Article 39(3) of the FIC's Regulations N° 002/FIC/2026 sets the limit at "within 24 hours from its occurrence".

Is there a minimum amount for an STR in Rwanda?

No. The Law requires reporting persons to report "all suspicious transactions, including an attempted transaction, regardless of the amount of the transaction".

What is the difference between an STR and a SAR in Rwanda?

The FIC's form covers both. A SAR "is similar to an STR except it does not contain any transactional data", so use it for suspicious activity where there is no transaction to report.

How do I file an STR with the FIC?

On the FIC's goAML portal, after registering your organisation, with the fields the FIC's template asks for. Reports keyed in by hand go to the production environment, and the FIC confirms acceptance or rejection on your goAML message board.

What happens if we do not file an STR?

Failing to submit an STR is an offence under Article 63 of Law N° 001/2025, punishable by 2 to 5 years' imprisonment and a fine of FRW 2 million to FRW 5 million for an individual, and a fine of FRW 10 million to FRW 20 million for a legal person. The FIC, the BNR and the CMA can also impose administrative fines on the reporting persons they supervise.

---

Suspicious transaction reporting with Creodata

Creodata's goAML Reporting Platform compiles parties, accounts and narrative in one STR workspace, generates schema-valid goAML XML, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for Rwanda, and AML compliance software in Rwanda for the transaction monitoring and case management that raise and document the suspicion.

See it on your own cases — request a demo.