Suspicious Transaction Reports in Uganda: The Two-Working-Day Rule, the FIA's Timelines and goAML Filing (2026)

Short answer: An accountable person in Uganda must report to the Financial Intelligence Authority (FIA) when it suspects, or has reasonable grounds to suspect, that a transaction or attempted transaction involves proceeds of crime or is linked to money laundering or terrorist financing, whatever the amount. The report goes on goAML without delay and "not later than two working days from the date the suspicion was formed". Since August 2024 the FIA also expects alerts opened within 3 working days and investigations finished within 10. Failing to report is an offence, even through negligence.

This guide is for money laundering control officers (MLCOs), investigators and compliance teams at Ugandan banks, microfinance institutions, insurers, forex bureaus, payment providers and other accountable persons. It is a practical guide, not legal advice: the Anti-Money Laundering Act, the Regulations and the FIA's guidance are the authoritative texts.

---

The duty

Section 9 of the Anti-Money Laundering Act, 2013 (section 10 of Cap. 118 in the FIA's own citation) says an accountable person "shall report to the Authority if it suspects or has reasonable grounds to suspect that a transaction or attempted transaction involves proceeds of crime or funds related or linked to or to be used for money laundering or terrorism financing, regardless of the value of the transaction".

• Supporting evidence. The report must be "accompanied by any documents directly relevant to that suspicion and the grounds on which it is based".
• Follow-up. The FIA can ask for further information, which you provide within the time it sets.
• Secrecy is no excuse. Bank secrecy, professional secrecy and contractual confidentiality do not override the duty to report (section 14).
• The exception. Advocates, other independent legal professionals and accountants need not report information they obtained under professional secrecy.

What counts as suspicious. The Act defines a suspicious transaction as one "inconsistent with a customer's known legitimate business or personal activities or with the normal business for that type of account or business relationship", or a complex and unusual transaction or pattern. The FIA's guidance asks each institution to write its own "operating definition" of suspicion that passes a test of reasonableness. Too narrow a definition misses cases; too broad a definition leads to "defensive reporting".

---

The clocks

The FIA issued the timelines because, in its words, "there is no clarity on the time accountable persons can take to form the suspicion", which had led to "significant delays" in filing. Its guidelines also say every accountable person "should have transaction monitoring systems (automated or manual)" that raise alerts.

Two working days, not 48 hours. Regulation 39(2) of the 2015 Regulations still says "not later than forty eight hours after the occurrence". The Act's two-working-day rule was substituted in 2017, and the Act prevails; the FIA's current guidance follows the Act.

The current guidance. The FIA's STR Guidance Note effective 18 March 2025 "supersedes all previous guidance notes related to Suspicious Transaction Reporting", including the December 2024 edition. The main practical change is that new facts on a filed report go in an AIF, not in "another STR/SAR".

---

Who files

The MLCO. The Guidance Note says "The responsibility of reporting suspicious transactions or activities lies with the Money Laundering Control Officer", and the Regulations make the MLCO the FIA's point of contact. Every member of staff must report suspicions to the MLCO (regulation 7).

Supervisory authorities and auditors have their own duty: when they suspect money laundering at an institution they oversee or audit, they report to the FIA within two working days (section 9(8)).

---

Writing and filing the report

On goAML. Reports go on the FIA's goAML portal. The Ugandan goAML report codes include:

• STR, the suspicious transaction report;
• SAR, the suspicious activity report;
• TFR, the terrorism financing report;
• AIF and AIFT, additional information without or with transactions.

The narrative. The "reason" field (up to 4,000 characters) explains why you are reporting. The FIA's completion notes for its STR form ask the reporter to "provide clearly and completely the events that led to the conclusion that the relevant activity is suspicious or unusual", the reasons for that conclusion, the crime suspected, and what was done internally. If the customer explained the source of the funds, say so.

The indicators. The FIA's Guidance Note lists general, cash, identity, cross-border and sector indicators, for example:

• cash transactions in "consistently rounded-off large amounts";
• cash kept just under the reporting threshold "in an apparent attempt to avoid the reporting threshold".

Indicators alone do not prove an offence; they are reasons to look closer.

After a report is accepted, goAML sends an automatic acknowledgement, and the FIA raises questions through the secure message board. See our FIA goAML registration guide if you are not yet registered.

---

After you file

• The transaction. You may complete a transaction you have reported, as long as you comply with the Act (section 17). The FIA has a separate power to halt financial activity after a suspicion is reported.
• Tipping off is prohibited. The institution, its directors and its employees must not disclose to the customer or anyone else that a report "will be, is being, or has been, submitted", or that an investigation is under way (section 9(6)). Doing so is an offence.
• Confidentiality. The identity of the reporter and of the people who handled the transaction, and the contents of the report, are confidential (section 9A).
• Protection. Reporting in good faith carries no criminal, civil or administrative liability (section 15).

---

Penalties

A currency point is UGX 20,000.

---

How many reports the FIA receives

In its latest posted annual report (FY2021/22), the FIA reported receiving 2,475 suspicious transaction reports, 2,361 of them through goAML, and 390 suspicious activity reports. Ministry of Finance reporting puts the first half of FY2023/24 at 1,072 STRs and 513 SARs.

---

STR checklist

1. Write down your institution's operating definition of suspicion, and the indicators your monitoring covers.
2. Make sure your monitoring raises alerts, and that alerts are opened within 3 working days.
3. Finish investigations within 10 working days of the alert, and record the decision and the reasons.
4. File the STR within 2 working days of forming the suspicion; report terrorist or proliferation financing at once.
5. Attach the documents behind the suspicion, and write a narrative covering events, reasons and the suspected crime.
6. Send new facts as an AIF referring to the original report.
7. Keep the report confidential, and train staff that tipping off is a crime.

---

Frequently asked questions

What is the STR deadline in Uganda?

Without delay, and not later than two working days from the date the suspicion was formed (section 9 of the Anti-Money Laundering Act, 2013, as amended; section 10 of Cap. 118 in the FIA's citation). Terrorist and proliferation financing are reported without delay.

Is there a minimum amount for an STR in Uganda?

No. The duty applies "regardless of the value of the transaction", and it covers attempted transactions.

How long does an institution have to investigate an alert?

The FIA's August 2024 guidelines expect alerts opened within 3 working days and the investigation finished within 10 working days of the alert. The STR is then due within 2 working days of forming the suspicion.

How do I add information to an STR already filed?

Under the FIA's March 2025 Guidance Note, file an Additional Information File (AIF) on goAML that refers to the original STR or SAR.

What happens if we do not file an STR?

Failing to report is an offence even through negligence, with fines of up to UGX 1.4 billion for a legal person. After an FIA directive, the FIA can also impose an administrative fine of up to UGX 750 million on a corporate body.

---

Suspicious transaction reporting with Creodata

Creodata's goAML Reporting Platform compiles parties, accounts and narrative in one STR workspace, generates schema-valid goAML XML, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for Uganda, and AML compliance software in Uganda for the transaction monitoring and case management that raise and document the suspicion.

See it on your own cases — request a demo.