Transaction monitoring for the UAE: suspicions reported without delay, and exchange houses held to automated, typology-based rules.
A rule engine that runs over streaming transactions and overnight batches, typology-aligned starter rules you switch on, tune and back-test, and data connectors that flag a failed feed instead of leaving a silent gap. Alerts become owned cases, and suspicious transaction and activity reports go to the FIU through goAML.
The UAE's rules in brief.
- Monitoring duty
- Continuous monitoring, scaled to the risks you have assessed and to the national risk assessment (Federal Decree by Law No. 10 of 2025, Art. 19)
- Suspicious transaction reports
- To the FIU immediately and without delay, whatever the value, attempted transactions included, through its electronic system (Art. 18 of the Decree by Law and of Cabinet Resolution No. 134 of 2025)
- The decision to report
- The compliance officer, independent in decision-making, decides whether to notify the FIU or retain the matter, and states the reasons; MoET also expects the decision to file, or not to file, to be documented
- Exchange houses
- Automated, risk-based monitoring whose rules reflect exchange-sector typologies, with special attention to third-party transactions (CBUAE Standards for exchange business, 16.24)
- CBUAE timeline
- For its licensees, an STR or SAR within 35 business days of an automated alert at most, or within 24 hours of an escalated decision; the law's duty to report without delay comes first
- Late and defensive filing
- MoET counts unjustified delays and batching of reports against supervisory expectations; the CBUAE reads defensive STRs as a sign of an inefficient monitoring system
- DNFBP threshold reports
- Dealers in precious metals and stones: cash transactions of AED 55,000 or more (DPMSR). Real estate brokers and agents: freehold deals paid with AED 55,000 or more in cash, or with virtual assets (REAR)
- FIU powers
- The FIU may, without notice, stop or suspend a suspect transaction for up to 10 working days and freeze funds for up to 30 days
- Records
- At least five years (Cabinet Resolution No. 134 of 2025, Art. 25); at least eight years for VASPs supervised by VARA in Dubai
Checked against primary sources on 1 October 2026.
What the UAE requires, and how the module handles it
Monitoring and reporting duties in the UAE come from Articles 18 and 19 of the 2025 Decree by Law and Cabinet Resolution No. 134 of 2025, with sector rules from the CBUAE for exchange houses and from VARA for VASPs in Dubai. Below, each duty sits beside its source and the monitoring feature that answers it:
| What the UAE requires | Where it sits | How the module handles it |
|---|---|---|
| Monitor transactions continuously, at a depth that matches each customer's risk and the national risk findings | Decree by Law No. 10 of 2025, Art. 19 | Rules are written in the engine's own rule language and run on live transaction streams as well as overnight batches, so instant channels and end-of-day loads meet the same logic. |
| Exchange houses: use automated, risk-based monitoring with rules built around exchange-sector typologies, watching third-party transactions closely | CBUAE Standards for exchange business, 16.24.1–16.24.2 | Instead of a blank page, a starter pack of rules and a typology library aligned with common laundering patterns, which you switch on and adjust to your own business. |
| Report suspicion to the FIU immediately and without delay, whatever the amount, attempted transactions included | Decree by Law, Art. 18(1); Cabinet Resolution No. 134 of 2025, Art. 18(1)(a) | Each alert turns into a case with an owner and a due date, and the STR or SAR goes through draft, review, approval and submission to the FIU through goAML. |
| Let the compliance officer decide, independently and with reasons, whether to report, and document the decision either way | Cabinet Resolution No. 134 of 2025; MoET STR/SAR guidance (March 2026) | Every decision on an alert is kept in an append-only audit log. Where machine-learning scores are switched on, each shows its top three reasons and a confidence level, and a person makes the call. |
| File no later than the CBUAE's outer limit of 35 business days from an automated alert, and avoid defensive reports that point to weak monitoring | CBUAE STR guidance (2021), sections 3.3.1 and 4.2 | A changed rule is first replayed over historical transactions so its alert volumes and outcomes can be compared, then promoted as a new version, with the previous version kept for audit. |
| Dubai VASPs: build FATF's virtual-asset red flags into monitoring scenarios and thresholds, and keep monitoring reported transactions, near real time where appropriate | VARA Compliance and Risk Management Rulebook, Rules III.C.4 and III.F.5 | The streaming side of the engine covers near-real-time monitoring. Feeds arrive over Kafka, REST, SFTP, ISO 20022 or change data capture; a failed feed is replayed or held in a dead-letter queue instead of failing silently, and you can see which rules lack the data attributes they depend on. |
Summaries of the primary texts as checked on 29 September and 1 October 2026: Federal Decree by Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025, the CBUAE's Standards for exchange business and its 2021 STR and exchange-house guidance, MoET's March 2026 STR/SAR guidance and circulars, VARA's Compliance and Risk Management Rulebook, the FIU's December 2025 virtual assets report and the 2024 national risk assessment. Not legal advice.
Frequently asked questions.
How quickly must a suspicious transaction be reported in the UAE?
Immediately and without delay, whatever the amount, and attempted transactions are reported too (Article 18 of the 2025 Decree by Law and of Cabinet Resolution No. 134 of 2025). The CBUAE's 2021 STR guidance gives its licensees an outer limit of 35 business days from an automated alert, and 24 hours once an escalated case is decided, but expects filing ahead of that. MoET tells DNFBPs that unjustified delays and batching of reports fall short of its expectations.
Do UAE exchange houses need automated transaction monitoring?
Yes. The CBUAE's Standards for exchange business require automated, risk-based monitoring tools suited to the size and complexity of the business, with rules and parameters that reflect the sector's typologies and pay special attention to third-party transactions. The CBUAE's 2021 guidance for exchange houses warns that having no monitoring system can bring large fines as well as reputational damage.
Is there a cash transaction reporting threshold in the UAE?
Not among the goAML report types the CBUAE lists for the financial institutions it licenses, exchange houses included: STR, SAR, AIF, AIFT, RFI, RFIT, HRC and HRCA. The threshold reports belong to two DNFBP sectors. Dealers in precious metals and stones file a DPMSR for cash transactions of AED 55,000 or more, and real estate brokers and agents a REAR for freehold deals paid with AED 55,000 or more in cash, or with virtual assets. Creodata's goAML Reporting Platform can be configured to support both.
What can the FIU do once a report is filed?
The Chief of the FIU may, without notice, order a suspect transaction stopped or suspended for up to 10 working days, and funds frozen for up to 30 days, which the Attorney General can extend. The FIU can also ask for more information in the form and time it sets. Throughout, tipping off the customer is a crime punishable by imprisonment and a fine of at least AED 50,000, or either.
Which typologies should UAE monitoring rules cover?
Start from the 2024 national risk assessment and your sector's red flags. For exchange houses, the assessment points to cash, cross-border transfers, banknote shipments, third-party transactions and high daily volumes, and the CBUAE's guidance adds structuring under CDD thresholds, cancelling a transaction when CDD looms, and sending money abroad to receive an equal amount back. For virtual assets, the FIU's December 2025 report found fraud the most common typology, with growing use of stablecoins, peer-to-peer activity and money-mule accounts.
Is goAML a transaction monitoring system?
No. goAML is the FIU's reporting platform: STRs, SARs and the other report types are filed through it, with the login running through the FIU's eServices portal. Monitoring happens before that, in your own systems. In the Creodata AML software, the rule engine raises alerts, alerts become cases, and approved reports go to the FIU through goAML.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.