CNMR and PNMR Filing on goAML: UAE Sanctions Guide

Last updated: 12 August 2026

A sanctions screening alert starts two deadlines running, and both are short. CNMR and PNMR filing on the goAML portal is how a UAE reporting entity proves what it did once a name matched the UAE Local Terrorist List or the United Nations Consolidated List. Supervisors read that filing record as evidence of whether the sanctions control actually functions. This guide sets out both deadlines, the decision between a confirmed and a partial match, the filing route step by step, and the evidence file to keep afterwards.

Quick Answer

A Confirmed Name Match Report (CNMR) is filed on goAML when a customer or counterparty is a confirmed match to a designated person. A Partial Name Match Report (PNMR) is filed when the match is only potential. Freeze a confirmed match within 24 hours without notifying the customer, then file the report within five business days.

Key Takeaways

Two reports, two triggers. A CNMR covers confirmed matches and the freezing measures taken. A PNMR covers potential matches where the transaction is suspended pending resolution.
The freeze happens first. Funds and assets must be frozen without delay and within 24 hours of confirming a match, before any report is filed.
Five business days to file. Both report types are submitted through goAML within five business days of the measure being taken.
The name changed in 2026. The Executive Office for Control and Non-Proliferation renamed the Funds Freeze Report (FFR) as the Confirmed Name Match Report in its March 2026 guidance update.
Telling the customer first is an offence. Notification before the freeze is tipping off. Notification after the freeze is applied is permitted.
Registration is a standing obligation. Reporting entities must be registered in the Notification Alert System to receive list updates, and screening must run on every update.
Penalties bite at the entity and the individual. Sanctions violations carry fines from AED 50,000 to AED 5,000,000 per violation, and UAE supervisors have penalised compliance officers personally.

What Are CNMR and PNMR Reports in the UAE?

Both are sanctions reports filed through goAML, the UAE Financial Intelligence Unit reporting platform. They sit apart from the suspicious transaction report route. An STR is about suspicion of money laundering or terrorist financing. A sanctions match report is about a name appearing on a designation list, which is a factual question rather than a judgement about suspicion.

Confirmed Name Match Report (CNMR)

A CNMR is filed when screening produces a confirmed match between a customer, beneficial owner, counterparty or related party and a person or entity on the UAE Local Terrorist List or the UN Consolidated List. The report records the identification, the freezing measures applied, the funds or assets affected, and any attempted transaction linked to the designated person.

Partial Name Match Report (PNMR)

A PNMR is filed when screening produces a potential match that cannot be confirmed or discounted on the information available. The transaction is suspended while the entity gathers identifiers such as date of birth, nationality, passport or trade licence number. The PNMR records the potential match and the action taken.

Why the Funds Freeze Report Name Changed

Practitioners who trained on older material will know this report as the Funds Freeze Report, or FFR. The Executive Office for Control and Non-Proliferation (EOCN) published its Guidance on Targeted Financial Sanctions for Financial Institutions, DNFBPs and VASPs in January 2021 and amended it in March 2026. That amendment renamed the FFR as the Confirmed Name Match Report.

The obligation itself did not change. The label did, and a policy document that still says FFR signals to an inspector that the framework has not been refreshed since the update.

Screening only works if the list behind it is current. First Compliance runs customer and counterparty screening against 1,800+ sanction lists and 5.5M+ PEP records, and keeps the reporting trail behind every alert. See how First Compliance handles sanctions screening and goAML reporting.

Who Must File CNMR and PNMR Reports?

The obligation reaches every reporting entity in the UAE AML framework. Financial institutions supervised by the Central Bank, designated non-financial businesses and professions supervised by the Ministry of Economy and Tourism or the Ministry of Justice, and virtual asset service providers all carry the same duty. Free zone entities in DIFC, ADGM and the commercial free zones are covered through their own regulators.

The duty applies whether or not the entity has ever had a hit. A real estate brokerage that has never seen a match must still be registered and still screening. It must also be able to show a supervisor how it would file if a match appeared tomorrow.

The Two Sanctions Lists You Must Screen Against

Screening covers the UAE Local Terrorist List, maintained under Cabinet Decision No. 74 of 2020, and the UN Consolidated List issued under United Nations Security Council resolutions. Both are published through the EOCN. Commercial screening tools usually carry a wider set of lists, which is useful for risk management, but the legal freezing obligation attaches to these two.

Registering for the Notification Alert System

Reporting entities must register in the Notification Alert System on the EOCN website to receive automated notification of list changes. Registration is the control that makes the 24-hour clock workable, because the clock starts when the designation is published rather than when someone happens to notice it. Entities that rely on a vendor feed alone, without their own registration, tend to discover the gap during an inspection.

Screening must run at defined points rather than once a year:

On every update to either sanctions list
Before onboarding a new customer
At periodic KYC review, and on any material change to the customer relationship
Before processing a counterparty transaction

Our guide to ongoing monitoring in UAE AML compliance covers how these screening points sit inside the wider monitoring cycle.

The Two Clocks: 24 Hours to Freeze, Five Business Days to File

In our audit work the sanctions failures we see are usually timing failures rather than detection failures. The entity saw the alert, then took a week to work out who owned the decision. Two separate clocks run here, and they do not run in sequence.

The 24-Hour Freeze Clock

Once a match is confirmed, all funds and other assets of the designated person must be frozen without delay and within 24 hours. Nothing may be made available to the designated person, directly or indirectly, including services. No prior notice may be given. Freezing is the legal measure, and the report that follows simply evidences it.

The Five-Business-Day Filing Clock

The CNMR is filed on goAML within five business days of taking the freezing measure. The PNMR is filed within five business days of the potential match arising, with the transaction suspended meanwhile. Entities without goAML access report to the EOCN by email to tfs@eocn.gov.ae within the same five business days, though registration on goAML is the expected route for reporting entities.

Situation	Immediate action	Report type	Deadline
Confirmed match, existing customer	Freeze funds and assets, provide nothing further, no prior notice	CNMR	Within 5 business days of the freeze
Confirmed match, prospective customer	Decline the relationship, apply the prohibition on providing funds or services	CNMR	Within 5 business days of the measure
Potential match, identifiers incomplete	Suspend the transaction, seek identifiers	PNMR	Within 5 business days of the potential match
Attempted transaction by a designated person	Refuse and record the attempt	CNMR	Within 5 business days
Match discounted on verified identifiers	Release the transaction, document the reasoning	No report	Retain the evidence file

Confirmed Match or Partial Match: How to Decide

Choosing between a CNMR and a PNMR is the point where compliance teams tend to hesitate, and hesitation is what breaches the 24-hour rule. Write the test into the policy so the answer does not depend on who is on duty that day.

What Counts as a Confirmed Match

A match is confirmed when the identifiers you hold align with the identifiers published for the designated person to the point that a reasonable compliance officer would conclude they are the same person or entity. Full name plus date of birth plus nationality, or full legal name plus registration number, will usually settle it. A confirmed match triggers the freeze and the CNMR.

What Counts as a Partial Match

A match is partial when the name aligns but the supporting identifiers are missing, incomplete or inconsistent, and the entity cannot resolve the question immediately. Common names, transliterated Arabic names and entities with similar trading names produce most of these. The correct response is to suspend, not to release and hope, and not to freeze an unrelated customer. File the PNMR and record what you asked for.

Clearing a False Positive

A discounted match still needs a file. Record the alert, the identifiers compared, the source of the discounting information, the decision, the name of the person who made it and the date. This is what an inspector samples.

An alert log showing hundreds of hits closed with a one-word note reads as a control being switched off rather than operated. Our guidance on PEP screening in the UAE sets out the same discipline for politically exposed person alerts.

How to File a CNMR or PNMR on goAML, Step by Step

Filing itself is not difficult. Being ready to file at short notice is where entities fall down, because the person who holds the goAML credentials is often the person on leave when the alert lands.

Before You Log In

Confirm the entity is registered on goAML and that at least two people hold active credentials. Registration steps are covered in our goAML portal registration guide.
Confirm the freeze has already been applied and timestamped. The report describes a measure that has been taken, not one that is planned.
Assemble the customer file: identification documents, beneficial ownership records, account and asset balances at the moment of freezing, and the transaction history.
Record the screening evidence: the list version, the alert, the identifiers compared and the confirmation decision.

Filing the Report

Log in to the goAML web portal with the entity credentials.
Select the report type, CNMR for a confirmed match or PNMR for a potential match. Choosing the wrong type is a common error and creates a correction trail.
Complete the reporting entity and reporting person details, including the compliance officer contact point.
Enter the subject details exactly as held, and separately record the designation details as published.
Describe the measures taken, with the date and time of the freeze or suspension, the funds and assets affected, and any attempted transaction.
Attach supporting documents, then submit and save the acknowledgement reference.
Notify the supervisory authority as required by your regulator, and log the filing in the compliance register.

If You Do Not Have goAML Access

An entity that is not yet registered on goAML must still report within five business days, by email to the EOCN. This is a fallback, not an alternative. Failure to register is itself a reportable violation in most supervisory frameworks, so treat the email route as a bridge while registration completes.

Would your sanctions control survive a file review? ADZ conducts independent AML/CFT audits for entities regulated by the Central Bank, DFSA and VARA, and tests the freeze and reporting workflow against real alert samples. Request an independent AML/CFT audit.

The Tipping-Off Trap and Other Common Failures

The most damaging error we see in sanctions handling is warning the customer. A relationship manager who calls the client to ask about an alert, or an operations officer who explains why a payment is delayed, can convert a technical control failure into a criminal exposure.

When You May Tell the Customer

No notice may be given before the freezing measure is applied. Once the freeze is in place, informing the customer that their funds have been frozen under the UAE sanctions framework is permitted and is often necessary. The rule is about sequence. Freeze, then explain.

Other Failures Supervisors Find

Screening only new customers. The existing book is never rescreened when a list updates, so a customer designated last month stays live.
Screening only the account holder. Beneficial owners, authorised signatories, counterparties and related parties are outside the screening scope.
Alert backlogs. Hits sit in a queue for days because no service level is set for sanctions alerts, which is incompatible with a 24-hour freeze duty.
No policy ownership. The AML policy does not name who confirms a match, who authorises the freeze and who submits the report.
Stale documentation. The policy still describes the Funds Freeze Report and cites superseded legislation.
Untrained front line. Staff who meet the customer do not know what tipping off is, and no training record proves otherwise.

Training is a legal requirement rather than a nicety, and it is one of the first things requested during an inspection. Our guide on AML training requirements for UAE employees covers who must be trained and how often.

What Happens After You File

Filing does not close the matter. A freeze holds until the designated person is de-listed or the EOCN authorises release. The entity cannot lift a freeze on its own assessment, and cannot release funds because the customer produced a document disputing the designation.

Three obligations continue after the report:

Maintain the freeze. Monitor the lists for de-listing and act on EOCN instructions when they arrive.
Answer follow-up requests. The FIU or the supervisory authority may request further information, and response time is itself assessed.
Consider a parallel STR. A sanctions match often carries suspicion that is separately reportable. The two obligations are independent, and our STR filing guide sets out that route.

Record Retention Periods

Regime	Minimum retention	Applies to
UAE federal AML framework	5 years	Mainland and commercial free zone entities
DIFC	6 years	DFSA regulated firms
ADGM	6 years	FSRA regulated firms
VARA	8 years	Virtual asset service providers in Dubai

The retention clock covers the alert, the identifiers compared, the freeze instruction, the goAML acknowledgement and any correspondence with the authorities. Our AML record-keeping guide sets out the wider requirement.

Penalties for Getting Sanctions Reporting Wrong

Sanctions breaches carry a fine of not less than AED 50,000 and not more than AED 5,000,000 per violation, and imprisonment is available against natural persons. For DNFBPs supervised by the Ministry of Economy and Tourism and the Ministry of Justice, Cabinet Resolution No. 71 of 2024 sets a unified list of 41 violations with administrative fines running from AED 50,000 to AED 1,000,000.

Serious money laundering cases against legal persons reach AED 100,000,000 in court under Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. The executive regulations sit in Cabinet Decision No. 134 of 2025, in force from 14 December 2025.

The enforcement record shows this is not theoretical:

The Ministry of Economy imposed AED 22.6 million in fines on 29 DNFBP companies for 225 violations, announced in March 2023. The first violation named was failure to establish internal policies to check customer databases against the terrorism lists under Cabinet Decision No. 74 of 2020. The penalised firms included 17 precious metals and gems dealers, four corporate service providers and two audit firms.
On 24 June 2026 the Central Bank fined a foreign bank branch AED 20 million and penalised its head of compliance AED 300,000 personally, citing repeated failures across anti-money laundering and sanctions controls.
The Central Bank issued more than AED 370 million in AML/CFT penalties during 2025.

The personal penalty matters for anyone holding the compliance officer role. Responsibility for the sanctions control sits with a named individual, and the MLRO responsibilities guide sets out what that role carries in practice.

Sanctions implementation is also assessed directly in the FATF fifth round mutual evaluation, with the UAE onsite expected in mid-2026. That round weights effectiveness rather than the existence of a written policy, so a filing record with correct report types and defensible timestamps is worth more than a well-drafted manual with nothing behind it. Our FATF mutual evaluation guide covers what assessors look for.

Frequently Asked Questions

What is the difference between a CNMR and a PNMR in the UAE?

A Confirmed Name Match Report is filed when the identifiers confirm the customer or counterparty is a designated person, and it records the freezing measures taken. A Partial Name Match Report is filed when the match is only potential and cannot be confirmed or discounted, with the transaction suspended while identifiers are sought. Both are submitted through goAML within five business days.

How long do I have to file a CNMR on goAML?

Five business days from the date the freezing measure was taken. The freeze itself must happen earlier, without delay and within 24 hours of confirming the match. Missing either deadline is a separate violation, so entities should timestamp the freeze instruction and the goAML acknowledgement separately.

Is the Funds Freeze Report still called an FFR?

No. The EOCN guidance amended in March 2026 renamed the Funds Freeze Report as the Confirmed Name Match Report. Older policies, training decks and vendor documentation still use FFR. The obligation is unchanged, but internal documents should be updated to the current terminology before the next supervisory review.

Can I tell the customer their account has been frozen?

Yes, after the freeze has been applied. Telling the customer beforehand is tipping off and carries criminal exposure. Once the funds are frozen, the entity may inform the customer that the measure was taken under the UAE targeted financial sanctions framework.

What happens if I do not report a sanctions match?

Failure to freeze or report is a violation in its own right, punishable by a fine of AED 50,000 to AED 5,000,000 per violation, with imprisonment available against individuals. Supervisors also treat a missed match as evidence that the whole screening control is ineffective, which usually widens the review into the broader AML programme.

Do DNFBPs have to file CNMR and PNMR reports?

Yes. Real estate brokers, dealers in precious metals and stones, auditors, lawyers and corporate service providers carry the same screening, freezing and reporting obligations as financial institutions. The supervisory authority differs, and administrative fines for these sectors follow Cabinet Resolution No. 71 of 2024.

How often must I screen my existing customers?

Screening runs on every sanctions list update, at onboarding, at periodic KYC review, on any material change to the relationship and before processing counterparty transactions. Registration in the Notification Alert System is what makes update-driven screening possible, because it tells the entity a list has changed.

Can a sanctions match also require a suspicious transaction report?

Often, yes. The obligations are separate. A CNMR records the sanctions measure; an STR records suspicion of money laundering or terrorist financing. Where both apply, file both, and do not treat one as satisfying the other.

Official Sources

Not sure your sanctions policy reflects the current guidance? ADZ reviews screening scope, freeze authority, report routing and training records, then rewrites the policy against the framework in force. Talk to the ADZ compliance advisory team.

Sanctions compliance is one of the few areas of UAE AML where the standard is binary. Either the freeze went on inside 24 hours and the report went in inside five business days, or it did not.

Entities that hold a current list registration, a named decision owner, a written confirmed-versus-partial test and a retained evidence file for every alert can answer a supervisor in an afternoon. Entities that cannot usually find out during an inspection, when the correction costs far more. ADZ works with reporting entities across the UAE to build and test that control, covering the policy itself, First Compliance screening, independent audit and Compliance 360 training.

This article is general guidance on UAE AML/CFT obligations and is current as at August 2026. It is not legal advice. Sanctions obligations change when lists and guidance are updated, so entities should confirm the position applicable to their licence and supervisory authority before acting.