goAML Report Types UAE: STR, SAR, DPMSR and REAR Guide

A compliance officer at a Dubai gold trading house spots a customer splitting AED 160,000 in cash across three visits in one week. That single pattern can require two different filings on the same portal, and picking the wrong one is a finding in itself. The UAE Financial Intelligence Unit runs a family of goAML report types, each with its own trigger, and this guide sets out which one applies, when, and what an inspector expects to see behind it.

Last updated: 21 October 2026. Written by the ADZ compliance advisory team for MLROs and compliance officers at UAE financial institutions, DNFBPs and VASPs.

Quick Answer

goAML report types fall into three groups. Suspicion reports (STR and SAR) are filed without delay when you suspect money laundering or terrorist financing. Threshold reports (DPMSR and REAR) are filed when a defined payment occurs, suspicion or not. Sanctions reports (CNMR and PNMR) follow a name match, and AIF, AIFT, HRC and HRCA cover follow-ups and high-risk countries.

Key Takeaways

Each report has its own trigger. goAML treats an STR, a SAR, a DPMSR and a CNMR as separate report types, and inspectors test whether you chose the right one.
Transaction or no transaction decides STR vs SAR. An STR records a suspicious transaction, including an attempted one. A SAR records suspicious activity where no transaction took place.
Threshold reports ignore suspicion. Dealers in precious metals and stones file a DPMSR, and real estate brokers file a REAR, when a cash payment reaches AED 55,000.
The FFR is now the CNMR. The Executive Office for Control and Non-Proliferation renamed the Funds Freeze Report as the Confirmed Name Match Report in its March 2026 guidance update.
One event can need two reports. A suspicious AED 55,000 cash purchase of gold needs a DPMSR for the threshold and an STR for the suspicion.
Sanctions clocks are short. A confirmed match is frozen within 24 hours and reported within five business days.
The penalty exposure is real. Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 set administrative fines of AED 5 million to AED 100 million for legal entities in breach.

What Are goAML Report Types?

Definition: goAML report types. goAML is the reporting platform the UAE Financial Intelligence Unit uses to receive filings from reporting entities. A report type is the category you select when you open a new filing. It tells the FIU why you are reporting: suspicion, a threshold payment, a sanctions match, a high-risk country link, or a reply to an earlier request.

The legal duty to report comes from Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its implementing regulation, Cabinet Decision No. 134 of 2025, came into force on 14 December 2025 and repealed Cabinet Decision No. 10 of 2019.

Together they require financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers to report to the FIU through goAML. Our Federal Decree-Law No. 10 of 2025 guide covers the wider changes.

Your supervisor depends on your licence. Banks, exchange houses and finance companies answer to the Central Bank of the UAE (CBUAE). Mainland DNFBPs answer to the Ministry of Economy and Tourism (MOET) or the Ministry of Justice.

Firms in the DIFC answer to the DFSA, firms in ADGM to the FSRA, and Dubai virtual asset firms to VARA. All of them file through the same goAML report types, so the selection rules below apply across the country.

Why do the three report groups matter?

Each group answers a different question. A suspicion report tells the FIU that something looks wrong. A threshold report records that a defined payment happened, and a sanctions report records that a listed name matched a customer.

A file that mixes these up, such as an STR filed where a REAR was required, tells an inspector the reporting procedure was never mapped to the real obligations. With the UAE’s FATF mutual evaluation running in 2026, supervisors check whether entities pick the correct goAML report types, and they look at quality as closely as volume.

Which goAML Report Types Does the UAE FIU Accept?

The table below maps each report type to its trigger, the businesses that file it, and the timing standard. Use it as the first page of your reporting procedure.

Report	Full name	Trigger	Who files	Timing
STR	Suspicious Transaction Report	Suspicion linked to a completed or attempted transaction	All FIs, DNFBPs and VASPs	Without delay
SAR	Suspicious Activity Report	Suspicious behaviour with no transaction	All FIs, DNFBPs and VASPs	Without delay
AIF	Additional Information File	Extra information on an earlier report, no transaction data	Any reporting entity	On discovery or by the FIU’s deadline
AIFT	Additional Information File with Transactions	Extra information that includes transaction data	Any reporting entity	On discovery or by the FIU’s deadline
HRC	High Risk Country Transaction Report	Transaction linked to a high-risk jurisdiction	Entities directed by their supervisor	Per supervisor guidance
HRCA	High Risk Country Activity Report	Activity linked to a high-risk jurisdiction, no transaction	Entities directed by their supervisor	Per supervisor guidance
DPMSR	Dealers in Precious Metals and Stones Report	Cash transaction, single or linked, of AED 55,000 or more	Dealers in precious metals and stones	Per MOET guidance
REAR	Real Estate Activity Report	Freehold deal with AED 55,000 or more in cash, or any virtual asset payment	Real estate brokers, agents, lawyers, notaries	Per MOET guidance
CNMR	Confirmed Name Match Report	Confirmed match to a sanctions list	All reporting entities	Freeze within 24 hours, report within 5 business days
PNMR	Partial Name Match Report	Potential match that cannot be confirmed or discounted	All reporting entities	Suspend, report within 5 business days

The portal also handles the FIU’s own requests to you. A Request for Information (RFI) arrives in your goAML message board and is answered through an AIF or AIFT. Registration comes first: you cannot file any of these until your entity and its users are approved on the portal, which our goAML registration guide walks through step by step.

STR vs SAR: How Do You Choose the Right Suspicion Report?

The STR and the SAR are the two report types most often confused, because many global firms use the terms as synonyms. goAML does not. The deciding question is simple: did a transaction happen, or was one attempted?

When is an STR the correct report?

File an STR when your suspicion attaches to a transaction. That includes a payment received, a transfer sent, a purchase completed, or a transaction the customer attempted and you refused. The STR carries the transaction details, the parties, and your reasoning.

A customer deposits cash in amounts just under internal review limits on consecutive days.
A client pays for a property from a third-party account with no clear link to the buyer.
A customer tries to buy gold bars with cash, then walks away when asked for source of funds documents.

When is a SAR the correct report?

File a SAR when the suspicion comes from behaviour and no transaction exists. A prospective client who abandons onboarding after an identity check fails is a typical case. So is a customer who asks how to stay under reporting limits, or adverse news about an existing client with no new transactions on file.

What does “without delay” mean in practice?

The law sets no fixed number of days. Supervisors read “without delay” as soon as the suspicion is formed and documented. An internal escalation that sits in an MLRO’s inbox for three weeks is the kind of gap inspectors flag. Our guide on how to file an STR in the UAE sets out a workable escalation timeline.

Two rules apply to both report types. You must not tip off the customer that a report has been made or is being considered, which our tipping off guide covers in detail. And failing to report a suspicious transaction can draw a fine of up to AED 5,000,000 under the 2025 framework, on top of supervisory action against the entity.

Spend less time on goAML paperwork. First Compliance automates CDD, sanctions screening and goAML reporting, screening against 1,800+ sanction lists and 5.5M+ PEP records so each report rests on a documented check. See how First Compliance works.

What Are AIF and AIFT Reports Used For?

Additional information files keep the FIU’s picture of a case current. They are not a fresh report. They attach to a report you have already filed, or answer a request the FIU has sent.

AIF is used when the new information has no transaction data, such as an updated address, a new beneficial owner, or adverse media found after the original STR.
AIFT is used when the new information includes transactions, such as further payments on an account already reported.

Here is the working rule. If a customer you already reported keeps behaving the same way, file an AIF or AIFT linked to the original report. A new STR is only right when the new activity is a different suspicion.

Keep the original report reference on the customer file so any analyst can link the two. When the FIU sends an RFI, reply through the same route and within the deadline stated in the request.

When Do HRC and HRCA Reports Apply?

HRC and HRCA reports cover transactions and activity linked to jurisdictions the UAE treats as high risk. The starting point is the FATF list of high-risk jurisdictions subject to a call for action. In its 19 June 2026 statement, FATF kept the Democratic People’s Republic of Korea, Iran and Myanmar on that list. You can check the current position on the FATF website.

Supervisors can add to that list. For mainland DNFBPs, the Ministry’s circular MOET/AML/001/2026, dated 11 March 2026, updated the high-risk and increased-monitoring country lists used for CDD and EDD. Reporting entities should take their list from their own supervisor, not from a vendor feed alone.

HRC: a transaction where a party, an account, an intermediary bank or the goods route touches a listed jurisdiction.
HRCA: activity with no transaction, such as an onboarding request from a person resident in a listed jurisdiction.

An HRC records a jurisdiction link and says nothing about suspicion. If the transaction is also suspicious, file an STR as well. Apply enhanced due diligence to every relationship that touches these jurisdictions, as the EDD guide explains.

Which Threshold Reports Apply to DPMS and Real Estate?

Two sectors carry mandatory threshold reports, and both use the same AED 55,000 figure. That shared number is a common source of confusion, so map each one separately.

DPMSR for dealers in precious metals and stones

A dealer files a DPMSR when a single cash transaction, or a series of linked cash transactions, reaches AED 55,000 or more. Suspicion plays no part in the trigger. The opening example in this guide, AED 160,000 in cash across three visits, crosses the threshold through linked transactions, so a DPMSR is due regardless of how the dealer views the customer. Our DPMS compliance guide covers the wider obligations, including CDD and record-keeping.

REAR for real estate brokers, agents, lawyers and notaries

A REAR is filed when a freehold property purchase or sale includes a cash payment of AED 55,000 or more, single or linked, or any payment in virtual assets, however small. Rentals and off-plan deposits that never reach a title transfer do not trigger a REAR on their own. The full trigger detail and filing steps are in our Real Estate Activity Report guide.

Point	DPMSR	REAR
Sector	Dealers in precious metals and stones	Real estate brokers, agents, lawyers, notaries
Cash trigger	AED 55,000, single or linked	AED 55,000, single or linked
Virtual asset trigger	Not the core trigger	Any amount
Suspicion needed?	No	No
Supervisor	Ministry of Economy and Tourism	Ministry of Economy and Tourism
Replaces an STR?	No	No

Keep the AED 55,000 reporting figure apart from the AED 60,000 cross-border declaration limit, which is a customs obligation on travellers. Supervisors test for this exact mix-up during inspections. The cash transaction reporting guide sets the three figures side by side.

How Do CNMR and PNMR Differ From Suspicion Reports?

CNMR and PNMR are sanctions reports. They record what you did after screening matched a customer or counterparty to the UAE Local Terrorist List or the United Nations Consolidated List. They do not express suspicion of money laundering, and they run on fixed clocks.

CNMR: the identifiers confirm the match. Freeze all funds and assets without delay and within 24 hours, without notifying the customer, then file the CNMR within five business days of the freeze.
PNMR: the match is possible but cannot be confirmed or discounted on the information you hold. Suspend the transaction and file the PNMR within five business days.

What happened to the Funds Freeze Report (FFR)?

Older policies, training decks and vendor manuals still refer to the Funds Freeze Report, or FFR. The Executive Office for Control and Non-Proliferation renamed it the Confirmed Name Match Report when it amended its targeted financial sanctions guidance in March 2026. The obligation did not change, but a policy that still says FFR tells an inspector the framework has not been refreshed. Update the term across your manual, your screening workflow and your training material.

For the full decision path on matches, read our guides on CNMR and PNMR filing and sanctions screening alert management.

Not sure your reporting procedure maps to the right goAML report types? ADZ’s compliance advisory team reviews your triggers, escalation path and filing history, then tells you where the gaps are. Talk to our advisory team.

Can One Event Need Two goAML Reports?

Yes, and this is where many filing errors start. The goAML report types answer different questions, so one event can trigger more than one. The table shows common combinations.

Scenario	Reports required
Gold dealer receives AED 70,000 in cash from a customer who cannot explain the source	DPMSR (threshold) and STR (suspicion)
Broker closes a freehold villa sale with AED 55,000 in cash, buyer profile is consistent	REAR only
Broker closes a sale part-paid in crypto from an unhosted wallet with mixing history	REAR (virtual asset) and STR
Screening confirms a customer matches the UAE Local Terrorist List	Freeze, then CNMR; add an STR if there is also suspicion of terrorist financing
Exchange house processes a transfer routed through a call-for-action jurisdiction	HRC; add an STR if the transfer is also suspicious
Prospect abandons onboarding after an ID mismatch, no funds received	SAR
Further cash deposits on an account already reported	AIFT linked to the original STR

Record the reasoning for every combination. When an inspector asks why a DPMSR had no matching STR, the answer should be a dated note on file, not a recollection.

What Are the Most Common goAML Filing Errors?

In ADZ’s audit and advisory work across UAE DNFBPs and financial institutions, the same reporting faults come up again and again. Most of them sit in procedure, and very few are portal problems. Mixing up goAML report types tops the list.

Wrong report type. A SAR filed where a transaction was involved, or an STR filed where only a REAR was required.
Threshold missed on linked payments. Instalments or split cash payments are not added together, so the AED 55,000 trigger is never caught.
Thin narrative. The reason for suspicion is a single line. The FIU needs the who, what, when and why, plus what the customer said when asked.
Retired terminology. Policies still name the FFR, cite Federal Decree-Law No. 20 of 2018 as current, or refer to Cabinet Decision No. 10 of 2019.
No link between follow-ups. Repeat activity is filed as new STRs instead of AIF or AIFT entries tied to the first report.
Slow escalation. Staff raise an internal alert, but the MLRO decision is not dated, so “without delay” cannot be shown.
Single-user access. Only one person holds goAML credentials, so reporting stops when that person is on leave.
Missing records. Copies of reports and the analysis behind them are not kept for the full five years required under the UAE record-keeping rules.

How Do You Build a goAML Report Selection Procedure?

A written procedure turns the table above into a repeatable decision. Build it in seven steps.

Map your sector obligations. List which goAML report types apply to your licence. A bank will not file DPMSRs, while a brokerage will file REARs.
Write a decision tree. Start with “is there a sanctions match?”, then “did a threshold payment occur?”, then “is there suspicion, and was there a transaction?” Each answer points to a report type.
Set internal clocks. Define how many hours staff have to escalate, and how quickly the MLRO decides. Write the 24-hour freeze and five-business-day sanctions deadlines in full.
Configure your systems. Set transaction monitoring to aggregate linked cash payments against the AED 55,000 trigger, and set screening to route confirmed and partial matches to separate queues.
Assign goAML users. Register at least two authorised users, with the MLRO and a deputy, so filings continue during absence.
Train by scenario. Run staff through the combination scenarios above. Front-line staff do not file reports, but they must know what to escalate.
Test it annually. Sample filed and unfiled cases each year, check report-type choice and timing, and record the results. An independent AML audit is the cleanest way to evidence this.

Tie the procedure to your enterprise-wide risk assessment. A business that rates cash-heavy customers as high risk should expect more DPMSR or REAR filings and staff the function to match.

Train your team on goAML reporting. Compliance 360 offers 32 specialised AML/CFT courses, KHDA-approved, covering STR drafting, threshold reporting and sanctions procedures. Explore Compliance 360 training.

Frequently Asked Questions

What is the difference between an STR and a SAR on goAML?

An STR is filed when suspicion is linked to a completed or attempted transaction. A SAR is filed when the suspicion comes from behaviour or information and no transaction took place. Both are filed with the UAE FIU without delay, and tipping off the customer is prohibited for both.

Is the Funds Freeze Report (FFR) still a goAML report type?

No. The Executive Office for Control and Non-Proliferation renamed the Funds Freeze Report as the Confirmed Name Match Report (CNMR) in March 2026. The obligation is the same: freeze within 24 hours of confirming a sanctions match, then report within five business days.

Do I need to file an STR as well as a DPMSR?

Only if the transaction is also suspicious. A DPMSR is a threshold report triggered by cash of AED 55,000 or more. It does not replace an STR. If the payment looks suspicious, file both, and record why on the customer file.

What is the AED 55,000 threshold in goAML reporting?

It is the cash trigger for two threshold reports. Dealers in precious metals and stones file a DPMSR, and real estate brokers, agents, lawyers and notaries file a REAR, when a single or linked cash payment reaches AED 55,000. A REAR is also required for any virtual asset payment in a freehold deal.

When should I use an AIF instead of a new STR?

Use an AIF or AIFT when you are adding information to a report already filed, or answering an FIU Request for Information. Use AIFT when the new information includes transactions. File a new STR only if the new activity represents a different suspicion.

Who must file HRC and HRCA reports in the UAE?

Reporting entities directed by their supervisor file an HRC for transactions, and an HRCA for activity, linked to jurisdictions the UAE treats as high risk. The FATF call-for-action list is the starting point, and supervisors such as the Ministry of Economy and Tourism publish their own updated lists.

What is the penalty for not filing a required goAML report?

Failing to report a suspicious transaction can draw a fine of up to AED 5,000,000. Under Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, administrative fines for legal entities in breach reach AED 5 million to AED 100 million, with licence action possible for repeated failures.