Transaction monitoring and reporting

Customer Due Diligence (CDD) is the assessment of who a customer is and how risky they are, carried out at onboarding and refreshed periodically. Transaction monitoring is the continuous review of what that customer actually does once the relationship is live — comparing real transaction activity against the risk profile and expected behaviour CDD established, to detect activity that may be connected to money laundering, terrorist financing, or proliferation financing. Both are required under the AML/CFT Law, and they work together: monitoring without a CDD-based risk profile to measure against has no defensible baseline for what counts as unusual.

It is a legal obligation, not an optional enhancement. Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions require regulated entities to maintain ongoing vigilance over customer transactions as part of the risk-based AML/CFT programme, and to report through goAML whenever monitoring — or any other means — gives rise to reasonable grounds for suspicion. A CDD programme with no ongoing monitoring behind it does not satisfy the full statutory obligation.

A Suspicious Transaction Report (STR) is filed when there are reasonable grounds to suspect that a specific transaction, or funds involved in it, are connected to money laundering or an underlying crime. A Suspicious Activity Report (SAR) is broader and can relate to a suspicious pattern of activity or an underlying relationship, including terrorist-financing concerns, even where no single discrete transaction is the trigger. Both are filed through goAML and both carry the same 'without delay' filing expectation once suspicion is reasonably formed.

It is a lower bar than proof or certainty — it means the facts available, viewed objectively, would lead a reasonable person in the entity's position to suspect a connection to money laundering, terrorist financing, or an underlying crime. It does not require the entity to have investigated and confirmed the suspicion, and it does not require the transaction to have actually completed. Waiting for certainty before escalating is itself a common cause of late or missed filings.

The AML/CFT Law requires reporting entities to file an STR or SAR promptly once reasonable suspicion is formed — it does not permit sitting on a suspicion while conducting an extended internal investigation, waiting to see how the transaction plays out, or delaying until a supervisory inspection prompts disclosure. Internal escalation and review should happen quickly, with the report filed as soon as the suspicion is reasonably formed, not once it is fully proven.

Value thresholds catch only the most obvious cases. Genuine red-flag patterns include structuring (breaking a large transaction into smaller ones to avoid a reporting threshold), rapid or circular movement of funds with no apparent commercial rationale, unexplained third-party payments, transaction activity materially inconsistent with a customer's stated business profile or the volumes anticipated at onboarding, use of multiple accounts or entities with no clear business reason, and sudden, unexplained changes in transaction pattern or counterparty.

First-line review is typically performed by a trained staff member close to the transaction — often the person who processed it or manages the customer relationship — who documents whether the alert can be cleared against defined criteria or must be escalated. The decision on whether reasonable grounds for suspicion exist, and whether to file an STR/SAR, rests with the designated Compliance Officer/MLRO, who must be sufficiently senior and empowered to make that call independently.

Tipping off is directly or indirectly informing a customer, or any third party, that a Suspicious Transaction Report has been filed, is being considered, or that an investigation is underway. It is a separate offence under the AML/CFT Law from the underlying suspected conduct, because it defeats the purpose of the reporting mechanism by allowing the customer to move funds or destroy evidence once alerted. This risk is highest during the escalation window, when front-line staff who noticed the alert may be tempted to explain to the customer why a transaction is delayed.

Thresholds should be calibrated against the entity's actual historical transaction data and its documented risk assessment, not copied from a generic industry template. PNPC tests proposed rules against a sample of the entity's real recent transaction history before go-live specifically to confirm the alert volume is meaningful — neither so high it floods the Compliance Officer with false positives that get rubber-stamped through fatigue, nor so low that genuinely unusual activity passes through unflagged.

The underlying legal obligation — ongoing vigilance calibrated to risk, with escalation and reporting when suspicion arises — applies across regulated categories, but the practical shape of monitoring differs materially. A bank runs automated, high-volume transaction-screening systems; a real estate broker or corporate service provider more often runs a smaller number of higher-value, lower-frequency transactions reviewed with a combination of defined thresholds and manual judgment. PNPC scales the monitoring design to the entity's actual transaction profile rather than imposing a bank-style system on a business that does not need or cannot support one.

Sanctions and Politically Exposed Person (PEP) screening should not be a one-time check at onboarding — lists are updated, sometimes with immediate effect, and a name that screened clean when the relationship began can appear on a list later. PNPC integrates periodic re-screening of the existing customer base into the same monitoring calendar as transaction review, so a list update is checked against live relationships, not just new ones.

A confirmed match against the UN Consolidated Sanctions List or the UAE Local Terrorist List triggers a distinct obligation from STR/SAR reporting: the entity must freeze the relevant funds without delay and file a Fund Freeze / Funds Awaiting Return report through goAML. This is a separate filing mechanism from suspicious-activity reporting, and it is triggered by the list match itself rather than by any assessment of the underlying transaction's legitimacy.

At minimum: the documented monitoring rules and thresholds in force, a log of every alert generated with its review date and reviewer, the clearance rationale or escalation decision for each alert, any STR/SAR filed and the internal escalation trail behind it, and periodic re-screening records. The AML/CFT Law's general record-retention requirements apply — records should be kept for the prescribed minimum period and be retrievable within the timeframe a supervisor gives, not merely stored somewhere.

The most frequent finding PNPC sees is a documented monitoring policy with no evidence of actual, consistent execution — no alert log, alerts cleared with no recorded rationale, or a Compliance Officer who cannot answer specific questions about recent alert decisions when interviewed. A second frequent finding is monitoring built only on fixed-value thresholds with no behavioural or pattern-based indicators, which structuring and more sophisticated activity are specifically designed to evade.

Yes. Where a business has already identified a specific transaction or relationship it considers suspicious and needs to escalate and file without delay, PNPC can support that filing directly and urgently, working with whoever holds or is stepping into the Compliance Officer role. We will also flag, separately, if the underlying gap that let the alert reach this stage without earlier detection — for example, no monitoring rules at all — needs addressing so the same gap does not recur.

We calibrate escalation criteria against the entity's documented risk assessment and its actual historical transaction data, then test the resulting alert volume before go-live. If testing shows an unworkable flood of low-value false positives, thresholds are adjusted; if testing shows almost no alerts generated against a transaction profile the risk assessment flags as higher-risk, criteria are tightened. This is an iterative calibration exercise, not a one-time guess.

PNPC designs the monitoring rules, escalation workflow, and disposition record-keeping system, trains the staff who operate it, and provides ongoing advisory including urgent support at the point of a live escalation. The statutory Compliance Officer/MLRO role, and the day-to-day decision on whether reasonable grounds for suspicion exist, must sit with a suitably senior individual inside the regulated entity itself, since that role carries an accountability an external adviser cannot exercise on the entity's behalf.

At minimum annually, in line with the broader AML/CFT risk-assessment review cycle, and additionally whenever there is a material change in the business — a new product or service line, a significant shift in transaction volumes, entry into a new customer segment or geography, or relevant new Cabinet Decision, FIU, or Ministry of Economy guidance. Thresholds calibrated once at build and never revisited drift out of alignment with the business as it grows and changes.

Inspectors typically request the documented monitoring rules and thresholds, sample a cross-section of generated alerts and their disposition, ask the Compliance Officer to walk through recent escalation decisions and explain the reasoning, and check that any STR/SAR filed shows a filing date consistent with the 'without delay' expectation relative to when suspicion first arose. They also commonly test whether ongoing sanctions/PEP re-screening is actually running against the existing customer base, not just new onboarding.

PNPC agrees a fixed, written fee for the monitoring programme design and build, scoped to the complexity and transaction volume of the business — a single-office corporate service provider and a multi-branch real estate brokerage require materially different depth of work. Ongoing advisory for threshold review, re-screening cadence, and urgent escalation support is quoted separately as a retainer, also fixed and agreed in writing.

The underlying legal obligation — ongoing vigilance calibrated to risk, escalation, and reporting through goAML when suspicion arises — applies regardless of whether the entity is mainland or free zone, since it flows from the same AML/CFT Law. What differs is the supervisory layer sitting on top: a DIFC entity answers to the DFSA and an ADGM entity to the FSRA for AML purposes, alongside the federal framework, while most mainland and other free zone DNFBPs answer to the Ministry of Economy. The monitoring design itself should be built once against the entity's actual transaction profile, then checked against whichever supervisor's specific expectations apply.

Management and financial reporting reviews transactions to produce accurate accounts and business insight — profitability, cash position, variance against budget. AML transaction monitoring reviews the same underlying transaction data for a completely different purpose: detecting patterns connected to money laundering, terrorist financing, or proliferation financing, measured against a customer's risk profile rather than against a budget or accounting standard. The two exercises can draw on overlapping source data but serve different objectives, use different rules, and answer to different obligations.

A small DNFBP with modest transaction volume can often run a well-designed manual process — a disciplined alert log, clear thresholds, and a defined reviewer — that satisfies the obligation appropriately for its scale. What cannot be skipped regardless of size is a human reviewer applying judgment to genuinely ambiguous cases; software can flag transactions against rules, but the assessment of whether reasonable grounds for suspicion exist is a judgment call software does not make on its own.

A material, sustained change in transaction volume or pattern is exactly the kind of business change that should trigger an off-cycle threshold review rather than waiting for the next scheduled annual review — thresholds calibrated to a lower volume can either flood the Compliance Officer with false positives at higher volume or, if loosened informally without proper recalibration, miss genuinely unusual activity within the new normal.

It is a genuine red flag and a relevant factor, but the filing decision turns on whether the facts as a whole give rise to reasonable grounds for suspicion, not on any single indicator viewed in isolation. A customer who cannot immediately explain a transaction may have a legitimate but complicated reason; the Compliance Officer's role is to assess that factor alongside the customer's risk profile, the transaction pattern, and any other red flags present, not to treat non-explanation alone as automatically dispositive.

A customer flagged for Enhanced Due Diligence at onboarding — a PEP, a higher-risk jurisdiction exposure, a complex ownership structure — should carry a correspondingly tighter monitoring cadence once the relationship is live, not just a more thorough one-time check at the door. PNPC designs monitoring thresholds with an explicit higher-risk tier so that EDD customers are reviewed more frequently and against tighter thresholds than the general customer base.

A false positive is an alert generated by the monitoring rules that, on review, turns out not to reflect genuinely unusual or suspicious activity — for example, a large but entirely ordinary transaction for that particular customer's business. A properly cleared alert is one where that determination has been reviewed and documented with a stated rationale. The two terms are not interchangeable: 'false positive' describes the underlying nature of the transaction, while 'cleared' describes that the review process was actually carried out and recorded.

PNPC scopes AML advisory and monitoring design as a distinct engagement from accounting, audit, or tax work for the same client, with clear internal separation of the teams and files involved, so that the advisory relationship on monitoring design does not compromise the independence expected of any separate statutory audit engagement. Where a genuine independence conflict exists for a specific engagement combination, we flag it and scope accordingly rather than assuming one team can simply do both.

Yes. A confirmed sanctions-list match and a suspicious transaction are treated as separate triggers with separate obligations — a Fund Freeze / Funds Awaiting Return report on the list match, and potentially an STR/SAR if the same underlying facts also give rise to reasonable grounds for suspicion independent of the list hit. The two filings are not mutually exclusive, and a Compliance Officer should assess both angles rather than assuming one filing type automatically covers the other.

Structuring across related entities is harder to detect than within a single customer relationship because each individual account may look unremarkable in isolation. Where the entity has visibility across genuinely related customers — common ownership, common beneficial owners, or a known business relationship between them — monitoring rules should be designed to look at aggregate activity across the related group, not just at each account independently, since that is precisely the pattern structuring is designed to exploit.

The AML/CFT Law's 'reasonable grounds for suspicion' standard is deliberately a lower bar than certainty, and filing in good faith on facts that later turn out to have an innocent explanation is not treated as a compliance failure — the failure the Law is concerned with is not filing when reasonable suspicion existed, not filing too readily. That said, chronic, poorly-targeted over-filing driven by badly calibrated thresholds is its own problem, since it degrades the Compliance Officer's ability to distinguish genuinely significant alerts from noise.

A shift in transaction frequency or pattern that departs materially from the profile established at onboarding is itself a monitoring trigger, independent of whether any individual transaction looks unusual — the change in behaviour is the signal. PNPC designs monitoring rules to flag this kind of profile drift specifically, rather than relying only on static value thresholds that a gradually escalating pattern can pass through undetected at each individual step.

They are unrelated regimes with different objectives and, since Cabinet Decision No. 98 of 2024, different current status — Economic Substance Regulations notification and reporting was discontinued for financial years starting on or after 1 January 2023, meaning ESR is now largely a closed, historical-period question for most entities, while AML/CFT transaction monitoring and reporting remains a live, ongoing obligation with no equivalent discontinuation. An entity's monitoring programme is not affected by its ESR status either way.

VASPs, regulated in Dubai by the Virtual Assets Regulatory Authority and by equivalent frameworks elsewhere in the UAE, generally face more stringent and more technically specific monitoring expectations than traditional DNFBPs, including obligations connected to transferring identifying information alongside virtual asset transfers and monitoring blockchain-based transaction patterns that have no direct analogue in cash or bank-transfer monitoring. A business that begins accepting or facilitating virtual asset transactions should treat this as a scope change requiring monitoring redesign, not an incremental addition to an existing traditional-payment monitoring rule set.

The Compliance Officer/MLRO holds the statutory decision-making authority on whether reasonable grounds for suspicion exist and whether to file, and that authority sits above the front-line reviewer's initial assessment. A front-line reviewer's clearance recommendation is an input to the Compliance Officer's decision, not a final determination — the escalation workflow should make clear that any alert can be escalated further for the Compliance Officer's independent view, even where the front-line reviewer initially leaned toward clearing it.

Urgent single-transaction support focuses narrowly on the specific facts giving rise to suspicion, the internal escalation trail for that one matter, and the goAML filing itself — it does not require the entity to have a complete monitoring programme in place first, though PNPC will flag if the underlying gap that let the alert reach this stage untreated needs addressing separately. A full programme engagement produces the broader documented rule set, escalation workflow, and disposition system that the urgent filing sits within once built.

PNPC draws on cross-sector and cross-client experience to inform what a workable threshold range typically looks like for a given business type and volume, while calibrating the actual rules for each client against that specific entity's own historical transaction data rather than another client's figures — client-specific data is never shared across engagements, and the final threshold set is always tested against the entity's own transaction history before go-live.

A correspondent bank or banking partner conducting its own periodic AML review of a business customer will often ask to see evidence of the entity's transaction monitoring controls — thresholds, escalation process, and disposition records — as part of its own risk assessment of maintaining the account relationship. Being able to produce a coherent, documented monitoring programme on request materially strengthens the entity's position in that conversation, compared to describing a process that exists informally or only on paper.

Alert logs, escalation records, and any STR/SAR-related documentation are handled under strict internal confidentiality, consistent with the tipping-off prohibition and the sensitivity of the underlying information, with access limited to the specific staff involved in the engagement. PNPC does not disclose the existence or content of any filing or escalation to any party outside the engagement, including within the client's own organisation beyond those with a legitimate need to know.

AML transaction monitoring looks for activity connected to money laundering, terrorist financing, or proliferation financing — typically focused on the source, movement, and purpose of funds relative to a customer's risk profile. Fraud monitoring typically looks for activity indicating the entity itself, or a third party, is being defrauded — unauthorised transactions, account takeover, or payment diversion. The two disciplines can share some detection techniques and occasionally overlap in a single flagged transaction, but they serve different legal obligations and are assessed against different standards.