Report money laundering UAE concerns through the correct official channel and preserve the evidence before taking further action.
The correct reporting route depends on who you are and what you observed. A bank, exchange house, virtual-asset provider, real-estate broker, dealer in precious metals or stones, lawyer acting within a covered transaction, accountant, or company-service provider may be a regulated reporting entity. A customer, employee, victim, or member of the public ordinarily does not file the same statutory report through an employer’s goAML account.
Using the wrong channel can delay action, expose confidential information, or turn an ordinary customer complaint into an incomplete allegation. The reporter must distinguish a Suspicious Transaction Report or Suspicious Activity Report to the UAE Financial Intelligence Unit, a criminal complaint to the relevant police authority, regulatory-misconduct information concerning a supervised entity, and a service or compensation complaint. Suspicion should be described accurately without presenting unverified conclusions as established fact.
How Do You Report Suspicious Activity in the UAE?
A UAE reporting entity must submit a detailed STR, SAR, or other applicable report to the Financial Intelligence Unit without delay through goAML when suspicion or reasonable grounds arise, regardless of value.
A member of the public should report suspected criminal conduct to the relevant police authority, while suspected AML misconduct by a CBUAE-regulated entity has a separate Central Bank channel.
Classify the reporter, subject, conduct, urgency, and intended outcome first. Then use the authorized channel, preserve the evidence and decision trail, avoid tipping off, and keep the intelligence report separate from customer-service, employment, recovery, or compensation processes.
How to report money laundering in the UAE? Framework
Federal Decree-Law No. 10 of 2025 is the current federal law on money laundering, terrorism financing, and proliferation financing. It took effect on 14 October 2025 and repealed Federal Decree-Law No. 20 of 2018. Cabinet Resolution No. 134 of 2025 is the current executive regulation and has applied since 14 December 2025. Reporting procedures and internal policies should not rely on the repealed 2018 law or 2019 regulation.
Article 11 establishes the Financial Intelligence Unit as an independent unit within the Central Bank. The FIU receives and analyses suspicious transaction information, seeks additional material, disseminates intelligence, and coordinates with domestic and international authorities. A report is an intelligence trigger, not a criminal judgment and not proof that the customer or counterparty committed an offence.
Article 18 imposes the statutory reporting duty on financial institutions, designated non-financial businesses and professions, and virtual-asset service providers. The scope of those categories and the detailed reporting method are developed through the Executive Regulation and supervisory guidance. A business should confirm its regulated activity and supervisor instead of assuming that an ordinary commercial licence either creates or removes goAML obligations.
Unsure Which UAE Reporting Route Applies?
Whether the issue involves goAML, a police complaint, or a regulatory-misconduct report, the correct route depends on who is reporting, what happened, and which authority has jurisdiction.
Who Files Through goAML and When
A regulated entity must notify the FIU directly and without delay when it suspects, or has reasonable grounds to suspect, that a transaction or funds are wholly or partly proceeds of a crime, related to a crime, or intended for use in a crime. The duty applies regardless of value. Attempted, declined, or incomplete transactions and suspicious activity without a completed transfer may still require the appropriate report type.
The employee who notices the concern should follow the approved internal escalation route to the compliance officer or MLRO. The decision should examine the customer profile, beneficial ownership, source and destination of funds, transaction purpose, counterparties, geography, products, devices, documents, prior alerts, and whether the behavior has a legitimate explanation. The goal is not to prove the predicate offense before reporting.
The compliance function should choose the report type that fits the facts, complete the required goAML fields, attach available supporting material, state the indicators, and explain the suspicion in a clear chronology. Vague labels such as unusual transfer or possible fraud do not explain what happened. The narrative should distinguish verified facts, system data, customer explanations, missing information, analysis, and the reason the pattern creates suspicion.
- Record when the alert arose, who reviewed it, and when the reporting decision was made.
- Include attempted transactions and linked activity where they form part of the pattern.
- Use the goAML message board for correspondence about an already filed report.
- Respond promptly to FIU requests for additional information and preserve the response record.
What Information Makes a Suspicious Report Useful
A useful report identifies the customer and beneficial owner, relevant accounts or wallets, transaction dates and amounts, currency or asset type, originators and beneficiaries, counterparties, countries, branches or channels, device or contact data where available, and the products or services used. It should explain how the activity differs from the expected profile and how separate events connect.
Attach lawful, relevant material such as customer-identification records, beneficial-owner documents, statements, transaction logs, invoices, contracts, onboarding information, source-of-funds documents, screening results, internal alerts, communications, and open-source information retained under the entity’s procedures. Do not modify originals, create retrospective documents, or include irrelevant personal data merely to make the report appear extensive.
A chronology is usually more useful than a conclusion. State what happened first, what triggered review, what information was requested, what response was received, what inconsistency remained, and which transactions or conduct create suspicion. If an amount, identity, translation, or ownership link is uncertain, say so. Accuracy protects the usefulness and credibility of the report.
How an Individual or Member of the Public Should Report
A private individual who is not reporting on behalf of a regulated entity should not assume that the employer or institution’s goAML account is a public complaint portal. Suspected criminal conduct can be reported to the competent local police authority. The UAE Government’s official economic-crime guidance directs the public to local police for fraud, scams, cybercrime, and other general economic crimes; Dubai Police also provides criminal-report and eCrime channels.
Where the concern is AML/CFT regulatory misconduct by an institution regulated by the Central Bank or a connected person, the CBUAE accepts reports from members of the public through its regulatory-misconduct channel. The report should identify who acted, what occurred, when and where it happened, how it was noticed, and whether another authority has been contacted. Employment grievances, matters for Sanadak, and issues involving institutions outside the CBUAE’s remit are excluded from that route.
A customer complaint about a delayed transfer, frozen account, service failure, fee, or disputed banking decision is not automatically a money-laundering report. It may require the institution’s complaint process and, where applicable, Sanadak or another supervisor. A victim seeking recovery may also need a police complaint, bank recall or fraud process, preservation request, and civil advice. Each route has a different purpose.
- Use official authority websites, applications, service centres, or verified contact details.
- Provide a factual chronology, transaction references, parties, amounts, documents, and contact details.
- Do not transfer more money, confront suspected participants, or announce the report publicly.
- For immediate danger or an active crime, use the appropriate emergency police channel rather than waiting for a compliance process.
Confidentiality, Tipping Off, Privilege, and Good-Faith Reporting
Regulated entities and their personnel must protect the confidentiality of suspicious reports and related investigations. A customer or third party should not be told, directly or indirectly, that a report has been or may be filed or that an investigation is underway. Article 29 creates criminal exposure for prohibited disclosure, including imprisonment and a fine of at least AED 50,000, or either penalty, with further consequences in aggravated circumstances.
Confidentiality does not mean inventing a false explanation or ignoring ordinary customer-service duties. Staff should use approved neutral language, refer questions through the correct function, and avoid promises about release dates or the cause of restrictions. Internal access should be limited to people who need the information, and emails, case notes, permissions, and downloads should be managed as part of the audit trail.
The legal-professional exception is specific, not a blanket exclusion for every lawyer or accountant. Article 18 and the Executive Regulation protect information obtained in defined circumstances connected with assessing a client’s legal position, representation in judicial or related proceedings, or other protected professional-secrecy situations. A professional should determine whether the engagement falls within the exception before withholding a report.
Article 37 protects the FIU, authorities, regulated entities, and their relevant personnel from criminal, civil, or administrative liability for furnishing required information, even where the reporter did not fully know the nature or occurrence of the crime, unless the report was made in bad faith with intent to harm. That protection reinforces accurate good-faith reporting; it does not protect malicious fabrication.
Concerned About STR Confidentiality or Tipping-Off Risk?
Leaders Advocates can review internal escalation, confidentiality, privilege, staff communications, and reporting obligations before sensitive information is disclosed or irreversible steps are taken.
What Happens After the FIU Receives a Report
The FIU may analyse the report with other data, request additional information, and disseminate intelligence to competent authorities. Under Article 5, the Chief of the FIU may, without prior notice, stop or temporarily suspend a suspected transaction for up to ten working days. The Chief may also freeze suspected funds held with regulated institutions or service providers for up to thirty days, subject to the law’s extension and prosecution procedures.
Article 28 creates criminal exposure where a person deliberately or through gross negligence breaches the statutory reporting duty. The prescribed penalty includes imprisonment and a fine from AED 100,000 to AED 1,000,000, or either penalty. The risks of late filing, undocumented decisions, incomplete escalation, and tipping off should therefore be addressed through a tested procedure rather than left to individual judgment under pressure.
Unsure which UAE money-laundering reporting route applies? Leaders Advocates can assess the reporter’s status, the suspicion and evidence, goAML and confidentiality obligations, police or regulatory channels, freezing risk, and any connected criminal, corporate, or recovery issue.
Common Mistakes
- Treating goAML as a general public complaint portal.
- Waiting for proof of the predicate offence instead of applying the suspicion threshold.
- Submitting a conclusion without transaction data, chronology, indicators, and supporting material.
- Telling the customer or another person that an STR or investigation exists.
- Using the CBUAE regulatory-misconduct route for an employment grievance or ordinary service complaint.
- Assuming a report, account restriction, or freeze proves that money laundering occurred.
Relevant Legal Services
A Criminal Defense Lawyer in Dubai can advise on suspected offences, police and prosecution contact, freezing measures, interviews, and evidence. A Corporate Lawyer in Dubai can review reporting scope, governance, internal escalation, privilege, confidentiality, and management exposure. A Litigation Lawyer in Dubai can coordinate challenges, third-party rights, recovery, compensation, and connected court proceedings.
People Also Ask
Reporting money laundering in the UAE is a routing and evidence exercise, not a single universal form. Regulated entities report to the FIU through goAML; members of the public use the competent police or regulatory channel for the issue involved. Accurate chronology, prompt escalation, confidentiality, and disciplined follow-up make the report both lawful and useful.
Need Legal Advice on a UAE AML Reporting Issue?
Our team can assess the suspicion threshold, reporting obligations, goAML process, police or regulatory channels, freezing risk, and any connected criminal, corporate, or recovery issue.
