Transaction monitoring and reporting

Customer Due Diligence (CDD) is the assessment of who a customer is and how risky they are, carried out at onboarding and refreshed periodically. Transaction monitoring is the continuous review of what that customer actually does once the relationship is live — comparing real transaction activity against the risk profile and expected behaviour CDD established, to detect activity that may be connected to money laundering, terrorist financing, or proliferation financing. Both are required under the AML/CFT Law, and they work together: monitoring without a CDD-based risk profile to measure against has no defensible baseline for what counts as unusual.

It is a legal obligation, not an optional enhancement. Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions require regulated entities to maintain ongoing vigilance over customer transactions as part of the risk-based AML/CFT programme, and to report through goAML whenever monitoring — or any other means — gives rise to reasonable grounds for suspicion. A CDD programme with no ongoing monitoring behind it does not satisfy the full statutory obligation.

A Suspicious Transaction Report (STR) is filed when there are reasonable grounds to suspect that a specific transaction, or funds involved in it, are connected to money laundering or an underlying crime. A Suspicious Activity Report (SAR) is broader and can relate to a suspicious pattern of activity or an underlying relationship, including terrorist-financing concerns, even where no single discrete transaction is the trigger. Both are filed through goAML and both carry the same 'without delay' filing expectation once suspicion is reasonably formed.

It is a lower bar than proof or certainty — it means the facts available, viewed objectively, would lead a reasonable person in the entity's position to suspect a connection to money laundering, terrorist financing, or an underlying crime. It does not require the entity to have investigated and confirmed the suspicion, and it does not require the transaction to have actually completed. Waiting for certainty before escalating is itself a common cause of late or missed filings.

The AML/CFT Law requires reporting entities to file an STR or SAR promptly once reasonable suspicion is formed — it does not permit sitting on a suspicion while conducting an extended internal investigation, waiting to see how the transaction plays out, or delaying until a supervisory inspection prompts disclosure. Internal escalation and review should happen quickly, with the report filed as soon as the suspicion is reasonably formed, not once it is fully proven.

Value thresholds catch only the most obvious cases. Genuine red-flag patterns include structuring (breaking a large transaction into smaller ones to avoid a reporting threshold), rapid or circular movement of funds with no apparent commercial rationale, unexplained third-party payments, transaction activity materially inconsistent with a customer's stated business profile or the volumes anticipated at onboarding, use of multiple accounts or entities with no clear business reason, and sudden, unexplained changes in transaction pattern or counterparty.

First-line review is typically performed by a trained staff member close to the transaction — often the person who processed it or manages the customer relationship — who documents whether the alert can be cleared against defined criteria or must be escalated. The decision on whether reasonable grounds for suspicion exist, and whether to file an STR/SAR, rests with the designated Compliance Officer/MLRO, who must be sufficiently senior and empowered to make that call independently.

Tipping off is directly or indirectly informing a customer, or any third party, that a Suspicious Transaction Report has been filed, is being considered, or that an investigation is underway. It is a separate offence under the AML/CFT Law from the underlying suspected conduct, because it defeats the purpose of the reporting mechanism by allowing the customer to move funds or destroy evidence once alerted. This risk is highest during the escalation window, when front-line staff who noticed the alert may be tempted to explain to the customer why a transaction is delayed.

Thresholds should be calibrated against the entity's actual historical transaction data and its documented risk assessment, not copied from a generic industry template. PNPC tests proposed rules against a sample of the entity's real recent transaction history before go-live specifically to confirm the alert volume is meaningful — neither so high it floods the Compliance Officer with false positives that get rubber-stamped through fatigue, nor so low that genuinely unusual activity passes through unflagged.

The underlying legal obligation — ongoing vigilance calibrated to risk, with escalation and reporting when suspicion arises — applies across regulated categories, but the practical shape of monitoring differs materially. A bank runs automated, high-volume transaction-screening systems; a real estate broker or corporate service provider more often runs a smaller number of higher-value, lower-frequency transactions reviewed with a combination of defined thresholds and manual judgment. PNPC scales the monitoring design to the entity's actual transaction profile rather than imposing a bank-style system on a business that does not need or cannot support one.

Sanctions and Politically Exposed Person (PEP) screening should not be a one-time check at onboarding — lists are updated, sometimes with immediate effect, and a name that screened clean when the relationship began can appear on a list later. PNPC integrates periodic re-screening of the existing customer base into the same monitoring calendar as transaction review, so a list update is checked against live relationships, not just new ones.

A confirmed match against the UN Consolidated Sanctions List or the UAE Local Terrorist List triggers a distinct obligation from STR/SAR reporting: the entity must freeze the relevant funds without delay and file a Fund Freeze / Funds Awaiting Return report through goAML. This is a separate filing mechanism from suspicious-activity reporting, and it is triggered by the list match itself rather than by any assessment of the underlying transaction's legitimacy.

At minimum: the documented monitoring rules and thresholds in force, a log of every alert generated with its review date and reviewer, the clearance rationale or escalation decision for each alert, any STR/SAR filed and the internal escalation trail behind it, and periodic re-screening records. The AML/CFT Law's general record-retention requirements apply — records should be kept for the prescribed minimum period and be retrievable within the timeframe a supervisor gives, not merely stored somewhere.

The most frequent finding PNPC sees is a documented monitoring policy with no evidence of actual, consistent execution — no alert log, alerts cleared with no recorded rationale, or a Compliance Officer who cannot answer specific questions about recent alert decisions when interviewed. A second frequent finding is monitoring built only on fixed-value thresholds with no behavioural or pattern-based indicators, which structuring and more sophisticated activity are specifically designed to evade.

Yes. Where a business has already identified a specific transaction or relationship it considers suspicious and needs to escalate and file without delay, PNPC can support that filing directly and urgently, working with whoever holds or is stepping into the Compliance Officer role. We will also flag, separately, if the underlying gap that let the alert reach this stage without earlier detection — for example, no monitoring rules at all — needs addressing so the same gap does not recur.

We calibrate escalation criteria against the entity's documented risk assessment and its actual historical transaction data, then test the resulting alert volume before go-live. If testing shows an unworkable flood of low-value false positives, thresholds are adjusted; if testing shows almost no alerts generated against a transaction profile the risk assessment flags as higher-risk, criteria are tightened. This is an iterative calibration exercise, not a one-time guess.

PNPC designs the monitoring rules, escalation workflow, and disposition record-keeping system, trains the staff who operate it, and provides ongoing advisory including urgent support at the point of a live escalation. The statutory Compliance Officer/MLRO role, and the day-to-day decision on whether reasonable grounds for suspicion exist, must sit with a suitably senior individual inside the regulated entity itself, since that role carries an accountability an external adviser cannot exercise on the entity's behalf.

At minimum annually, in line with the broader AML/CFT risk-assessment review cycle, and additionally whenever there is a material change in the business — a new product or service line, a significant shift in transaction volumes, entry into a new customer segment or geography, or relevant new Cabinet Decision, FIU, or Ministry of Economy guidance. Thresholds calibrated once at build and never revisited drift out of alignment with the business as it grows and changes.

Inspectors typically request the documented monitoring rules and thresholds, sample a cross-section of generated alerts and their disposition, ask the Compliance Officer to walk through recent escalation decisions and explain the reasoning, and check that any STR/SAR filed shows a filing date consistent with the 'without delay' expectation relative to when suspicion first arose. They also commonly test whether ongoing sanctions/PEP re-screening is actually running against the existing customer base, not just new onboarding.

PNPC agrees a fixed, written fee for the monitoring programme design and build, scoped to the complexity and transaction volume of the business — a single-office corporate service provider and a multi-branch real estate brokerage require materially different depth of work. Ongoing advisory for threshold review, re-screening cadence, and urgent escalation support is quoted separately as a retainer, also fixed and agreed in writing.