Suspicious Transactions and Activities — STR/SAR Assessment and goAML Reporting

Follow the current statutory and sector timing requirements; do not wait for a routine monthly threshold-report cycle if a suspicious report is due sooner. Preserve evidence without altering original transaction records.

Explain who is involved, what occurred, when and where, the transaction path and why it differs from expected activity. Distinguish verified facts, customer explanations and the reporting entity's assessment. Attach relevant evidence using the permitted process. A vague narrative such as “large amount suspicious” cannot explain a pattern or support analysis.

A customer repeatedly changes beneficiary details and requests several smaller payments inconsistent with the stated business purpose. The compliance team reviews the linked pattern, ownership and explanation. Even if no individual payment reaches a TTR threshold, the facts can require an STR/SAR assessment. Threshold exemption does not automatically exempt suspicious reporting.

Use authorised institutional access and current FIU registration/reporting guidance. Validate report type, required fields and acknowledgement; a locally saved report is not a completed submission.

Restrict information to authorised persons, apply the applicable tipping-off prohibition and preserve records securely. Customer communication should not reveal a confidential report or investigation. Resolve rejected submissions through the lawful procedure and keep the original and corrected report history. FIU’s published FAQ permits web or XML reporting; an XML report and its attachments are submitted together as one zip file. Use the current instructions applicable to your sector for an actual submission. This guide explains assessment, narrative and evidence controls; it is not a field-by-field portal tutorial.

FIU's July 2025 STR/SAR guidance requires reporting immediately after the examination establishes reasonable grounds for suspicion under the relevant requirements. It covers attempted transactions and activities as well as completed payments. Do not delay a due suspicious report until a routine TTR cycle, or assume that a small value prevents reporting.

A red flag is an indicator for assessment, not proof of crime. Review the explanation against the customer's known activity, the ownership, the flow of funds and other relevant facts. Record what was examined and why the concern was resolved or remained suspicious. If later information supports or refutes a previously reported suspicion, the guidance calls for appropriate communication to FIU.

ICAN's STR Guidance Note, effective 1 January 2026, addresses audit firms and distinguishes their role from firms providing other specified services. Auditors report relevant concerns discovered through audit work; they are not required to conduct separate money-laundering investigations or bank-like CDD and risk assessment. The audit team's ordinary professional scepticism and legal considerations still apply.

For a joint audit, the guidance addresses individual reporting responsibility where both firms conclude there are reasonable grounds. The partner and compliance officer should use the firm's authorised process to establish and record the conclusion. An unresolved management disagreement does not remove a reporting duty that has arisen under the applicable requirements.

Describe who was involved, the transaction or activity, the relevant dates and amounts, the evidence examined and the grounds for concern. Distinguish observed facts from inference. Refer to supporting documents and include the information required by the current reporting instructions without making unsupported accusations.

An audit finds repeated payments to a supplier whose ownership appears connected to management, but the contracts and delivery evidence do not explain the pattern. The firm examines the records and related-party consequences, assesses the suspicious features and follows the lawful confidential process. Its audit report addresses the financial-statement effect under the applicable standards without stating that an STR was filed. The confidential decision file retains the reporting evidence and later communications.