goAML STR drafting: from alert to a report the FIU will accept

Every licensed firm in the UAE, whether supervised by the CBUAE, the SCA (now CMA), the DFSA, the FSRA or VARA, files suspicious transaction reports through the UAE Financial Intelligence Unit’s goAML portal. Uploading is the easy part. The work is writing, for each alert, a narrative the reviewer will sign and the FIU analyst can act on without writing back.

What the FIU is actually reading

A goAML STR carries structured fields (reporting entity, subject, accounts, transactions, indicators) and a free-text reason. FIU analysts triage on the narrative. The reports that get worked are the ones that state, in the first paragraph, who did what, over which period, for how much, and why that is inconsistent with the client’s profile. Reports that open with background about the firm, or repeat the rule that fired, go to the bottom of the pile.

Three things are routinely missing: the link between the subject and any related accounts (a shared beneficial owner, device or funding source); the specific transactions relied on, with identifiers; and the action the firm has taken, such as a hold on a pending withdrawal. Each gap comes back as a request for information, and the clock starts again.

Why drafting takes hours

The reviewer opens the alert in one system, the client file in another, the trade or payment ledger in a third, and assembles a story in a document. For a wash-trading alert that means reconciling two accounts’ trade histories against each other; for structuring, listing a dozen deposits with card and on-ramp references. Two to three hours per matter is normal, and most of that is copying.

Time is not the only cost. A narrative written under pressure drifts into generalities (“the client engaged in suspicious activity”) because the writer cannot see all the evidence at once, and those are the reports the FIU sends back.

Evidence-bound drafting

Marqib produces the narrative from the same evidence table the detection rule produced: every sentence cites a numbered record (E1, E2…) that the reviewer can open. A sentence without a valid citation is removed before the reviewer sees it. Where the firm enables a language model for wording, identifiers are replaced by tokens before any call, and the rule-generated text and the model text are shown side by side.

The reviewer still writes the report. What changes is that the reviewer starts from a complete file: subject and linked accounts, the transactions relied on with identifiers, the hold already placed, an evidence pack with a SHA-256 hash, and a goAML XML skeleton whose indicator codes are mapped to the FIU’s list during the pilot. The reviewer reads and decides instead of assembling.

What this looks like on a UAE brokerage book

Two corporate accounts sharing a beneficial-owner reference trade XAUUSD against each other 58 times in a 72-hour window, each pair matched within two seconds at identical size; both were funded from the same EMI account; a withdrawal is pending. The rule fires overnight, the withdrawal is held, and the MLRO opens a case file in the morning that already lists the pairs, the funding, the introducing partner’s rebate and a draft reason for suspicion. The demo at app.marqib.com runs exactly this case on synthetic data.

Questions