STOR or STR? Suspicion reporting to the DFSA and to the UAE FIU

A DIFC firm that executes or arranges client orders has two separate suspicion-reporting duties. Market-abuse suspicions go to the DFSA as a suspicious transaction and order report (STOR). Money-laundering and terrorist-financing suspicions go to the UAE Financial Intelligence Unit as an STR or SAR through goAML, followed by a notification to the DFSA. This page sets the two side by side, with links to the DFSA and federal texts.

Reviewed 30 September 2026 · Educational material, not legal advice.

Two reports, two recipients

The DFSA explains the STOR duty in Markets Brief No. 24 (October 2021). It applies to Authorised Market Institutions, Authorised Firms operating an Alternative Trading System, Authorised Firms acting as market intermediaries, and Recognised Members; issuers are encouraged to notify voluntarily. The brief cites GEN 11.10.12A(1)(b) for Authorised Firms, REC 3.4.5 for Recognised Members, AMI 5.11.2 and COB 9.6.9 for market operators, and GEN 5.3.20 for the systems and controls behind them.

The STR duty comes from federal law. Article 18(1) of Federal Decree-Law No. 10 of 2025, in force since 14 October 2025 and replacing Decree-Law No. 20 of 2018, requires financial institutions that suspect, or have reasonable grounds to suspect, that funds or a transaction are proceeds of crime or related to it to notify the FIU "without delay and directly". The DFSA's AML overview confirms that DIFC firms lodge STRs and SARs with the UAE FIU through goAML, that goAML registration is mandatory, and that AML Rule 13.3.1 requires the firm to notify the DFSA immediately after submitting one, through the SAR/STR Notification Form on the DFSA ePortal.

Rule numbers for the STOR duty are as cited in Markets Brief No. 24. Check the current DFSA Rulebook before quoting them in a procedure.

Side by side

	STOR	STR or SAR
Concern	Market abuse: the prohibitions in Articles 54 to 61 of the DIFC Markets Law, including market manipulation and insider dealing.	Proceeds of crime, money laundering and terrorist financing (Article 18).
Recipient	The DFSA, through the online STOR form on its electronic portal.	The UAE FIU, through goAML; then a notification to the DFSA (AML Rule 13.3.1).
Trigger	Reasonable grounds to suspect that an order or transaction may constitute market abuse.	Suspicion, or reasonable grounds to suspect, that funds or a transaction are proceeds of crime or related to it, regardless of value.
Scope	All Investments, securities and derivatives; DIFC and other venues; on exchange, on an ATS or over the counter; own account or client; any client type; orders executed, pending, refused or withdrawn.	Any transaction or funds.
Timing	As soon as practically possible. Do not hold a notification back to accumulate more orders; a delay must be justified to the DFSA if asked.	"Without delay" (Article 18). The DFSA notification follows immediately after submission.
Content	Order and transaction details in structured fields, plus the suspected person, a description of the behaviour, why it is suspicious, and the reporting firm. Share all information available.	A detailed report with all available data and information on the transaction and the parties; further information on the FIU's request.
Tipping-off	Prohibited: the client may not be told of the intention to notify or that a STOR was made (GEN 11.10.12A(3), REC 3.4.5(3), as cited in Markets Brief No. 24).	Criminal offence: imprisonment and a fine of not less than AED 50,000 (Article 29(1)).
Records	A confidential record of every STOR and the information considered, kept for six years from the transaction or order, or from the notification.	Keep the case file and the decision; check the DFSA AML module for the retention period that applies.

Timing in practice

The DFSA treats STOR timing strictly. In February 2026 the Financial Markets Tribunal upheld a DFSA fine on a Nasdaq Dubai Recognised Member for failing to report suspicious transactions immediately. The firm argued that it had not actually suspected market abuse. The Tribunal rejected that: the duty arises where there are reasonable grounds for suspicion, judged objectively.

For STRs, the federal law says "without delay". The CBUAE's maximum of 35 business days from alert generation is written for firms the CBUAE licenses; do not import it into a DIFC procedure as a comfort period.

Run two clocks on a case that raises both questions. A STOR that waits for the AML investigation to finish will be late.

When one case needs both

Take linked accounts trading against each other, where one account was funded by a third party and the other withdraws the profit to an unrelated person. The matched trades may be manipulation; the money flow may be laundering. Neither Markets Brief No. 24 nor the DFSA's AML overview says that one report satisfies the other.

Open one case and keep one evidence set.
Record two decisions, each with its reason: STOR yes or no, STR yes or no.
File the STOR through the DFSA portal as soon as practically possible.
File the STR or SAR through goAML and notify the DFSA under AML Rule 13.3.1.
Make sure both reports tell the same facts. Differences between them will be asked about.
Agree neutral wording for any hold or restriction before the client is contacted.

The wash trading detection guide covers the detection side of this example.

Controls the DFSA expects around STORs

Markets Brief No. 24 expects systems and controls to detect and report suspicious orders and transactions (GEN 5.3.20), procedures that allow past analyses to be recalled and reviewed, STORs completed by a function independent of the front office such as compliance, and periodic training for relevant staff, tailored to the firm's risk profile.

Surveillance that looks only at executed trades cannot see a refused or withdrawn order. If your data does not include orders, say so in the risk assessment.

Where Marqib fits

Marqib builds the AML side of this workflow: deterministic alerts, a case with the evidence rows, a draft STR narrative that cites them, a goAML XML draft, and maker-checker approval. It does not prepare or submit a STOR. The same evidence rows and narrative can be used to complete the DFSA's online form.

Sources

Questions

Does a DIFC broker file STRs with the DFSA?

No. STRs and SARs go to the UAE FIU through goAML. The DFSA is then notified that a report was made, under AML Rule 13.3.1. STORs about market abuse go to the DFSA.

Is there a deadline in days for a STOR?

Markets Brief No. 24 gives no number of days. It asks for notification as soon as practically possible and says firms must not wait to accumulate further suspicious orders.

Do STORs cover orders that were never executed?

Yes. The brief includes orders that are pending, refused or withdrawn as well as executed transactions.

Does the CBUAE 35-business-day limit apply in the DIFC?

It is part of the CBUAE's guidance for the firms it licenses. DIFC firms work to the federal "without delay" standard and the DFSA's rules.

Can one case lead to both reports?

Yes. Market-abuse and money-laundering suspicions are reported under separate duties to different recipients. Record each decision separately and keep the facts consistent.