Kuwait FIU STR Filing: The KwFIU Process Step by Step

Listen To Our Podcast🎧

How do you file an STR with the Kuwait FIU?

The Kuwait Financial Intelligence Unit (KwFIU) receives suspicious transaction reports (STRs) from banks, exchange companies, insurers, investment firms and the designated non-financial businesses and professions (DNFBPs) covered by Law No. 106 of 2013. You must report any transaction or attempted transaction you suspect is linked to money laundering or terrorist financing, whatever its value, no later than two working days after the suspicion forms, through goAML. The portal is the easy part. What takes work is getting a red flag examined, decided and written up inside that window, with a narrative KwFIU can act on.

Article 12 of Law No. 106 of 2013 sets the duty: financial institutions and DNFBPs shall report to the Unit without delay any transaction or attempted transaction, regardless of its value, if they suspect or have reasonable grounds to suspect it involves proceeds of crime or funds linked to money laundering or terrorism financing. Article 16 of the Executive Regulation sets the outer limit at two working days, using the methods and forms the Unit sets. KwFIU's May 2025 guidance note for banks says STRs must go through goAML, the digital platform all reporting entities in Kuwait are obliged to use.

This guide is for MLROs and compliance officers at Kuwaiti banks, exchange companies and other reporting entities. It walks through the process from the first red flag to KwFIU's follow-up questions, what each part of the report needs, how to avoid tipping off, and which records to keep. It reflects KwFIU, Central Bank of Kuwait (CBK) and statutory sources as they stood on October 17, 2026. It isn't legal advice, and the English texts used here are translations, so check the Arabic originals for anything you rely on.

The seven-step KwFIU STR process

Get a red flag examined, decided, written up and filed in goAML inside two working days of suspicion, then answer KwFIU's questions and keep the record.

1. Detect and record the red flag, with its date and source.
2. Examine the transaction and the customer, and document what you find.
3. Escalate to the reporting decision-maker or committee and record the decision and reasons, including decisions not to report.
4. Prepare the report: subjects, accounts, transactions, narrative, measures taken and annexed documents.
5. Submit through goAML within two working days of the suspicion forming.
6. Answer KwFIU's requests for additional information within the time it sets.
7. Apply post-report measures without tipping off, report to the board and keep the records for at least five years.

Who must file an STR with the Kuwait FIU?

Every financial institution and DNFBP covered by Law No. 106 of 2013. The KwFIU FAQs list the financial institutions it receives reports from as banks, exchange companies, finance companies, agents and brokers, exchange institutions, investment companies, securities trading companies, financial brokerage firms, asset managers, mutual funds and custodians, and insurance companies. On the non-financial side they list real estate brokers, dealers in gold, gemstones and precious metals, and independent lawyers and accountants.

There is one narrow carve-out. Under Article 12, attorneys, other independent legal professionals and accountants don't have to report a transaction if they obtained the information in circumstances where professional secrecy applies. Everyone else reports, and banks carry most of the volume: the bank guidance note cites Kuwait's October 2024 mutual evaluation report, which found banks responsible for well over half of the STRs submitted to KwFIU.

Your sector also decides which supporting guidance applies. The KwFIU manuals page publishes a general guide to completing the STR form and separate STR guidance notes for banks and for exchange companies. The KwFIU indicators page publishes red-flag lists for banks, investment companies, insurers and the non-financial professions. If you run a group with a bank and an exchange company, expect two sets of sector guidance feeding one reporting process.

For the wider Kuwaiti framework, including CMA and CBK obligations beyond reporting, see our guide to Kuwait AML/CFT requirements. This article stays with the reporting process itself.

What triggers a suspicious transaction report in Kuwait?

A suspicion, or reasonable grounds to suspect, that a transaction or attempted transaction involves proceeds of crime or funds linked to money laundering or terrorist financing. That covers attempted transactions, so a deal the customer abandons when you ask for documents can still be reportable. There's no minimum amount: Article 12 says regardless of the value.

Most STRs start with a red flag. Article 5 of the law requires enhanced due diligence for complex, unusual large transactions and unusual patterns with no clear economic or visible lawful purpose, including examining their background and purpose as far as reasonably possible and documenting what you find. KwFIU's bank guidance note is careful about what a red flag means: red flags do not automatically mean that a crime has been committed, but they signal the need for further diligence and examination. Its banking examples include structured cash deposits or withdrawals and incoming funds quickly sent offshore with no business justification. It also counts internal alerts, where transaction monitoring systems flag repeated rule breaches such as velocity, volume or destination.

Two points catch teams out. The first is that the value threshold for customer due diligence doesn't apply to reporting. Article 6 of the Executive Regulation sets KD 3,000 as the threshold for the due diligence that Article 5 of the law requires before a transaction for a customer you don't have an established relationship with. KwFIU's guidance note points out that, because suspicions are reportable regardless of value, an STR might be required even where the bank has not yet carried out due diligence on the customer.

The second is that you don't have to prove anything. KwFIU's guide to completing the STR form reminds reporting institutions to file as soon as suspicion has arisen and not to seek to prove a predicate offense, money laundering or terrorism financing. If the examination runs until the case is airtight, it will usually run past the deadline.

If you can't complete due diligence at all, Article 5 tells you to refuse or end the relationship and to consider filing a report to the Unit.

The reporting test is suspicion, not proof, and it has no value floor. Write that into your procedure in those words, because analysts trained on threshold-based reports will otherwise look for a number.

How fast must you file an STR in Kuwait?

No later than two working days after you form a suspicion or have reasonable grounds to suspect. Article 16 of the Executive Regulation sets that limit and tells you to report following the methods and forms set by the Unit. KwFIU's guidance note repeats it: the STR needs to reach KwFIU no later than 2 working days after the suspicion has materialised.

Banks should read one more source. The CBK's AML/CFT instructions say a bank shall report within two days maximum to KwFIU, regardless of value. That wording doesn't say working days. Until your legal team confirms otherwise, our suggestion is that CBK-licensed banks plan to the shorter reading.

The clock has a soft start. The bank guidance note says the law doesn't define a maximum timeline for the examination, or for escalation and the formal decision, but that these need to be concluded as quickly as possible. That leaves each institution to define, in writing, the point at which suspicion has formed. If your policy starts the clock only when a committee signs, an examiner may ask why the analyst's notes showed suspicion days earlier.

What are the steps to file an STR with KwFIU?

Seven steps cover the process, from the first red flag to the questions KwFIU may send after it reads your report. The sources assign some of them to particular functions; the rest are for your procedure to define.

• A red flag sends the transaction to examination by the compliance or risk function. Examination ends in a reporting decision taken higher up the hierarchy or by a reporting committee. A reporting decision to file sends the STR through goAML, the platform every reporting entity in Kuwait must use. From goAML, the STR reaches KwFIU for operational analysis.

The first figure shows the core path. A red flag sends the transaction to examination by the compliance or risk function. Examination ends in a reporting decision taken higher up the hierarchy or by a reporting committee. A reporting decision to file sends the STR through goAML, the platform every reporting entity in Kuwait must use. From goAML, the STR reaches KwFIU for operational analysis.

Step 1: Detect and record the red flag

Red flags reach compliance from monitoring alerts, front-line staff, due diligence reviews, screening hits and requests from authorities. Record the date and source of each one. That record becomes part of the report: the STR form guide asks when, where and how the suspicious transaction or behaviour was detected, including through which monitoring.

Step 2: Examine the transaction and the customer

The bank guidance note says the examination is usually carried out by the risk function or the compliance function, meaning operational staff with insight into money laundering and terrorist financing risks. This is the enhanced due diligence Article 5 requires: look at the background and purpose of the transaction and document all information about it and the identity of everyone involved. Pull the customer's profile, the account history, linked parties and any earlier reports. Ask the customer for information only through approved procedures that won't reveal a report is being considered.

Step 3: Escalate and decide

The bank guidance note says the formal decision to submit a report to KwFIU is usually taken by persons higher up the formal hierarchy. For banks, the CBK's compilation lists an August 2019 circular obligating banks to form a committee assigned to decide on reporting suspicious transactions to KwFIU. Smaller firms work differently. The exchange-company guidance note says some entities have a designated committee, but at an exchange company the decision would normally be taken by the director or owner. Whoever decides, record the decision, the reasons and the date, including decisions not to report.

Step 4: Prepare the report

Assemble the subject details, accounts, transactions, narrative, measures taken and supporting documents. The next section covers each part. Name a contact who knows the case: the form guide says KwFIU must be given contact details for the compliance officer, or the person who replaces them in their absence, who is familiar with the report and the transactions in it.

Step 5: Submit through goAML within the deadline

File in goAML. The May 2025 guidance notes for banks and exchange companies both say STRs submitted to KwFIU need to be communicated via goAML, which all reporting entities in Kuwait are obliged to use. If you're new to the platform, our explainer on what goAML is and how FIUs use it covers the basics. We found no public English guide to Kuwait's goAML registration on KwFIU's manuals, forms, FAQs or circulars pages on October 17, 2026, so get your registration and user set-up confirmed with KwFIU before your first report is due.

Step 6: Answer KwFIU's follow-up requests

KwFIU may come back to you. Under Article 18 of the law it can obtain any additional information it deems necessary from anyone subject to the reporting duty, within the time limits it specifies. Article 16 of the Executive Regulation adds that you must provide relevant information or copies of documents, however stored, within the timeframe the Unit prescribes. Track these requests the same way you track the filing deadline.

Step 7: Apply post-report measures and keep the records

After filing, apply enhanced measures to the relationship: the form guide mentions enhanced due diligence, monitoring the customer's accounts and transactions, and measures limiting disposal of funds, while taking care not to suggest to the customer that a report will be filed. Under Article 11, keep a copy of the STR and related documents for at least five years from the date you sent it. For banks, the CBK expects periodic reports to the board to include a statement of all suspicious transactions monitored, their impacts and the measures compliance staff took.

Illustrative scenario: one alert, two working days

Illustrative scenario, not a customer result.

A retail bank in Kuwait gets a monitoring alert on a salaried customer's account. Over nine days, cash deposits of just under KD 3,000 arrive at four branches, and most of the money leaves within a day by transfer to an account abroad with no stated purpose. The bank, the customer and the amounts are invented to show the process, not drawn from a real case.

On day one the analyst reviews the account and finds the deposits don't fit the customer's declared salary. Structured cash deposits and funds quickly sent offshore are both on KwFIU's banking red-flag list. The analyst asks the relationship manager what the customer has said about the account, without raising the alert, and finds no explanation on file.

1. By the end of day one the analyst records that suspicion has formed, with the reasons, and escalates to the compliance officer.
2. The compliance officer convenes the reporting committee on day two, outside its regular schedule.
3. The committee decides to report and records its reasons.
4. The compliance officer files the STR in goAML that afternoon, with the account history, deposit records, transfer details and the narrative, and records the KwFIU reference.
5. The bank puts the account under enhanced monitoring, and front-line staff are told only that any large cash deposit needs compliance sign-off.
6. Three weeks later KwFIU asks for the identity of the account holder abroad. The compliance officer answers within the deadline KwFIU sets.

What goes into a Kuwait STR?

KwFIU's guide to completing the STR form sets out six parts: the reporting institution, the suspicious transaction information (subjects and their accounts), the transaction details, a detailed description of the reason for reporting, the measures taken by the reporting institution, and the documents annexed. The guide was written for KwFIU's original report form, but it's the most detailed public statement of what KwFIU wants in each field. Use it as your content standard while goAML sets the format.

• The case file supplies the subject details: names, dates of birth, nationalities, occupations, addresses and PEP status. The case file supplies the account details for every account the subject holds with you. The case file supplies the transaction details, including status, type, date, currency, amount and the parties on each side. The case file supplies the narrative, built from the examination findings and the red flags. The case file supplies the measures taken before and after the suspicion arose. The case file supplies the annexed documents that back up each statement.

The second figure maps the case file to those parts. The case file supplies the subject details: names, dates of birth, nationalities, occupations, addresses and PEP status. You also take the account details from the case file for every account the subject holds with you. The transaction details come from the case file too, including status, type, date, currency, amount and the parties on each side. You build the narrative from the case file, using the examination findings and the red flags. The measures taken before and after the suspicion arose should already be logged in the case file. Finally, attach the annexed documents from the case file that back up each statement.

For subjects, the form provides for up to three, each marked as the main subject or an associate subject. For a company, give information on the legal entity and on the natural persons linked to it, such as directors and beneficial owners.

Report the subject's accounts whether or not they were used in the suspicious transaction. Investigators need the subject's whole financial footprint if they later trace or freeze funds.

For each transaction, state whether it was carried out, attempted, postponed, delayed or canceled. If transactions aren't clearly related, the guide advises filing separate reports. If you're updating an earlier report, quote the KwFIU reference number you received for it.

The bank guidance note gives a shorter version of the same list: the customer, the transaction, all information related to the examination including analysis, the reason for suspicion (the narrative) and supporting documentation such as transaction records and copies of due diligence documents.

How do you write an STR narrative KwFIU can use?

The form guide calls the detailed description of the reason for reporting the most important part of the submission, because it should describe the suspicious transactions or accounts in great detail. It asks for the volume, sequence, links, originators and beneficial owners of the transactions, and the indicators that apply. It also asks for information on the source and purpose of the funds and whether they relate to proceeds of crime or terrorist financing.

The most useful sentence in the guide is a reminder about the reader. KwFIU officers do not have access to client files or a working knowledge of the client's business. A narrative that says "activity inconsistent with profile" assumes they know the profile. Spell it out: what the customer told you they do, what you expected to see, what you actually saw, and why the gap matters.

A narrative structure that works for most Kuwaiti STRs:

1. The customer, their business and how long they've banked with you.
2. What you expected: declared income, business activity and expected account use.
3. What happened: transactions in date order, with amounts, currencies, counterparties and channels.
4. Why it's suspicious: the specific red flags, tied to the transactions that show them.
5. What you checked: questions asked, documents reviewed, explanations received and why they didn't resolve the concern.
6. What you did: internal measures taken and any post-report controls, without anything that would tip off the customer.

If any employee may have colluded, been negligent or turned a blind eye, the guide asks you to say so and describe the measures you took. Our SAR narrative template gives a structure you can adapt to KwFIU's fields.

Check one thing about language. KwFIU's 2014 circular and 2015 circular told financial institutions and DNFBPs to send their STRs in Arabic. The 2025 guidance notes don't restate a language requirement, so confirm with KwFIU what language it expects in goAML narratives today.

What happens after you file an STR with KwFIU?

KwFIU analyses the report. The bank guidance note describes KwFIU as an administrative authority, not a law enforcement body. An STR is intelligence rather than a complaint: the note says it isn't a police report and can't be used by law enforcement or prosecution as evidence of criminality.

• When KwFIU's analysis confirms the suspicion, KwFIU sends a dissemination report to the Public Prosecutor's Office. The Public Prosecutor's Office often asks a unit of the Ministry of Interior to carry out the preliminary investigation. KwFIU can also send the reporting entity a request for additional information. The reporting entity answers KwFIU within the time it sets. Meanwhile the reporting entity applies enhanced due diligence to the relationship.

The third figure shows the paths after filing. When KwFIU's analysis confirms the suspicion, KwFIU sends a dissemination report to the Public Prosecutor's Office. The Public Prosecutor's Office often asks a unit of the Ministry of Interior to carry out the preliminary investigation. KwFIU can also send the reporting entity a request for additional information. The reporting entity answers KwFIU within the time it sets. Meanwhile the reporting entity applies enhanced due diligence to the relationship.

The sources behind those paths are specific. Article 19 of the law says that where the Unit has reasonable grounds to suspect funds are proceeds of crime or linked to money laundering or terrorist financing, it shall notify the public prosecutor's office and forward the relevant information to competent authorities. The guidance note adds that the Public Prosecutor's Office would often decide that the Money Laundering Unit or the Terrorist Financing Unit of the Ministry of Interior should carry out the preliminary investigation.

You won't usually hear the outcome. Plan for requests instead: the data KwFIU asks for later is often the account history and documents you held back from the first report.

How do you avoid tipping off after an STR?

Article 13 of the law prohibits financial institutions and DNFBPs, their directors and employees from disclosing to a customer or any other person that a report has been made, or any information related to the Unit or to a money laundering or terrorism financing investigation. KwFIU's guidance note puts it plainly: it is illegal to inform a customer about an STR being submitted. The CBK's instructions apply the same ban to banks, covering reports that have been filed or will be filed.

• Inside the permitted circle, the compliance officer can discuss the report with directors and employees of the institution who need to act on it. The compliance officer can also share it with lawyers advising the institution. The compliance officer can provide information to competent authorities. The compliance officer can provide information to the public prosecution. Nothing about the report goes to the customer.

The law also says who can know. The prohibition doesn't prevent disclosures between directors and employees of the institution, or to lawyers, competent authorities and the public prosecution.

The fourth figure draws that boundary. Inside the permitted circle, the compliance officer can discuss the report with directors and employees of the institution who need to act on it. The compliance officer can also share it with lawyers advising the institution. The compliance officer can provide information to competent authorities. The compliance officer can provide information to the public prosecution. Nothing about the report goes to the customer.

Most tipping-off risk comes from ordinary operations rather than a careless remark. A relationship manager who suddenly asks pointed questions, a payment that's blocked with an explanation that hints at compliance, or a customer letter generated by an automated workflow can all give the game away. Limit access to STR decisions and drafts to the people who need them, and agree a script for customer contact after a report.

The law also protects staff who report. Article 13 removes penal, civil, disciplinary and administrative liability for breaching a disclosure restriction where a report or other information was provided to the Unit in good faith.

Which STR records must you keep in Kuwait?

Article 11 requires you to keep copies of STRs and related documents for at least five years after the date you made the report to the Unit. Transaction records must also be kept for at least five years and be detailed enough to permit the reconstruction of each individual transaction. A competent authority can require longer retention in specific cases.

Keep the decision trail as well as the filing. An examiner who reads a filed STR will ask how long the examination took and who decided. An examiner who finds an alert closed without a report will ask why. The enhanced due diligence records Article 5 requires for unusual transactions answer both questions, if you've kept them.

What are the penalties for STR failures in Kuwait?

Article 35 of the law punishes anyone who deliberately or by gross negligence fails to make a report, presents false statements or conceals facts that should be disclosed, or tips off a third party, with imprisonment for up to three years and a fine of KD 5,000 to KD 500,000, or one of those penalties. Where a legal person commits either offense, the fine is KD 5,000 to KD 1 million. Article 33 adds a fine of KD 5,000 to KD 500,000 per violation for an institution that deliberately or through gross negligence breaches the due diligence, compliance and record-keeping articles. Separately, under Article 15 supervisors can impose measures including a fine on a financial institution of up to KD 500,000 per violation.

What makes STR filing fail in practice?

Most STR failures happen in the handoffs between teams rather than in the reading of the law.

The clock starts in the wrong place

If policy says the two working days run from the committee's decision, but the analyst's notes show suspicion three days earlier, you've filed late on your own evidence. Define the trigger in writing and train analysts to record the moment their concern becomes a suspicion.

The committee meets on a calendar

A weekly sitting can't meet a two-day limit. Give the committee a way to decide urgent cases between meetings, with the same record.

Narratives assume KwFIU can see your files

KwFIU officers don't have access to client files. A narrative full of internal codes and "see attached" leaves the analyst at KwFIU to reconstruct your case.

Old instructions survive in procedures

The form guide still tells filers to hand reports to the chairman's office in a special, secret envelope, while KwFIU's 2025 guidance says goAML is the channel. The KwFIU circulars page still lists Circular FI/1/2015 on STRs next to its 2025 high-risk country circulars, so old and new instructions sit side by side. Procedures copied from older manuals can send staff the wrong way.

Decisions not to report go unrecorded

The examination record Article 5 requires for unusual transactions should show why an alert didn't become an STR. If it doesn't, an examiner will read the alert as ignored.

Post-report controls tip off the customer

Freezing a card with a message about "compliance review" tells the customer more than any conversation would. Route post-report measures through someone who knows the tipping-off rules.

Sector red flags are copied, not adapted

KwFIU publishes separate indicators for banks, investment companies, insurers and the non-financial professions. An exchange company running a bank's red-flag list will miss its own patterns.

Who decides at each step of a Kuwait STR?

The law places reporting duties on the institution and its staff, the KwFIU guidance places the decision higher in the hierarchy, and the CBK holds the board to account for what compliance reports. Article 10 requires the compliance officer to be appointed at senior management level. For banks, the CBK requires the compliance officer to act with sufficient operational independence and to be responsible to senior management.

• Case data flows into the agent layer, which gathers the records and drafts the file. The agent layer passes the prepared case to the analyst, who checks it and decides whether suspicion has formed. The analyst escalates to the compliance officer. The compliance officer brings the case to the reporting committee where the institution has one. The reporting committee decides, and an authorised person completes the goAML submission. The compliance officer reports to the board on suspicious transactions and the measures taken.

The fifth figure shows where an AI agent layer can sit without taking any of those decisions. Case data flows into the agent layer, which gathers the records and drafts the file. The agent layer passes the prepared case to the analyst, who checks it and decides whether suspicion has formed. The analyst escalates to the compliance officer. The compliance officer brings the case to the reporting committee where the institution has one. The reporting committee decides, and an authorised person completes the goAML submission. The compliance officer reports to the board on suspicious transactions and the measures taken.

Automation can carry the assembly work in that chain: pulling records, drafting the narrative and tracking the two-working-day clock. For how that fits a wider compliance operation, see our guide to automated regulatory reporting. None of it moves the suspicion decision, the reporting decision or the submission away from the people the law and the CBK hold responsible.

Roles and boundaries in a Kuwait STR workflow

Core systems hold the records, an AI agent layer gathers them and drafts the file, the analyst decides whether suspicion has formed, the compliance officer and reporting committee decide whether to report, an authorised person submits in goAML, and the board receives periodic reports.

The analyst decides whether suspicion has formed, the compliance officer and the reporting committee decide whether to report, and an authorised person submits in goAML. The institution decides how much each agent does on its own, and every agent has a kill switch.

Which sources support this guide?

How FluxForce fits Kuwait STR filing

What should an MLRO in Kuwait set up before the next STR?

1. The written trigger for when suspicion has formed, and who records it.
2. The reporting decision-maker for each entity, and how they decide urgent cases between meetings.
3. Named goAML users, with cover for absence, and registration confirmed with KwFIU.
4. A narrative standard written for a reader with no access to your files.
5. The language KwFIU expects in narratives, confirmed in writing.
6. A tipping-off protocol for post-report controls and customer contact.
7. Retention of STRs, decisions not to report and KwFIU requests for at least five years.

Conclusion

Filing an STR with the Kuwait FIU means reporting any suspected transaction or attempt, whatever its value, through goAML within two working days of the suspicion forming. The law sets no separate limit for the examination, and the reporting decision has to fit inside the two working days after suspicion forms. Write narratives for a reader who can't see your files, protect the report from the customer, and keep every decision, including the ones not to report, for at least five years.

Frequently Asked Questions

About the author

Sahil works on secure AI and financial technology for regulated industries. His engineering background spans identity verification, payment security and compliance automation. He has led teams across Africa, the United States, Europe and India.

At FluxForce.ai, his focus is on explainable AI and auditable financial workflows. He writes for banking and compliance teams about the practical decisions behind these systems: how to assess risk, keep controls visible and introduce automation without losing accountability.

Related articles