Reporting to the financial intelligence unit
NFIU reporting and goAML submission
Reporting entities in Nigeria submit suspicious and threshold-based transaction reports to the Nigerian Financial Intelligence Unit. This page sets out what the obligation requires in substance, what evidence a supervisor expects behind it, and exactly which parameters you must take from the unit itself rather than from us.
Who sets the expectation
Nigerian Financial Intelligence Unit (NFIU)
Nigeria's financial intelligence unit: it receives, analyses and disseminates reports submitted by reporting entities, and it defines the registration process, the accepted formats and the submission channel.
Who this applies to
- Financial institutions
- Banks, microfinance banks, payment service providers, bureaux de change, insurers and capital market operators, to the extent each is a reporting entity under Nigerian law.
- Designated non-financial businesses and professions
- Businesses and professions designated under Nigerian law, supervised for AML/CFT purposes through SCUML.
- The MLRO personally
- The reporting decision and the accountability for it sit with the designated officer, not with a system. Software prepares and evidences the report; a person decides it.
What it requires
The obligation, stated qualitatively
Each duty below is described in substance — what it requires and what evidence it produces. Thresholds, deadlines, section numbers and penalty provisions are deliberately absent, and where a duty turns on one, the parameter you must read from the operative instrument is named beside it.
Register and maintain the reporting relationship
A reporting entity registers with the unit and maintains the credentials, contact details and authorised users through which reports are submitted.
Evidence: Registration record, named authorised users, and a documented process for adding and removing them when staff change.
Read from the operative instrument: The registration procedure, the categories of entity required to register, and the renewal or re-confirmation cycle, if any.
Report suspicion once it is formed
Where the entity knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of crime or relate to terrorist financing, it must report to the unit. The trigger is suspicion, not proof, and the obligation attaches to the moment suspicion is formed rather than to the completion of an internal process.
Evidence: The case file behind the report: what triggered it, what was examined, the reasoning to the conclusion, who decided, and when. Decisions not to report should be documented to the same standard.
Read from the operative instrument: The time limit that runs from the trigger, and precisely what event starts it running.
Report cash and threshold-based transactions
Transactions meeting a prescribed objective criterion must be reported whether or not anything about them is suspicious. This is a mechanical duty and it is discharged by having complete, correctly classified transaction data rather than by analysis.
Evidence: A reconciliation showing that every qualifying transaction in the period produced a report, and that aggregation was applied as the regulation requires.
Read from the operative instrument: The threshold value and currency, whether and how related transactions aggregate, which instruments and channels are in scope, and the submission cycle.
Submit in the accepted format, through the accepted channel
Reports must be structured as the unit specifies and delivered through the channel it operates. goAML is the application many financial intelligence units use for this; the schema version, the code lists and the transport are the unit's to define.
Evidence: The schema version and digest a report validated against, the submission reference and timestamp, and the acknowledgement received.
Read from the operative instrument: The current schema or XSD version, the code lists in force, the transport, and the correction and re-submission procedure for a rejected filing.
Preserve confidentiality of the report
The fact that a report has been made or is being considered is restricted information. Where investigation notes live, who can see them, and what a customer-facing colleague may be told are design decisions that follow from this.
Evidence: Access controls over case and report records, and an audit record of who viewed them.
Read from the operative instrument: The exact scope of the prohibition, and the permitted internal and group disclosures.
Retain the underlying records and be able to produce them
The customer due diligence, transaction records and analysis behind a report must be retained and retrievable in a form a competent authority can use.
Evidence: A retention schedule by record category, and a demonstrated ability to reproduce a complete file for a past report within a reasonable time.
Read from the operative instrument: The retention period, when it starts running, and the acceptable format.
How the platform supports it
Capability, and the control it traces to
Each row below describes behaviour the product documentation records, and carries the identifier of the control-register row it traces to, so a claim can be checked rather than taken on trust.
- Governed report generationReports are generated from mappings that carry the authority artefact, the schema version and digest, the code list versions, the transformation, the validation and the maker and checker who approved them. A mapping is an approved, immutable, versioned object rather than a setting.Control C-14
- Submission that fails closedA generated report cannot be marked submitted without external evidence of the submission: the channel, the reference, the timestamp, the payload digest and the acknowledgement state. There is no path that records a submission without that evidence, and an unacknowledged submission stays visibly unacknowledged rather than being rounded up to filed.Control C-14
- Case-to-report provenanceA report is assembled from the case that produced it, and the alerts, rule evaluations, screening runs and customer evidence behind that case remain linked to it, so the basis for a filing can be reconstructed later.Control C-13
- Four-eyes on the filing decisionGeneration, review and approval are separate actions by separate people, recorded with actor, digest, decision and timestamp; the same person cannot approve their own submission.Control C-03
- Retrievable evidenceAudit events form an append-only per-tenant hash chain, and object evidence is write-once, so the file behind a past report can be produced and shown to be unaltered.Control C-16
What we do not claim
On a compliance product the absence of a claim is information a buyer needs as much as the presence of one.
- We do not ship an authority-approved goAML schema. The schemas in the product are placeholders, and report submission remains refused until the institution supplies and formally accepts the authoritative artefacts and the filing channel.
- We are not endorsed, certified or approved by the NFIU, and no statement on this site should be read as suggesting the unit has reviewed this product.
- We do not tell you whether a given transaction must be reported. The software evidences and governs the decision; the decision is the MLRO's.
Verify before you rely on this page
This page states obligations qualitatively and carries no figures. Before acting on anything here, confirm the following against the instrument currently in force for your licence category — and record the date you checked it.
- The current threshold, currency and aggregation rules for cash and threshold-based reporting.
- The time limit for a report of suspicion, and the event from which it runs.
- The registration procedure and the categories of entity required to register.
- That goAML is the operative submission channel for this category of reporting entity, and the schema or XSD version, code lists and transport currently in force.
- The correction and re-submission procedure for a rejected filing, and any service levels attached to it.
- The exact scope of the confidentiality obligation and the permitted internal disclosures.
- The record retention period and its start point, as interpreted for this institution.
Talk to a specialist
See how a report is assembled, reviewed and evidenced
Walk a case from alert to a validated report with its mapping version, approval chain and submission evidence attached — using your own schema once you have it.