· Jurisdiction Briefing

Qatar Financial Centre: the QFCRA has to be told separately when you file an STR

If your STR procedure ends at the moment of lodgement — suspicion formed, MLRO decides, report goes to the financial intelligence unit, file closed, customer handled carefully from then on — it is incomplete for a firm inside the Qatar Financial Centre. The…

Illustration for “Qatar Financial Centre: the QFCRA has to be told separately when you file an STR”

If your STR procedure ends at the moment of lodgement — suspicion formed, MLRO decides, report goes to the financial intelligence unit, file closed, customer handled carefully from then on — it is incomplete for a firm inside the Qatar Financial Centre. The report to the QFIU is only the first of two things the firm owes.

The QFC Regulatory Authority has set this out in its Guidance on the Implementation of an Effective Suspicious Transaction and Activity Reporting Programme, published in 2026 and marked v.1.0. It is written for firms operating within the Qatar Financial Centre, and in the guidance’s own glossary “firm” means a financial institution, a DNFBP or a Designated Token Service Provider operating in the QFC. If your entity is licensed outside the Centre, this document is not addressed to you.

Two things about its status are worth fixing before anything else.

It is guidance, and it says where the obligation actually comes from. The guidance places the suspicious reporting framework in Article 21 of AML/CFT Law No. 20 of 2019 and Chapter 5 of the QFCRA AML/CFT Rules of 2019, and where it states an obligation it footnotes the AML/CFT Rule that imposes it — Rule 5.1.7(6) for the notification below, Rule 5.1.9 for the termination one. The QFCRA also says plainly that it does not prescribe a particular methodology for developing an STR and SAR programme. So read what follows as the Regulatory Authority describing obligations that sit in the Law and the Rules.

It is not a standalone text. The QFCRA says the guidance should be read in conjunction with the QFIU’s Instructions on Implementing Suspicious Transaction Reporting Requirements (April 2024) and any future guidance the QFIU issues. The underlying duty it restates is to report promptly to the QFIU any transaction, activity or operation, including attempted ones, regardless of value, where there is suspicion or reasonable grounds to suspect a link to the proceeds of a predicate offence or to terrorism financing.

Two filings, not one

This is the paragraph to take back to your procedure manual. At paragraph 24 the guidance says:

> “In addition to filing a report with the QFIU, the firm must immediately advise > the QFCRA that it has made a report. In this connection when a firm makes a > report to the QFIU submit a Form Q07 … via the Electronic Submission System > (ESS) to notify the QFCRA. DO NOT INCLUDE A COPY OF THE STR.”

The footnote attributes the obligation to AML/CFT Rule 5.1.7(6). Three operational points fall out of it.

It is a separate channel. The STR goes to the QFIU; the notification goes to the QFCRA through the Electronic Submission System. Lodging one does not lodge the other.

It is a specific form. The guidance names Form Q07 in paragraph 24 and, when it comes back to the same form for terminations at paragraph 26, calls it “the Form Q7”. The two spellings sit in one document; the form list at the back calls it the QFCRA Form Q07. Whichever your ESS submission screen shows, it is the QFCRA notification form, not an STR.

It carries no copy of the report. The instruction not to include a copy of the STR is in capitals in the original. A firm that attaches its QFIU report to the QFCRA notification as a courtesy is doing the opposite of what the guidance asks.

The self-assessment checklist at the back of the guidance puts the same question to you directly: does the firm have procedures for notifying the QFCRA once a report has been made to the QFIU, including the lodgement of a Form Q07?

Ending the relationship is a second notification, not a private decision

The guidance is clear that an STR does not freeze a firm into a relationship it no longer wants. A firm is not prevented or restricted from terminating its business relationship with a customer for normal commercial reasons after it has reported that customer to the QFIU. Two conditions travel with that freedom.

First, the firm must ensure that restricting or terminating the relationship does not inadvertently tip the customer off. The guidance defines tipping-off by reference to AML/CFT Rule 5.2.1 as the unauthorised disclosure of information that may result in the customer, or a third party other than the FIU or the Regulator, knowing or suspecting that they are or may be the subject of an STR or of a money laundering or terrorism financing investigation, and that may prejudice prevention, detection, apprehension, prosecution or recovery.

Second, if the firm does restrict or terminate, the guidance states that it must immediately notify the Regulator about the restriction or termination, using the Form Q7, citing AML/CFT Rule 5.1.9. An exit that would otherwise be a purely commercial decision therefore carries a second regulatory notification with it.

Two neighbouring paragraphs belong in the same part of your procedure. Once the firm has decided to report, it must ensure that any proposed transaction mentioned in the report does not proceed without consultation with the QFIU. And where the firm has reported a customer, or knows a customer is under investigation by a law enforcement agency for money laundering or terrorism financing, it must not destroy any records relating to that customer without consulting the QFIU — the guidance cites Rule 5.1.8.

The filing decision has to sit outside the business

Paragraph 20 is the governance paragraph. It is the one to read against your current escalation chart.

On receiving an internal report, the MLRO must ensure it is appropriately documented, give the person who made it a written acknowledgement of receipt including notification of any decision, remind that person of the tipping-off provisions, consider the report against all other relevant information the firm holds about the applicant, customer or transaction, and decide whether the transaction is suspicious.

Then the guidance adds the constraint. The final decision on filing a report in the first instance should be made by the MLRO, the Deputy MLRO or other senior AML/CFT staff — and that decision must be independent from a management or business function. If a relationship manager, a desk head or a business committee holds a veto over whether an STR goes to the QFIU, that is the arrangement paragraph 20 is written against. The checklist asks whether your programme records that the final decision for filing rests with the MLRO or Deputy MLRO.

There is a documented fallback, and it is narrow. The report must be made by the firm on behalf of the MLRO or, in their absence, the Deputy MLRO. Only where neither officer is available may a person at management level, or a legal person of the same group with sufficient seniority, lodge it — and the guidance says any alternative lodgement arrangement must be documented and must take the QFIU’s registration requirements on Ekhtar into account.

Register the MLRO and the deputy on Ekhtar

Paragraph 21 pairs two duties that are easy to treat as one-off and are not. The firm’s policies, procedures, systems and controls must provide established reporting mechanisms to the QFIU for all known or suspected money laundering or terrorism financing, citing AML/CFT Rule 5.1.6. On top of that, firms are required to keep their policies and procedures up to date with the QFIU’s latest guidance, and to ensure that they have registered the MLRO and the Deputy MLRO with the QFIU on Ekhtar — which a footnote describes as the QFIU’s online portal for the lodgement of an STR.

Both duties are live rather than historical. A change of MLRO, a change of deputy, or a new set of QFIU instructions each reopens them.

The internal leg does not stop at the internal report

Two paragraphs describe what happens around the MLRO, and both are worth naming in staff training.

All officers and employees must have direct access to the firm’s MLRO, and the guidance says the reporting lines between them should be as short as possible. Firms using an outsourced service provider for the function have to make sure their policies, procedures, systems and controls reflect those same reporting requirements.

And the reporting obligation continues after the internal report is made. An officer or employee who has reported a customer internally must promptly give the MLRO details of every subsequent transaction of that customer — whether or not it is of the same nature as the transaction that gave rise to the internal report — until the MLRO tells them to stop. The guidance notes that an officer or employee who fails to report under that rule may commit an offence against the AML/CFT Law, and may also be dealt with under Part 9 of the Financial Services Regulations.

There is a group dimension too. The guidance says that where a firm uses its head office or a centralised office outside the QFCRA entity as part of its ongoing monitoring, the resolution and closure of a suspicious transaction or activity still has to be considered, that all alerts must be resolved with sufficient justification in a diligent manner, and that STRs must be lodged with the QFIU where warranted. The checklist turns that into a question: if alerts are managed outside the Qatar office or via third parties, including head office and outsourced service providers, does the firm have documented procedures for submitting an STR to the QFIU?

Records, review and the independent review report

The MLRO must make and keep records showing the details of each internal STR received — enough to demonstrate how the MLRO’s obligations on receipt were met — and the details of each STR the firm made to the QFIU. The guidance says those records should be kept for at least ten years, pointing to the general record-keeping obligations in Part 7.1 of the AML/CFT Rules, and that the firm must be able to respond fully and quickly to QFIU and law enforcement enquiries about whether it maintains, or has maintained in the previous ten years, a business relationship with a person and the nature of that relationship.

Policies, procedures, systems and controls are to be reviewed annually and signed off by senior management. The guidance also points at the QFCRA’s 2024 revised Independent Review Report guidance, which it says now requires testing of the transaction monitoring system and of the overall process for identifying and reporting suspicious transactions and activities, including a review of internal and external STRs for their accuracy, timeliness and completeness.

Three things worth doing

  1. Read your STR procedure for the second filing. It should name the Form Q07 notification to the QFCRA through the ESS as a step of its own, immediately after lodgement with the QFIU, and it should say in terms that no copy of the STR is attached. Add the separate Form Q7 notification that a restriction or termination triggers.
  2. Check Ekhtar against your current officers. Confirm that the MLRO and the Deputy MLRO in post today are the ones registered, and write down the fallback lodgement arrangement the guidance allows when neither is available.
  3. Trace the sign-off on your last few filing decisions. If a business or management function signed, approved or could have blocked them, paragraph 20 is pointed at you.

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu