NFIU STR Guidelines and Transaction Monitoring

Transaction Monitoring · October 2026 · Nigeria

The Guidelines treat an alert as a starting point. Each one needs a documented path to an STR or a written reason it was not filed, inside two fixed clocks.

NFIU STR Guidelines change how a monitoring alert should be handled before anything is filed. On 13 December 2024 the Nigerian Financial Intelligence Unit issued its Guidelines for the Identification, Verification and Reporting of Suspicious Transactions Related to Money Laundering, Financing of Terrorism and Proliferation of Weapons of Mass Destruction for Financial Institutions, under section 28(2) of the NFIU Act 2018.

The Guidelines start from a problem monitoring teams know well. Monitoring systems generate hundreds to thousands of alerts a day, and unusual alerts should not automatically be treated as suspicious. The Guidelines aim to improve the quality of the STRs filed, reduce false positives and defensive filings, and make institutions show how they reached a view.

For a risk leader the useful reading is a decision chain: what each alert must show, how long the institution has, and what record survives when an alert is not filed.

NFIU STR Guidelines visual showing the decision chain from monitoring alert through review and a determination of suspicion to an STR within 24 hours or a written record of why none was filed

Each alert needs a documented route to an STR within 24 hours of suspicion, or a written reason why none was filed.

Quick answer

The Nigerian Financial Intelligence Unit’s Guidelines for the Identification, Verification and Reporting of Suspicious Transactions, issued on 13 December 2024, require a financial institution to screen and review alerts, assess the facts and context, link red flags and explain its grounds for suspicion before filing. An STR is due to the NFIU within 24 hours of the transaction being deemed suspicious, scrutiny should not exceed 72 hours, and alerts investigated but not filed must be recorded internally with written reasons.

What an alert must show before an STR

According to Moroom Africa Legal Consults’ summary of the Guidelines, before filing an STR an institution must establish reasonable grounds to suspect a link to an ML, TF or PF offence. It does this by screening and reviewing all transaction alerts, assessing the facts and context, linking ML/TF/PF indicators or red flags to that assessment and explaining how the facts, context and indicators led to a reasonable ground for suspicion. It must also take account of high-risk predicate offences in the National Risk Assessment and relevant sectoral assessments, and of higher-risk jurisdictions.

The facts to assess include the transaction’s date, time, location, amount or type and any other available information, which can come from account opening or due diligence updates.

Screen and review the alert

All transaction alerts are screened and reviewed.

Assess facts and context

Date, time, location, amount, type and customer information.

Link red flags

ML/TF/PF indicators are tied to the assessment of the facts.

Explain the grounds

How facts, context and indicators produced reasonable suspicion.

What a fileable STR contains

The Guidelines also set the content of an STR and the documents that go with it. These are the parts a monitoring and case system needs to capture as the investigation runs, not afterwards.

Part	What it contains	Where it comes from
Narrative	A detailed, organised account: who, when, where, what, why and how	Investigator’s analysis
Alert history	The alerts that triggered the investigation and all earlier alerts and STR history on the subject	Monitoring and case records
Prior investigations	Earlier internal investigations and law-enforcement requests on the subject	Case management
Remedial action	A detailed account of the steps taken to address the risk	Case and customer records
Attachments	Identification documents or account-opening package, transaction records, and documents showing the predicate offence	Onboarding and transaction systems

The two clocks

The Guidelines apply two time limits. An STR is to reach the NFIU within 24 hours, and under the Money Laundering (Prevention and Prohibition) Act 2022 and the Terrorism (Prevention and Prohibition) Act 2022 that period starts from the date the institution deems the transaction suspicious. The institution’s own scrutiny period should not exceed 72 hours.

The two clocks put a premium on when and how suspicion is recorded. A case system that timestamps the determination, not just the alert, is the evidence an examiner can reasonably ask for.

Alert generated

A monitoring rule or model raises the alert.

Scrutiny, up to 72 hours

The institution screens, reviews and assesses the alert.

Deemed suspicious

The determination is recorded with its reasons.

STR within 24 hours

Filing to the NFIU runs from the determination.

Alerts that do not become STRs

The Guidelines require reporting entities to file internally all alerts that were generated and investigated but did not qualify as suspicious, with clear written reasons, so that examiners can review them during AML/CFT/PF examinations. That turns the closed-alert population into evidence about whether monitoring and judgement are working.

The penalties summarised by First Fiduciary include that failure to report suspicious transactions is an offence under section 7(10) of the MLPPA 2022, and that the NFIU may impose penalties under section 25(2) of the NFIU Act 2018.

What examiners can reasonably ask

For a sample of closed alerts: the alert, the facts reviewed, the red flags considered, the written reason for closure and who decided. A closure note that only says ‘no suspicion’ will not answer that.

How the NFIU Guidelines connect to the CBN Baseline Standards

The CBN’s Baseline Standards, issued in March 2026, expect automated solutions to support case management and regulatory reporting as linked functions. The NFIU Guidelines describe what has to flow through them: alert history, investigation records and a documented determination. A case record that holds both the AML decision chain and the reporting route lets one set of evidence serve the CBN and the NFIU.

Record the determination

Time-stamp when suspicion is determined and by whom.

Keep closure reasons

Require a written reason for every alert closed as not suspicious.

Build the STR from the case

Narrative, alert history and attachments drawn from one record.

Test a sample

Review closed alerts on a schedule against the Guidelines’ expectations.

How Nexiant supports alert-to-STR workflows

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For alert-to-STR workflows, the useful tests of any capability are whether the determination of suspicion is time-stamped, whether closed alerts keep their written reasons, and whether an STR narrative can be assembled from the case record. Nexiant brings these questions together across KYC, fraud and monitoring as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

What are the NFIU STR Guidelines?

They are the NFIU’s Guidelines for the Identification, Verification and Reporting of Suspicious Transactions Related to ML, TF and PF for Financial Institutions, issued on 13 December 2024 under section 28(2) of the NFIU Act 2018. They set out what makes a transaction suspicious enough to file and what an STR must contain.

How quickly must an STR be filed in Nigeria?

The Guidelines say an STR is to be submitted to the NFIU within 24 hours. Under the MLPPA 2022 and the Terrorism (Prevention and Prohibition) Act 2022 the period begins from the date the institution deems the transaction suspicious, and the institution’s scrutiny period should not exceed 72 hours.

Is every monitoring alert a suspicious transaction?

No. The Guidelines note that monitoring systems generate large numbers of alerts and that unusual alerts should not automatically be deemed suspicious. An institution must review the alert, assess the facts and context, link red flags and explain its grounds before filing.

What must a financial institution do with alerts it does not file?

It must file internally all alerts that were generated and investigated but did not qualify as suspicious, with clear written reasons, so that examiners can review them during AML/CFT/PF examinations.

What documents accompany an STR?

Customer identification documents or the account-opening package, transaction records such as statements and electronic payment records, and documentation indicating the specific predicate offence.

Make every alert a documented decision

Speak with a Nexiant expert about alert-to-STR workflow governance for Nigerian institutions, or explore FraudShield’s case-management and rule-configuration capability.

Speak with an expert

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.