What This Guide Covers
A quick look at what’s inside, so you can jump to what you need:
- What PNMR stands for and what a partial name match means
- How to tell a partial match apart from a confirmed match and a false positive
- Which sanctions lists trigger a PNMR and the ones that don’t
- Who must file, and what you need in place before you can
- The deadlines: the five-business-day filing window and the ten-business-day document window
- Whether to suspend or reject, and how those two differ from freezing
A step-by-step walkthrough of filing a PNMR on goAML - What information and documents must go into the report
- What happens after you file, and how long you wait
- PNMR vs CNMR vs STR/SAR — which report goes where
- Why partial matches happen and how to cut down on false alerts
- Common mistakes, penalties, and a readiness checklist
PNMR Full Form and Meaning
PNMR stands for Partial Name Match Report. It is a report that a regulated business in the UAE files through the goAML portal when a customer, counterparty or beneficial owner partially matches a name on the UAE Local Terrorist List or the UN Security Council Consolidated List, and the business cannot confirm or rule out the match.
If you searched those four letters and landed somewhere about healthcare, that is a different field entirely using the same abbreviation. In UAE compliance, PNMR means one thing only: a partial name match report filed on goAML.
What Does “Partial Name Match” Mean?
Think of it this way. You run your customer’s details against the sanctions lists. Something comes back. The name is close, maybe an exact spelling, maybe one letter off. The date of birth lines up. But the nationality is different, or the ID number doesn’t match, or you simply don’t have enough on file to say either way.
You can’t confirm this is the designated person. You also can’t honestly say it isn’t. That grey zone is a partial name match, and the report you file about it is the PNMR.
Filing a PNMR is not an accusation
This trips up a lot of business owners. Filing a PNMR does not mean you have caught a criminal or accused your customer of anything. It means the opposite, it means you could not reach a conclusion, and you are handing the question to the authority that can.
The Executive Office for Control and Non-Proliferation (EOCN) holds information you don’t. Your report asks them to make the call. Plenty of PNMRs come back as false positives, and the customer relationship carries on.
Strengthen Your AML Compliance Framework
Confirmed Match vs. Partial Match vs. False Positive
Before you file anything, you need to know which of the four possible screening outcomes you are looking at. This is the single most important judgement in the whole process, because each outcome leads somewhere different.
| Screening result | What it means | What you do | What you file |
|---|---|---|---|
| Confirmed name match | All the key identifiers line up with a designated person | Freeze immediately, within 24 hours | CNMR |
| Partial name match | Some identifiers line up, you can’t conclude either way | Suspend or reject | PNMR |
| False positive | The identifiers rule the person out | Carry on as normal | Nothing — but document it |
| Negative match | Nothing came back at all | Carry on as normal | Nothing |
The key identifiers that decide it
Screening comes down to comparing a handful of data points: full name, date of birth, nationality, passport or Emirates ID number, and address. For companies, it’s the trade licence details, registered address and the names behind the ownership.
The EOCN guidance gives a useful, worked illustration. If your customer’s name and date of birth both lines up with a designated person, but the nationality is different and the spelling is slightly off, that’s a partial name match. You have real overlap and a real gap, and you cannot close it.
Why a location or nationality mismatch alone doesn’t clear a match
This comes up constantly, so it’s worth being direct. If the date of birth matches and you are otherwise unable to rule the person out, a difference in location or nationality on its own is not enough to clear the match.
People move. Records get entered inconsistently. Someone can hold more than one nationality. A single mismatched field is a reason to look harder, not a reason to close the alert and move on. If after looking harder you still can’t decide, you are in PNMR territory.
Why spelling similarity alone doesn’t confirm it either
The reverse mistake is just as common. A near-identical spelling is not a confirmed match. If the name is close but the date of birth is two decades out and the nationality is different, that is very likely a false positive and the guidance is clear that false positives don’t need reporting, as long as you document what you found and what you decided.
A quick self-check before you escalate
Run through these before treating an alert as a partial match:
- Do I hold the customer’s ID documents, or am I working from a name and nothing else?
- Does the date of birth match, partly match, or contradict?
- Does the nationality or ID number rule the person out on its own?
- Have I checked the alias and alternative spellings published on the list entry?
- Can I write down, in one sentence, why I can’t conclude either way?
If you can’t answer question five, you probably have a false positive or a confirmed match, not a partial one.
Which Sanctions Lists Actually Trigger a PNMR
This is where a lot of unnecessary filings come from. Most screening tools bundle dozens of watchlists together. A hit on any of them looks the same on screen. But only two lists lead to a PNMR.
The two lists that count
- The UAE Local Terrorist List: the national list of designated individuals, entities and groups issued by the UAE Cabinet.
- The UN Security Council Consolidated List: the international list maintained under the relevant Security Council resolutions.
That’s it. Your screening should cover both, on an ongoing basis, for existing customers, prospective customers, counterparties and beneficial owners alike.
The lists that do NOT trigger a PNMR
If you get a confirmed or partial match against a unilateral or multilateral sanctions list, OFAC, the EU list, HM Treasury, INTERPOL notices and similar the EOCN guidance says plainly that you should not use a PNMR or CNMR to report it. Those reports are reserved for the UAE Local Terrorist List and the UN List.
That doesn’t mean you ignore it. The guidance directs you to consult your supervisory authority on the right course of action, and to consider raising an STR or SAR with the UAE Financial Intelligence Unit instead.
The same logic applies elsewhere:
- A politically exposed person hit is not a sanctions match. It leads to enhanced due diligence, senior approval and closer monitoring not a PNMR.
- An adverse media hit is a risk signal to assess and record. It isn’t a sanctions report.
- Suspected sanctions evasion with no name match goes to the FIU as a suspicious transaction or activity report, not through a PNMR.
Getting this boundary right protects you in both directions. Over-reporting clogs the system and signals that your team can’t distinguish between report types. Under-reporting is worse.
Staying on top of list changes
Designations don’t arrive on a schedule. Subscribe to the EOCN’s Notification Alert System so you find out when a list changes rather than discovering it at your next review.
One point the guidance is specific about: screening obligations don’t pause for weekends or public holidays. If your business is genuinely closed and no customer can access funds or assets during that period, screening starts from the first minute you reopen, and measures must follow immediately. If customers can transact, you need a procedure that covers those days.
Who Has to File a PNMR in the UAE?
If you are a regulated business in the UAE, this applies to you. That’s broader than most people assume.
- Financial institutions – banks, exchange houses, insurers, finance companies, brokerages and payment providers.
- DNFBPs – real estate brokers and agents, dealers in precious metals and stones, corporate service providers, auditors and accountants, lawyers and notaries.
- Virtual asset service providers – including crypto exchanges, custodians and brokers.
If you hold a licence and you onboard customers or process transactions, assume you are in scope until you have documented otherwise.
Who inside the business files
The Compliance Officer or MLRO is the primary goAML user and the person who submits. The deputy should be set up too, and this matters more than it sounds. A five-business-day clock does not pause because one person is on leave. If only one individual in your business can log in and file, you have a single point of failure sitting on top of a statutory deadline.
What you need in place before you can file
- goAML registration, approved and active
- An EOCN Notification Alert System subscription so you receive list updates
- A written escalation procedure covering who decides, who suspends and who files
- Screening that covers both required lists, running on an ongoing basis rather than only at onboarding
If any of these are missing, fix them before you have a live match. You do not want to be registering for a portal while a deadline runs.
Need Support With goAML Reporting?
When Do You Have to File a PNMR? Triggers and Deadlines
Two different clocks run in this process and mixing them up is one of the more common mistakes.
If the partial match is an existing customer
You already hold their ID documents. You’ve reviewed them and still can’t conclude whether it’s a confirmed match or a false positive. In that case you must suspend the transaction without delay, stop providing funds, assets or services, and submit a PNMR through goAML within five business days from taking the suspension measures.
Note where the clock starts: from the measure, not from the moment the alert appeared.
If the partial match is a prospective customer or counterparty
Here you may not have documents yet, so the first job is to get them. The guidance allows a reasonable window of ten business days to obtain ID documents.
What happens next depends on what you get:
- The documents clear it as a false positive → proceed with the relationship or transaction. No PNMR needed. Document the decision internally.
- The documents confirm the match → that’s now a confirmed name match, and a different report applies.
- The documents never arrive within ten business days → reject or cancel the transaction or service, then file a PNMR within five business days of that rejection, stating that it was rejected because you couldn’t obtain ID documents.
- The documents arrive after you’ve already rejected and filed → screen again on the new documents and act on the result. You may treat it as a new transaction and submit a fresh report.
Deadline summary
| Situation | Immediate action | Filing deadline | Clock starts from |
|---|---|---|---|
| Existing customer, partial match | Suspend without delay | 5 business days | The suspension measure |
| Prospective customer, documents pending | Hold, chase documents | — | Up to 10 business days to obtain ID |
| Prospective customer, no documents after 10 business days | Reject the transaction | 5 business days | The rejection |
| Documents received after rejection | Re-screen | Depends on result | Treated as a new case |
What “without delay” means
The guidance defines it: immediately, or in any case within 24 hours of designation. In practice, treat “without delay” as something you do before you finish the paperwork, not after.
Suspend or reject? What to Do the Moment a Partial Match Appears
Suspension and freezing are not the same thing
They look identical operationally, both stop the person getting at their funds or assets. The difference is what triggers them and how long they last.
- Freezing applies to a confirmed name match. It stays in place until the person is delisted or the EOCN instructs you to cancel it.
- Suspension applies to a partial name match, where you’ve looked at the documents and still aren’t sure. It stays in place until the EOCN comes back and tells you which way it went.
Using the words interchangeably in your policy or your filing creates confusion at exactly the wrong moment. Keep them separate.
When to reject rather than suspend
Suspension is for people you already have a relationship with. Rejection is for prospective customers and counterparties where you couldn’t get the documents you needed inside the ten-business-day window. You cancel the transaction, then file.
What you can and can’t say to the customer
This is worth getting right, because the common advice “never tell the customer anything” is not quite what the guidance says.
The EOCN guidance states that notifying a customer after measures have been implemented is not considered tipping off. What you must not do is tell them beforehand. Warning someone that their name has flagged, before you have acted on it, is the problem.
Once measures are in place, you can tell an affected customer about the grievance and requests procedure published on the EOCN’s website, which is how they raise the matter themselves.
Separately, if your concern has moved from a sanctions match into genuine suspicion of money laundering, the tipping-off rules around suspicious transaction reporting are stricter and different. Don’t blur the two situations.
Handling a legitimate customer caught in a partial match
Most partial matches involve people who have done nothing wrong. Keep the conversation factual and procedural: you are completing a regulatory check required of all licensed businesses, you have requested additional identification, and you will update them as soon as you are able. Avoid speculation, avoid apologising for the law, and put the request for documents in writing so the ten-day window is evidenced.
How to File a PNMR in goAML: Step by Step
Here is the full sequence, from the alert on screen to the submission confirmation.
Step 1: Get the ID documents in front of you
For an existing customer, pull the file and review what you already hold. For a prospective customer or counterparty, request passport or Emirates ID for individuals, and trade licence plus articles of association for entities. Put the request in writing and date it — that’s what starts and evidences your ten-business-day window.
Step 2: Screen against both lists
Run the check against the UAE Local Terrorist List and the UN Security Council Consolidated List. Include beneficial owners and counterparties, not just the named customer.
Step 3: Try to resolve the match before you escalate
Compare every identifier you hold against the list entry, including published aliases and alternative spellings. Write down what matched, what didn’t, and what you couldn’t verify. If that note lets you conclude one way or the other, you don’t have a partial match. If it doesn’t, you do and you now have the beginning of your report narrative.
Step 4: Apply suspension or rejection measures
Do this before you start filling in the report. Suspend the transaction for an existing customer or reject it for a prospective one where documents never came. The filing clock starts here.
Step 5: Log in to goAML and select the PNMR report type
Sign in as the Compliance Officer or MLRO and choose the Partial Name Match Report. Selecting the wrong report type is a common and entirely avoidable error a PNMR is not an STR, and neither is a CNMR.
Step 6: Complete the reporting entity and reporting person details
Confirm your organisation’s details and the contact details of the person submitting. Make sure these are current – this is how the EOCN comes back to you.
Step 7: Enter the match, customer and transaction details
Record the full name of the partial name match, the identifiers you hold, and the transaction or service involved. Write the narrative so someone outside your business can follow it: what matched, what didn’t, what you tried, and why you couldn’t conclude.
Step 8: Attach the supporting documents
Cover everything in the mandatory list below. Check that attachments are legible and that the names and figures in them agree with your narrative.
Step 9: Submit and save the reference
Record the submission reference, the date, the person who filed and the deadline it met. This is what an inspection will ask for.
Step 10: Notify your supervisory authority
Share the report with your relevant supervisory authority in line with their process. Different supervisors handle this differently, so confirm yours rather than assuming.
Step 11: Wait for instructions before doing anything else
Suspension measures stay in place until the EOCN responds. Do not lift them on your own judgement, however confident you become, and however much pressure the customer applies.
Not Sure How to Handle a Partial Match?
What Goes Into a PNMR: The Information and Documents Checklist
The guidance sets out what is obligatory when you submit a PNMR.
The full name of the partial name match
Attach ID documents where you have them – passport or ID card for individuals, trade licence and articles of association for entities.
This matters more than it might appear. Without ID documents, the EOCN cannot verify whether the match is a confirmed match or a false positive. A PNMR with no identification attached is a question the recipient has no way of answering, which means your suspension sits unresolved for longer.
The amount of funds or other assets suspended
Include the value of funds in accounts, transactions, securities or real estate, with documentary proof: bank statements, transaction receipts, portfolio summaries, title deeds.
A description of the rejected transaction or service
If you hold no funds and the engagement is service based, describe the transaction or service you rejected in enough detail that someone can picture it.
Previous relationships and transactions
The same approach as confirmed matches applies. Where there is earlier history with the same party, covering a five-year window, it should be reported — including where no funds are currently held and where accounts have since been closed. Say so explicitly in the description.
Why filings come back incomplete
In practice, the same handful of issues recur:
- No ID documents attached, leaving the EOCN unable to verify anything
- A narrative that describes the transaction but never states why the match couldn’t be resolved
- Figures in the report that don’t reconcile with the attached statements
- Illegible scans or documents in a format the portal handles badly
- The wrong report type selected entirely
What Happens After You File a PNMR
Three things can happen, and the waiting is the part nobody prepares for.
- The EOCN concludes it was a false positive. Cancel the suspension, resume normal business, and keep every piece of documentation from the episode.
- The EOCN validates the match. It is now a confirmed name match. Freeze the funds or assets, stop providing services, and follow the confirmed name match reporting route.
- You haven’t heard back yet. Suspension measures stay in place until instructions arrive through goAML. There is no self-clearing and no expiry you can rely on.
Record keeping
Keep records of all screening results confirmed matches, partial matches and false positives like for at least five years, retrievable for audits and inspections.
The false positive part is the one business skip. If you cleared an alert and wrote nothing down, you have no way of showing an inspector that you made a reasoned decision rather than simply closing it.
PNMR vs CNMR vs STR vs SAR: Which Report Do You File?
| Report | What triggers it | Where it goes | Deadline | Measure alongside |
|---|---|---|---|---|
| PNMR | Partial match to the UAE Local Terrorist List or UN List you can’t resolve | EOCN and your supervisory authority, via goAML | 5 business days from the measure | Suspend or reject |
| CNMR | Confirmed match to either list | EOCN and your supervisory authority, via goAML | 5 business days from freezing | Freeze without delay |
| STR | Suspicion that a transaction involves proceeds of crime | UAE FIU, via goAML | Without delay | Depends on the case |
| SAR | Suspicious behaviour or pattern not tied to a specific transaction | UAE FIU, via goAML | Without delay | Depends on the case |
The CNMR used to be called the FFR
If your policy documents still refer to a Funds Freeze Report, they’re out of date. The report used for confirmed name matches was renamed the Confirmed Name Match Report (CNMR). A fair amount of published guidance and consultancy content still uses the old name, which is worth knowing when you’re reading around the topic.
The mix-up worth avoiding
Filing an STR when you needed a PNMR, or the reverse, is the most frequent error. The test is simple. Is this a name match against the UAE Local Terrorist List or the UN Consolidated List? Then it’s a PNMR or a CNMR. Is it suspicion about conduct, funds or behaviour, with no such name match? Then it’s an STR or SAR.
Let’s Review Your AML Compliance Setup
Why Partial Matches Happen: Name Matching in AML Screening
Most PNMR workload is created upstream, in how your screening tool decides what counts as a match. Understanding that is the difference between a manageable alert queue and a permanent backlog.
Arabic and English name variations
A single Arabic name can be transliterated into English several legitimate ways. Add patronymics, dropped or included articles, inconsistent spacing, and the same person appearing with three, four or five name elements depending on the document. This is the main engine of false positives in the region, and no amount of staff diligence fixes it on its own.
How screening tools decide what counts as a match
Most tools score similarity between the name you entered and the names on the list, then flag anything above a threshold you set. That threshold is a judgement call with consequences in both directions.
- Set it loose and you generate alerts constantly. Teams start clearing them at speed, and the one that mattered gets cleared alongside the rest. Alert fatigue is a real compliance failure, not a productivity complaint.
- Set it tight and you miss matches. This is by far the more dangerous error, because nothing on your screen tells you it happened.
The answer is not a magic number. It’s deliberate tuning, documented reasoning, and periodic testing against known cases so you can show what your settings catch.
Matching companies is harder than matching people
Entity matching brings its own problems: trading names that differ from legal names, legal suffixes that appear inconsistently, abbreviations, branch and group structures, and ownership that must be traced before you know whose name to screen. A tool that handles individuals well can still be weak on entities.
What good name matching should be giving you
If you’re assessing your current setup or choosing AML screening software, these are the things that reduce PNMR workload rather than adding to it:
- List updates that reach you promptly, not at the next scheduled refresh
- Genuine transliteration and alias handling, not just character-level fuzzy matching
- An audit trail on every alert decision, including the ones cleared
- Scoring you can see and explain, rather than a number with no reasoning behind it
- Re-screening of the whole book when a list changes, not only new customers
- Entity matching that handles ownership structures properly
Testing whether your screening works
Responsibility doesn’t transfer to your vendor. If your tool misses a designated customer, that’s your failure, not theirs. Periodic testing against known cases, with the results written down, is what turns a purchase into a defensible control, and it feeds directly into your customer risk assessment and your wider ongoing monitoring framework.
Common PNMR Mistakes and How to Avoid Them
- Clearing a match on one mismatched field. A different nationality or address is not, on its own, proof the person is someone else. Look at the whole identifier set.
- Waiting for certainty before suspending. Suspension is precisely what you do when you don’t have certainty. Waiting until you’re sure means you’ve missed the point and probably the deadline.
- Starting the clock from the wrong date. Five business days runs from the suspension or rejection, not from the alert.
- Filing a PNMR for a list that doesn’t require one. OFAC, EU, HM Treasury and INTERPOL matches don’t go through a PNMR.
- Lifting a suspension on your own judgement. It stays until the EOCN says otherwise.
- Submitting without ID documents when you have them. You’re asking a question nobody can answer.
- One person with goAML access. Deadlines don’t respect annual leave.
- Treating a false positive as nothing. No record means no defence at inspection.
What Happens If You Don’t File
Failing to comply with instructions issued by the Executive Office in relation to targeted financial sanctions carries imprisonment and a fine of not less than AED 20,000, or either penalty, under Federal Decree-Law No. 10 of 2025 (Article 33). The underlying targeted financial sanctions framework sits in Cabinet Resolution No. 74 of 2020.
The financial penalty is rarely the worst of it. Supervisory scrutiny rises, inspections become more frequent and more detailed, banking relationships get harder to maintain, and licensing questions follow. A sanctions failure is the kind of finding that shapes how a regulator treats everything else you do.
How to Make PNMR Filing Routine Instead of a Scramble
- Write a one-page escalation procedure. Who spots the alert, who decides, who applies the measure, who files, and who covers each of them. One page that people read beats thirty that nobody opens.
- Keep a match decision log. Every alert, the identifiers compared, the conclusion, the reasoning and the person who made it. Including false positives.
- Pre-build your document pack. Know in advance where ID documents, statements and transaction records live, and who can produce them within a day.
- Test your screening deliberately. Run known cases through it. Record what it caught and what it didn’t.
- Train the people who meet customers first. Front desk and onboarding staff are where a partial match is often first visible. They need to know to escalate, and equally to know not to mention it.
- Do a dry run. File a practice PNMR internally, end to end, before a real one lands. Everyone finds out where the gaps are while it costs nothing.
PNMR Readiness Checklist
- [ ] Registered and active on goAML, with an approved Compliance Officer or MLRO
- [ ] Deputy MLRO set up with goAML access
- [ ] Subscribed to the EOCN Notification Alert System
- [ ] Screening covers both the UAE Local Terrorist List and the UN Consolidated List
- [ ] Screening runs on an ongoing basis, not just at onboarding
- [ ] Beneficial owners and counterparties are screened, not only the named customer
- [ ] Written escalation procedure covering suspension, rejection and filing
- [ ] Documented match threshold and tuning rationale
- [ ] Match decision log in place, including false positives
- [ ] Procedure covering weekends and public holidays
- [ ] Document pack retrievable within one business day
- [ ] Five-year record retention working and tested
- [ ] Staff trained on the difference between a PNMR, a CNMR and an STR
- [ ] A dry-run filing completed in the last twelve months
How GRC Advisors Can Help
GRC Advisors works with regulated businesses across the UAE – financial institutions, DNFBPs and virtual asset service providers on the parts of sanctions compliance that are easy to get wrong under time pressure.
We help you build screening and escalation procedures that hold up at inspection, tune and test the tools generating your alerts, and get your PNMR, CNMR and goAML reporting right the first time. Our work covers screening framework design, match adjudication procedures, regulatory reporting support, AML policy documentation, staff training and inspection readiness, all aligned to the current UAE AML laws.
If sanctions matches are consuming your team’s week, or you are not confident your last filing would survive scrutiny, that is a solvable problem.
Need Help With PNMR Compliance?
Frequently Asked Questions About PNMR
What is the full form of PNMR?
PNMR stands for Partial Name Match Report. It is filed through goAML when a customer or counterparty partially matches a name on the UAE Local Terrorist List or the UN Security Council Consolidated List, and the business cannot confirm or rule out the match.
What does PNMR mean in AML?
It refers to the report you submit when sanctions screening produces a result you cannot resolve, not clearly the designated person, and not clearly someone else.
What is a partial name match?
It is where some key identifiers align between your customer and a designated person, others don’t, and you are unable to conclude that it is either a confirmed match or a false positive.
Who must file a PNMR in the UAE?
Financial institutions, DNFBPs and virtual asset service providers. In practice that includes banks, exchange houses, real estate brokers, gold and jewellery dealers, corporate service providers, auditors, lawyers and crypto businesses.
How many days do I have to file a PNMR?
Five business days, running from when you applied the suspension measure or rejected the transaction not from when the alert appeared.
What's the difference between freezing and suspending?
They work the same way operationally. Freezing applies to a confirmed name match and stays until delisting or a cancellation instruction. Suspension applies to a partial name match and stays until the EOCN tells you which way it went.
Do I file a PNMR if the match is a PEP?
No. A politically exposed person match leads to enhanced due diligence, senior management approval and closer monitoring not a sanctions report.
Do I have to report a false positive?
No report is required and business may proceed, but you must keep internal documentation of the alert and the actions you took.
What's the difference between a PNMR and an STR?
A PNMR is triggered by a name match to the sanctions lists. An STR is triggered by suspicion about a transaction, with no name match involved.
Is the FFR the same as a PNMR?
No. The Funds Freeze Report was used for confirmed matches and has been renamed the Confirmed Name Match Report (CNMR). A PNMR has always been for partial matches.
Can I file a PNMR without ID documents?
Yes, in defined circumstances, typically where a prospective customer failed to provide documents within ten business days. State that as the reason. Bear in mind the EOCN cannot verify the match without identification.
How long do I keep PNMR records?
At least five years, covering all screening results including false positives, and retrievable for audits and inspections.
What happens after I submit a PNMR?
The EOCN either confirms the match, concludes it was a false positive, or hasn’t responded yet. Suspension stays in place until you hear.
Can I use manual screening instead of software?
For a very small, low-volume business with structured processes, it can work. It tends to break down on re-screening the whole customer book after a list update and on producing a reliable five-year audit trail.
Who in my business is responsible for filing?
The Compliance Officer or MLRO, with a deputy set up as backup.
