Suspicious Transaction Reporting to FIU-India: STR Rules for Bankers (2026)

Every frontline banker eventually hits the same judgment call: a transaction pattern looks off, but there's no obvious fraud, no bounced cheque, nothing that trips a hard rule. This is exactly where suspicious transaction reporting to FIU-India comes in. Under the Prevention of Money Laundering Act (PMLA), 2002 and the PML (Maintenance of Records) Rules, 2005, every reporting entity — banks included — must escalate such transactions to the Financial Intelligence Unit-India (FIU-IND), the central national agency that receives, analyses, and disseminates information on suspicious financial activity. For JAIIB and CAIIB candidates, this is a high-yield exam area because it combines a legal obligation, a strict timeline, and a criminal-liability trap (tipping off) in one compact topic.

This article breaks down what actually triggers a Suspicious Transaction Report (STR), who inside the bank owns the filing, how fast it must reach FIU-IND, and why telling the customer about it can put you on the wrong side of the law. Bookmark the KYC, AML and CFT tag hub for the full run of related articles on this subject.

🚨 What Triggers a Suspicious Transaction Report

An STR is not limited to transactions above a fixed rupee value — that is precisely what separates it from a Cash Transaction Report (CTR). A transaction becomes reportable when it appears, in the bank's reasonable judgment, to involve proceeds of crime, has no obvious economic or lawful purpose, or is structured to avoid reporting or identification requirements. Typical triggers include rapid layering of funds across multiple accounts, transactions inconsistent with a customer's declared occupation or turnover, sudden activity in a dormant account, or a client who is visibly reluctant to provide documentation.

Alerts often surface first through the bank's transaction monitoring system, but they can equally come from a teller's observation, a law-enforcement reference, or patterns spotted during account review. Increasingly, banks also see STR triggers originate from digital channels — mule accounts used to route proceeds of phishing, OTP fraud, or investment scams. If you're revising cyber-enabled fraud typologies alongside this topic, the Prevention of Cyber Crime exam pattern guide maps well onto how these red flags feed into STR filing. Once an alert is raised, it goes to the Principal Officer's team for evaluation — not every alert converts into an STR, but every alert must be documented and reasoned through.

⏱️ STR Filing Timelines and the Principal Officer's Role

Every reporting entity is required to designate a Principal Officer (PO) — typically a senior compliance functionary — who is responsible for internal reporting and for furnishing information to FIU-IND under Section 12 of PMLA. Branch staff and the Principal Officer do not act independently of the record-keeping chain: the identification and transaction records that support an STR trace back to the same customer files covered under record keeping obligations under PMLA.

The widely tested timeline is this: once the bank's internal process arrives at a conclusion that a transaction is suspicious, the STR must be furnished to FIU-IND without delay and not later than seven working days from that conclusion. This is distinct from the earlier internal step of detecting and investigating the alert, which itself should not be allowed to drag on indefinitely — RBI's KYC Master Direction expects banks to reach a decision within a reasonable period after the transaction first comes to notice. Filing itself happens electronically through FIU-IND's FINnet 2.0 reporting portal, using the prescribed STR format.

💡 Exam Tip: Remember the anchor point for the 7-working-day clock — it starts from the date the bank concludes the transaction is suspicious, not from the date the transaction occurred.

🤐 Tipping Off: Why Bankers Cannot Alert the Customer

PMLA makes it a punishable offence for a bank, its officers, or its employees to disclose to the customer — or to any third party — that an STR has been filed or that an investigation is underway. This is called "tipping off," and it exists because a forewarned customer can move or destroy evidence, close accounts, or flee before enforcement agencies act. The confidentiality obligation extends to internal communication as well: only staff with a genuine need to know should have visibility into an STR, and it must never be referenced in customer-facing correspondence, account remarks the customer can view, or informal conversation.

This creates a real operational tension for branch staff. A customer may ask directly why their account is on hold or why a transaction was queried — the honest-sounding answer is often the wrong one. Banks train staff to use neutral, generic language ("this is a routine compliance review") rather than confirming or denying an STR. Getting this distinction right is one of the more commonly misunderstood areas in KYC-AML exam papers.

⚠️ Common Mistake: Candidates often assume tipping off only applies after an STR is filed. In practice, the same confidentiality discipline applies from the moment an internal suspicion review begins.

📊 STR vs Other FIU-India Reports

Banks file several distinct report types with FIU-IND, and exam questions frequently test whether candidates can tell them apart by trigger, threshold, and deadline. The table below lines up the four core report types reporting entities routinely submit.

The absence of a threshold is what makes STR unique — a ₹5,000 transfer can be just as reportable as a ₹5 crore one if the surrounding facts are suspicious. This is also why STR relies heavily on judgment and pattern recognition rather than a simple rupee-value trigger.

🏛️ Inside FIU-India's Reporting Ecosystem

FIU-IND functions as the national nodal agency for receiving and analysing reports from banks, NBFCs, insurers, and other reporting entities, and for sharing actionable intelligence with law enforcement and regulators. Understanding where it sits in the broader institutional structure — alongside enforcement agencies, RBI, and sector regulators — is covered in depth under Organization Structure in India, which every candidate should read alongside this topic.

The underlying legal mandate for all of this — PMLA itself, its rules, and the reporting obligations placed on banks — is set out in Legislation at National Level. India's STR framework also reflects global standards; for the international benchmarks that shaped these obligations, see International Guidelines & Standards. Because monitoring quality depends directly on how current customer data is, ongoing re-verification cycles described in periodic KYC updation rules feed the same alert pipeline that produces STR triggers, and identity data drawn from the Central KYC Records Registry often supports the customer-profile checks a Principal Officer runs before deciding to file.

📌 Remember: FIU-IND does not investigate crimes itself — it analyses reports and routes actionable intelligence to enforcement agencies, RBI, and other regulators.

For the current reporting formats, FAQs, and compliance clarifications, banks and candidates can refer to the Reserve Bank of India's published guidance at rbi.org.in.

🎯 Exam Takeaways and What to Revise Next

For KYC-AML papers, lock in three things: STR has no monetary threshold, the 7-working-day clock starts from the bank's conclusion of suspicion (not the transaction date), and tipping off is a standalone offence independent of whether the STR was ultimately accepted or acted upon by FIU-IND. Questions often combine two of these in a single scenario-based MCQ, so practise reading the fact pattern carefully before picking the trigger.

Ready to test yourself under exam conditions? Attempt a full mock set on iibf.store/tests or continue your structured prep through the CAIIB course track.

🧠 Practice MCQs: Suspicious Transaction Reporting to FIU-India

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions