goAML is the mandatory NFIU platform for filing Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) in Nigeria. The CBN March 2026 circular requires automated API-based filing, manual portal submissions are no longer sufficient. This is the complete technical and operational integration guide.
What is goAML?
goAML is the UNODC-developed financial intelligence platform deployed by the Nigerian Financial Intelligence Unit (NFIU) to receive STRs and CTRs from all regulated financial institutions. Every Nigerian bank, fintech, MFB, and VASP must file reports via goAML, available at goaml.nfiu.gov.ng. As of 2026, automated API-based filing is required under the CBN Baseline Standards circular.
Register Your Institution on NFIU goAML Portal
Visit goaml.nfiu.gov.ng and complete the institutional registration form. You will need: CAC registration number, CBN licence number, MLRO details, and a designated goAML system administrator. NFIU typically activates new institution accounts within 5–10 business days.
Obtain goAML Web Services API Credentials
After registration, submit a formal request to the NFIU IT department for web services API access. You will receive: institution code, API endpoint URL, authentication method details (typically Basic Auth or OAuth2), and the NFIU goAML XSD schema files for STR and CTR reports.
⚠ Note: As of 2026, the NFIU has expanded goAML API access following the CBN March circular. Institutions that previously used manual portal submissions must now migrate to API-based automated filing.
Map Your Data Schema to goAML XML Format
The NFIU goAML platform accepts STRs and CTRs in a specific XML format defined by the goAML XSD schema. Key data fields required include: report reference number, institution code, report date, reporter details, subject (customer) information including BVN/NIN, account details, transaction details (amount, date, channel, counterparty), and the grounds for suspicion narrative.
Configure Your AML Platform for Automated Report Generation
Your AML monitoring system must be configured to automatically generate a goAML-compliant XML STR or CTR when: (a) a compliance analyst confirms an alert as suspicious, or (b) a cash transaction meets the CTR threshold. The report must be routed through the MLRO approval workflow before submission.
Test in NFIU Sandbox Environment
The NFIU provides a sandbox test environment for validating report formats before live submission. Submit at least 20 test STRs and 10 test CTRs covering different typologies, account types, and transaction channels. Validate that all NFIU acknowledgement codes (accepted, rejected, pending) are handled correctly by your system.
⚠ Common rejection reasons: missing BVN, incorrect date format, narrative under minimum word count, invalid institution code, malformed XML structure.
Enable Live Reporting & Monitor Submission Confirmations
After NFIU sandbox sign-off, enable live automated reporting. Implement a reconciliation process that tracks every STR and CTR from alert confirmation through NFIU submission to acknowledgement receipt. Maintain a full audit trail of all submissions, rejection codes, resubmissions, and NFIU responses for CBN examination.
Suspicious Transaction Report (STR)
Currency Transaction Report (CTR)
Missing or invalid BVN in subject record
Fix: Validate BVN format (11 digits) before submission. Ensure your AML system pulls BVN from customer records.
Narrative too short (minimum 200 words)
Fix: AI-generated STR narratives must meet NFIU minimum length requirements. AI Shield Nexus templates exceed 300 words by default.
Invalid date format in transaction records
Fix: Use ISO 8601 format (YYYY-MM-DDTHH:MM:SS) for all date-time fields in the goAML XML schema.
Duplicate report reference number
Fix: Implement a unique, sequential reference numbering system (e.g. BANKCODE-STR-YYYY-NNNNNN).
Missing transaction channel code
Fix: Map all your transaction channels to the NFIU-defined channel codes: 01 (counter), 02 (ATM), 03 (internet banking), 04 (mobile), 05 (USSD), 06 (POS), 07 (agent), 08 (NIP/NIBSS).
XML schema validation failure
Fix: Validate your XML against the official NFIU XSD schema file before every submission. Implement schema validation in your integration middleware.
24-Hour Deadline Risk
Manual filing processes frequently miss the 24-hour STR deadline as analysts struggle with report writing, data gathering, and submission logistics.
Narrative Quality Failures
Manually-written STR narratives are often rejected by the NFIU for being too vague, too short, or failing to articulate the specific grounds for suspicion.
Volume Scalability
As transaction volumes grow, manual filing cannot scale. A single analyst can file 3–5 STRs per day manually; AI-assisted filing handles hundreds.
Audit Trail Gaps
Manual processes leave incomplete audit trails, CBN examiners require evidence of every alert from initial detection through to NFIU submission confirmation.
AI Shield Nexus includes pre-built NFIU goAML integration, automated STR generation, AI-written narratives, MLRO approval workflow, and submission tracking. Nigerian banks go live in 2–4 weeks.
What is goAML Nigeria?
goAML is the UNODC-developed platform used by the Nigerian Financial Intelligence Unit (NFIU) to receive STRs and CTRs from all regulated financial institutions in Nigeria. It is mandatory for all CBN-licensed banks, fintechs, MFBs, and VASPs.
How long does goAML integration take?
A typical goAML integration takes 4–10 weeks depending on the bank's core banking system, data quality, and IT capacity. AI Shield Nexus includes pre-built goAML integration that reduces this to 2–4 weeks.
What is the STR filing deadline?
Nigerian institutions must file STRs with the NFIU via goAML within 24 hours of detecting or forming a suspicion of money laundering or terrorist financing. Late filing is a CBN enforcement trigger.
Can goAML integration be done without AI Shield Nexus?
Yes, institutions can build goAML integration directly. However, this requires significant internal IT development, XML schema expertise, NFIU API knowledge, and ongoing maintenance. AI Shield Nexus provides a pre-built, tested, and supported integration.
What happens if our goAML submissions are rejected?
Rejected submissions must be corrected and resubmitted. If the original 24-hour deadline has passed due to the rejection, document the error and resubmission as part of your audit trail. Systematic rejection patterns should be reported to the NFIU for guidance.