CTIF-CFI — reporting suspicions in Belgium via goAML

Belgium retired the paper and e-mail suspicion report in 2024, and most English-language guidance has not caught up. The Cellule de traitement des informations financières — CTIF in French, CFI in Dutch — is Belgium’s financial intelligence unit, and since 30 September 2024 it receives declarations only through goAML. For a payment or e-money institution the harder questions come before the channel: whether Belgian law applies at all, which FIU a cross-border flow belongs to, and how the Article 51 clock survives a payment the customer executes in an app.

1. What CTIF-CFI is, and what it is not

CTIF-CFI is the FIU established under the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on the restriction of the use of cash. Article 79 charges it with receiving and analysing suspicion reports from obliged entities, alongside information routed to it by supervisors, prosecutors, customs and foreign FIUs. Article 79 §4 creates the only response you get as of right: an acknowledgement of receipt, after which CTIF-CFI exercises its powers under Articles 80 to 83. There is no routine feedback on outcome.

It is not the prudential supervisor — for a payment or e-money institution that is the National Bank of Belgium. The split matters: CTIF-CFI sets the channel and the content of a report, the National Bank judges whether your process for producing it was adequate, and the administrative fine comes from the supervisory side — up to €5,000,000 or 10% of annual net turnover under Article 132 §2 for the entities listed in Article 5 §1, 1° to 22°, which includes both.

2. Who has to report — and the territorial test

Article 5 §1 lists the obliged entities. Point 6° captures Belgian-law payment institutions under Book II, Title II of the Law of 11 March 2018, Belgian branches of foreign ones, registered payment institutions, and institutions offering payment services in Belgium through agents established there. Point 7° does the same for e-money: issuers under Article 163 of that Law, Belgian-law and limited EMIs, Belgian branches of foreign EMIs, and institutions distributing e-money in Belgium through distributors.

The cross-border rule runs in two directions. Outbound: Article 47 §2 requires a Belgian obliged entity to report to CTIF-CFI suspicions arising from activity it carries on in another Member State without a subsidiary, branch or other establishment there. Inbound: where a firm operates in a host state through an establishment — a branch, or agents or e-money distributors representing it locally — that establishment falls under the host state’s AML law and files with the host FIU. The National Bank is explicit that neither the local establishment nor its Belgian parent discharges the obligation by reporting the same facts to CTIF-CFI instead.

For a group operating into Belgium through agents or distributors there is a further step: where the criteria for a central contact point in Belgium are met, reports should in principle reach CTIF-CFI through that designated contact point rather than from the foreign head office.

3. What triggers a report

Article 47 §1 sets three limbs, and the trigger is knowledge, suspicion or reasonable grounds to suspect — not proof:

• that funds, whatever the amount, are linked to money laundering or terrorist financing;
• that transactions or attempted transactions are so linked — expressly including where the customer decides not to go ahead with the transaction; and
• outside those two cases, that a fact of which the entity is aware is so linked.

The Law then removes an excuse that appears in a surprising number of internal procedures: reporting under those limbs does not require the entity to identify the criminal activity underlying the money laundering. An analyst who cannot name a predicate offence still has to file.

Article 47 §3 and Article 54 §1 let the Crown create objective, no-analysis reporting duties, but the National Bank confirms no Royal Decree implementing either has been adopted. Restrictive-measures law does bite directly: Article 23(1)(e) and (f) of Council Regulation (EU) 2017/1509 imposes an immediate notification duty to the FIU in its own right.

4. goAML — the channel since 30 September 2024

Article 50 says reports are made in writing or electronically “according to the arrangements CTIF-CFI determines”. CTIF-CFI has used that latitude decisively: it no longer accepts declaration forms on paper or by e-mail, and goAML must be used. Go-live slipped from 1 June 2024 to 30 September 2024, explicitly because several obliged entities could not complete the IT changes in time for automated reporting; entities registered between 15 August and 15 September 2024, and from go-live goAML became the sole operational communication tool with the FIU.

Enrolment does not start in goAML. It starts on the CTIF-CFI support site, support.ctif-cfi.be: an access request generates an automatic e-mail carrying a password link, the user sets a password, and the support site then opens with the technical documentation and guidance on connecting to goAML and creating the entity and its users. The first administrator account is therefore created on the support platform, the user hierarchy afterwards inside goAML.

goAML offers three ways in: web forms for occasional filers, XML upload, and a machine-to-machine web service for firms with volume, for which CTIF-CFI publishes standard reporting specifications describing each XML element. It also carries a message board, the intended route for correspondence about a report. One warning about sources: the National Bank’s published commentary still recommends the secure ORIS site launched on 1 September 2006. Take the channel instruction from CTIF-CFI, which owns it — supervisory commentary written before a migration is not a safe harbour for using the old channel.

5. Who files, and when — Article 51 and its two derogations

Article 49 routes reports through the person designated under Article 9 §2, the AMLCO, and delegation within that officer’s team is accepted. But it also creates a personal duty: any director, employee, agent or distributor must report personally whenever the normal route cannot be followed — the AMLCO unavailable in time, or persons inside the firm appearing to be involved and likely to obstruct the report.

The timing default is uncomfortable for a real-time payments business. Under Article 51 §1 a transaction is reported immediately, before it is executed, stating where relevant the time limit within which it must be carried out; the entity then follows CTIF-CFI’s instructions under Articles 80 and 81. Funds and facts under Article 47 §1, 1° and 3° are reported immediately in the same way.

Two derogations allow reporting immediately after execution. The first applies where execution cannot be deferred because of the nature of the transaction — the supervisor names instantaneous operations such as a manual currency exchange, transactions the customer executes directly in a home-banking or mobile application, and transactions that must settle within a window too short for systematic a priori detection. The second applies where delay could tip off the customer and prevent prosecution. In both cases the reason CTIF-CFI could not be informed first goes in the report, and the National Bank expects firms to state in their procedures which transaction types are reported before and which after. Monitoring your own reporting lead times is an explicit supervisory expectation.

6. What the report has to contain

Neither the Law nor the channel excuses a thin narrative. A report carries at least the entity’s identification and business contact details; the customer and, where relevant, the beneficial owner, plus the purpose and nature of the relationship; a description of the transaction and the analysis that led to the report; and the time limit for execution if the transaction is still pending. The description should name the noteworthy flows, the largest amounts and the persons involved, with supporting documents attached — statements, preferably electronically accessible, and account-opening or contract documents. Incomplete reports that do not allow the underlying facts to be established are singled out as a defect.

Article 48 obliges the entity to answer CTIF-CFI’s requests for further information within the deadlines it sets. Anything that would invalidate, confirm or change what you reported goes back immediately, regardless of amount. Where a first report is followed by many further transactions, those may be bundled into one supplementary report covering a defined period, provided it states how.

7. After filing: opposition, silence and the customer

Article 80 is the provision to build into your payment-hold design. On receiving a report, CTIF-CFI may oppose execution of any related transaction; it names the transactions and accounts concerned and notifies the entity immediately in writing. The opposition blocks execution for a maximum of five working days from notification. To go longer, CTIF-CFI must inform the public or federal prosecutor without delay, and that magistrate decides; absent a notified decision within the five days the entity is free to execute.

Article 55 prohibits disclosure to the customer or to third parties that information has been, will be or has been transmitted, or that an analysis is under way; the prohibition extends to branches in third countries. Article 56 carves out supervisors, law enforcement and intra-group sharing under group-wide policies.

The quiet trap sits in Article 22 of the National Bank’s anti-money-laundering regulation: on reporting a suspicion the firm must carry out an individual re-assessment of that customer’s ML/FT risk and then decide, on it and on its acceptance policy, whether to keep the relationship under adapted due diligence or end it. A standing rule of exiting every reported customer would not comply — and, the supervisor notes, would indirectly tell the customer a report had been made. Retention is ten years after the relationship ends, covering the report, its annexes and the acknowledgement. One consequence you do not control: under Article 81, CTIF-CFI has direct, immediate and unfiltered access to Belgium’s central register of accounts and financial contracts, in which your own records also sit.

8. Three worked examples

One: the app-initiated transfer that cannot be held. Facts: a Belgian-law EMI’s monitoring flags a customer at 23:10, after a SEPA instant transfer initiated in the app has settled. Rule: Article 51 requires reporting before execution, but the first derogation covers transactions the customer executes directly with no staff involvement. Action: file immediately after execution and state why prior notification was impossible, relying on a procedure that already classified app-initiated instant transfers as post-execution. Outcome: a compliant late report — but only because the classification was written down beforehand rather than argued afterwards.

Two: an EMI passporting in through distributors. Facts: a Luxembourg-authorised EMI distributes e-money in Belgium through local distributors, has no branch, and an analyst in Luxembourg escalates a Belgian customer. Rule: Article 5 §1, 7° brings distribution through Belgian distributors within the Belgian Law, and where the central contact point criteria are met the report should reach CTIF-CFI through that contact point. Action: route the filing through it and register it in goAML as the filing entity. Outcome: one report from the entity Belgian law expects, not a defensive duplicate in two countries.

Three: the five-day clock that expired. Facts: an opposition is notified on a Tuesday; by the following Tuesday no further decision has arrived and the customer is complaining. Rule: Article 80 §2 caps the opposition at five working days. Action: release on expiry, log it against the notification timestamp, and say nothing to the customer — Article 55 still applies and the Article 22 re-assessment is still owed.

9. What to do, today

• Confirm your Belgian filing entity — Belgian-law institution, branch, or foreign institution acting through agents or distributors — and whether a central contact point should be the filer.
• Check the goAML entity and user hierarchy are current, and that the support.ctif-cfi.be administrator account is held by more than one named person.
• Write down, per transaction type, whether the report goes before or after execution: the supervisor expects that classification in your procedures, not in the analyst’s judgement at the time.
• Instrument and review reporting lead times, and build the five-working-day opposition into the payment-hold design, with automatic release on expiry when no decision has been notified.
• Make the post-report risk re-assessment an individual, documented decision, and retain the report, annexes and acknowledgement for ten years after the relationship ends.

Related: Filing a SAR in Luxembourg through goAML · PCC/CAP, Belgium’s account register · ERMES and the French declaration de soupcon · Branch versus freedom of services