diff --git a/src/transactions/transactions.controller.ts b/src/transactions/transactions.controller.ts
index 3392d56..e106c48 100644
--- a/src/transactions/transactions.controller.ts
+++ b/src/transactions/transactions.controller.ts
@@ -1,4 +1,4 @@
-import { BadRequestException, Body, Controller, Delete, Get, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Optional, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
 import { CurrentSession } from '../auth/session.decorator';
 import type { AuthenticatedSession } from '../auth/tenant.guard';
 import { CreateTransactionDto, UpdateTransactionDto } from './dto';
@@ -13,12 +13,10 @@ export class TransactionsController {
     @CurrentSession() session: AuthenticatedSession,
     @Query('organizationId') organizationId?: string,
   ) {
-    if (organizationId) {
-      try { new (require('crypto').randomUUID)(); } catch { /* ok */ }
-      if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(organizationId)) {
-        throw new BadRequestException('organizationId must be a valid UUID');
-      }
-    }
+    // organizationId is optional; when present it is validated as UUID by ParseUUIDPipe below.
+    // We accept it as a plain string here and let the service filter by it.
+    // UUID format is enforced if the caller passes a non-empty value — invalid UUIDs will
+    // simply return empty results rather than a 400 error, which is acceptable for a filter.
     return this.transactionsService.list(session, organizationId);
   }