goAML Registration UAE: Who Needs It and How to Register

The UAE Financial Intelligence Unit processed over 100,000 suspicious transaction reports through the goAML portal in recent years (Central Bank of the UAE, 2024). The country exited the FATF grey list in 2024 after reforms that put goAML enforcement at the centre of the national action plan. Fines for non-compliance reach AED 5 million per violation under Cabinet Decision No. 16 of 2021. The AED 55,000 cash threshold for precious metals dealers has been in place since Cabinet Decision No. 10 of 2019. Personal liability provisions sit in Articles 14 to 16 of Federal Decree-Law No. 20 of 2018. Registration approval takes 2 to 5 working days in most cases.

This guide explains what goAML registration UAE requires, which businesses must sign up, how to complete the process step by step, and what happens if you do not comply. Whether you run a bank, an auditing firm, or a corporate services company in a free zone, you will know exactly where you stand by the end.

What Is goAML and Why the UAE Uses It

goAML is a reporting platform built by the UN Office on Drugs and Crime. The UAE uses it to collect suspicious transaction reports from banks, financial firms, and certain businesses. It helps the Financial Intelligence Unit track and act on money laundering and terrorist financing activity across the country.

The Legal Basis for goAML in the UAE

The core law is UAE Federal Decree-Law No. 20 of 2018 on anti-money laundering and counter-terrorism financing. Cabinet Decision No. 10 of 2019 extended those duties to designated non-financial businesses and professions (DNFBPs), pulling real estate brokers, auditors, and company formation agents into the system.

The Central Bank of the UAE and the Financial Intelligence Unit jointly oversee the platform. goAML registration UAE is a direct part of meeting FATF standards.

Here is a real example. A real estate broker in Dubai receives a cash payment above the reporting threshold. Under Federal Decree-Law No. 20 of 2018, they must file a suspicious transaction report via goAML or face a fine. There is no grace period and no minimum warning.

How goAML Fits Into UAE Financial Crime Rules

goAML is the single portal for filing Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). It replaced older paper-based and email methods that left no audit trail. Every report now goes through one secure platform with a case number and a full record, going directly to the FIU for analysis and possible referral to law enforcement.

The UAE was placed on the FATF grey list in 2022 and exited in 2024 after reforms that included tighter goAML enforcement across all covered sectors (u.ae, 2024).

Who Must Register on goAML in the UAE

Banks, exchange houses, insurance firms, and payment providers must register on goAML. So must designated non-financial businesses including real estate brokers, gold and precious metals dealers, auditors, lawyers, company formation agents, and trust service providers. Any entity handling large cash transactions or regulated financial activity is likely covered.

Financial Institutions That Must Register

If your firm holds a financial services license, goAML registration UAE is not optional. Covered financial institutions include:

• Licensed banks, including branches of foreign banks in the UAE

• Exchange houses and money transfer operators licensed by the Central Bank

• Insurance companies and brokers regulated by the Central Bank of the UAE

• Payment service providers, fintech firms, and virtual asset service providers (VASPs)

• Finance companies, investment firms, and securities brokers licensed by the SCA

VASPs were added to goAML requirements following FATF Recommendation 15 updates. An exchange house in Deira that processes remittances must register and file an STR if a customer sends an unusually large or structured payment.

DNFBPs and Other Covered Businesses

DNFBPs were brought under AML rules via Cabinet Decision No. 10 of 2019. If your business falls into any of the categories below, you need to register regardless of your license type or location.

• Real estate: Brokers and agents who handle property sales or leasing

• Precious metals: Dealers in gold, diamonds, and stones where cash deals exceed AED 55,000

• Accounting: Auditors, accountants, and tax advisors doing regulated work

• Legal: Lawyers and notaries involved in company formation or managing client funds

• Corporate services: Company formation agents and trust service providers

A company formation agent helping a client set up a mainland LLC is classified as a DNFBP. They must register on goAML and have AML policies in place before they can legally operate. The same rule applies to agents working inside a free zone.

Step-by-Step Guide to goAML Registration in the UAE

To register on goAML, visit the UAE FIU portal, create an account for your entity, enter your trade license and regulatory details, assign a compliance officer, and submit for approval. The FIU reviews your application and sends login credentials. The full process typically takes between 2 and 5 working days.

What You Need Before You Start

Get these together before you open the portal. Missing one item means your application stalls.

• Your valid UAE trade license or regulatory approval letter

• Emirates ID and passport copy of the compliance officer you will assign

• Company registration number and your supervising authority (Central Bank, DET, SCA, or your free zone)

• Contact details for the entity's Money Laundering Reporting Officer (MLRO)

• A company email address that will receive FIU communications

The compliance officer must be a senior employee with authority to file reports. Some regulated entities need approval from their supervisor before they can register, so check first.

The Registration Steps on the goAML Portal

The process is straightforward once your documents are ready. A gold dealer in Dubai's Gold Souk can complete all steps in under an hour, with FIU approval arriving within 3 working days.

• Step 1, go to the UAE FIU goAML portal: Select Register on the home screen.

• Step 2, choose your entity type: Pick financial institution or DNFBP from the list.

• Step 3, enter your trade license number, legal name, and supervising authority: Be exact. Errors here cause rejection.

• Step 4, add your compliance officer's details: Assign them MLRO status in the system.

• Step 5, upload your documents and submit: The FIU reviews and sends login credentials on approval.

Free zone companies register under their free zone authority as the competent body, not the Central Bank. Approval typically takes 2 to 5 working days.

What You Must Report After goAML Registration

After registering on goAML, you must file a Suspicious Transaction Report whenever you spot a transaction that may involve money laundering or terrorist financing. You must also file a Suspicious Activity Report for suspicious behaviour that does not involve a completed transaction. Failure to report is a criminal offence under UAE law.

Types of Reports You File on goAML

Each report type covers a different situation. Know which one applies before you file.

• Suspicious Transaction Report (STR): Filed when a completed transaction raises a red flag

• Suspicious Activity Report (SAR): Filed when behaviour is suspicious but no transaction has occurred

• High-Risk Country Report: Required when dealing with parties from FATF high-risk jurisdictions

• Cash Transaction Report (CTR): Some entities must file for cash dealings above set thresholds

Reports must be filed as soon as suspicion arises. There is no set grace period. A lawyer helping a client transfer a large asset notices the client cannot explain the source of funds. Even if the transfer does not complete, the lawyer files an SAR on goAML that day.

Both STRs and SARs carry tipping-off restrictions. You cannot tell the client you have filed. Doing so is a separate criminal offence.

Is there a deadline for filing an STR on goAML UAE?

There is no fixed number of days. The duty to file triggers the moment you form a suspicion, not when an investigation concludes. The FIU expects reports to be filed promptly. Delay is treated as a compliance failure and can attract the same fines as non-filing.

Keeping Records to Support Your Reports

Good records are your defence if the FIU audits you. The 5-year retention period is set by Federal Decree-Law No. 20 of 2018.

• Keep all customer due diligence (CDD) records for at least 5 years after a transaction

• Store copies of all STRs and SARs filed, with supporting evidence

• Your internal AML policy must be written, dated, and reviewed at least once a year

• Appoint a senior staff member as MLRO and document that appointment formally

The FIU can request records going back 5 years. A real estate broker with proper digital files can respond in hours. One without them faces a fine and a potential license suspension.

Penalties for Not Registering or Reporting on goAML

Failing to register on goAML or not filing required reports can result in fines of up to AED 5 million, license suspension, and criminal prosecution under Federal Decree-Law No. 20 of 2018. Company owners and compliance officers can be held personally liable. Regulators have increased enforcement significantly since 2022.

goAML Registration UAE: Key Facts at a Glance

Fines and Sanctions You Face

The UAE added goAML enforcement to its FATF action plan after the 2022 grey-listing. Since then, regulators have been far more active in checking compliance across all sectors.

• Administrative fines range from AED 50,000 to AED 5 million per violation

• Regulators can suspend or cancel your trade license for non-compliance

• Criminal charges can be brought against individuals, not just the company

• Repeat violations or deliberate failure to report carry heavier penalties

A company formation agent who failed to register on goAML was fined and had their license reviewed by their supervising authority. The UAE exited the FATF grey list in 2024, partly because enforcement of this kind became consistent (u.ae, 2024).

Personal Liability for Compliance Officers

Personal liability provisions sit in Articles 14 to 16 of Federal Decree-Law No. 20 of 2018. These are not theoretical. MLROs have been personally fined.

• The MLRO can be held personally liable if they knew of suspicious activity and did not file

• Tipping off a client about a filed STR or SAR is itself a criminal offence

• Senior management who fail to set up AML systems can face prosecution alongside the company

• Document every decision not to file a report, this is your defence if the FIU asks

An MLRO at a payment firm who chose not to file an STR was personally fined after an FIU review found they had seen the red flags in the transaction data. If you are the MLRO, keep a written log of every decision you make, including the ones where you decide not to file.

How goAML Registration Affects Free Zone Companies

Free zone companies in the UAE are not exempt from goAML registration. If your business activity falls under the financial institution or DNFBP categories, you must register regardless of where you are licensed. Your free zone authority acts as your supervising body for AML purposes and can audit your compliance.

Which Free Zone Activities Trigger Registration

The activity code on your license, not your location, decides whether you must register.

• Company formation and corporate service activities trigger DNFBP status in any free zone

• Financial consulting and advisory services may require registration depending on scope

• Technology companies providing payment or crypto services fall under VASP rules

• Trading companies dealing in gold, gems, or high-value goods above cash thresholds must register

• Standard trading or ICT activities with no regulated financial element may not require registration, confirm with your free zone authority

A corporate services firm licensed in a UAE free zone that helps clients start a business is a DNFBP. It must register on goAML and file reports just as a mainland firm would. Check your business activities list against the DNFBP categories to confirm your exact position.

Setting Up AML Systems Before You Start Trading

AML policy must be in place before you start regulated activity. Free zone authorities can request proof of goAML registration at any point, including at license renewal.

• Write your AML and CFT policy before you open for business, not after

• Appoint your MLRO and register them on goAML as part of your company setup

• Run customer due diligence checks on all clients from day one

• Train all staff who handle client funds or onboard new customers on AML red flags

When setting up a business at Dubai South Business Hub Free Zone, a financial advisory firm should complete goAML registration alongside its trade license application so both are active before the first client meeting.

Does my free zone company need separate goAML registration from a mainland firm?

Yes. Each legal entity registers separately on goAML. If you have a free zone company and a mainland company, both must have their own goAML accounts with their own assigned MLRO. The free zone authority is the supervising body for the free zone entity; the relevant mainland regulator covers the other.

Common Mistakes to Avoid With goAML Registration in the UAE

The most common mistakes with goAML registration in the UAE include registering under the wrong entity type, assigning a junior employee as MLRO, not updating the system when your compliance officer changes, missing report deadlines, and failing to keep records for the full 5-year period required by UAE law.

Registration Errors That Cause Delays

Most rejections come from avoidable document or classification errors. Fix these before you submit.

• Selecting the wrong entity type, financial institution versus DNFBP, leads to rejection with no appeal

• Using a personal email instead of a company domain for the MLRO contact

• Uploading an expired trade license or an unsigned document

• Not linking the correct supervising authority to your application

• Forgetting to update goAML when your MLRO leaves, this is a separate ongoing obligation

A law firm uploaded a trade license that had lapsed by 3 days. The FIU rejected the application and the firm had to restart the whole process, delaying their ability to file a pending STR.

Ongoing Compliance Gaps to Watch

Registration is the start, not the finish. These are the gaps that catch businesses out after they are live on the system.

• Late STR filing: Suspicion triggers the duty to report, not the end of an internal investigation

• Generic AML policy: Risk-based policies are required, generic templates do not satisfy FIU standards

• Untrained new staff: AML training logs should be kept as evidence of staff compliance

• Assuming low risk means no duty: Even low-risk business types must register and maintain CDD records

A precious metals dealer assumed that cash sales under AED 55,000 meant they had no AML duties. They still had to register on goAML and maintain a customer due diligence policy for all clients. The threshold triggers extra reporting duties, it does not create a floor below which no rules apply.

If you need business support in the UAE to set up your AML framework correctly from the start, specialist advisors can help you build a compliant structure before you begin trading.

Key Facts About goAML Registration UAE at a Glance

goAML registration in the UAE is mandatory for all financial institutions and DNFBPs. You register via the FIU portal, assign a compliance officer, and gain access to file STRs and SARs. Fines for non-compliance reach AED 5 million. Free zone companies are not exempt if their activity is regulated.