Under anti money laundering rules, any business entity in the UAE that is covered by the rules must be registered on a government website called goAML before it can submit a single suspicious transaction. Registration is the key to access the whole reporting system. If a company hasn’t finished it, then it cannot lawfully file the reports required by the law.
goAML is an acronym of go Anti Money Laundering. It is a reporting platform developed by the United Nations Office on Drugs and Crime and used by financial intelligence unis in a number of countries. In UAE it is run by the Financial Intelligence Unit. That unit is part of the Central Bank, and is the federal agency that collects and evaluates reports on money laundering and financing of terrorism. In this article they are going to find out who needs to register, what documentation is required and exactly what to do on the portal.
What goAML Registration Actually Means
The act of registering a business as a reporting entity on the Financial Intelligence Unit portal is called goAML registration. The company then can log in and upload the reports that the law requires, and is chosen compliance officer can be the one to upload the reports.
There are some words that are repeated in the process. A Suspicious Transaction Report (STR) is a report that is filed by a business if they have reasonable suspicion that a transaction is in the proceeds of crime. A Suspicious Activity Report or SAR is a report on suspicious activity that is unrelated to a particular transaction. A Money Laundering Reporting Officer or MLRO is the person a business designates to be responsible for its obligations and to act as the business’s liaison with the regulator.
No point is more confusing than this one. A goAML registration does not constitute a business licence and is not a onetime process once you receive confirmation via email. It sets up the communication pathway that all subsequent information the law mandates flows through for the duration of the business.
The Legal and Regulatory Framework
The guidance that is going around online still references the anti money laundering law from 2018 and executive regulations from 2019. It is no longer that system. The two laws have been replaced by the current law, Federal Decree Law No. 10 of 2025, which took effect on 14 October 2025. It is an executive regulation that came into effect with Cabinet Resolution No. 134 of 2025, replacing the regulations that were in place in 2019. The new law explicitly applies to virtual assets, and proliferation financing, and significantly increases penalties.
This legislation is the basis for the requirement to register on goAML and to report suspicious transactions. The FIU receives reports under the provisions of Article 46 of Cabinet Resolution No. 134 of 2025 and the registration duty is contained in the reporting duty imposed on regulated businesses by the law. It brings the country in line with the Financial Action Task Force recommendations. It is the global standard setting body with regards to anti money laundering and that is the body that the country sought to meet around the time it was removed from the Task Force grey list in early 2024.
The approval of a registration does not go through a single office, but through the supervisory authority that has oversight over the person making the application. Most of the mainland and commercial free zone companies are under the supervision of the Ministry of Economy. The Central Bank regulates banks & financial institutions. The Financial Services Regulatory Authority is the name given to the entity that regulates the Abu Dhabi Global Market and the Dubai Financial Services Authority is the name given to the entity that regulates the Dubai International Financial Centre. Choosing the right supervisor before you begin is important because one of the reasons applications are returned is the wrong supervisor is given.
Who Must Register
Registration is mandatory for three broad groups regardless of the size of the business or how few transactions it handles.
→ Financial Institutions This group includes banks and exchange houses, insurance companies and brokers. It also takes in investment firms and payment service providers. The entities have the most extensive reporting obligations and are overseen primarily by the Central Bank.
→ Designated Non Financial Businesses and Professions. commonly referred to as ‘DNFBPs’, it covers businesses which regularly engage in activities that could facilitate the movement of illicit money. It covers real estate agents/brokers. It takes in auditors and accountants. It applies to solicitors of the court and notaries who have the custody of client monies. Also included are precious metal dealers and corporate service providers who form or administer companies.
→ Virtual Asset Service Providers. This group, known as VASPs, includes cryptocurrency exchanges, digital asset custodians and virtual asset brokers. With the introduction of the 2025 law, virtual assets are now fully included in the scope of reporting and a VASP licensed by the Virtual Assets Regulatory Authority in Dubai or by a free zone regulator is required to register on goAML as any other reporting entity.
Documents to Prepare Before You Start
Most delays can be attributed to incomplete or improperly formatted documentation, so it is best to gather all the necessary documentation beforehand before opening the portal. The main documents are the entity trade licence and an authorisation letter on the company letterhead with the company stamp. Also, the Emirates ID or passport of that officer needs to be attached with the resident visa, where applicable.
They can be scanned and combined into a single PDF document since the system will only allow one document to be attached and there is a restriction on the file size (max 5 megabytes). Also having the Ultimate Beneficial Owner details at hand is worthwhile. This refers to the persons who ultimately own or control a 25 per cent or more of the company. Current regulations include a supervisory review process that pays close attention to ownership. Before you start, download Google Authenticator on the cell phone associated with the registration so that you can get the login codes.
The Registration Process Step by Step
Registration runs in two stages on two connected systems. The first stage sets up secure access while the second registers the organisation itself.
Stage one. Services Access Control Manager and Google Authenticator
The first stage is completed on the Services Access Control Manager or SACM. This is where the Financial Intelligence Unit checks that the applicant is eligible to enter the goAML system and issues the credentials needed to do so.
→ Open the SACM form and set the type. Start a new registration on the SACM portal. The registration type is Select Reporting Entity and the supervisory body is the body overseeing the business. Another common reason for rejection is entering an incorrect supervisor.
→ Enter the entity and officer details. Provide the company name exactly as it appears on the trade licence and enter the trade licence number in the identification field. Also, fill in the details of the compliance officer (e.g. a valid email address and a mobile number registered in the UAE).
→ Upload the merged PDF and submit. Attach the single combined PDF. Acknowledge the terms and submit. The system then generates a reference number for the request.
→ Verify the email address. An email is sent asking for confirmation of the address and the request does not get to the supervisor until this is completed. Add two portal sender address to a whitelist, or the messages will be lost to a spam filter.
→ Collect the username and secret key. An email and mobile code then give you the opportunity to create a secret key, once approved by the supervisor. Enter that key into Google Authenticator with an account name of goAML Portal. The app then generates the 6 digit code that you can use as your password. This approval code is only valid for 24 hours after which time you should complete the step.
Stage two. Registering the organisation on goAML
With the username and the Authenticator set up the second stage registers the business on the goAML portal itself.
→ Log in and set up a new organisation. Log in with the six digit Authenticator code and the SACM username. From the home page select the option to register a new organisation and choose Reporting Entity.
→ Fill out the necessary details and submit. Provide the organisation and compliance officer information. Fill out all required fields, incomplete applications will be rejected. Attach the documents and enter the captcha and submit. The system creates a reference starting with “REP”.
→ Wait until approved and Organisation ID is provided. Supervisor reviews and tells you if it is approved or not. On approval the entity receives a unique Organisation ID which is its identity in the system. No printed certificate, retain the approval email.
Key Considerations and Common Mistakes
Most applications that are rejected or delayed are due to a few mistakes that can be prevented. These are all easy to avoid if they can be known.
Þ Selecting the wrong registration type. Any financial institution, business designated by the government and a virtual asset provider must be registered as Reporting Entity. If a wrong choice is made (Stakeholder or other stakeholder type), the application will be halted.
Þ Choosing a supervisor that does not match the licence. The supervisory authority chosen should be the authority which directly assumes the control of the business. Confirm it before submitting rather than guessing.
Þ Uploading documents separately. All documents need to be consolidated into one PDF (within size limits) and the system operates on one attachment only. Multiple files are not accepted.
Þ Misplacing the licence number or the code. The trade licence number should be included in the identification number and is frequently mistaken as a registration number. Approval code will expire after 24 hours and a new one must be requested to resume.
Þ Rejection is not uncommon and it is nothing to be alarmed about. The supervisor sends an email message that explains what the problem is and most of the time the solution is a document and/or a corrected field and not a brand new start. Read the reason and correct and resubmit.
Cost and timeline
There is no fee for registration on goAML no matter the sector. Typically, it takes a few business days for the approval process after a clean submission is received. If a filing is incomplete or if there is inconsistent information, it can extend that out through the rounds of correction. The one variable that the applicant can control is the preparation quality.
Obligations after registration
Registration is the starting process and does not imply completion of the process. Customer due diligence and monitoring of transactions, and record keeping for a minimum of 5 years, are required to be conducted for a registered entity. It is required to file Suspicious Transaction Reports whenever there is suspicion. There is no set statutory deadline (in days) for an ordinary suspicious transaction, and no minimum value that triggers a report. The law mandates that the filing be done without delay once a reasonable suspicion has been formed and the time period is much shorter if there is a suspicion of financing terrorism. An entity profile is also required to be kept up to date, ensuring that a change in the compliance officer or in the licence is updated as soon as possible.
The Risk of Not Registering
Failure to register on goAML will be considered an administrative violation. The specific violation of failure to register will result in a fine between AED 50,000 to AED 200,000 as per Cabinet Resolution No. 71 of 2024 with a potential of doubling the fine in the case of a repeat violation.
Another ongoing violation for not reporting is that an unregistered business cannot file suspicious transaction reports. That is a problem at hand and not a fine months down the road.
Conclusion
In the United Arab Emirates, financial institutions, designated non financial businesses and virtual asset service providers are required to be registered with goAML. It is a prerequisite for compliance with all the subsequent reporting requirements. The process is not demanding. It operates in two phases, the government charges no fee, and it becomes easier to process with due preparation.
There are three things that determine whether it goes smoothly or not. The first is to know the supervisory authority in advance and ensure that it is the right one. The second is creating a complete and properly matched documents merged into a single file. The third is to view registration as the beginning of an ongoing responsibility instead of a checklist to be fulfilled. It is in the checks, monitoring and reporting that follow that compliance is tested.
