goAML Registration and Reporting in the UAE

goAML is software built by the United Nations Office on Drugs and Crime for financial intelligence units. In the UAE it is operated by the Financial Intelligence Unit, which Article 11 of Federal Decree-Law No. 10 of 2025 establishes as an independent unit within the Central Bank and to which all suspicious transaction reports must be submitted exclusively by financial institutions, Designated Non-Financial Businesses and Professions and virtual asset service providers.

The law does not name the platform. Article 18(1)(a) of Cabinet Decision No. 134 of 2025 requires notification "through the Unit's electronic system or any other means approved thereby", and Article 18 of the Decree-Law uses the same formula. goAML is that system. Registration on it is therefore not a filing in its own right — it is how a reporting entity becomes reachable, so that when a report has to be made there is an account to make it from.

The platform hosts more report types than most summaries mention, and picking the wrong one is a real error.

Article 3 of Cabinet Decision No. 134 of 2025 defines Designated Non-Financial Businesses and Professions as any person carrying on one or more of five listed activities. Two of those five are this site's own readership: independent accountants, and company and trust service providers.

Read the article closely, because for professionals the trigger is the activity, not the profession. An accountant is caught when preparing, conducting or executing transactions for a customer relating to buying and selling real estate, managing the customer's funds, managing bank, savings or securities accounts, organising contributions for the establishment, operation or management of companies, or establishing, operating or managing legal persons or arrangements, or selling or buying commercial entities. A company service provider is caught when acting as an agent in incorporation, acting or arranging for another to act as director, secretary or partner, providing a registered office or business, residence, correspondence or administrative address, acting as trustee of an express trust, or acting as a nominee shareholder.

The Ministry of Economy and Tourism's own online self-check is broader than the text: it asks whether you are "an auditing or accounting firm" or "a trust or company service provider" and returns a positive answer on the profession alone. Where a supervisor screens categorically and the Regulation defines by activity, the safe assumption for an accounting, audit or corporate services firm is that you are in scope.

This is the single most useful thing on this page. Almost every UAE goAML article in circulation, including several written by regulated firms, cites Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. Both are repealed.

Article 41(1) of Federal Decree-Law No. 10 of 2025, issued 30 September 2025, repeals the 2018 Decree-Law outright; the new law enters into force two weeks after publication in the Official Gazette. Article 70 of Cabinet Decision No. 134 of 2025, issued 29 October 2025, repeals Cabinet Decision No. 10 of 2019; it enters into force thirty days after publication. The regime was renamed at the same time: proliferation financing now sits in the title alongside money laundering and terrorist financing.

Subordinate material survives. Article 41(3) keeps executive regulations, resolutions and circulars issued under the 2018 law in force so far as they do not conflict with the new law, until superseding instruments are issued. That is why the Ministry's goAML circulars, the beneficial ownership Decisions of 2023 and the penalty schedule discussed below all still stand.

Checked 17 August 2026: the Ministry of Economy and Tourism's own "Register in goAML" page still states the obligation by reference to "Federal Decree Law No (20) of 2018 and Article 20(2) of Cabinet Decision No (10) of 2019". Its DNFBP Guidelines of March 2026, published on the same site, correctly cite the 2025 pair. Where a landing page and an instrument disagree, the instrument governs.

Registration is two systems, not one, and the first is where most applications stall. SACM — Services Access Control Manager — is the FIU's access layer; it issues the username and the authenticator secret. goAML is the reporting application behind it. You cannot start the second before the first is approved.

The route below follows the Ministry's goAML System Registration Guide dated 29 October 2024 and the FIU's own SACM guide. Both are published documents; neither is behind a login.

Three documents, and one formatting condition that is not obvious.

The Ministry's registration guide lists the trade licence of the entity; an authorisation letter from the entity appointing the compliance officer or MLRO, on letterhead and stamped or sealed; and a copy of the Emirates ID or passport of that appointed officer. The Ministry's "Register in goAML" page words it slightly differently, listing an authorisation letter from the institution you represent, a copy of your passport, residence visa and Emirates ID, a copy of the commercial trade licence for companies, and an authenticator application installed on your phone.

The condition is that the system accepts one attachment only. The documents have to be scanned into a single PDF, and it must not exceed 5 MB. The same file is used again at the second stage, so keep it. If an application is rejected, the notification carries the reason; correct that and resubmit rather than starting a parallel request.

Searches for a goAML registration certificate, registration proof or a confirmation document are looking for something the system does not issue. There is no certificate.

What exists is a chain of identifiers. SACM pre-registration generates a temporary reference number. Approval produces a username in the form UMOEC followed by digits. The goAML organisation request generates a reference beginning REP. Approval of that request produces an email from no-reply.goaml@uaefiu.gov.ae confirming acceptance and stating the unique Organisation ID created for your entity. Those emails, together with the ability to log in and see your organisation, are the evidence a supervisor or a bank will expect — so keep them somewhere other than one person's inbox.

Registration also has to stay live. The March 2026 DNFBP Guidelines require entities not only to register but to "maintain their registration in an active status". Where the registered officer leaves, the account has to be moved rather than abandoned; the Ministry publishes a separate guide for changing the registered MLRO.

No fee for goAML registration appears in any of the primary documents read for this page: not in Federal Decree-Law No. 10 of 2025, not in Cabinet Decision No. 134 of 2025, not in the Ministry's goAML System Registration Guide, not in the FIU's SACM guide, and not on the Ministry's "Register in goAML" page. We are still not going to print "goAML registration is free" as a sourced fact, because an absence in five documents is not a published price. If the cost matters to your decision, ask your supervisory authority to confirm in writing before you engage anyone.

What the fee searches are usually really asking is what an adviser charges to do it. This site publishes no prices, no fee ranges, no packages and no turnaround promises — for this or for anything else. Any figure you see quoted elsewhere as "the goAML registration cost" is that firm's fee, not a government charge.

The compliance officer is not a job title you add to an existing role to satisfy a form. Article 21(3) of Cabinet Decision No. 134 of 2025 requires internal anti-crime policies to include appropriate compliance management arrangements, including the appointment of a compliance officer at management level. Article 22 then requires that the officer be appointed at management level and under the entity's responsibility, have independence in decision-making, and possess appropriate competence and experience.

Five duties are listed. Monitoring transactions related to the crime. Reviewing records and receiving, examining and assessing suspicious transaction data, and deciding whether to notify the Unit or to retain the matter with reasons stated, in full confidentiality. Reviewing internal systems against the Decree-Law and the Regulation, assessing the level of compliance, proposing updates, and reporting periodically and directly to senior management, with a copy to the supervisory authority on request. Developing, implementing and documenting training programmes. And cooperating with the supervisory authority and the Unit, including giving their personnel access to records.

Note the second duty. The decision whether to file is the compliance officer's, and it is exercised inside your business. That is also why the goAML account is registered in the officer's name.

Article 18(1) of Cabinet Decision No. 134 of 2025 is the operative rule. Where a reporting entity suspects, or has reasonable grounds to suspect, that a transaction, an attempted transaction, or funds in whole or in part constitute proceeds, are related to the crime, or are intended to be used in it — regardless of their value — it must, without invoking banking secrecy, professional secrecy or contractual liability, immediately and without delay notify the Unit through its electronic system with all available data, and respond promptly to any request for more.

There is no minimum value, no de minimis, and no requirement that the transaction completed. The Ministry's March 2026 Guidelines are explicit that attempted, declined, reversed and past transactions are reportable, and that the only test is reasonable grounds — you do not need evidence of a predicate offence.

Article 18(2) exempts lawyers, notaries, other independent legal professionals and independent statutory auditors where the information was obtained while assessing a customer's legal position, defending or representing them before courts or in arbitration or mediation, or advising on judicial proceedings, or otherwise in circumstances subject to professional secrecy. It is narrow. Ordinary accounting, audit and corporate services work is not covered by it.

Three consequences, in ascending order of seriousness.

First, operating without registration is itself prohibited. Article 20 of Federal Decree-Law No. 10 of 2025 states that no natural or legal person shall engage in DNFBP activities without obtaining a licence, registration or enrolment from the competent authority or the relevant supervisory authority.

Second, the supervisory authority's administrative powers under Article 17(1) are not limited to fines: warning; an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation; a ban on operating in the relevant sector; restrictions on the powers of responsible board members, executives or owners, including a temporary supervisor; suspension or replacement of responsible officers; suspension or restriction of the activity or profession; and revocation of the licence. Article 17(3) allows an incremental fine where the same violation recurs within a year, and Article 17(4) allows the authority to publish the penalties it imposes.

Third, there is a per-violation schedule. Cabinet Resolution No. 71 of 2024, issued 8 July 2024, sets a unified list of violations and administrative fines for DNFBPs supervised by the Ministry of Justice and the Ministry of Economy, and its Article 8 repeals Cabinet Resolution No. 16 of 2021. Under Article 5(2) the Ministry may double a fine on repetition, and under Article 4 a grievance may be filed within thirty working days, with no reply within forty working days treated as a rejection.

There is no emirate-level goAML. The platform is federal and the account is with the Financial Intelligence Unit, so a firm in Dubai, Abu Dhabi, Sharjah or a commercial free zone registers through the same two portals. What differs is who supervises you and therefore who approves the registration.

The Ministry of Economy and Tourism supervises independent accountants and auditors, trust and corporate service providers, dealers in precious metals and stones, and real estate agents and brokers, in the mainland and in commercial free zones. The Ministry of Justice supervises law firms and other legal professionals. The Dubai Financial Services Authority supervises DNFBPs in the Dubai International Financial Centre, and the Financial Services Regulatory Authority those in Abu Dhabi Global Market. Select the supervisory body that matches your licence; selecting the wrong one is a rejection.

On the non-UAE searches: goAML is UNODC software deployed by financial intelligence units worldwide, so queries about registering with a Financial Intelligence Centre, or about goAML in Zimbabwe or elsewhere, are about another country's deployment. The portals, documents, deadlines and penalties on this page are the UAE's and do not transfer. We do not publish other jurisdictions' AML procedures.

Start with what cannot be outsourced. The compliance officer is appointed at management level within your business, has independence in decision-making, and decides whether a report is filed. The Ministry's guidance is that the officer is the registered goAML user. No adviser can be your compliance officer by contract, and nobody should be filing your suspicious transaction reports for you.

What a competent provider actually does around that: work out whether Article 3 catches you at all, and on which activity; draft the authorisation letter and assemble the single-PDF document pack; walk the officer through SACM, the authenticator and the organisation registration; build the internal policies, controls and procedures Article 21 requires, the risk assessment under Article 5, the indicators under Article 17 and the record-keeping under Article 25; run the training under Article 22(4); and rehearse a filing so the first live report is not the first time anyone has opened the form.

To check any provider, ask three things. Are they themselves a registered DNFBP — a corporate services firm that has not registered its own entity is telling you something. Will they name the articles they are working from, and are those the 2025 instruments rather than the 2018 pair. And will they put in writing that the compliance officer and the reporting decision remain yours.

As at 17 August 2026 this site publishes no trade licence number, no Federal Tax Authority tax agent registration, no audit licence, no named reviewer with a stated credential, no office address and no telephone number, because none has been verified for publication. Nothing here is a claim to be licensed, registered or accredited for AML work, and nothing here should be read as an offer to register or file on your behalf. Apply the same three questions to us that you would apply to anyone else.