goAML is an electronic reporting system developed by the United Nations Office on Drugs and Crime (UNODC) and used by Financial Intelligence Units to receive, analyse, and process suspicious transaction and suspicious activity reports.

In the UAE, the system is connected to the work of the UAE Financial Intelligence Unit (UAE FIU) and is used by reporting entities to fulfil applicable anti-money laundering and counter-terrorist financing reporting obligations.

Registration on goAML is not, by itself, an indication that a company has engaged in suspicious activity. It means that the entity has access to the reporting system through which applicable reporting obligations can be fulfilled.

For this reason, goAML registration should be treated as one part of a broader AML compliance framework, rather than simply as an online account-creation process.

In this guide, Legal Consultant Mohammed Jasem explains who may be required to register, the difference between SACM and goAML, the registration process, required documents, common reasons for rejection, post-registration obligations, and the potential consequences of AML non-compliance.

Important: Registration procedures, electronic forms, and technical requirements may be updated by the competent authorities. The applicable official instructions should therefore be checked at the time of registration.

Who Is Required to Register on goAML in the UAE?

The registration obligation depends on the nature of the business, the activities conducted, and the applicable supervisory framework.

Depending on the applicable legal requirements, regulated or reporting entities may include:

• Financial institutions.
• Certain virtual asset service providers.
• Real estate brokers and agents involved in activities falling within the applicable AML framework.
• Dealers in precious metals and stones.
• Independent legal professionals when conducting specified activities.
• Independent accountants and auditors where the relevant obligations apply.
• Company service providers and trust service providers.
• Other entities falling within the applicable AML legislation and regulatory framework.

The UAE Ministry of Economy identifies designated non-financial businesses and professions (DNFBPs) that are subject to relevant AML obligations, including certain real estate activities, dealers in precious metals and stones, company service providers, auditors and accountants, and certain legal consultancy activities.

The company name alone is not sufficient to determine whether registration is required.

The analysis should consider:

• The trade licence.
• The actual business activity.
• The services provided.
• The transactions conducted.
• The applicable supervisory authority.
• Whether the entity operates in a commercial free zone or financial free zone.

Accordingly, the first legal step should be to determine whether the entity is actually subject to the registration requirement and under which regulatory classification.

What Is the Difference Between SACM and goAML?

One of the most common questions is:

What is the difference between SACM and goAML?

In simple terms, SACM is associated with the access and registration process used to obtain the credentials required to access the goAML environment.

goAML, on the other hand, is the reporting system used by registered entities to submit relevant suspicious transaction and suspicious activity reports to the UAE FIU.

The two stages should therefore not be confused.

Completing the initial SACM registration does not necessarily mean that the entity has completed its entire goAML registration.

The required procedures must be completed before the entity can properly access and use the system for its applicable reporting obligations.

How Do You Register on goAML in the UAE?

The process can generally be understood as involving two main stages.

Stage One: SACM Registration and Access Credentials

The first stage involves registering the relevant user and providing the information and supporting documents required by the registration system.

The information should be accurate and consistent with the entity’s official records.

This may include:

• Legal name of the entity.
• Trade licence number.
• Business activity.
• Supervisory authority.
• Compliance or AML reporting officer details.
• Email address.
• Mobile number.
• Identification documents.
• Supporting corporate documents.

The UAE Ministry of Economy’s current technical guidance states that applicants should provide accurate contact details, select the appropriate registration type, provide the relevant registration/licence number, upload supporting documents, verify their email, and complete the authentication process.

Any discrepancy between the entity’s legal documents and the information entered into the system may cause delays or require correction.

Stage Two: Registering the Entity on goAML

After the required access credentials have been obtained, the entity proceeds with the goAML registration process.

Depending on the applicable supervisory framework, the process may require the entity to provide:

• Entity information.
• Reporting entity details.
• Supervisory authority.
• Compliance or AML reporting officer details.
• Contact information.
• Supporting documents.
• Other information required by the UAE FIU or relevant supervisory authority.

The application is then reviewed and may be approved, returned for amendment, or accompanied by a request for additional information.

The UAE FIU’s registration portal currently requires information such as the reporting entity name, supervisory body, registration number, registering individual’s details, email, mobile number, and a PDF attachment.

What Documents Are Required for goAML Registration?

The documents required may differ depending on the entity and its supervisory authority.

However, documents may include:

Trade Licence

A clear and valid copy of the trade licence or other document establishing the legal status of the entity.

Appointment Letter for the Compliance or AML Reporting Officer

Where applicable, the appointment should be properly documented and consistent with the requirements applicable to the entity.

The appointment letter may include:

• Entity name.
• Name of the appointed officer.
• Job title.
• Appointment date.
• Relevant responsibilities.
• Relevant authority and powers.
• Approval of the entity.

Identification Documents

Depending on the applicable procedure, identification documents may include:

• Emirates ID.
• Passport.
• Residence documentation.
• Other identification documents requested by the competent authority.

Contact Information

The registered email address and mobile number should be accurate and accessible.

This is particularly important because authentication and verification procedures may depend on the registered contact details.

Additional Documents

The competent authority may request additional documents depending on:

• The nature of the business.
• The type of entity.
• The supervisory authority.
• The information submitted.
• The results of the application review.

The UAE Ministry of Economy currently advises applicants to consolidate supporting documents into one PDF where required by the registration process and to ensure that the information submitted is complete and accurate.

Who Is the Compliance Officer or AML Reporting Officer?

The person responsible for AML compliance should not be treated as merely a name entered into a registration form.

The relevant officer may have an important role in the entity’s AML framework, including:

• Risk assessment.
• Implementation of AML policies and procedures.
• Customer due diligence.
• Transaction monitoring.
• Record keeping.
• Suspicious transaction reporting.
• Communication with competent authorities.
• Internal compliance coordination.

The individual should therefore have the appropriate authority, knowledge, experience, and practical ability to perform the responsibilities assigned to them.

The appointment should be genuine and supported by appropriate internal procedures rather than being made simply to complete the online registration process.

Can Any Employee Be Appointed as the Compliance Officer?

An employee should not be selected solely because they are available to complete the registration.

The entity should consider the person’s:

• Qualifications.
• Experience.
• Knowledge of AML requirements.
• Authority within the organisation.
• Ability to perform the required duties.
• Independence where required.
• Capacity to monitor and implement AML procedures.

The applicable legal and regulatory requirements should be reviewed before appointing the responsible officer.

How Do You Select the Supervisory Authority During goAML Registration?

Selecting the correct supervisory authority is one of the most important parts of the registration process.

The supervisory authority should not be selected simply based on the emirate in which the company operates.

It should be determined based on the regulatory framework applicable to the entity and its activities.

Factors may include:

• Nature of the business.
• Type of licence.
• Licensing authority.
• Location of the entity.
• Whether the entity operates in a commercial free zone.
• Whether the entity operates in a financial free zone.
• Nature of the services provided.

The UAE FIU’s current portal specifically provides for different supervisory bodies, including entities operating under frameworks such as ADGM and DFSA, demonstrating the importance of selecting the correct regulatory route.

Financial Free Zones

Entities established in financial free zones may operate under specialised regulatory frameworks.

Examples include:

• Dubai International Financial Centre (DIFC)
• Abu Dhabi Global Market (ADGM)

Therefore, the applicable supervisory authority should be confirmed before completing the registration.

Why Is a goAML Registration Application Rejected?

An application may be rejected or returned for correction for several reasons.

Inconsistent Entity Information

For example:

• The legal name does not match the trade licence.
• An incorrect licence number is entered.
• The entity type is incorrectly identified.

Incorrect Supervisory Authority

Selecting a supervisory authority that does not regulate the entity can cause the application to be returned or rejected.

Problems With the Compliance Officer Appointment

The appointment documentation may be incomplete, unclear, or inconsistent with applicable requirements.

Missing Information

Incomplete information concerning the entity or responsible officer may result in a request for amendment.

Unclear Documents

Unreadable, incomplete, expired, or otherwise unsuitable documents may delay the review process.

Outdated Entity Information

If the company’s trade licence, address, ownership structure, activity, or other relevant information has changed but the registration information has not been updated, discrepancies may arise.

For this reason, the registration file should be reviewed carefully before submission rather than relying on repeated trial-and-error submissions.

What Should You Do If Your goAML Registration Is Rejected?

If the application is rejected, it is better not to resubmit it randomly.

Start by reviewing:

1. The stated reason for rejection.
2. The information entered.
3. The selected supervisory authority.
4. The supporting documents.
5. The compliance officer’s details.
6. Any comments or requests issued by the competent authority.

The identified issue should then be corrected before the application is resubmitted according to the applicable procedure.

If the reason for rejection is unclear or the application continues to be rejected after corrections, a legal or compliance review of the registration file may help identify the underlying issue.

What Happens After goAML Registration?

Registration is not the end of the AML compliance process.

Once registered, the entity may have continuing obligations depending on its activities and regulatory framework.

These may include:

• Reporting suspicious transactions or activities where the applicable legal criteria are met.
• Applying customer due diligence procedures.
• Conducting AML/CFT risk assessments.
• Maintaining records and supporting documents.
• Establishing internal AML policies and procedures.
• Training relevant employees.
• Monitoring customers and transactions according to risk.
• Complying with applicable sanctions and targeted financial sanctions requirements.
• Responding to requests from competent authorities.
• Cooperating with the UAE FIU and supervisory authorities within the scope of applicable law.

The UAE Ministry of Economy explains that goAML enables relevant entities to submit suspicious transaction and suspicious activity reports to the UAE FIU.

Therefore, an entity may be properly registered on goAML and still face compliance problems if it fails to implement the wider AML requirements applicable to its business.

Does goAML Registration Mean That Every Transaction Must Be Reported?

No.

Registration does not mean that every ordinary commercial transaction must automatically be reported.

The reporting obligation concerns transactions and activities that meet the applicable legal and regulatory criteria for suspicious transaction or suspicious activity reporting.

For this reason, the entity should maintain an internal compliance framework that enables the responsible officer to:

• Identify suspicious indicators.
• Assess relevant risks.
• Review transactions.
• Escalate concerns internally.
• Determine whether a report should be submitted.

The entity should also be aware of applicable restrictions concerning disclosure of suspicious reporting information to customers, including tipping-off restrictions where applicable.

What Is the Penalty for Failing to Register on goAML?

Failure to register where an entity is legally required to do so may result in administrative sanctions under the applicable AML legislation and regulatory decisions.

However, AML violations are not limited to failure to register.

Depending on the circumstances, violations may include:

• Failure to appoint an appropriately qualified responsible officer.
• Failure to implement AML policies and procedures.
• Failure to conduct required customer due diligence.
• Failure to maintain required records.
• Failure to report suspicious transactions or activities when legally required.
• Failure to respond to requests from competent authorities.
• Improper disclosure of protected information.

The applicable sanctions depend on the type of violation, the entity involved, the relevant supervisory authority, and the legislation or regulatory decision applicable to the case.

The current UAE AML framework includes Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 concerning its Executive Regulations.

Accordingly, it would be incorrect to assume that one fixed fine applies to every AML or goAML violation.

Can a Compliance Officer Have Personal Liability?

Potential legal or administrative responsibility may arise depending on:

• The nature of the violation.
• The person’s actual role.
• The responsibilities assigned to them.
• The extent of their authority.
• The applicable legal requirements.
• The facts of the case.

For this reason, appointing someone as a compliance officer without giving them the authority, resources, information, or support necessary to perform their responsibilities may create risks for both the entity and the individual.

The appointment should therefore be properly structured and supported by written internal procedures.

What Is the Difference Between goAML Registration and AML Compliance?

There is an important distinction.

goAML Registration

This refers to registering the entity with the electronic reporting system and completing the required access and registration procedures.

AML Compliance

AML compliance is much broader.

It may include:

• Business risk assessment.
• Customer due diligence.
• Enhanced due diligence where required.
• AML policies.
• Internal controls.
• Transaction monitoring.
• Record keeping.
• Employee training.
• Suspicious transaction reporting.
• Targeted financial sanctions compliance.
• Cooperation with regulators.

Therefore, obtaining a goAML registration number does not mean that the entity has automatically satisfied all of its AML obligations.

Are Small Companies Required to Register on goAML?

Company size alone does not determine whether an entity is subject to registration.

The key consideration is the nature of the business and whether the entity falls within a category subject to the applicable AML requirements.

A small business may still be subject to AML obligations if its activities fall within a regulated or designated category.

Are Free Zone Companies Required to Register on goAML?

They may be.

The answer depends on:

• The type of free zone.
• The licensing authority.
• The business activity.
• The applicable supervisory authority.
• The regulatory framework governing the entity.

Commercial free-zone entities may be subject to applicable AML requirements according to their activities.

Entities established in financial free zones such as DIFC and ADGM may be subject to their own specialised regulatory frameworks.

Therefore, the free-zone status alone does not provide a universal answer.

Do Law Firms Have to Register on goAML?

AML obligations may apply to independent legal professionals and legal consultancy businesses when they conduct activities or transactions falling within the applicable AML framework.

The fact that an entity is a law firm does not necessarily mean that every service it provides is subject to exactly the same AML requirements.

The actual services and transactions should therefore be reviewed to determine the applicable obligations.

The UAE Ministry of Justice identifies the legal profession and legal consultancy sector within its AML supervisory framework and provides a goAML registration route for relevant regulated activities.

Do Gold and Precious Metals Dealers Have to Register on goAML?

Dealers in precious metals and stones may be subject to AML requirements in circumstances defined by the applicable legislation and regulations.

The Ministry of Economy identifies dealers in precious metals and stones as a category within the DNFBP framework.

The business should not stop at registration.

It should also assess:

• Customer due diligence.
• Transaction risk.
• Source of funds.
• Record keeping.
• Suspicious transaction indicators.
• Applicable reporting obligations.

Do Real Estate Brokers Have to Register on goAML?

Real estate businesses may be subject to AML obligations when conducting activities that fall within the applicable regulatory framework.

The Ministry of Economy identifies relevant real estate activities among the DNFBP sectors subject to AML requirements.

Real estate businesses should therefore assess their transactions and establish appropriate internal AML procedures rather than relying solely on registration.

What If I Was Required to Register on goAML but Never Did?

If an entity determines that it was legally required to register but failed to do so, it should not simply wait for an inspection.

The business should promptly review:

• When the registration obligation began.
• Whether the business was subject to AML requirements throughout the relevant period.
• Whether an appropriate compliance officer was appointed.
• Whether AML policies were implemented.
• Whether customer and transaction records were maintained.
• Whether any transactions should have been assessed or reported.

The next steps should then be determined based on the entity’s legal and compliance position.

Can goAML Registration Information Be Updated?

Business information may need to be updated when there is a change in:

• Trade licence.
• Registered address.
• Compliance officer.
• Contact information.
• Ownership structure.
• Organisational structure.
• Business activity.
• Other information required by the system or supervisory authority.

Leaving outdated information in the registration system may create compliance and regulatory issues.

How Should a Company Prepare for an AML Inspection?

An AML inspection is not limited to checking whether the company has a goAML registration number.

Depending on the entity and supervisory authority, the inspection may consider the wider AML compliance framework.

AML Policy

Does the company have a written and up-to-date AML policy?

Risk Assessment

Has the company assessed the money laundering and terrorist financing risks associated with its activities?

Customer Files

Are appropriate customer due diligence procedures being applied?

Compliance Officer

Has the responsible officer been properly appointed?

Does the officer have the authority and resources required to perform the role?

Records

Are relevant documents and records being retained for the required period?

Suspicious Transaction Reporting

Does the company have a clear mechanism for identifying and reporting suspicious transactions or activities?

Employee Training

Do relevant employees understand the warning signs and internal procedures for escalating suspicious activity?

For this reason, goAML registration should be treated as part of an integrated AML compliance programme.

How Can Legal Consultant Mohammed Jasem Help With goAML Registration?

Legal Consultant Mohammed Jasem can assist companies and regulated businesses in reviewing goAML registration and broader AML compliance requirements according to the nature of the business.

Legal support may include:

Reviewing the Business Activity and Trade Licence

Determining whether the entity falls within a category subject to applicable AML and goAML requirements.

Identifying the Supervisory Authority

Reviewing the licensing authority and business activity to determine the appropriate regulatory framework.

Reviewing the Compliance Officer Appointment

Assessing the legal and regulatory requirements applicable to the appointment and reviewing the relevant documentation.

Reviewing the Registration File

Checking the information and supporting documents before submission to reduce the risk of rejection or unnecessary delays.

Addressing a Rejected Registration

Analysing the reason for rejection and reviewing the application and documents before resubmission.

Developing the AML Compliance File

Reviewing AML policies, procedures, risk assessments, customer due diligence, record-keeping procedures, and other compliance requirements applicable to the business.

Dealing With AML Violations

Providing legal advice concerning potential violations, administrative sanctions, objections, appeals, and other available procedures depending on the circumstances.

Frequently Asked Questions About goAML Registration in the UAE

Is goAML Registration Mandatory in the UAE?

Registration is mandatory for entities that fall within the applicable categories subject to registration under UAE AML legislation, regulations, and the requirements of the relevant supervisory authority.

What Is the Difference Between SACM and goAML?

SACM is associated with the access and registration process, while goAML is the reporting system used by registered entities to fulfil applicable suspicious transaction and suspicious activity reporting obligations.

How Long Does goAML Registration Take?

There is no single guaranteed processing period for every application.

The timing may depend on:

• Completeness of the application.
• Accuracy of the information.
• Supporting documents.
• Review by the competent authority.
• Requests for additional information.
• Corrections required during the process.

What Should I Do If My goAML Application Is Rejected?

Review the stated reason for rejection, correct the relevant information or documents, and resubmit according to the applicable procedure.

If the rejection continues despite corrections, a legal or compliance review of the file may help identify the underlying problem.

Who Can Be Appointed as the Compliance Officer?

The responsible person should satisfy the qualifications, experience, authority, and other requirements applicable under the relevant legislation and supervisory framework.

Is goAML Registration Alone Enough for AML Compliance?

No.

Registration is only one component of a broader AML compliance framework that may include risk assessment, customer due diligence, internal policies, record keeping, training, transaction monitoring, and suspicious transaction reporting.

Are Free Zone Companies Required to Register on goAML?

They may be, depending on the type of free zone, business activity, licensing authority, and applicable supervisory framework.

Financial free zones such as DIFC and ADGM may operate under specialised regulatory frameworks.

Does a Law Firm Need to Register on goAML?

AML requirements may apply to legal professionals and legal consultancy businesses when they conduct activities or transactions falling within the applicable legal framework.

Do Gold Traders Need to Register on goAML?

Dealers in precious metals and stones may be subject to the applicable AML and goAML requirements depending on their activities and transactions.

Can I Register on goAML After a Delay?

It may be possible to correct the position, but if the entity was subject to registration requirements during an earlier period, its previous compliance position should be reviewed before taking corrective action.

Is Failure to Register on goAML a Violation?

If an entity was legally required to register and failed to do so, the failure may constitute a regulatory or administrative violation subject to the applicable sanctions.

Legal Consultant Mohammed Jasem – goAML and AML Compliance Support

Legal Consultant Mohammed Jasem assists businesses in the UAE with goAML registration and AML compliance matters.

Services may include reviewing the entity’s business activity and licence, identifying the appropriate supervisory framework, reviewing registration documents, assessing compliance officer requirements, reviewing AML policies and procedures, and advising on potential violations and administrative sanctions.

For businesses operating in regulated sectors, obtaining legal and compliance advice before registration or before an AML inspection can help identify gaps and reduce regulatory risks.

Conclusion

goAML registration in the UAE is not simply the creation of an online account.

Before registration, a business should determine whether it falls within the applicable AML framework, identify the correct supervisory authority, appoint the appropriate responsible officer, and prepare accurate supporting documents.

After registration, the entity may remain subject to continuing AML obligations, including risk assessment, customer due diligence, record keeping, internal controls, employee training, and suspicious transaction or activity reporting where required.

This is particularly important for businesses operating in sectors such as real estate, precious metals and stones, company services, certain legal consultancy activities, accounting and auditing, financial services, and other activities falling within the applicable regulatory framework.

The UAE’s current AML framework is governed by Federal Decree-Law No. (10) of 2025 and its Executive Regulations under Cabinet Resolution No. (134) of 2025, together with the applicable regulatory decisions and official guidance.

If you are required to register on goAML or need to assess your company’s AML compliance position, a legal review of the business activity, licence, registration file, internal policies, and compliance procedures can help identify the appropriate steps before regulatory problems arise.

Legal Disclaimer

This article is provided for general legal information and educational purposes only. It does not constitute legal advice or a legal opinion concerning any specific company, transaction, or set of circumstances.

goAML procedures, electronic forms, supervisory requirements, and regulatory guidance may be updated by the competent UAE authorities. The applicable requirements should therefore be verified at the time of registration.

Each business should be assessed according to its actual activities, trade licence, regulatory status, supervisory authority, and applicable AML obligations.

Legal Consultant Mohammed Jasem