goAML Registration UAE 2026: Step-by-Step Guide

goAML registration in the UAE is the single most important anti-money-laundering step a regulated business takes, and in 2026 it is strictly enforced. If your company is a bank, an insurer, a real estate broker, a precious-metals dealer, a corporate service provider or an auditor, you must enrol on the goAML platform run by the UAE Financial Intelligence Unit, appoint a compliance officer, and be ready to file reports. Getting it wrong is expensive: administrative fines under the AML framework run from AED 50,000 to AED 5,000,000 per violation.

This guide walks a founder through exactly what goAML is, who must register, the documents you need, the step-by-step process, and the ongoing duties that follow. It also flags the mistakes that cause supervisors from the Ministry of Economy and other authorities to issue penalties, so you can avoid them from day one.

What Is goAML Registration in the UAE?

goAML registration in the UAE is the mandatory enrolment of financial institutions and Designated Non-Financial Businesses on the platform of the UAE Financial Intelligence Unit. It requires you to register your entity, appoint a compliance officer, and prepare to file suspicious transaction reports. Under Cabinet Decision No. 16 of 2021, failing to register risks administrative fines from AED 50,000 up to AED 5,000,000, and repeat breaches can multiply.

goAML is a secure reporting application originally developed by the United Nations Office on Drugs and Crime and adopted by more than 60 financial intelligence units worldwide. In the UAE it is operated by the Financial Intelligence Unit and supervised alongside the Central Bank of the UAE (CBUAE) and sector regulators. It is the only official channel for submitting Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs) and several other report types. Alongside goAML sits the Automatic Reporting System for Sanctions Lists, which handles sanctions screening obligations. Together they form the reporting backbone of the UAE's AML regime.

The Federal Tax Authority is a separate body handling corporate tax and VAT, but AML and tax compliance increasingly overlap in the eyes of banks and auditors, so a business that treats both seriously presents a much stronger profile. Registration on goAML signals to regulators, banks and counterparties that your business takes financial crime prevention seriously.

Who Must Register on goAML in 2026

The UAE AML law captures two broad populations. The first is financial institutions: banks, finance companies, exchange houses, money-service businesses, insurance firms and payment-service providers, all regulated primarily by the CBUAE. The second, and the group most founders belong to, is the Designated Non-Financial Businesses and Professions, commonly shortened to DNFBPs.

Five DNFBP categories carry goAML obligations. Real estate agents and brokers are in scope whenever they carry out transactions for a client involving the buying or selling of property. Dealers in precious metals and precious stones fall in scope when they conduct a single cash transaction, or linked cash transactions, equal to or above AED 55,000. Corporate service providers, meaning company-formation agents and firms that provide registered offices, directors or nominee arrangements, are captured because their services can be misused to hide beneficial ownership. Auditors and accountants who prepare or execute transactions for clients are included, as are independent legal professionals and notaries when they handle specified financial transactions.

If your activity sits in any of these categories, you must register, regardless of whether you operate on the mainland under a DED or DET licence or inside a free zone such as DMCC, IFZA or DAFZA. The Ministry of Economy is the designated supervisor for most DNFBP categories and runs the compliance system through which these businesses enrol. Some free zones and professional bodies act as sector supervisors for their members, but the underlying goAML obligation is national. When in doubt, assume you are in scope and confirm, rather than assume you are exempt and be fined.

goAML Registration Costs and Timeline

There is no government charge to create a goAML account. The real cost of compliance sits elsewhere, and it helps to budget for it honestly before you begin. The single largest item is usually the compliance function, whether you appoint an internal officer or engage an outsourced Money Laundering Reporting Officer. Add the cost of an independent AML risk assessment, policy drafting, sanctions-screening tools and staff training.

On timing, plan for two to four weeks from starting the application to receiving an active, approved account. Much of that window is spent waiting for your supervisor to review and approve the compliance officer you nominate. Businesses that already trade should not wait: the obligation applies from the moment your activity is in scope, and supervisors have run registration campaigns with firm deadlines followed by fines for stragglers. Treat registration as a launch-week task, not a nice-to-have you address once revenue arrives.

Step-by-Step: How to Complete goAML Registration

The process differs slightly by supervisor, but the core journey is consistent. Work through it methodically and keep copies of every submission.

First, confirm your supervisor and reporting entity type. Most DNFBPs register through the Ministry of Economy's dedicated AML system, which then links to goAML. Financial institutions register through the channel their regulator specifies. Getting the entity type right at the start prevents rejections later.

Second, create your organisation profile. You will provide your legal name exactly as it appears on your trade licence, your licence number, licensing authority, registered address and primary contacts. Accuracy matters: mismatches between your licence and your goAML entry are a common cause of delay.

Third, nominate and register your compliance officer, the MLRO. This individual becomes the named point of contact for the FIU. You submit their Emirates ID, passport copy, contact details and a signed authorisation showing they are empowered to act. For Ministry of Economy-supervised firms, this usually means obtaining AML department approval and submitting a sub-administrator, or SACM, request for the officer.

Fourth, complete security setup. goAML uses two-factor authentication, so your officer configures an authenticator application to protect the account.

Fifth, submit for approval and monitor status. Your supervisor reviews the application and either approves it, requests corrections, or rejects it. Once approved, the account becomes active and you can file reports and respond to notices. Finally, register on the Automatic Reporting System for Sanctions Lists so you can meet screening and freezing obligations. Only when both are live is your registration genuinely complete.

Documents You Need Before You Start

Preparation prevents rejection. Gather the following before you open the portal so you are not forced to abandon a half-finished application. You will need a clear copy of your valid trade licence, whether issued by a mainland authority such as DED or DET or by a free zone such as DMCC, IFZA or DAFZA. You will need the passport and Emirates ID of the nominated compliance officer, plus their mobile number and dedicated compliance email address.

You will also need a board resolution or authorisation letter appointing the officer and granting them authority to report. Many supervisors expect to see the officer's basic AML qualifications or experience, so have a short professional summary ready. Prepare your company's contact details, including a physical address that matches your licence, and the name and identification of the entity's authorised signatory. For most DNFBPs, an enterprise-wide AML risk assessment is either required at registration or expected shortly after, so drafting it early is wise. Keep everything in a single, well-labelled folder; supervisors frequently ask for re-submissions and you will save days by having documents ready.

Appointing Your AML Compliance Officer (MLRO)

The compliance officer, formally the Money Laundering Reporting Officer, is the human being the whole system revolves around. Under the AML law this person must be competent, sufficiently senior and independent enough to make reporting decisions without commercial pressure. In a small business the owner or a director can hold the role, but they must genuinely perform it, not simply lend a name.

The MLRO's duties are substantial. They oversee customer due diligence, decide when enhanced due diligence is required, review internal alerts, make the call on whether a transaction is suspicious, and file the STR on goAML when it is. They maintain the AML policy, run training, keep the sanctions-screening process current, and act as the point of contact for the FIU and the supervisor. They also prepare the business for inspections and complete the annual AML/CFT questionnaires that the Ministry of Economy and other supervisors issue.

Many small and medium businesses outsource this role to a qualified firm, which is permitted and often sensible where in-house expertise is thin. What is not permitted is leaving the role vacant or purely nominal. Regulators specifically look for evidence that the officer is active: dated reviews, training logs, filed reports and updated risk assessments. A named but dormant officer is treated as no officer at all, and that is a finable breach.

After Registration: Your Ongoing goAML Obligations

Registration is the gate, not the destination. Once live on goAML, your business carries a continuous compliance burden that supervisors test through inspections. The core duty is customer due diligence: verifying the identity of every customer and, where relevant, the ultimate beneficial owner behind a corporate client, before or during the establishment of the business relationship. Higher-risk customers, including politically exposed persons and clients from higher-risk jurisdictions, require enhanced due diligence and closer ongoing monitoring.

You must screen customers and counterparties against the UN Consolidated List and the UAE Local Terrorist List, and act immediately, including freezing and reporting, if there is a match. You must file a Suspicious Transaction Report or Suspicious Activity Report on goAML whenever you have reasonable grounds to suspect that funds are proceeds of crime or linked to terrorism, without tipping off the customer. Dealers in precious metals and stones additionally file the dedicated cash-transaction report for dealings at or above AED 55,000.

Record-keeping is non-negotiable: you must retain customer records, transaction records and reports for at least five years. You must train relevant staff, keep your written AML policies current, and complete supervisory questionnaires on time. The Ministry of Economy and other supervisors run themed inspection campaigns, and the ability to produce a clean, dated compliance file is what separates a passed inspection from a penalty.

Penalties for Failing to Register or Report on goAML

The consequences of non-compliance are set out in Cabinet Decision No. 16 of 2021, the unified list of AML violations and administrative fines. Penalties are calibrated to the breach, and they are real: the UAE has publicly announced tens of millions of dirhams in fines imposed on private-sector firms for AML failures.

Beyond fines, supervisors can suspend or withdraw licences, publish the names of penalised firms, and refer serious cases for criminal investigation. Under Article 26 of the AML law, the criminal offence of money laundering carries imprisonment of one to ten years and fines of AED 100,000 to AED 5,000,000, and businesses can be held liable where their failures enable an offence. The reputational damage often outlasts the fine: banks increasingly ask to see a counterparty's AML posture, and a public penalty can trigger account reviews or closures. Registration, properly maintained, is far cheaper than any of these outcomes.

The goAML Report Types You Must Know

Once registered, you file through goAML using defined report types, and knowing them prevents costly errors. The Suspicious Transaction Report is filed when an actual transaction gives you reasonable grounds to suspect proceeds of crime or terrorist financing. The Suspicious Activity Report covers suspicion arising from behaviour or an attempted transaction that was not completed, for example a customer who abandons a deal when asked for identification. Dealers in precious metals and stones use a dedicated high-value dealers report for qualifying cash transactions at or above AED 55,000, and a similar report exists for real estate.

There is also a Fund Freeze Report, filed when you freeze funds after a sanctions-list match, and a Partial Name Match report used during sanctions screening. Filing the wrong type, or filing late, is treated as a compliance failure even when your underlying suspicion was correct. Reports must be complete, timely and never disclosed to the customer, because tipping off is itself a serious offence under the AML law. The practical lesson is that registration is only useful if your team is trained to recognise the trigger for each report type and to act within the platform quickly and confidentially.

goAML for Free Zone vs Mainland Companies

Founders often assume a free zone licence changes their AML position. It does not change whether you are in scope. A real estate broker, precious-metals trader, corporate service provider or auditor is captured by the AML law whether licensed by a mainland authority such as DED or DET, or by a free zone such as DMCC, IFZA, DAFZA or ADGM. The obligation to register on goAML, appoint an officer and report is national.

What can differ is the supervisor and the exact enrolment route. The Ministry of Economy supervises most DNFBP categories nationally. Certain free zones and financial free zones operate their own supervisory frameworks for firms licensed there, and financial free zones such as ADGM run their own regulator with equivalent AML expectations. In practice this means you must first confirm which body supervises your specific activity, then follow its enrolment path into goAML. The safest approach for any founder is to identify the supervisor during licensing, not after, so that AML registration runs in parallel with your company formation rather than surfacing as an urgent problem when you try to open a bank account. Banks routinely check AML registration, so an incomplete goAML status can itself stall your account opening.

Real Examples: When goAML Registration Applies

Abstract rules become clear through examples, so consider four businesses that founders actually run. A Dubai real estate brokerage lists and sells apartments for clients. The moment it facilitates a purchase or sale on behalf of a customer, it is a DNFBP and must be registered on goAML, screen buyers and sellers, and verify the source of funds behind a purchase. A cash deal for a villa is precisely the scenario the law targets, and an unregistered broker handling it is exposed on multiple fronts.

A gold and jewellery trader in the Gold Souk sells a AED 90,000 piece for cash. Because the transaction sits above the AED 55,000 threshold, the dealer must be registered, must file the dedicated dealers report, and must have verified the customer's identity. Two linked payments of AED 50,000 each do not escape the rule; supervisors look at linked transactions in aggregate, so structuring a deal into smaller cash amounts is itself a red flag.

A corporate service provider sets up companies and provides registered-office and nominee-director services. Because these services can obscure who really owns and controls a company, the provider is squarely a DNFBP, must register on goAML, and must know the ultimate beneficial owner of every entity it forms. An audit firm that prepares or executes client transactions, and an independent legal professional handling property or company transfers, are captured on the same logic. In each case, the trigger is the nature of the activity, not the size of the firm or how long it has traded. If your business touches any of these patterns, treat goAML registration as mandatory and immediate.

How Customer Due Diligence Underpins goAML

goAML reporting only works if what feeds it, your customer due diligence, is sound. Due diligence is the process of knowing who your customer really is before you act for them. At a minimum you identify the customer, verify that identity against reliable documents such as a passport, Emirates ID or trade licence, understand the purpose of the relationship, and identify the beneficial owner where the customer is a company. For a straightforward, low-risk customer this is standard due diligence.

Certain situations demand enhanced due diligence: a politically exposed person, a customer or transaction connected to a higher-risk jurisdiction, an unusually complex ownership structure, or a transaction with no obvious economic purpose. Here you dig deeper, seek senior sign-off, establish the source of funds and source of wealth, and monitor the relationship more closely. Where you cannot complete due diligence, you must not proceed, and you should consider whether the failure itself warrants a report.

This is why a named-but-dormant compliance officer is so dangerous. It is the officer who calibrates these judgements, documents them, and decides when a pattern crosses from unusual to suspicious. Supervisors inspecting a goAML-registered firm will pull a sample of files and test whether due diligence was actually performed and recorded. Clean, dated, complete customer files are the strongest evidence that your registration is real rather than cosmetic, and they are the difference between a routine inspection and a penalty notice.

Common Mistakes to Avoid with goAML Registration

• Assuming you are exempt because you are small or new. The AML law captures activity, not size, and a single in-scope transaction brings you into scope.
• Registering the entity but never appointing an active compliance officer, leaving a nominal name with no reviews, logs or filed reports behind it.
• Entering company details that do not match the trade licence, which triggers rejection and weeks of delay while you correct the record.
• Forgetting the second system. goAML handles reporting, but the Automatic Reporting System for Sanctions Lists handles screening, and you must be live on both.
• Treating registration as a one-off. Skipping ongoing customer due diligence, sanctions screening and the five-year record rule is where most fines are actually earned.
• Missing supervisory deadlines and questionnaires from the Ministry of Economy, which are treated as reportable non-compliance in their own right.
• Waiting until a bank asks before registering, then scrambling under pressure and making errors that delay both the account and the licence.
• Handling explicit or ambiguous cases without advice, when a wrong call on a suspicious transaction can expose the business and its officers personally.

Get goAML Registration Right with Noble Core

goAML registration sits at the intersection of company formation, banking and compliance, which is exactly where founders lose time. Noble Core handles the whole chain: we confirm whether your activity is in scope, identify the correct supervisor, prepare your documents so the entity profile matches your licence, register you on goAML and the sanctions system, and appoint or support your compliance officer with a real, inspection-ready AML programme.

Because AML and licensing are inseparable, it pays to plan them together from the start of your business setup in Dubai. We align your goAML enrolment with your broader obligations, including the AML compliance essentials, costs and deadlines for small businesses that every DNFBP must meet. We also join the dots to your wider financial file: your corporate tax registration and returns with the Federal Tax Authority, and the corporate bank account opening process where banks now scrutinise AML posture before approving. You can verify tax obligations directly with the Federal Tax Authority and confirm DNFBP supervision through the Ministry of Economy.

Register once, register correctly, and keep it maintained. That is the difference between a business that passes supervision quietly and one that meets a five- or six-figure fine. Book a free 20-minute consultation and we will map your exact goAML obligations and the fastest compliant route through them.

Frequently Asked Questions