goAML Registration UAE: A Practical 2026 Guide for DNFBPs

If your business sells property, trades gold or diamonds, audits accounts or sets up companies for clients, goAML registration in the UAE is not optional. goAML is the reporting platform of the UAE Financial Intelligence Unit (FIU), and it is the only channel through which regulated businesses file suspicious transaction reports and certain cash transaction reports. This guide explains who must register, how the two-stage SACM and goAML process works, which reports you will file once you are live, and what changed with the 2025 AML law. All facts are stated as at November 2026.

This is a hands-on registration and reporting guide. For the bigger picture on the UAE's AML framework after the FATF grey list exit, see our separate article linked at the end.

What goAML is and who runs it

goAML is a system developed by the United Nations Office on Drugs and Crime and used by the UAE FIU to receive, analyse and distribute suspicious transaction reports. The Ministry of Economy and Tourism (MoET) notes that the UAE was the first Gulf country to adopt it.

Under Article 11 of Federal Decree-Law No. (10) of 2025, the FIU sits within the Central Bank but acts independently, and all suspicious transaction reports from financial institutions, DNFBPs and virtual asset service providers must be submitted to it exclusively. In practice, that means through goAML.

Who must complete goAML registration in the UAE

The obligation applies to Designated Non-Financial Businesses and Professions (DNFBPs). MoET states that it supervises the following DNFBP sectors in the mainland and in commercial free zones:

A few points that often cause confusion:

• Financial free zones are different. MoET's goAML System Registration Guide states that it supervises trade licences issued by mainland registrars and commercial free zones, and that entities in the financial free zones (supervised by the DFSA and FSRA) are excluded from MoET supervision.
• Lawyers and notaries are DNFBPs too, but MoET's own penalty legislation list shows they sit with a separate supervisor (Cabinet Resolution No. (71) of 2024 covers entities supervised by the Ministry of Justice and MoET). Under Article 18(2) of the 2025 law, legal professionals are not required to report information obtained under professional secrecy.
• Commercial gaming operators were added as DNFBPs under Cabinet Resolution No. 134 of 2025, according to Al Tamimi & Company.

MoET's goAML page also offers a short self-check questionnaire covering these four sectors. It is a useful first filter, though MoET itself says it is guidance rather than legal advice.

The legal basis in 2026: the new AML law

Older guides still refer to Federal Decree-Law No. (20) of 2018 and Cabinet Decision No. (10) of 2019. Both have been replaced:

• Federal Decree-Law No. (10) of 2025 on anti-money laundering, combating the financing of terrorism and proliferation financing was issued on 30 September 2025 and took effect on 14 October 2025 (UAE Legislation portal). It repeals the 2018 law.
• Cabinet Resolution No. (134) of 2025, its executive regulations, came into force on 14 December 2025, replacing Cabinet Decision No. (10) of 2019 (Al Tamimi).

Two provisions matter most for goAML users. Article 18 requires DNFBPs that suspect, or have reasonable grounds to suspect, that funds are linked to a crime to notify the FIU "without delay", regardless of value, through the FIU's designated electronic system. Article 20 says no one may operate as a DNFBP without licensing, registration or enrolment with the competent or supervisory authority.

Step-by-step goAML registration

MoET's goAML System Registration Guide splits the process into two stages, each approved by MoET.

Before you start: documents

Prepare one combined PDF (the system accepts a single attachment, maximum 5 MB) containing:

1. The entity's trade licence.
2. An authorisation letter appointing the Compliance Officer or Money Laundering Reporting Officer (MLRO), on company letterhead and/or stamped.
3. The Emirates ID and/or passport of the appointed Compliance Officer or MLRO.

You will also need the Google Authenticator app on a phone with a UAE-registered mobile number.

Stage 1: SACM registration

1. Go to the FIU's Services Access Control Manager (SACM) at services.uaefiu.gov.ae/sacm.
2. Choose Reporting Entity as the registration type, enter the company name exactly as on the trade licence, select the Ministry as supervisory body and enter the trade licence number.
3. Add the Compliance Officer or MLRO's details as they appear on their ID, upload the PDF, accept the terms and submit. You receive a reference number.
4. Verify your email address. The request does not reach MoET until you do. Whitelist the FIU's no-reply addresses so approval emails are not lost.
5. Once MoET approves, you receive an email OTP and a mobile OTP. Use them on the "Get Secret Key" page to receive your username and secret key. The OTP is valid for 24 hours only.
6. Add the username and secret key to Google Authenticator, which then generates the six-digit code you need every time you log in.

Stage 2: entity registration on goAML

1. Log in to services.uaefiu.gov.ae/goaml using the SACM username and the Authenticator code.
2. Select Register New Organisation, then Reporting Entity.
3. Complete the entity details, address and phone numbers, and the Compliance Officer or MLRO's details, then upload the same document file.
4. Submit. The system issues a reference beginning "REP".
5. MoET reviews the request. If approved, you receive your unique Organisation ID. If rejected, the email gives the reason and you resubmit.

From then on, login is two-level: the SACM username plus Authenticator code, then the goAML username and password you created.

Common reasons for rejection include mismatched company names, an unstamped authorisation letter, a non-UAE mobile number and missing fields. Most can be avoided by checking the documents against the trade licence before submitting.

Reports you will file on goAML

Registration is only the start. Once active, a DNFBP files several report types.

Suspicious transaction and activity reports (STR/SAR)

These are the core of the system. Any suspicion triggers a report, with no minimum value, under Article 18 of the 2025 law.

DPMSR for dealers in precious metals and stones

MoET Circular No. 08/AML/2021 requires dealers to obtain ID and file a Dealers in Precious Metals and Stones Report (DPMSR) for:

• cash transactions equal to or exceeding AED 55,000 with resident or non-resident individuals; and
• transactions equal to or exceeding AED 55,000 in cash or by wire transfer with companies, where a copy of the trade licence and ID of the company representative must also be obtained.

Records must be kept for at least five years.

REAR for real estate agents and brokers

MoET Circular No. 05/2022 requires a Real Estate Activity Report (REAR) on goAML for freehold property purchases and sales where:

• one or more physical cash payments equal or exceed AED 55,000 for all or part of the property value;
• a virtual asset is used to pay for all or part of the property; or
• the funds were converted from a virtual asset.

For company buyers or sellers, the circular lists the trade licence, articles of association, register of beneficial owners and ID of all beneficial owners and shareholders. A REAR does not replace SAR, funds freeze, partial name match or high-risk country reports.

As at November 2026, both circulars are still published on MoET's AML page. Check that page periodically, as the ministry issues new circulars under the 2025 framework.

Penalties for non-compliance

MoET's goAML page warns that failure to register may lead to severe penalties. Under Article 17 of Federal Decree-Law No. (10) of 2025, a supervisory authority may impose, for each violation:

• a warning;
• an administrative fine of AED 10,000 to AED 5,000,000;
• restrictions on, or suspension of, responsible managers; and
• suspension of the activity or revocation of the licence.

Repeat violations can attract incremental fines.

Talk to GULF CONSULT

GULF CONSULT helps Dubai businesses with goAML registration, Compliance Officer appointment letters, AML policies and ongoing DPMSR and REAR reporting. Book our free 30-minute consultation: email [email protected], call +971 58 600 4833, or message us on WhatsApp.