goAML Registration in the UAE for DNFBPs: Step-by-Step Checklist

Quick answer: goAML registration is mandatory for UAE designated non-financial businesses and professions (DNFBPs) such as real estate brokers, dealers in precious metals and stones, accountants, auditors and corporate service providers. You pre-register the compliance officer on the UAE Financial Intelligence Unit (FIU) portal, register the organisation on goAML, upload licence and ID documents, and wait for approval before reporting suspicious or threshold transactions.

Key takeaways

• The UAE AML framework is now Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025, which replaced the 2018 law and Cabinet Decision No. 10 of 2019.
• Every DNFBP must be able to file reports to the FIU through goAML, so registration should be done before you start the regulated activity.
• Registration runs in two stages: user pre-registration with one time passwords, then organisation registration on goAML.
• Real estate brokers file REARs and precious metals dealers file DPMSRs in addition to STRs and SARs.
• Supervisors can fine between AED 10,000 and AED 5,000,000 per violation and have suspended businesses that failed to register.

What is goAML and why does it matter for DNFBPs?

goAML is the secure reporting platform used by the UAE Financial Intelligence Unit to receive suspicious transaction reports and other filings from reporting entities. It was developed by the United Nations Office on Drugs and Crime and is used by FIUs in many countries. In the UAE, the FIU analyses what businesses submit and shares intelligence with law enforcement.

For a DNFBP, goAML is not optional software. Cabinet Resolution No. 134 of 2025 requires reporting entities to report suspicious transactions to the FIU “immediately and without delay” through its electronic system. If you are not registered, you cannot comply with that duty, which is why supervisors check goAML status during inspections.

The legal framework in 2026

Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing was issued on 30 September 2025 and repealed Federal Decree-Law No. 20 of 2018. Its Executive Regulations were issued as Cabinet Resolution No. 134 of 2025, replacing Cabinet Decision No. 10 of 2019. Circulars issued under the old regime stay in force where they do not conflict with the new law, so earlier Ministry circulars on goAML, DPMSR and REAR reporting still matter. You can read the decree-law on the UAE legislation portal.

Who must complete goAML registration in the UAE?

Article 3 of Cabinet Resolution No. 134 of 2025 lists the businesses and professions that are DNFBPs. Coverage depends on the activity you actually carry out, not just the name on your licence.

DNFBP category	When it is covered	Usual supervisor
Real estate brokers and agents	When concluding purchase or sale transactions for customers	Ministry of Economy and Tourism (mainland and commercial free zones)
Dealers in precious metals and stones	Cash transactions of AED 55,000 or more, single or linked	Ministry of Economy and Tourism
Independent accountants and auditors	When preparing or carrying out listed financial transactions for clients	Ministry of Economy and Tourism
Company and trust service providers	Acting as formation agent, director, secretary, registered office, trustee or nominee	Ministry of Economy and Tourism
Lawyers, notaries and independent legal professionals	When preparing or carrying out listed transactions such as property deals or managing client funds	Ministry of Justice
Commercial gaming operators	Transactions of AED 11,000 or more	Relevant gaming regulator

Entities licensed in the financial free zones follow their own supervisor. ADGM firms register through ADGM, and DIFC firms through the DFSA. The FIU portal asks you to choose your supervisory body, so get this right from the start.

Common grey areas

• A general trading company that occasionally sells gold or jewellery for cash may fall within the dealer category once a cash sale reaches AED 55,000.
• A business setup consultancy that provides nominee services, registered addresses or acts as a director is likely to be a company service provider.
• An accounting firm that only prepares bookkeeping may sit outside scope, but one that manages client funds or forms companies for clients is usually in scope.

If you are unsure, ask your supervisor in writing or take advice before you trade. Our AML and DNFBP compliance team can map your activities against the regulations.

What documents do you need for goAML registration?

Requirements change, and each supervisor can add its own items, but the core pack published in official registration guidance includes:

• A valid trade or commercial licence showing the regulated activity.
• Evidence of the compliance officer (MLRO) appointment, and the supervisor’s approval where one is required.
• For the compliance officer and any deputy: passport copy, Emirates ID front and back, and UAE residence visa.
• A unique, working UAE mobile number and email address for each user, because one time passwords are sent to both.
• Entity details exactly as they appear on the licence, including the licence number and registered address.

Merge the documents into one clear PDF where the portal asks for it, and make sure the licence is not close to expiry. If a licence renewal or amendment is pending, finish it first so the names and numbers match.

How do you register on the goAML portal step by step?

The FIU now uses a two stage process: a secure access pre-registration for the user, then organisation registration inside goAML. The steps below follow the official guide published by ADGM for its firms; mainland and commercial free zone DNFBPs follow the same flow but choose the Ministry of Economy and Tourism as their supervisory body.

Stage 1: pre-register the compliance officer

1. Open the services section of the UAE FIU website and select the Security Access Control Manager registration.
2. Choose “Reporting Entity”, enter the entity name and licence number exactly as licensed, and select your supervisory body.
3. Enter the compliance officer’s personal details, ID or passport number, mobile number and email address.
4. Upload the consolidated PDF, accept the terms and submit.
5. Verify the email link you receive, which includes a pre-registration number and one time password.
6. Enter the email and SMS one time passwords to obtain a secret key, then link it to an authenticator app that produces a six digit code.

The one time passwords expire 24 hours after they are issued, so plan to complete the next stage the same day.

Stage 2: register the organisation on goAML

1. Log in to goAML with the username sent to you and the authenticator code.
2. Select “Register a New Organization” and choose “Reporting Entity”.
3. Pick the organisation type that matches your licensed activity, for example real estate broker or dealer in precious metals and stones.
4. Complete the mandatory fields, including phone numbers and address, and upload the required documents one by one.
5. Submit and record the registration reference number shown on screen.
6. Watch your email for the approval or rejection notice. If rejected, correct the stated issue and resubmit.

Adding users or changing the compliance officer

Each additional user completes Stage 1 individually, then uses “Register a New Person” and enters the Organization ID provided by the existing administrator. When your compliance officer leaves, update goAML promptly so that reports never stop. Keep the change in step with your supervisor’s records too.

What do you report after goAML registration?

Registration is the start, not the end. The main report types for DNFBPs are:

• STR (Suspicious Transaction Report): filed when you suspect a transaction involves the proceeds of crime or terrorist financing, regardless of amount.
• SAR (Suspicious Activity Report): filed for suspicious behaviour or attempted dealings where no transaction completes.
• DPMSR (Dealers in Precious Metals and Stones Report): a threshold report for dealers on cash transactions at or above AED 55,000, introduced by Ministry Circular No. 8 of 2021.
• REAR (Real Estate Activity Report): required under Ministry Circular No. 5 of 2022 for freehold sales where cash of AED 55,000 or more is used, or where virtual assets, or funds converted from virtual assets, pay any part of the price.
• FFR and PNMR: funds freeze reports and partial name match reports linked to targeted financial sanctions screening.

Never tell the customer that a report has been or may be filed. Tipping off is a criminal offence under the 2025 law. Keep supporting records, including identity documents and transaction files, for at least five years.

What are the penalties for missing goAML registration?

Article 17 of Federal Decree-Law No. 10 of 2025 lets a supervisory authority impose a warning, an administrative fine of AED 10,000 to AED 5,000,000 per violation, restrictions on managers, suspension of the activity, or licence revocation. Repeat breaches within a year can attract incremental fines, and penalties may be published.

Enforcement is real. In August 2023 the Ministry announced it had suspended 50 DNFBP establishments for three months for failing to register on goAML, and reported fines of about AED 76.9 million on 225 DNFBP companies earlier that year. See the Ministry’s AML supervision page for current circulars.

What common mistakes delay goAML registration?

• Wrong supervisory body: selecting a regulator that does not supervise your licence triggers rejection.
• Name mismatches: the entity name, licence number or officer name differs from the documents.
• Wrong organisation type: choosing a category that does not match your licensed activity.
• Shared contact details: using a generic office email or another person’s mobile, so one time passwords never arrive.
• Expired documents: an expired licence, visa or Emirates ID.
• Letting the codes lapse: not finishing Stage 2 within the 24 hour window.
• Treating it as a one off: registering but never screening customers, training staff or filing threshold reports.

What should your post-registration checklist include?

1. Write and approve a business wide risk assessment and AML policies signed off by senior management.
2. Set customer due diligence procedures, including beneficial ownership checks. Our guide to the UBO register explains the related company duties.
3. Subscribe to sanctions list updates and screen customers before onboarding and on each change.
4. Train staff on red flags and on how to escalate internal reports to the compliance officer.
5. Diary threshold reporting for DPMSR or REAR cases so nothing is missed.
6. Arrange independent testing of your AML programme, which an audit and assurance provider can support.

How Emiracle helps with goAML registration and DNFBP compliance

Emiracle Advisory works with real estate brokerages, gold and jewellery traders, accounting practices and corporate service providers across Dubai and the wider UAE. We confirm whether your activity is in scope, prepare the document pack, guide your compliance officer through both portal stages, and fix rejected applications.

After registration we help you build what supervisors look for: risk assessments, AML manuals, screening procedures, training records and reporting workflows. Our PRO and government services team keeps licences and visas current, so details stay consistent across the FIU, your supervisor and your licensing authority. As an authorised channel partner across 45+ UAE free zones, we can also structure new DNFBP licences with compliance built in from day one.

Ready to register or tidy up an existing account? Contact Emiracle Advisory, call +971 52 185 3005, or message us on WhatsApp at the same number. You can also email info@emiracle.ae or visit us at Level 9, Boulevard Plaza Tower 1, Downtown Dubai.

Frequently asked questions

Is goAML registration mandatory for every UAE company?

No. It is mandatory for financial institutions, virtual asset service providers and designated non-financial businesses and professions (DNFBPs). A general trading or consultancy company that does not carry out a DNFBP activity is not a reporting entity, although every business should still have basic anti-money laundering controls.

Do free zone companies need to register on goAML?

Yes, if they carry out a DNFBP activity. The Ministry of Economy and Tourism supervises DNFBPs in the mainland and commercial free zones, while ADGM and DIFC entities register under their own supervisors. The free zone licence does not remove the obligation.

Who should be the main user on the goAML portal?

The compliance officer (MLRO) normally registers the organisation and acts as its administrator. The person should be at management level, have a valid UAE mobile number and email address, and be able to file reports without interference from sales or management.

How long does goAML registration take?

It varies. Pre-registration codes expire within 24 hours, so the portal steps themselves can be done quickly, but approval depends on the FIU and your supervisor reviewing the documents. Confirm current timelines at the time of application and do not start DNFBP activity before you can report.

What is the difference between an STR, a SAR, a DPMSR and a REAR?

An STR reports a suspicious transaction and a SAR reports suspicious activity or behaviour. A DPMSR is a threshold report for dealers in precious metals and stones on cash transactions of AED 55,000 or more. A REAR is a threshold report for real estate brokers on cash, virtual asset and similar freehold property deals.

What happens if a DNFBP does not register on goAML?

Supervisors treat it as a serious breach. Under Federal Decree-Law No. 10 of 2025, administrative fines range from AED 10,000 to AED 5,000,000 per violation, and the Ministry has suspended DNFBP businesses until they registered.

Does goAML registration replace other AML obligations?

No. It only gives you the channel to report. You still need a business risk assessment, customer due diligence, sanctions screening, record keeping for at least five years, staff training and an approved compliance officer.

Last reviewed: 21 October 2026. Rules change; confirm current requirements with an Emiracle advisor before you apply.