Overview
goAML is the reporting platform, built by the United Nations Office on Drugs and Crime, used by the UAE Financial Intelligence Unit. Registration is mandatory for financial institutions, virtual-asset service providers, and designated non-financial businesses and professions.
The obligation is statutory, not contractual, and it does not wait for the operating licence.
Who must register
Financial institutions. VASPs. And DNFBPs, a category that captures real-estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and lawyers and notaries in relation to specified transactions.
A crypto group often has companies in more than one of these categories. Each reporting entity registers in its own right.
Legal basis
Federal Decree-Law No. 20 of 2018 on AML/CFT and its implementing regulation, Cabinet Decision No. 10 of 2019, both as amended. Sector supervisors — VARA, the Central Bank, the SCA, the FSRA, the DFSA, the Ministry of Economy — apply the same framework within their own perimeters.
What must be reported
- STR — suspicious transaction report.
- SAR — suspicious activity report, where no transaction was executed.
- DPMSR — dealers in precious metals and stones report.
- REAR — real estate activity report.
- FFR — funds freeze report, following a targeted financial sanctions match.
- PNMR — partial name match report.
- HRC and HRCA — high-risk country reports.
Reports are filed without tipping off the customer. The prohibition on disclosure is as important as the obligation to file.
Transaction
Customer instruction received
Screening
Sanctions and adverse media, before execution
Freeze immediately on a sanctions match
Red flag
Alert raised by monitoring rules
Internal escalation
Documented, with the decision recorded
MLRO decision
Report or record the reasons for not reporting
File without delay once suspicion is formed
goAML filing
Submitted without tipping off the customer
Financial Intelligence Unit
Analysis and dissemination
Law enforcement and supervisor
Action outside your control
Targeted financial sanctions
Screening against the lists maintained by the UAE Executive Office for Control and Non-Proliferation, and against United Nations consolidated lists. A match requires an immediate freeze and a report within the statutory window.
This is the obligation with the shortest clock and the least tolerance for a manual process that depends on one person being at their desk.
What a supervisor expects to see
An enterprise-wide risk assessment that reflects the actual business. Customer due diligence proportionate to risk, with enhanced measures where the risk is higher. Ongoing monitoring with alert thresholds someone can justify. An appointed MLRO with real authority. Training, with attendance records. Record-keeping for the statutory period. An independent audit of the programme.
How we help
We register the entity and the officer, draft the AML/CFT programme and the risk assessment against the applicable rulebook rather than a generic template, design the reporting workflow and the sanctions screening process, prepare and support the MLRO, run staff training, and arrange the independent audit.
Documents
Indicative categories. The exact bundle is activity-specific and the regulator may ask for more.
- MLRO Emirates ID and passport
- Trade licence
- Authorised signatory declaration
- MLRO appointment letter
- AML/CFT policy
Interaction with other regulators
Common questions
Is goAML registration optional if we have not started trading?
No. The obligation attaches to being a reporting entity, not to having transactions to report. Registering late is itself a finding.
Who can be the MLRO?
Someone with the seniority and independence to escalate against commercial pressure, and enough knowledge of the business to recognise what is unusual about it. The role can be outsourced in some structures, but responsibility for the appointment does not move.
What happens if we file nothing for a year?
A nil-return pattern is not automatically wrong, but it invites the question of whether monitoring is working. A supervisor will look at the monitoring design, the alerts it generated, and what was done with them.
Sources
- Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism — Primary AML/CFT statute, as amended
- Cabinet Decision No. 10 of 2019 — Implementing Regulation — Implementing regulation, as amended
- UAE Financial Intelligence Unit — goAML registration portal