Overview
goAML is the reporting platform, built by the United Nations Office on Drugs and Crime, used by the UAE Financial Intelligence Unit. Registration is mandatory for financial institutions, virtual-asset service providers, and designated non-financial businesses and professions.
The obligation is statutory, not contractual, and it does not wait for the operating licence.
Who must register
Financial institutions. VASPs. And DNFBPs, a category that captures real-estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and lawyers and notaries in relation to specified transactions.
A crypto group often has companies in more than one of these categories. Each reporting entity registers in its own right.
Legal basis
Federal Decree-Law No. 20 of 2018 on AML/CFT and its implementing regulation, Cabinet Decision No. 10 of 2019, both as amended. Sector supervisors — VARA, the Central Bank, the CMA, the FSRA, the DFSA, the Ministry of Economy — apply the same framework within their own perimeters.
What must be reported
- STR — suspicious transaction report.
- SAR — suspicious activity report, where no transaction was executed.
- DPMSR — dealers in precious metals and stones report.
- REAR — real estate activity report.
- FFR — funds freeze report, following a targeted financial sanctions match.
- PNMR — partial name match report.
- HRC and HRCA — high-risk country reports.
Reports are filed without tipping off the customer. The prohibition on disclosure is as important as the obligation to file.
Opération
Instruction du client reçue
Filtrage
Sanctions et presse défavorable, avant exécution
Geler immédiatement en cas de correspondance avec une liste de sanctions
Signal d'alerte
Alerte déclenchée par les règles de surveillance
Escalade interne
Documentée, la décision étant consignée
Décision du MLRO
Déclarer, ou consigner les motifs de ne pas déclarer
Déclarer sans délai dès que le soupçon est formé
Déclaration goAML
Déposée sans en avertir le client
Cellule de renseignement financier
Analyse et diffusion
Services répressifs et superviseur
Action hors de votre contrôle
Targeted financial sanctions
Screening against the lists maintained by the UAE Executive Office for Control and Non-Proliferation, and against United Nations consolidated lists. A match requires an immediate freeze and a report within the statutory window.
This is the obligation with the shortest clock and the least tolerance for a manual process that depends on one person being at their desk.
What a supervisor expects to see
An enterprise-wide risk assessment that reflects the actual business. Customer due diligence proportionate to risk, with enhanced measures where the risk is higher. Ongoing monitoring with alert thresholds someone can justify. An appointed MLRO with real authority. Training, with attendance records. Record-keeping for the statutory period. An independent audit of the programme.
How we help
We register the entity and the officer, draft the AML/CFT programme and the risk assessment against the applicable rulebook rather than a generic template, design the reporting workflow and the sanctions screening process, prepare and support the MLRO, run staff training, and arrange the independent audit.
Documents
Catégories indicatives. Le dossier exact dépend de l'activité et le régulateur peut en demander davantage.
- MLRO Emirates ID and passport
- Trade licence
- Authorised signatory declaration
- MLRO appointment letter
- AML/CFT policy
Interaction avec les autres régulateurs
Questions fréquentes
Is goAML registration optional if we have not started trading?
No. The obligation attaches to being a reporting entity, not to having transactions to report. Registering late is itself a finding.
Who can be the MLRO?
Someone with the seniority and independence to escalate against commercial pressure, and enough knowledge of the business to recognise what is unusual about it. The role can be outsourced in some structures, but responsibility for the appointment does not move.
What happens if we file nothing for a year?
A nil-return pattern is not automatically wrong, but it invites the question of whether monitoring is working. A supervisor will look at the monitoring design, the alerts it generated, and what was done with them.
Sources
- Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism — Primary AML/CFT statute, as amended
- Cabinet Decision No. 10 of 2019 — Implementing Regulation — Implementing regulation, as amended
- UAE Financial Intelligence Unit — goAML registration portal