What Is goAML and Who Must Register in the UAE?
goAML is the UAE's national anti-money-laundering reporting platform, operated by the UAE Financial Intelligence Unit (FIU) under CBUAE. Financial institutions, designated non-financial businesses and professions, and virtual-asset providers must register on goAML and file suspicious reports, as mandated by Federal Decree-Law 20/2018.
- Governing law: Federal Decree-Law 20/2018 on Anti-Money Laundering and Combating the Financing of Terrorism.
- Operator: The UAE Financial Intelligence Unit (goAML / UAE FIU), housed within CBUAE.
- Who registers: Financial institutions (FIs), designated non-financial businesses and professions (DNFBPs), and virtual-asset service providers (VASPs).
- Core obligation: Register on goAML and file suspicious reports such as STRs and SARs.
- Enforcement context: The UAE has substantially strengthened its AML supervision and enforcement in recent years.
The UAE's position as a regional trade, property, and financial hub — with a large expat majority, extensive free-zone activity, and cross-border salary and remittance flows — makes robust AML supervision central to its banking sector. goAML is the single channel through which the UAE's reporting entities communicate suspicious activity to the regulator, whether they are an Emirates NBD branch onboarding a new salary-transfer customer, a DIFC-based advisory firm, or a real-estate brokerage handling a high-value Dubai purchase.
What is goAML in the UAE?
goAML is an integrated reporting and analysis application originally developed by the United Nations Office on Drugs and Crime and adopted by the UAE FIU. In the UAE, it is the mandatory portal for submitting money-laundering and terrorism-financing reports. Reporting entities create an organisation account, register their compliance officer, and then submit structured reports electronically rather than through email or paper.
The platform sits at the centre of the framework created by Federal Decree-Law 20/2018 and its implementing regulation. It lets the FIU receive, store, and analyse reports, and — where warranted — refer matters to law-enforcement and supervisory authorities such as CBUAE, the SCA, DIFC (DFSA), or ADGM (FSRA).
Who must register on goAML?
Registration is not optional for in-scope entities. Broadly, three categories must register:
Category | Examples in the UAE | Typical supervisor |
|---|---|---|
Financial institutions (FIs) | Banks, exchange houses, finance companies, insurers | CBUAE / SCA |
Designated non-financial businesses and professions (DNFBPs) | Real-estate agents, auditors, lawyers, dealers in precious metals and stones, corporate service providers | Ministry of Economy / free-zone authorities |
Virtual-asset service providers (VASPs) | Licensed crypto exchanges and custodians | Relevant licensing authority |
Each entity registers once as an organisation and nominates a Money Laundering Reporting Officer (MLRO) or compliance officer as its authorised user. Firms operating in free zones such as DIFC or ADGM register through the same national goAML platform while remaining answerable to their respective regulators.
What must be reported through goAML?
Reporting entities file several report types. The two most commonly referenced are the Suspicious Transaction Report (STR) and the Suspicious Activity Report (SAR), alongside other structured filings the FIU may require.
Report type | What it captures |
|---|---|
STR (Suspicious Transaction Report) | A specific transaction suspected to involve the proceeds of crime or terrorism financing |
SAR (Suspicious Activity Report) | Suspicious conduct or attempted activity, even without a completed transaction |
Additional filings | Other structured reports the UAE FIU designates from time to time |
Under Federal Decree-Law 20/2018, a report must be filed when there are reasonable grounds to suspect that funds represent proceeds of crime or relate to terrorism financing. The obligation to report is time-sensitive, and "tipping off" the customer that a report has been made is prohibited.
What happens if an entity fails to register or report?
Failure to register on goAML, or failure to file required reports, exposes an entity to administrative and financial penalties under the AML framework, and potentially to criminal liability for the underlying offences. Because supervisors treat AML controls as a licensing condition, weak reporting can also jeopardise a firm's ability to operate in the UAE.
How AI helps
A recurring bottleneck in goAML compliance is the manual work of verifying identity documents and extracting information for customer due diligence — reading each Emirates ID, trade licence, or establishment card before a customer file is complete and monitorable. YuAccess applies document AI to this step, extracting and structuring KYC data from UAE identity and licensing documents so compliance teams spend less time on data entry and more on genuine risk review. The outcome is materially faster, more consistent onboarding — a stronger foundation for the suspicious-activity monitoring that goAML reporting depends on.
Frequently asked questions
Is goAML mandatory for all businesses in the UAE? No. It is mandatory for financial institutions, DNFBPs, and virtual-asset service providers. Businesses outside these categories are not required to register, though many still maintain AML controls.
Who operates goAML in the UAE? The UAE Financial Intelligence Unit (FIU), which sits within CBUAE, operates the platform and receives all reports submitted through it.
What is the difference between an STR and a SAR? An STR reports a specific suspicious transaction, while a SAR reports suspicious activity or conduct even where no transaction was completed. Both are filed through goAML.
Which law requires goAML reporting in the UAE? Federal Decree-Law 20/2018 on Anti-Money Laundering and Combating the Financing of Terrorism, together with its implementing regulation, establishes the reporting obligations.
Can free-zone firms in DIFC or ADGM use goAML? Yes. Entities in DIFC and ADGM register on the same national goAML platform while remaining supervised by their respective regulators, DFSA and FSRA.
What is "tipping off" under the UAE AML regime? Tipping off means alerting a customer that a suspicious report has been or may be filed about them. It is prohibited under the UAE's AML framework.
This is a general explainer, not legal advice.
Explore more UAE banking and compliance guides on the YuVerse UAE hub.
References
- Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations — https://u.ae/
- Central Bank of the UAE Rulebook — https://rulebook.centralbank.ae/
