Home / goAML & AML Compliance

Registration Is Free
Suspension Is Not

goAML registration with the UAE Financial Intelligence Unit is free. Not registering can suspend your licence and carries a fine of AED 200,000 to AED 10,000,000. If your firm provides a client address, you are in scope.

FreeCost to register on goAML
50DNFBPs suspended for three months over goAML
AED 55,000Cash threshold for REAR and DPMSR reports
5 yearsMinimum record retention
Ask a consultant Read the detail
01
Scope

Who counts as a DNFBP

Cabinet Resolution 134 of 2025, Article 3, lists the Designated Non-Financial Businesses and Professions that must register. Registration is free. Operating without it is a criminal offence under Article 32 of Federal Decree-Law 10 of 2025.

Company and trust service providers, including business setup consultancies — You are a DNFBP if you act as a formation agent, act or arrange for another to act as director, secretary or partner, act as trustee or nominee shareholder, or provide a registered office, business address, correspondence address or administrative address for a company. Providing a client address is enough. Most business setup firms and corporate service providers are DNFBPs in their own right, not merely advisers to them, and must register with their own compliance officer.
Real estate brokers and agents — Caught when concluding transactions or settlements on behalf of customers for the purchase or sale of real estate. There is no monetary threshold in the definition.
Dealers in valuable metals and precious stones — Caught on a single cash transaction, or linked transactions, of AED 55,000 or more.
Lawyers, notaries, other independent legal professionals and independent accountants — Caught only when preparing, conducting or executing customer transactions in buying or selling real estate, managing customer funds, managing bank, savings or securities accounts, organising contributions to establish, operate or manage companies, or establishing, operating or managing legal persons or arrangements or buying and selling commercial entities.
Commercial gaming operators — A category added in 2025. Caught on single or linked transactions of AED 11,000 or more, with gaming chips alone excluded.
Financial institutions and virtual asset service providers — Financial institutions fall under Article 2. VASPs fall under Article 4, covering exchange between virtual assets and fiat, exchange between virtual assets, transfer, safekeeping and administration, and services related to an issuer's offer or sale.
02
Consequences

What not registering costs

Penalties come from Federal Decree-Law 10 of 2025, issued 30 September 2025. Article 41 repealed Federal Decree-Law 20 of 2018, so older guidance citing the 2018 law is out of date. The Ministry of Economy has suspended the operations of 50 DNFBP establishments for three months at a stroke, purely for failing to register on goAML, with suspension continuing until they registered.

BreachPenalty
Any administrative violation, imposed by your supervisory authority (Article 17)Warning, an administrative fine of AED 10,000 to AED 5,000,000 per violation, prohibition from the sector, restriction of the powers of board members and executives, appointment of a temporary supervisor, suspension or replacement of directors, suspension or restriction of the activity or profession, or revocation of the licence
Operating without licence, registration or enrolment (Article 32)Imprisonment and a fine of AED 200,000 to AED 10,000,000, or either
Failure to report a suspicious transaction, deliberately or by gross negligence (Article 28)Imprisonment and a fine of AED 100,000 to AED 1,000,000, or either
Tipping off a customer that they are being reported (Article 29(1))Imprisonment and a fine of not less than AED 50,000, or either
Violating targeted financial sanctions instructions (Article 33)Imprisonment and a fine of not less than AED 20,000, or either
False information about a beneficial owner (Article 35(1))Imprisonment and a fine of not less than AED 20,000, or either
Breach of customer due diligence, internal policies or the anonymous account rules (Article 35(3))Imprisonment and a fine of not less than AED 10,000, or either
Money laundering itself (Article 26(1))One to ten years and AED 100,000 to AED 5,000,000, or the value of the criminal property, whichever is greater
A legal person convicted of money laundering, terrorist financing or proliferation financing (Article 27(1))Fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property, whichever is greater
03
Getting registered

Two stages, then your MLRO

Stage one is SACM. Stage two is goAML. You cannot do stage two without stage one, and going straight to goAML is the single most common failure. goAML has been live since June 2019 and is run by the UAE Financial Intelligence Unit.

Stage one: SACM pre-registration — The Services Access Control Manager is the secure gateway. It issues your username and a secret key for Google Authenticator. Register as a Reporting Entity, using your trade licence number as the ID number, with the organisation's legal name exactly as on the licence. Your supervisory body then approves or rejects the request.
One PDF, or it comes back — Regulators accept one PDF only. Merge the trade licence, Emirates ID, passport, Ministry of Economy approval email and authorisation letter into a single file. Repeated rejection for missing documents is almost always this.
The 24 hour window — On approval you enter the email OTP and the SMS OTP. Both are valid for 24 hours only. Miss it and pre-registration restarts. The mobile must be a UAE number, and neither the number nor the email may be reused across pre-registration requests.
Stage two: register the organisation on goAML — Your username comes from the SACM email. Your password is the current six-digit Google Authenticator code, which rotates every 30 seconds. Register the organisation, keep the registration reference number, and use a group mailbox for the organisation email so approvals, rejections and the annual questionnaire are all seen.
Appoint a compliance officer, at management level — Article 22 requires a compliance officer at management level, with independence in decision-making and appropriate competence and experience. The MLRO is the registering person on goAML and must use an official business email address, not Gmail, Hotmail or Yahoo, because password resets depend on it.
Additional users and MLRO changes — Once approved, the entity receives an Org ID. Other staff register as a person against that Org ID, and your own MLRO approves them and sets their permissions, not the FIU. When the MLRO changes, the incoming officer registers as a new person under the existing Org ID. Do not reuse the outgoing officer's credentials, and remove their access.
04
Filing

The reports you have to file

There are twelve report types on goAML. These are the ones DNFBPs meet. A threshold report is not an accusation. It is a record, and not filing it is the offence.

ReportWhen it is filed
STR, Suspicious Transaction ReportSuspicion of money laundering, fraud or terrorist financing around an executed transaction. File without delay.
SAR, Suspicious Activity ReportSuspicion around an activity, or an attempted transaction that was not executed.
REAR, Real Estate Activity ReportPurchase or sale of freehold property where payment includes cash of AED 55,000 or more, in a single payment or multiple payments, or where any part of the value is a virtual asset or was converted from or to a virtual asset. Obtain the Emirates ID or passport first. Effective 27 June 2022.
DPMSR, Dealers in Precious Metals and Stones ReportCash of AED 55,000 or more from an individual, resident or non-resident. For an entity, AED 55,000 or more in cash or by wire transfer, and you obtain the trade licence plus the representative's Emirates ID or passport. The wire transfer rule for companies is the most commonly missed in the gold trade. Effective 12 June 2021.
HRC and HRCA, High Risk Country reportsA transaction or activity involving a National Committee high-risk country. The transaction may only be executed three working days after reporting it, and only if the FIU has not objected in that period. Tell your client before they commit to the deal.
PNMR and FFR, sanctions reportsPNMR for a potential match against a sanctions list. FFR for a confirmed match, covering any freeze, prohibition on providing funds or services, or attempted transaction.
AIF, AIFT, RFI, RFITThe FIU requests further information through the Message Board. Fill in the FIU Reference field with the case number, or the response will not link to the original report.
05
Year on year

Registration is the start

Cabinet Resolution 134 of 2025 sets the standing obligations every financial institution, DNFBP and VASP must meet. Inspectors ask to see the documents, not the intention.

The Ministry of Economy and Tourism annual questionnaire — Every year the Ministry issues a mandatory AML and CFT Risk Assessment questionnaire to the DNFBPs it supervises, at amlquestionnaire.moec.gov.ae. Your username is the email address at which the notification arrived, so that mailbox must stay monitored. Recent cycles have run to roughly 290 mandatory questions with a deadline in the second quarter, and the round for financial year 2025 closed on 24 April 2026. Responses are reviewed, scored and retained as your supervisory risk profile, and they drive whether you are inspected. Participation is mandatory, and non-participation or an inaccurate submission invites administrative measures including fines. Confirm the current cycle's deadline from your own notification email.
Enterprise risk assessment — Article 5 requires you to identify, understand, manage and assess crime risk across customer, country and geographic, product, service, transaction and delivery channel factors. Document it, retain it, update it on an ongoing basis and produce it to the authority on request.
Internal policies approved by senior management — Article 21 requires policies, controls and procedures approved by senior management and proportionate to your risk and size, covering customer due diligence, STR reporting procedures, compliance management arrangements, employee screening for fitness and propriety, periodic training programmes and workshops, and an independent audit function that tests whether any of it works.
The internal decision log — Your compliance officer must receive, examine and assess suspicious transaction data and decide whether to notify the FIU or to retain the matter stating the reasons. Where a red flag was reviewed and not reported, the file must record who decided, when and why. Most small DNFBPs have no such log. Inspectors ask for it.
Sanctions screening and record keeping — Screen against the domestic Terrorist List and the UNSCR lists, implement Executive Office instructions forthwith, and file a PNMR or FFR. Keep records for five years, immediately available to competent authorities. No anonymous, fictitious, alias or numbered accounts or relationships.
Good faith filing carries no liability — Article 37(1) removes criminal, civil and administrative liability from a reporting entity, its board, its employees and its authorised representatives for filing a report, or for breaching a confidentiality restriction to do so, even if they were not fully aware of the nature or actual occurrence of the crime, unless the report was made in bad faith to harm someone. Filing in good faith has no downside. Not filing starts at AED 100,000 and imprisonment.
06
Fee guide

Our fee for this

ServiceFee (AED)
goAML registration & MLRO setup1,020

Registration on the goAML portal itself is free. The fee above is our charge for preparing and completing it, and matches the schedule published on our tax page.

Government charges are separate and are paid to the authority, not to us.

07
FAQ

Common Questions.

If you act as a formation agent, or provide a registered office, business address, correspondence address or administrative address for a company, then yes. Cabinet Resolution 134 of 2025, Article 3, makes company and trust service providers a DNFBP category, and providing a client address is one of the listed triggers. Your own firm must be registered on goAML with its own compliance officer. You are not simply an adviser to DNFBPs. You are one.
Registration is free. That is why the penalty for skipping it is the story. Operating without the required licence, registration or enrolment carries imprisonment and a fine of AED 200,000 to AED 10,000,000 under Article 32 of Federal Decree-Law 10 of 2025, and your supervisory authority can suspend or revoke your licence separately under Article 17.
Yes. Article 17 allows the supervisory authority to suspend or restrict the activity or profession, and to revoke the licence outright. The Ministry of Economy has suspended the operations of 50 DNFBP establishments for three months at a stroke purely for failing to register on goAML, with suspension continuing until they registered and stronger penalties available after that. The authority may also publish the penalty in the media.
Article 22 requires a compliance officer at management level with independence in decision-making and appropriate competence and experience. The role carries five duties: monitor transactions, examine and assess suspicious transaction data and decide whether to notify the FIU or retain the matter stating the reasons, review internal systems and report periodically direct to senior management, develop and document ongoing training, and cooperate with the supervisory authority and the FIU.
Not immediately. A reported high-risk-country transaction or activity may only be executed three working days after it is reported to the FIU, and only if the FIU has not objected within that period. Tell the client before they commit to the deal, not after.
Only narrowly. Article 18(2) disapplies the reporting duty for lawyers, notaries, other legal professionals and independent legal auditors where the information was obtained under circumstances subjecting them to professional secrecy. It protects privileged advice. It does not protect transactional work done for a client under Article 3(4).

Get registered
before you are told to

We handle SACM pre-registration, the goAML organisation filing, your MLRO appointment and the annual Ministry questionnaire.

Ask a consultant 💬 WhatsApp Us
✅ 500+ Clients Served
🏢 UAE Licensed Since 2020
📞 Free 30-Min Consultation
🏦 12+ Bank Assistance
Talk to a consultant

Not sure whether you are a DNFBP?

Send us your trade licence and activity list, and we will tell you plainly whether you must register and what is already overdue.

Tell us your situation and a consultant replies with what actually applies to you, what it costs and what we need from you to start.

We reply on WhatsApp, usually within the hour on working days. Your details go to our consultants only — never to a third party.