AML Compliance and goAML Registration in the UAE

A designated non-financial business or profession (DNFBP) is a business outside banking and insurance that the AML law treats as a gatekeeper, because its services can be misused to move or disguise illicit money. Article 3 of Cabinet Resolution No. 134 of 2025, the Executive Regulations of the new AML law, lists the DNFBP activities. The obligations are triggered by the activity you carry out, not by the name on your licence, so a company can fall inside the regime for only part of its business.

The list also covers commercial gaming operators, and supervisors can add further businesses or professions. MoET is the supervisory body for DNFBPs licensed by mainland registrars and commercial free zones. Businesses licensed in a financial free zone fall under their own regulator, such as the DFSA in DIFC or the FSRA in ADGM, and the supervisory body selected on goAML must reflect that.

If you are not sure whether your activity is caught, that is the first question we answer, in writing, before any registration work starts.

Guides that still quote Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 are out of date. Both have been repealed and replaced.

The changes that matter most to DNFBPs:

• Tax evasion is a predicate offence. The law’s definition of a predicate offence now expressly includes evasion of direct and indirect taxes. Corporate tax and VAT behaviour therefore belongs in your customer risk thinking, and keeping your own corporate tax compliance in order is part of the same picture.
• Proliferation financing sits alongside money laundering and terrorist financing throughout the law, including the duty to apply targeted financial sanctions.
• Administrative penalties (Article 17). A supervisor can issue a warning; impose a fine of AED 10,000 to AED 5,000,000 for each violation; bar the business from the sector; restrict the powers of, suspend or require the replacement of responsible managers; suspend or restrict the activity; or revoke the licence. It can also require periodic reports on how a violation is being fixed. A repeat of the same violation within one year can attract an incremental fine, and penalties can be published.
• Criminal fines for companies (Article 27). Where a company’s representatives, directors or agents commit money laundering, terrorist financing or proliferation financing on its behalf, the fine is AED 5,000,000 to AED 100,000,000, or the value of the criminal property if that is greater.

MoET has also previously suspended the operations of DNFBP establishments that failed to register on goAML, so not registering is an enforcement risk in itself.

goAML is the UAE Financial Intelligence Unit’s (UAEFIU) electronic reporting platform. Since 27 June 2019, reporting entities have been required to file suspicious transaction reports and other reports through it, and a business must be registered before it can file. Access runs in two stages: a secure gateway called SACM, then the goAML organisation registration itself. The steps below follow the UAEFIU’s published registration guides.

1. SACM pre-registration. The person who will register, normally your compliance officer, submits an expression of intent through the registration link on the UAEFIU’s SACM portal. The form asks for the entity name as licensed, the supervisory body, the trade licence number, the person’s Emirates ID, an operational email address and a UAE mobile number, with the licence, Emirates ID and any documents your supervisor asks for attached as a PDF. The request is confirmed through a verification email.
2. Supervisor review. Your supervisory body, MoET for most mainland and commercial free zone DNFBPs, approves or rejects the request.
3. Secret key and authenticator. Once approved, the officer secures a personal secret key using a link and one-time password sent by email and SMS, and links it to the Google Authenticator app, which then generates the codes used to log in. Each user secures their own key; keys cannot be shared within an organisation.
4. Register a new organisation. On goAML, select Reporting Entity as the registration type and the organisation type that matches your licensed activity and supervisor. Enter the licence number, business activity, addresses, phone numbers and a group email address that authorised staff can access.
5. Registering person. Add the compliance officer’s details, including Emirates ID and passport numbers, entered without spaces or hyphens, and an official business email. The UAEFIU guide rules out Gmail, Hotmail and Yahoo accounts for this field.
6. Attachments and submission. Upload the supporting documents, complete the captcha and submit. The system issues a registration reference number for any follow-up with the supervisor or the goAML support team.
7. Approval. The supervisory body or the FIU reviews the request and approves or rejects it, and the outcome is notified by email. The registering person becomes the organisation’s admin user and can then approve colleagues’ user requests.

Neither the UAEFIU nor MoET publishes a fixed approval time, so we do not promise one. What we control is helping you submit a complete, consistent application the first time.

Documents required for goAML registration

For entities supervised by MoET or the Ministry of Justice, the UAEFIU’s SACM and goAML guide lists these attachments:

Entities supervised by the DFSA, the FSRA or the Central Bank have different attachment lists.

Where registrations usually stall

• A personal webmail address used for the registering person.
• An organisation type or business activity that does not match the trade licence.
• An expired licence, or unclear scans of identity documents.
• A registering person who is not the appointed compliance officer, or has no authorisation letter.

Registration gives you a channel to report. Inspections test whether the programme behind it works. Article 19 of Federal Decree-Law No. 10 of 2025 and the Executive Regulations set out the core duties every DNFBP must meet.

What an AML risk assessment covers

The business-wide risk assessment is the document everything else hangs from. It describes who your customers are, where they and their money come from, which services and payment methods you offer, and how customers reach you, then rates each factor and records the controls that bring the risk down. A gold trader taking cash from walk-in customers and a broker selling off-plan units to overseas companies will reach very different conclusions, and the inspector will expect yours to read as specific to you.

What an AML policy should include

• Governance: who owns AML, the compliance officer’s role and how senior management approves the policy.
• Customer due diligence, including simplified and enhanced measures and when each applies.
• Sanctions screening and what staff do on a possible match.
• Internal escalation and suspicious transaction reporting.
• Staff screening, training and record keeping.
• Review frequency and independent testing.

Your own beneficial ownership information

Separately from customer checks, Article 38 of Cabinet Resolution No. 134 of 2025 requires companies to hold their own beneficial owner information and shareholder register data, update it within 15 working days of any change, and cooperate when a bank or DNFBP asks for it. Those records must be kept for at least five years after the company is dissolved. We check this as part of every engagement.

Each engagement is scoped and quoted in writing before work starts. A typical sequence:

1. Scoping. We confirm whether and where your activities fall under the DNFBP rules, and which supervisor applies.
2. Gap review. If you already have documents, we test them against Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 and list what is missing. Policies written under the 2018 law usually need updating.
3. goAML registration. We prepare the documents and guide your compliance officer through SACM and the goAML forms until the account is active.
4. Programme build. Risk assessment, policy and procedures, KYC forms, screening routine and STR escalation process.
5. Training. A session for the compliance officer and front-line staff, using examples from your own sector.
6. Ongoing support. Periodic reviews, updates when the rules change and help preparing for a supervisory inspection. For a wider controls review, see our internal audit services.

We work alongside the compliance officer you appoint; the decision to report and the accountability stay with your business, as the law intends. To discuss scope, contact our team.