TRW & Co · AML, sanctions and investigations
goAML Registration and Suspicious Transaction Reporting in the UAE
goAML registration UAE rules require every financial institution, DNFBP and virtual asset service provider to register with the Financial Intelligence Unit and report through its platform. Registration is free and takes two stages. The real risks lie in late registration, wrong report types, slow suspicious transaction reports and staff who tip off customers.
Key pointRegistration is not triggered by a suspicion: supervisors expect you to be registered, with at least two working users, from the day you are licensed, because a report you cannot file on time is a breach in itself.
At a glance
Who must register
All financial institutions, DNFBPs such as brokers, jewellers, accountants and corporate service providers, and virtual asset service providers, onshore, in free zones and in DIFC and ADGM.
Two-stage process
Pre-registration on the FIU services portal, then full registration on the Central Bank services platform with two-factor authentication, led by the compliance officer or MLRO.
Many report types
Besides STRs and SARs, goAML handles precious metals and real estate threshold reports, partial name match and funds freeze reports, and high-risk country reports.
Report without delay
Under the 2025 AML law, suspicious transaction reports go exclusively to the FIU, immediately once suspicion is formed and regardless of the amount involved.
Tipping off is criminal
Disclosing that a report has been filed or an investigation is under way is an offence, and fines for tipping off are no longer subject to a fixed cap.
Swipe or scroll →
The short answer on goAML registration UAE rules
goAML registration UAE rules are straightforward in principle: every financial institution, designated non-financial business or profession (DNFBP) and virtual asset service provider must register on goAML, the reporting platform of the UAE Financial Intelligence Unit (FIU), and use it to file suspicious transaction reports and other mandatory reports. Registration is free, done in two stages by your compliance officer, and should be complete before you ever need to file.
The harder questions are practical. Who in the business should be the registered administrator? Which supervisory body do you select? Which report type fits which situation, and how fast must it be filed? And how do you investigate a suspicion without tipping off the customer? This guide answers each, with the differences between onshore, free zone and DIFC/ADGM firms.
As of October 2026, reporting sits under Federal Decree-Law No. 10 of 2025, which took effect on 14 October 2025, and its executive regulation, Cabinet Resolution No. 134 of 2025. The new law confirms that suspicious transaction reports go exclusively to the FIU and strengthens the FIU's powers to suspend transactions and freeze funds.
Who must complete goAML registration in the UAE
Registration follows the definition of "reporting entity" in the federal AML framework. In practice, that means:
- Financial institutions licensed by the Central Bank or the capital markets regulator, including banks, finance companies, exchange houses, payment firms, insurers and brokers.
- DNFBPs, including real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and lawyers and notaries when they carry out specified transactions. Commercial gaming operators were formally brought within the DNFBP category under the 2025 regulation.
- Virtual asset service providers, whether licensed by VARA in Dubai, by the federal capital markets regulator, or in the DIFC or ADGM.
Two misconceptions cause most late goAML registration UAE problems. First, registration is not triggered by having a suspicion: supervisors expect registration as soon as you are licensed for a covered activity. Second, a free zone licence does not take you outside the system. Commercial free zone DNFBPs register with the Ministry of Economy as their supervisor, and firms in the DIFC and ADGM register with the DFSA or ADGM respectively. For a sector-by-sector view of who counts as a DNFBP, see our guide to AML obligations for DNFBPs.
How goAML registration works, step by step
The Ministry of Economy publishes technical instructions for goAML registration for the businesses it supervises, and the ADGM has issued a similar guide. The process has two stages and should be done by the person who will own reporting.
- Choose the nominated person. This should be your compliance officer or money laundering reporting officer (MLRO). If you have not yet appointed one, a managing director, head of operations or chief financial officer may register, but appoint a qualified officer quickly.
- Prepare one combined PDF. The Ministry asks for a single file under 5 MB containing a signed and dated authorisation letter naming the nominated person as administrator, plus their passport, UAE residence visa and Emirates ID, and the company's trade licence.
- Complete pre-registration. On the FIU services portal, register as a reporting organisation, select your supervisory body, enter your licence number, choose the correct organisation type and upload the PDF. Verify your email and enter the one-time password sent by email and SMS.
- Complete full registration. Using the credentials issued after pre-registration, complete the second stage on the Central Bank services platform, again selecting your supervisor, and set up two-factor authentication through an authenticator app.
- Watch for FIU correspondence. Check inbox and junk folders. If the second stage is rejected, resubmit only that stage; you do not need to repeat pre-registration.
- Add users and a deputy. Once approved, the administrator can approve additional users, such as a deputy MLRO, using the organisation ID. Each email address and mobile number can be used for only one registration.
- Record and test. Keep the registration confirmation in your compliance file, confirm that at least two people can log in, and test the workflow before you need it.
Selecting the wrong supervisory body or organisation type during goAML registration UAE submissions is one of the most common reasons for rejection. A precious metals dealer in a commercial free zone selects the Ministry of Economy; a DFSA-registered DNFBP selects the DFSA; an ADGM firm selects ADGM. If your group has entities in more than one place, each entity registers separately with its own supervisor.
goAML report types and filing deadlines
goAML is used for more than suspicious transaction reports. Supervisors have set out a range of report types, each with its own trigger. The table below follows the categories described in ADGM's 2025 notice on goAML obligations; onshore supervisors use the same platform and broadly the same categories, but always check your own supervisor's current guidance.
| Report | When it is used | Timing |
|---|---|---|
| STR (suspicious transaction report) | A transaction, executed or attempted, suspected of links to money laundering, terrorist financing or other crime | As soon as practicable and without delay once suspicion is formed |
| SAR (suspicious activity report) | Suspicious activity or behaviour not tied to a specific transaction | As for STRs |
| DPMSR (dealers in precious metals and stones report) | Cash or wire transactions of AED 55,000 or more by precious metals and stones dealers | Within two weeks of the transaction |
| REAR (real estate activity report) | Property transactions involving cash of AED 55,000 or more, virtual assets, or third-party funds | Per transaction |
| PNMR (partial name match report) | A potential match to the UAE Local Terrorist List or UN Consolidated List, with the relationship suspended | Within 24 hours of identifying the match |
| FFR (funds freeze report) | Funds frozen following a confirmed sanctions match | Freeze within 24 hours; report within five days of freezing |
| HRC / HRCA (high-risk country reports) | Transactions or activity involving designated high-risk jurisdictions | Before execution, with a waiting period for any FIU objection |
Sanctions-related reports overlap with targeted financial sanctions obligations; our guide to targeted financial sanctions and screening explains how freezing and notification fit together.
How to file a good suspicious transaction report
The 2025 law requires reports immediately and regardless of the amount involved. "Immediately" runs from the point at which suspicion is formed, not from the end of a lengthy internal investigation. Firms therefore need a short, disciplined escalation route.
Internal escalation
Front-line staff escalate unusual activity to the MLRO through a confidential internal report. The MLRO reviews available information, may make discreet enquiries using existing records, and decides whether there are grounds for suspicion. Both the decision to report and the decision not to report should be documented with reasons. A long queue of unreviewed alerts is itself a compliance failure.
What a useful report contains
The FIU can only act on what you give it. Strong reports identify the parties and their roles, describe the transactions with dates, amounts and accounts, explain clearly why the activity is suspicious (by reference to the customer's profile and known typologies), and attach supporting documents. Vague narratives such as "unusual activity" or copied alert text add little and invite follow-up requests.
After filing
The FIU may request further information, and its head can suspend a transaction for up to ten days or freeze funds for up to 30 days, with extensions through the Public Prosecution. Firms must follow those instructions and keep the case confidential. Whether to continue the relationship is a separate risk decision for the firm, taken with care to avoid tipping off.
Tipping-off risk: where firms go wrong
It is a criminal offence to disclose, directly or indirectly, that a report has been or will be filed, or that an investigation is under way. Under the 2025 law, fines for tipping off are no longer capped at a fixed maximum. Tipping-off risk is highest not in the compliance team but in relationship managers, sales staff and customer service.
Explaining delays to the customer
A customer asks why a transfer has not gone through. Telling them it is "with compliance because it looks suspicious" or "being reviewed by the FIU" can amount to tipping off. Firms need neutral, pre-approved wording and a rule that staff dealing with a flagged customer consult the MLRO before saying anything beyond routine processing language.
Asking questions after a report has been filed
Requests for source-of-funds documents are normal due diligence. But a sudden, pointed interrogation after a report, or one that refers to concerns raised by authorities, can alert the customer. Coordinate any post-report information requests with the MLRO and frame them within your ordinary periodic review process.
Exiting the relationship
Closing an account straight after filing can signal the report. Exit decisions should follow your normal risk procedures, be timed with any FIU instruction in mind, and use standard termination wording. Where the FIU has suspended or frozen funds, follow its directions before acting.
Sharing within a group or with advisers
Information may be shared within a group for AML purposes and with legal advisers, but disclosures to business partners, introducers or the customer's other advisers can breach confidentiality. Agree internal protocols for who may know about a report, and keep case files restricted.
Keeping goAML registration UAE details current
Registration is not a one-off event. Supervisors review whether reporting entities can actually report, and an inactive account or a departed administrator is a frequent inspection finding. Treat goAML registration UAE maintenance as part of the compliance calendar, alongside the annual risk assessment and training cycle.
When the compliance officer changes
When the MLRO resigns or is replaced, update the administrator promptly through the process your supervisor specifies, using a fresh authorisation letter and the new officer's identity documents. Do not share log-in credentials or authenticator devices between individuals: access is personal, and shared access undermines both confidentiality and the audit trail of who filed what.
When the licence or business changes
A new trade licence number, a change of legal form, a move between free zones or the onshore market, or a new regulated activity may affect your organisation profile or even your supervisory body. Check the goAML profile whenever corporate details change, and confirm with the supervisor whether a fresh registration is needed for a new entity rather than an update to an existing one.
Periodic access checks
A simple quarterly check, in which each user logs in, confirms that authenticator access works and reviews pending FIU messages, prevents most lock-outs. Record the check in the compliance monitoring plan so that you can evidence it at inspection, and escalate any access problem to the FIU's technical support channel well before a filing is due.
Illustrative scenario: a real estate brokerage
This scenario is illustrative only and does not describe any real client.
A mainland Dubai brokerage completed goAML registration UAE-wide steps when it was licensed but its MLRO has since left, and nobody else has access. A buyer proposes to pay part of the price for an apartment in cash and part from a virtual asset wallet held by a relative.
The transaction triggers a real estate activity report because it involves cash at or above the reporting threshold, virtual assets and third-party funds. The buyer's explanations of the source of the virtual assets are inconsistent, so the brokerage also considers a suspicious transaction report. The immediate problem is access: without an active user, nothing can be filed.
The fix is to appoint a new compliance officer, update the goAML administrator through the supervisor's process, file the activity report, document the suspicion analysis and file an STR if suspicion is confirmed. Throughout, the agent dealing with the buyer is told only to proceed with standard document requests. The brokerage then adds a deputy user so it is never locked out again. Our real estate regulation page covers the wider brokerage regime.
DIFC, ADGM and cross-border points
Firms in the DIFC and ADGM report to the same FIU through goAML, selecting their own regulator as supervisory body, and must comply with their regulator's AML rules as well. ADGM, for example, asks firms to notify its financial crime team when an STR or SAR is filed and requires report records to be retained for six years.
Cross-border groups often ask whether a report filed elsewhere covers the UAE. It does not: a suspicion connected with UAE business must be reported to the UAE FIU, even if the group has reported in the UK, Singapore or another jurisdiction. Equally, information from a UAE report should only be shared within a group for AML purposes and in line with UAE confidentiality rules. Where a report leads to a freezing order or investigation, our white-collar crime and investigations team coordinates with locally licensed advocates where court representation is needed.
What to do next: a goAML registration UAE checklist
- Confirm every licensed UAE entity has completed both registration stages with the correct supervisor.
- Make sure at least two named users (MLRO and deputy) have working access and authenticator set-up.
- Map which report types apply to your business, including DPMSR, REAR and sanctions reports.
- Write an escalation procedure with decision logs for both reports and non-reports.
- Train customer-facing staff on tipping off and give them approved wording.
- Store report records for at least the federal five-year minimum or any longer rulebook period.
- Review the programme against the 2025 UAE AML law and your supervisor's latest notices.
TRW & Co helps businesses register, design reporting procedures and train staff through our AML compliance practice. To discuss a reporting question, contact our Dubai team.
Frequently asked questions
01Is goAML registration mandatory in the UAE?
Yes, for all reporting entities: financial institutions, DNFBPs and virtual asset service providers. Supervisors expect registration once a business is licensed for a covered activity, not only when it has something to report. Failure to register can lead to administrative sanctions, and it leaves the business unable to meet its reporting duties if a suspicion arises. Each licensed entity in a group registers separately, selecting its own supervisory body.
02How long does goAML registration take?
There is no published statutory timeframe. Pre-registration can be completed in one sitting if documents are ready, and the one-time password issued afterwards is valid for 24 hours. Full registration then depends on the FIU reviewing the submission. Delays usually come from incomplete PDFs, the wrong supervisory body or organisation type, or emails going to junk folders, so prepare everything in advance and monitor correspondence closely.
03Who should be the goAML administrator?
The nominated person should be the compliance officer or MLRO, because they own suspicious transaction reporting. If no compliance officer has been appointed yet, a managing director, head of operations or CFO may register, but the business should appoint a qualified officer promptly. Add a deputy as a second user so reports can be filed if the main officer is absent or leaves.
04What is the deadline for filing an STR in the UAE?
There is no fixed number of days. The law requires suspicious transaction reports to be filed immediately and without delay once suspicion is formed, regardless of the amount. Supervisors interpret this as soon as practicable after the MLRO concludes there are grounds for suspicion. Internal reviews should therefore be prompt and documented; leaving alerts unreviewed for weeks is likely to be treated as a breach.
05What happens after I file an STR?
The FIU analyses the report and may ask for more information. Its head can suspend a transaction for up to ten days or freeze funds for up to 30 days, with extensions through the Public Prosecution. You must follow any instruction and keep the matter confidential. The FIU may share intelligence with law enforcement, but the report itself is not a criminal complaint against the customer.
06Do DIFC and ADGM firms use goAML?
Yes. Firms and DNFBPs in both financial free zones register on goAML and file reports with the UAE FIU, selecting the DFSA or ADGM as their supervisory body. They must also follow their regulator's AML rules, which can add steps; ADGM, for example, asks firms to notify its financial crime team when a suspicious report is filed and keep report records for six years.
Sources and official materials
- UAE Financial Intelligence Unit — The FIU and its role in receiving suspicious transaction reports
- Ministry of Economy: goAML registration technical instructions — Two-stage registration steps and document requirements
- ADGM FCCP Notice 84 of 2025 on AML, TFS and goAML obligations — Report types, timelines and tipping-off reminder for ADGM firms
- Federal Decree-Law No. (10) of 2025 — The 2025 federal AML/CFT/CPF law
- DFSA DNFBP registration service — Registration of DNFBPs with the DFSA in the DIFC
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
