goAML Portal Registration & Reporting Assistance

goAML is the online platform operated by the UAE's Financial Intelligence Unit (FIU), which sits within the UAE Central Bank, for receiving Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other statutory AML/CFT disclosures from regulated entities. It is the single national channel through which Financial Institutions and Designated Non-Financial Businesses and Professions (DNFBPs) meet their reporting obligations under Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions.

Registration is mandatory for every entity that falls within the DNFBP or Financial Institution definition, regardless of whether it has ever identified a suspicious transaction. The obligation attaches the moment the entity's activity brings it into scope — it is a standing registration requirement, not something triggered only by an actual suspicious event.

The AML/CFT Law and its Cabinet Decisions define specific DNFBP categories: real estate brokers and agents, dealers in precious metals and stones (above prescribed thresholds), independent legal professionals and notaries carrying out specified transactions, auditors and accountants providing specified services, and corporate/trust service providers. Whether a specific business falls into one of these categories depends on the actual services it provides, not the wording of its trade licence.

No. Supervisory authorities look at the substance of the services actually rendered, not just the licence activity description. A company registered under a general business consultancy licence that, in practice, forms companies for clients or manages client funds can still fall within the DNFBP definition regardless of how the licence is worded.

goAML registration happens in two linked stages: first, the entity itself is registered as an organisation on the platform; second, the individual designated as Compliance Officer (or MLRO) is registered and given filing authority linked to that organisation profile. An entity that has only completed the organisation-level registration cannot yet file reports — the Compliance Officer's activation is a separate and necessary step.

The nominee should be sufficiently senior and empowered within the organisation to act independently — able to escalate concerns, request further information from business units, and where necessary pause a transaction pending review, without needing case-by-case sign-off from someone whose interests might conflict with reporting. A junior staff member with no real authority, nominated only to satisfy the registration requirement, is a recognised inspection red flag.

A Suspicious Transaction Report (STR) is filed when there are reasonable grounds to suspect that funds involved in a specific transaction are, in whole or part, the proceeds of a crime or connected to money laundering. A Suspicious Activity Report (SAR) is broader and can relate to suspicious activity or patterns connected to underlying criminal conduct, including terrorist financing, even where a single discrete transaction is not the trigger. Both are filed through goAML and both carry the same 'without delay' filing expectation once suspicion arises.

The AML/CFT Law requires reporting entities to file an STR or SAR promptly once reasonable suspicion arises — it does not permit a business to sit on a suspicion while it conducts its own extended internal investigation, waits to see how the transaction plays out, or delays until a supervisory inspection prompts disclosure. Internal escalation and review should happen quickly, with the report filed as soon as the suspicion is reasonably formed.

Failure to register when in scope is itself a compliance breach under the AML/CFT Law and its Cabinet Decision on administrative penalties (Cabinet Decision No. 10 of 2019, as amended). Supervisory authorities — principally the Ministry of Economy for most DNFBPs — can impose administrative penalties for non-registration, independent of whether any actual suspicious transaction has occurred. The specific penalty amount and any additional licence-related consequences depend on the nature and duration of the non-compliance and are determined by the relevant authority.

Yes. The AML/CFT Law prohibits disclosing to a customer, or to any third party, that an STR or SAR has been filed or that an AML-related investigation is underway, where that disclosure could prejudice an investigation. This 'tipping off' prohibition applies to the Compliance Officer and to any staff member aware of the filing.

The organisation and Compliance Officer registration submissions themselves can typically be prepared and filed within days once documentation is in order. The FIU's own review and approval timeline is not within the applicant's control and can vary. Building the surrounding AML/CFT programme — risk assessment, policies, CDD procedures, training — in parallel typically takes several weeks depending on the complexity of the business.

DNFBP and AML/CFT obligations, including goAML registration, apply based on the nature of the licensed activity, not on whether the entity is set up on the UAE mainland or in a free zone. A free zone company genuinely carrying out a DNFBP activity — corporate services, real estate brokerage where permitted, precious metals dealing — falls within scope in the same way a mainland entity would, subject to the relevant free zone's own supervisory arrangements where applicable (for example, DIFC-licensed entities are supervised by the DFSA and ADGM-licensed entities by the FSRA for AML purposes).

Basic KYC (Know Your Customer) is typically limited to identifying who the customer is — name, ID, address. CDD under the AML/CFT Law goes further: it requires identifying and verifying beneficial ownership behind corporate customers, understanding the purpose and intended nature of the business relationship, and — for higher-risk customers — understanding the source of funds or source of wealth, with ongoing monitoring of the relationship over time rather than a one-time check at onboarding.

EDD is a heightened level of due diligence applied to higher-risk customers or transactions — for example, Politically Exposed Persons (PEPs), customers or counterparties connected to high-risk jurisdictions, complex or unusually large transactions with no clear economic rationale, or relationships involving significant cash. EDD typically requires additional verification of source of funds and wealth, senior management approval to onboard or continue the relationship, and more frequent ongoing monitoring.

A Politically Exposed Person (PEP) is an individual who holds, or has held, a prominent public function — a head of state, senior government official, senior judiciary or military official, senior executive of a state-owned enterprise, or senior political party official — along with their immediate family members and close associates. PEPs are treated as inherently higher-risk under AML/CFT frameworks worldwide because of the potential for corruption-linked proceeds, and relationships with PEPs typically require EDD and senior management approval.

At minimum, UAE entities are expected to screen against the UN Security Council Consolidated Sanctions List and the UAE's own local terrorist and sanctions lists maintained under the AML/CFT framework. Depending on the entity's international dealings, screening against other major international sanctions regimes (such as those of the EU, UK, or US where relevant to cross-border transactions) may also form part of a properly risk-calibrated programme.

The risk assessment should be treated as a living document — reviewed at least annually, and refreshed sooner if there is a material change in the business (new products or services, new customer segments, new geographies, significant growth in transaction volumes, or a relevant regulatory update). An assessment prepared once at registration and never revisited quickly becomes disconnected from what the business actually does.

PNPC advises on, trains, and supports the Compliance Officer function, and can assist in preparing the individual for the role, but the statutory Compliance Officer/MLRO role must be held by a suitably senior individual within the regulated entity itself who can be held accountable under the AML/CFT Law. We do not take on the statutory role as an external party, since the position requires day-to-day authority within the business that an outside adviser cannot exercise.

The AML/CFT Law and its regulations require reporting entities to retain CDD records, transaction records, and records of any internal analysis or reports filed for a prescribed minimum retention period following the end of the business relationship or the date of the transaction, whichever is applicable. The exact retention period should be confirmed against the current regulations and any supervisory authority guidance applicable to the entity's specific DNFBP category.

The AML/CFT Law recognises certain carve-outs for independent legal professionals in specific circumstances connected to privileged legal advice, but these carve-outs are narrow and fact-specific — they do not exempt a lawyer from DNFBP reporting obligations when acting in a transactional capacity (company formation, real estate conveyancing, managing client funds) rather than providing pure legal advice or litigation representation. Legal professionals in scope should seek specific guidance on how privilege interacts with their reporting duty for particular engagements.

Beneficial ownership refers to identifying the natural person(s) who ultimately own or control an entity, even where legal ownership sits behind layers of corporate shareholding, trusts, or nominee arrangements. AML/CFT compliance — and UAE beneficial ownership regulations more broadly — require entities to look through the legal structure to identify and verify the real individuals in control, because obscured beneficial ownership is a recognised money-laundering technique.

They are related in that both sit within the UAE's broader regulatory compliance landscape, but they are separate obligations administered by different authorities. ESR, administered under Ministry of Finance guidance, previously required certain UAE entities carrying out defined 'Relevant Activities' to file annual notifications and substance reports — however, the ESR notification and report filing requirement was discontinued for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024, so ESR is no longer a live ongoing filing obligation for most current financial years (earlier-year filings and any related historical assessments may still be relevant). goAML/AML compliance, by contrast, is a live, ongoing obligation under the AML/CFT Law aimed at money-laundering and terrorist-financing detection, with no equivalent discontinuation. A business should confirm current status on each regime separately rather than assuming one still tracks the other.

The FIU, housed within the UAE Central Bank, operates the goAML platform and receives, analyses, and disseminates STRs/SARs. The Ministry of Economy is the primary supervisory authority for most DNFBP categories — it conducts inspections, issues guidance, and enforces administrative penalties for DNFBP non-compliance. Financial institutions are separately supervised by the Central Bank or the relevant financial free zone regulator (DFSA in DIFC, FSRA in ADGM) for prudential and AML purposes.

Inspections can be scheduled as part of a routine supervisory cycle, triggered by risk-based selection of higher-risk DNFBP categories, prompted by a specific complaint or referral, or connected to a broader sectoral sweep. A business should not assume inspection risk is low simply because it has not been inspected before — the supervisory programme has expanded its coverage over time as the UAE's AML/CFT framework has matured.

A typical engagement covers: DNFBP/Financial Institution applicability assessment; goAML organisation and Compliance Officer registration; a written, entity-specific AML/CFT risk assessment; board-approved AML/CFT policies and procedures covering CDD, EDD, sanctions/PEP screening, and record-keeping; staff training with documented records; support setting up sanctions/PEP screening; and ongoing advisory including STR/SAR filing assistance when a reporting trigger arises. Engagements can be scoped as a one-time registration-and-setup project or as an ongoing retainer.

PNPC agrees a fixed, written fee for the registration and programme-build engagement before work begins, scoped to the complexity of the business — a single-office corporate service provider and a multi-branch real estate brokerage require materially different depth of work. Ongoing retainer pricing for periodic risk assessment refresh, training, and reporting support is quoted separately and is also fixed and agreed in writing.

Registering an organisation profile on goAML is mechanically straightforward once the applicability question is answered correctly — the harder and higher-stakes work is everything around it: confirming whether you are actually in scope, nominating a Compliance Officer with real authority, building a risk assessment that reflects your actual business rather than a generic template, and having a firm on call when an actual suspicious transaction arises and the 'without delay' clock starts running. A self-filed registration with no programme behind it is the pattern we most often see corrected after an inspection finding.

We work with the Compliance Officer to document the specific facts giving rise to suspicion, confirm the internal escalation trail is properly recorded, prepare the STR/SAR content for accuracy and completeness, and support submission through goAML without unnecessary delay. We also advise on the tipping-off restriction throughout the process so the customer-facing team does not inadvertently disclose the filing.

The AML/CFT Law's registration and reporting obligations apply regardless of entity size, but the depth and formality of the surrounding programme can reasonably scale to the size and complexity of the business — a sole practitioner's risk assessment and policy documentation will look different from a 50-person brokerage's, while still covering the same substantive requirements: risk assessment, CDD/EDD procedures, a designated Compliance Officer, and reporting readiness.

There is generally no penalty for having registered proactively even where, on closer review, the entity's activities do not squarely meet the DNFBP definition — registering when uncertain is the lower-risk choice compared to remaining unregistered while genuinely in scope. PNPC can revisit the applicability assessment and advise on whether continued registration, deregistration, or simply maintaining a dormant but compliant registration is the sensible path.

A global group AML policy is a useful starting point but rarely satisfies UAE requirements on its own — it needs to be localised to reference the specific UAE AML/CFT Law provisions, the goAML reporting channel, the UAE Compliance Officer's specific authority and contact registration, and any UAE-specific risk factors (local sanctions lists, local high-risk activity thresholds) that a global template will not capture.

For clients with operations spanning India and the UAE, our Dubai team leads the UAE AML/CFT and goAML engagement directly, while our India offices support any parallel India-side compliance (such as FEMA reporting or Indian AML obligations for cross-border structures) under the same coordinated engagement — so a group with entities in both jurisdictions is not explaining its business twice to two unconnected advisers.

The organisation's goAML registration itself does not automatically lapse, but the entity must promptly update the registered Compliance Officer details on the platform when there is a change in the role holder, and ensure the new nominee is properly registered and activated before there is any gap in filing capability. Continuing to operate with an outdated or departed Compliance Officer on record is itself a governance gap that inspection will identify.

The AML/CFT framework sets a designated cash-transaction threshold above which dealers in precious metals and stones fall within DNFBP scope for a given transaction or series of connected transactions, as prescribed by the Ministry of Economy. Because threshold figures are set by regulation and can be updated, PNPC confirms the current applicable threshold against the latest Ministry of Economy guidance at the time of the applicability assessment rather than relying on a fixed number that may have changed.

A properly implemented AML/CFT programme — registration, risk-based CDD/EDD, monitoring, and timely reporting when suspicion arises — is the standard against which a business's conduct is judged. It does not guarantee that criminal activity will never occur through the business, but a business that can demonstrate it followed its documented programme in good faith is in a materially different position, from a regulatory and reputational standpoint, than one that had no programme or ignored red flags.

No. goAML registration only opens the reporting channel — it gives the organisation and its Compliance Officer the ability to file STRs and SARs. It says nothing about whether the entity has a documented risk assessment, board-approved policies, CDD/EDD procedures, sanctions/PEP screening, or trained staff behind it. Supervisory authorities inspect the substance of the AML/CFT programme, not just whether the portal profile exists.

A template can be a useful starting reference, but it must be adapted to the entity's actual customers, products, geography, delivery channels, and transaction patterns before it functions as a real policy. A policy that describes a generic business rather than the one operating under it is a recognised, recurring inspection finding — supervisory authorities test whether the document matches reality, not whether a document exists.

Yes. A common engagement is a goAML registration health check: confirming the organisation profile and Compliance Officer registration are both complete and active, that registered details match the current trade licence and ownership structure, and that a documented risk assessment and policy set exist behind the registration. Gaps are common even where the portal itself shows as registered.

FIU queries usually arise from inconsistencies between the goAML organisation profile and the entity's trade licence, ownership records, or activity description. PNPC reviews the specific query, reconciles the underlying records, and resubmits a corrected, internally consistent application rather than resubmitting the same data and expecting a different outcome.

Yes. The registration obligation attaches the moment an entity's actual activity falls within the DNFBP or Financial Institution definition, regardless of whether it has ever identified a suspicious transaction. An AML/CFT programme with no filings to date is not evidence of exemption from the obligation — it may simply mean no reporting trigger has yet arisen.

The AML/CFT Law requires a specific, sufficiently senior Compliance Officer/MLRO with real authority to escalate concerns and pause transactions where needed. PNPC works with management to identify a nominee who genuinely holds that authority within the existing organisation chart, rather than assigning the role to whoever is administratively convenient.

Alongside the broader CDD/risk-assessment file, keep the goAML organisation and Compliance Officer registration confirmations, any FIU correspondence or queries and their resolutions, the internal escalation log showing how and when suspicion was raised before any STR/SAR filing, and confirmation of Compliance Officer succession whenever the role changes hands.

No. PNPC can materially improve the completeness and defensibility of the registration and the programme behind it, but penalty decisions rest with the supervisory authority and depend on the specific facts, the history of the entity's compliance, and the authority's own discretion. We do not promise a regulatory outcome we do not control.

PNPC tracks Cabinet Decisions, Ministry of Economy circulars, and FIU guidance updates affecting DNFBP registration and reporting obligations, and reflects relevant changes in client risk assessments and policy manuals as part of the ongoing retainer rather than waiting for the next inspection to prompt a review.

Close-out includes confirmed organisation and Compliance Officer activation on goAML, the finalised risk assessment and policy manual, training records for the initial session, the sanctions/PEP screening setup, and a forward compliance calendar showing the next scheduled review, refresher training, and any pending FIU or Ministry of Economy items.

Yes. Where the entity's statutory auditor needs to confirm AML programme existence for audit purposes, or where legal counsel is separately advising on a related matter such as beneficial ownership structuring or a specific privilege question, PNPC coordinates directly with them so the client is not relaying technical detail between advisers.

Yes. Where a customer, counterparty, or beneficial owner matches a name on the UN Security Council or the UAE's local terrorist/sanctions lists, the obligation is not an STR — it is a Targeted Financial Sanctions response: the relevant funds must be frozen without delay and a Fund Freeze / Funds Awaiting Return report filed through goAML. This is triggered by a list match, not by a suspicious pattern of transactions, which is why entities that build only STR/SAR workflows sometimes miss it entirely.

Potentially yes. goAML runs a periodic re-registration / profile-confirmation cycle, and a profile that is never reviewed or confirmed can become dormant, leaving the entity technically unable to file when a report is actually needed. Compliance Officer details also drift out of date as people change roles. A registration completed years ago and never revisited should be checked for live filing access, not assumed to be current.

The AML/CFT framework expects regulated entities, proportionate to size and risk, to subject their AML programme to independent review that tests whether policies, CDD/EDD, screening, and reporting actually work in practice — not just that documents exist. Where PNPC has built or advises on the programme, independence considerations mean the review is best performed by a separate reviewer; where another party built the programme, PNPC can perform the independent AML review directly.

They are separate obligations that reinforce each other. UAE UBO regulations require most entities to identify and maintain a register of their ultimate beneficial owners with the relevant registrar, while AML/CFT CDD requires a reporting entity to look through its customers' structures to the real controllers. A corporate service provider therefore has a double exposure: its own UBO register obligation, and a CDD duty to verify the beneficial owners of every client it forms companies for.

No. The AML/CFT Law protects a reporting entity and its staff who file a report in good faith based on reasonable suspicion — the fact that the underlying transaction is later found to be legitimate does not create liability for having reported. The standard is whether there were reasonable grounds for suspicion at the time, not whether a crime was ultimately proven.

A low-cost provider typically completes the visible step — an organisation profile on the portal — and stops there. What is usually missing is the substance an inspector actually tests: a correct applicability determination, a Compliance Officer with genuine authority (and their separate activation), a risk assessment that describes your business rather than a template, calibrated CDD/EDD, live sanctions screening, and documented training. A registered-but-hollow profile is the exact pattern that fails a Ministry of Economy inspection, and rebuilding under a remediation deadline costs far more than doing it properly once.

PNPC agrees a fixed written fee before work begins, scoped to the entity's complexity — a single-office corporate service provider and a multi-branch real estate brokerage require materially different depth. A one-time build covers applicability assessment, goAML organisation and Compliance Officer registration, risk assessment, policies, CDD/EDD procedures, screening setup, and documented training; ongoing retainer pricing for periodic risk-assessment refresh, profile confirmation, training, and STR/SAR support is quoted separately. Any government or third-party charges are shown separately from professional fees.

AML/CFT obligations in the UAE are actively supervised and periodically updated through Cabinet Decisions, Ministry of Economy circulars, and FIU guidance. On a retainer, PNPC tracks these changes and reflects the relevant ones in the client's risk assessment, policies, and reporting procedures rather than waiting for an inspection to expose the drift — a policy manual written once at registration and never revisited falls out of alignment within a year or two.

No — and the two should not be conflated. ESR notification and report filing was discontinued for financial years starting on or after 1 January 2023 under Cabinet Decision No. 98 of 2024, so ESR is no longer a live annual filing obligation for current periods (only historical pre-2023 assessments may still matter). goAML/AML-CFT obligations under Federal Decree-Law No. 20 of 2018 are entirely separate, administered by a different authority, and remain fully live and ongoing — the winding-down of ESR filing has no effect on them.