goAML registration in the UAE is the first thing an inspector checks when reviewing a company’s AML status. It is mandatory for every financial institution, every virtual asset service provider (VASP) and all six categories of DNFBP: real estate agents, dealers in gold and jewellery, lawyers, independent accountants and auditors, corporate service providers and commercial gaming operators. Without registration a company cannot file suspicious transaction reports — which means it has been in breach of Federal Decree-Law No. (10) of 2025 from its first day of trading. The fine for non-registration starts at AED 50,000, and the upper limit of administrative liability under the new law is AED 5,000,000 per breach.
Dynasty Business Adviser handles goAML and SACM registration from start to finish: we confirm whether the requirement applies to you, prepare the documents, complete both registrations and hand over working access. Turnaround from 3 working days. We work with companies in Dubai, on the mainland and in every free zone in the UAE.
Check whether your company must register with goAML →
What goAML and SACM are and how they differ
goAML is the platform of the UAE Financial Intelligence Unit (FIU) through which obliged entities file their reports: suspicious transaction reports (STR), suspicious activity reports (SAR), partial name match reports (PNMR) against sanctions lists and other forms. The system was developed by the United Nations Office on Drugs and Crime and is used by financial intelligence units around the world; in the UAE it has become the single channel of communication between businesses and the FIU.
SACM (Services Access Control Manager) is the pre-registration system. Before a company can access goAML, its representative must create a SACM account, complete two-factor authentication and upload the company’s documents. Only once SACM approval is granted does goAML registration itself open.
Table 1 — goAML and SACM: the difference
| Parameter | SACM | goAML |
|---|---|---|
| Purpose | Access control and pre-registration | Filing reports with the FIU |
| Who creates the account | The company’s representative (usually the future MLRO) | The same account, once approved in SACM |
| What is uploaded | Company documents as a single PDF of up to 5 MB | Organisation data and the profile of the responsible person |
| Login security | Two-factor authentication via Google Authenticator | Login through the SACM account |
| Outcome | Access to the goAML portal | Ability to file STRs, SARs and PNMRs |
In practice, “goAML registration” means two consecutive registrations. Most of the mistakes companies make happen at the first stage — SACM registration in the UAE: a badly assembled PDF, unconfirmed two-factor authentication, details that do not match the licence.
Who must register and the deadline after licensing
The obligation to register with goAML does not depend on the size of the company, its turnover or whether it operates on the mainland or in a free zone. It depends solely on the type of activity. Financial institutions, VASPs and the six categories of DNFBP must register.
Table 2 — Who must register with goAML
| Category | Examples of activity | Supervisor |
|---|---|---|
| Real estate agents and brokers | Buying and selling real estate on behalf of clients | Ministry of Economy |
| Dealers in precious metals and stones (DPMS) | Gold, jewellery, cash transactions of AED 55,000 or more | Ministry of Economy |
| Lawyers, notaries and independent legal professionals | Real estate transactions, asset management, company formation for clients | Ministry of Justice |
| Independent accountants and auditors | Transactions involving client funds | Ministry of Economy |
| Corporate and trust service providers (CSP/TCSP) | Company formation, nominee services, registered office | Ministry of Economy |
| Commercial gaming operators | Transactions of AED 11,000 or more | GCGRA |
| Financial institutions and VASPs | Banks, exchange houses, insurers, crypto services | Central Bank, SCA, DFSA, FSRA |
The goAML registration deadline for a new company runs from the moment the licence is issued: as soon as a company holds a licence for an activity on the list, the goAML obligation is already in effect. For a new company the best approach is therefore to run registration in parallel with licensing, so that goAML access is in place before the first client comes through the door. If a company has been operating for some time and is still not registered, every day without registration is a continuing breach — the sooner it is closed, the fewer questions there will be at an inspection. How company formation and AML fit together is explained on the page.
If you are not sure whether your activity counts as a DNFBP, the categories are broken down on the page and in DNFBPs in the UAE.
Step-by-step registration procedure
This goAML registration guide covers five steps. They are completed by the company’s representative — usually the appointed compliance officer (MLRO), because it is their details that are tied to the account.
-
Pre-registration in SACM. An account for the company’s representative is created on the SACM portal: full name, position, contact details, licence details.
-
Two-factor authentication. The Google Authenticator app is linked to the account. Without confirmed two-factor authentication the application goes no further.
-
Organisation details. The company profile is completed: name exactly as it appears on the licence, licence number, type of activity, supervisor, address, contact details.
-
Document upload. All documents are merged into a single PDF file of up to 5 MB and uploaded to the system. The system does not accept multiple files or a larger file.
-
Awaiting approval. The regulator reviews the application. Once SACM approval is granted, goAML access opens and the organisation and responsible person profiles are created there.
After approval the company has working access to goAML. From that point it must use the system to file reports — registration without subsequent use of the system does not count as meeting the AML requirements.
How to log in to goAML
goAML login in the UAE is through the SACM account, confirmed with a code from Google Authenticator. If the employee in whose name the account was created has left the company or lost access to the authenticator app, access has to be restored through the regulator — one reason to tie the account to the appointed MLRO rather than to whichever member of staff happened to be available.
Have specialists handle your goAML registration →
Documents required
SACM and goAML registration requires documents for the company and for the responsible person:
-
a valid trade licence;
-
the passport and Emirates ID of the company’s representative (the appointed MLRO);
-
a document appointing the responsible person — an authorisation letter from the company’s management;
-
details of the supervisor and the type of activity, as stated on the licence.
All documents are merged into a single PDF of up to 5 MB. A mismatch between the details in the application and the details on the licence is the main reason applications are returned for correction.
Common reasons for rejection
In our experience, applications are most often returned for five reasons.
- The name does not match the licence. The application gives an abbreviated or translated company name while the licence shows the full one. The system compares the details literally.
- The wrong activity category. The company selects the wrong DNFBP category or the wrong supervisor. A corporate service provider, for example, selects “accounting services”.
- Problems with the PDF. Several files instead of one, a file larger than 5 MB, unreadable scans.
- Two-factor authentication not completed. The account exists, but Google Authenticator has not been linked or the code has not been confirmed.
- Expired documents. The licence or the representative’s Emirates ID is out of date.
Every return means a fresh submission and a fresh wait. That is why we check the application against the licence line by line before it is sent.
After registration: STR, SAR and PNMR
Registration is the way into the system, not the fulfilment of the obligation. Once it has access, the company must file reports whenever there are grounds to do so.
- STR (Suspicious Transaction Report) — a report on a suspicious transaction. Filed when the company has reason to believe that a specific transaction is linked to money laundering, terrorist financing or the financing of the proliferation of weapons of mass destruction.
- SAR (Suspicious Activity Report) — a report on suspicious activity. Used when the suspicion is raised not by an individual transaction but by the client’s behaviour as a whole: an attempted transaction, a refusal to provide documents, an unusual arrangement.
- PNMR (Partial Name Match Report) — a partial name match report. Filed when sanctions screening of a client produces a partial match that the company cannot conclusively confirm or rule out. The PNMR is filed through goAML like any other report.
The decision to file each report rests with the appointed compliance officer. If keeping one on the payroll is too expensive, the function can be outsourced — see the page. How to prepare and file reports is covered in STR, SAR and PNMR through goAML.
Beyond reporting, a registered company must also have an AML policy with a risk assessment, which is what determines which transactions count as suspicious. Without it, goAML reporting has nothing to rest on. Details on the page.
Penalties for non-registration and unfiled reports
Liability for breaches of AML requirements is set by Federal Decree-Law No. (10) of 2025, in force since 14 October 2025, and Cabinet Resolution No. (134) of 2025, which took effect on 14 December 2025.
Table 3 — Liability related to goAML
| Breach | Consequences | Legal basis |
|---|---|---|
| No goAML registration | Fine from AED 50,000; administrative sanction of up to AED 5,000,000 per breach | Federal Decree-Law No. (10) of 2025, Article 17 |
| Failure to file an STR / SAR where there are grounds | Administrative fine of AED 10,000 to AED 5,000,000; possible suspension or revocation of the licence | Federal Decree-Law No. (10) of 2025, Article 17 |
| Systematic breaches | Ban on operating in the sector, restrictions on management powers, publication of sanctions in the media | Federal Decree-Law No. (10) of 2025, Article 17 |
| Involvement of a legal entity in money laundering, on conviction | AED 5,000,000 to AED 100,000,000 | Federal Decree-Law No. (10) of 2025, Article 27(1) |
Under the new law no statute of limitations applies to money laundering, terrorist financing or proliferation financing offences (Article 37(2)). Separately, when opening an account and at each annual KYC review, banks ask DNFBPs for proof of goAML registration — the absence of registration can mean a refusal or a frozen account long before any inspection.
How we work
-
Confirming the obligation (1 working day). From the licence and type of activity we determine whether the company must register, in which category and with which supervisor.
-
Document preparation. We assemble the set, draft the letter appointing the responsible person and compile the single PDF of up to 5 MB.
-
SACM registration. We create the account, set up two-factor authentication and submit the application.
-
goAML registration. Once SACM approval is granted, we create the organisation and responsible person profiles in goAML.
-
Handover and briefing. We pass the credentials to the appointed MLRO and explain how to file STRs, SARs and PNMRs.
If the company does not yet have an AML policy or an appointed compliance officer, goAML registration is best combined with the full turnkey AML package — all four core obligations are closed at the same time.
Timing and cost
goAML and SACM registration takes from 3 working days from receipt of the complete set of documents. The timing depends on how quickly the regulator reviews the application and how quickly the company supplies its documents.
The service includes confirming the obligation against the licence, preparing the documents and the single PDF, SACM pre-registration with two-factor authentication set-up, goAML registration, handover of access to the appointed responsible person and a briefing on filing reports. Payment is a one-off fee. The price is fixed in the contract before work begins — after a free check of whether you need to register at all.
Register with goAML before the bank or the regulator asks
Send us your business activity and licence number — within one working day we will tell you whether your company must register and quote the price. Registration from 3 working days.
WhatsApp / phone: +971 52 634 1022
Get a free check →
Information current as of October 2026. Legal basis: UAE Federal Decree-Law No. (10) of 2025 and UAE Cabinet Resolution No. (134) of 2025. This page is for general guidance only and does not constitute legal advice.
