goAML registration in the UAE: who must register, and what to do once you are in

The Financial Intelligence Unit runs goAML for filing reports. The MoET guidelines are direct about it: DNFBPs are mandated to register on goAML, to keep that registration active, and to do it immediately so they are ready to file. The compliance officer of the company is the person who registers as the user, not an outsourced consultant in their own name.

That matters for firms that use a consultant. Under the 2026 guidelines the compliance officer remains fully accountable for outsourced work, so the registration and the account should sit with the business. Check whether your business is in scope.

goAML is not the only place you must register. Article 21 of Cabinet Decision No. 74 of 2020 requires financial institutions and DNFBPs to register on the Executive Office's website to receive notifications when names are listed, relisted, updated or delisted.

Without it you learn about a designation late, and the freezing clock does not wait: a confirmed match must be frozen within 24 hours of the designation, not of the day you noticed. A business registered on goAML but not on the EOCN system is compliant on paper and blind in practice.

Once registered, the reports you may have to file are not interchangeable:

• STR or SAR: when you suspect, on reasonable grounds, that funds or a transaction relate to a crime. No minimum amount, filed immediately.
• CNMR: a confirmed name match against the sanctions lists, filed within five business days of freezing or rejecting.
• PNMR: a partial name match you could not resolve, filed within five business days of suspending.
• REAR and DPMSR: threshold reports for real estate and precious metals transactions, required by the transaction itself, with or without suspicion.

Detail on the sanctions reports: CNMR and PNMR in goAML.

The MoET guidelines are explicit: the only requirement is reasonable grounds. Suspicion can be inferred from indicators, behaviour or due diligence information. You do not need evidence of a predicate offence, knowledge of the underlying crime, or proof that funds are illicit. Waiting for certainty is itself a compliance failure.

• A secure channel to the FIU through your supervisory authority, with filing guidance on the dashboard.
• Trends and typologies reports circulated to registered users, worth reading and feeding into your own red flag indicators.
• Requests for more information, which must be answered promptly.
• An obligation to keep the registration active, which means keeping contact details and the compliance officer current.

Filing is also confidential. Telling the customer that a report has been made, or that a freeze is coming, is an offence, and the two prohibitions come from different instruments.

• Screening in place against the UAE Local Terrorist List and the UN Consolidated List, with a record of every decision.
• Your own red flag indicators, updated as methods change.
• Documents ready to attach: identification, ownership, transaction records.
• An internal escalation route, so staff raise concerns to the compliance officer quickly enough to meet a five day clock.

RiskLens360 keeps screening results, case decisions and audit logs in one place, so a report can be assembled from the file rather than reconstructed. Work through the screening checklist.