goAML and AML in the UAE: who must register and what the fines are
There is one UAE obligation business owners tend to discover last — usually through a penalty notice. Companies in four "non-financial" sectors must register on the goAML platform, appoint a compliance officer and report suspicious transactions. The sanctions are not symbolic: the standard range is AED 50,000 to AED 1,000,000 per violation, and since October 2025 a new federal law has tightened the whole regime.
- Who must register
- 4 DNFBP categories
- Where
- the goAML portal (FIU)
- Fines
- AED 50,000 – 1,000,000
- New law
- No. 10 of 2025, from 14.10.2025
What goAML is
goAML is a platform developed by the United Nations Office on Drugs and Crime (UNODC) and operated in the UAE by the Financial Intelligence Unit. Businesses use it to file suspicious transaction reports (STRs) and suspicious activity reports (SARs), giving the state a single channel for data on suspicious dealings.
Registering on goAML is not an optional extra for large firms — it is an obligation tied to the activities on your trade licence. What matters is what the licence says, not how risky you personally consider your business to be.
Who counts as a DNFBP: four categories
DNFBP stands for Designated Non-Financial Businesses and Professions. Under the Ministry of Economy and Tourism's classification there are four groups:
| Category | Who falls in |
|---|---|
| Real estate | brokers and agents involved in buying or selling property |
| Audit and accounting | auditors and accounting firms providing professional services to third parties |
| Precious metals and stones | dealers, jewellers, cutters, refiners, jewellery retailers |
| Corporate and trust service providers (TCSP) | company formation, registered addresses, business administration services |
Lawyers and notaries are covered separately, supervised by the Ministry of Justice, and the new law extended the regime explicitly to virtual asset service providers (VASPs) — exchanges, custody services and platforms.
The most common mistake is assuming you are "too small". There is no turnover threshold in this obligation: a property agent with one deal a quarter and an accounting firm with two clients must register exactly like a large company. And there is no minimum transaction value for filing a suspicious transaction report either.
What changed: the new law No. 10 of 2025
Since 14 October 2025 Federal Decree-Law No. 10 of 2025 on combating money laundering, the financing of terrorism and the financing of proliferation has been in force, fully replacing the previous law No. 20 of 2018. The key points:
- the regime now explicitly covers virtual assets and their service providers;
- targeted financial sanctions are written into the primary legislation, and the powers of the FIU and supervisory authorities are widened;
- criminal liability is heavier — for legal persons the ceiling reaches AED 100 million;
- proliferation financing is set out as an offence in its own right.
What this means for an ordinary company: the set of obligations — registration, a compliance officer, customer checks, reporting — is unchanged, but the price of ignoring them has gone up and inspections have become tougher. Note that some government pages and industry material still cite the 2018 law — worth checking publication dates when you read around the subject.
What an in-scope company has to do
- Register on goAML — before starting to work with clients, not "when there is time".
- Appoint a compliance officer (AML/MLRO) — a named person with authority and contact details in the system.
- Assess your risks: countries, clients, products, payment channels.
- Customer due diligence (CDD/KYC) — identify the client and the beneficial owner, with enhanced checks on the source of funds for higher-risk transactions.
- Sanctions screening — check clients and counterparties against the national list and UN lists, on an ongoing basis rather than once at onboarding.
- File STRs and SARs whenever suspicion arises — with no minimum transaction value.
- Keep records for five years — on transactions, clients and the checks performed.
- Internal policies and staff training — a documented procedure you can produce during an inspection.
How to register
Registration runs in two steps: an organisation account is created in the goAML portal's security system, then access is confirmed with a one-time password from an authenticator app. The documents usually required are:
- an authorisation letter from the company for the responsible person;
- copies of that person's passport, visa and Emirates ID;
- a copy of the trade licence;
- an installed two-factor authentication app.
Once approved, the company gets an account through which reports are filed. Registration is not the finish line: an unmaintained profile and the absence of reports where grounds existed are both treated as breaches.
The fines
The unified schedule of violations and administrative fines is set by Cabinet Decision No. 71 of 2024. The standard range is AED 50,000 to AED 1,000,000 per violation, reaching AED 5 million in serious cases, with warnings, licence suspension and licence revocation available alongside the monetary penalties.
| Typical breach | What follows |
|---|---|
| Not registered on goAML | a fine from the main range, risk of the licence being blocked |
| No compliance officer and no internal policies | a separate breach, fined in its own right |
| Customer due diligence not performed | a fine; escalated penalties where it is systematic |
| STRs not filed where grounds existed | the heaviest part of the schedule |
| Records not kept for five years | a fine regardless of whether any suspicious transactions occurred |
This is not theoretical: since late 2022 the Ministry of Economy and Tourism has imposed more than AED 130 million of administrative fines on the non-financial sector, around AED 42 million of it in the first half of 2025 alone. Inspections are run both remotely and on site.
A free zone licence does not exempt you from AML obligations. Only the supervisor changes: the mainland and most free zones fall under the Ministry of Economy and Tourism, while DIFC and ADGM have their own regulators. The duty to register and run compliance is the same.
How this connects to the rest of your reporting
AML compliance and tax live in different rulebooks but rest on the same order in your documents. A company with contracts, invoices and a coherent payment history satisfies both the auditor's request and an AML inspector's questions. Related reading: when an audit is mandatory and corporate tax deadlines and penalties. Client due diligence also makes opening and keeping a bank account noticeably easier — the bank asks much the same questions, see our corporate account guide.
How we help
We check against the activities on your licence whether you fall within the DNFBP perimeter and, if you do, we support the goAML registration, help put internal policies and a risk assessment in place, and build client due diligence and record keeping into your day-to-day accounting rather than into a folder that only exists for inspections.
Let us check whether AML rules apply to you
Based on the activities on your licence we will tell you whether goAML registration is required, what has to be implemented and which gaps are already visible. The review takes one working day.
Frequently asked questions
This material is for general information only and is not legal advice. The data is current as of 14 August 2026. The list of supervised categories, the level of fines and the registration procedure are set by the Ministry of Economy and Tourism and the Financial Intelligence Unit; whether the requirements apply to a particular company depends on the activities on its licence. Please confirm the current rules at moet.gov.ae and uaefiu.gov.ae, or with us.
