AML & goAML Registration for DNFBPs in the UAE

If your UAE business buys or sells property, trades gold or diamonds, audits accounts, or sets up companies for clients, you are very likely a DNFBP — and goAML registration in the UAE is not optional. Registering on the Financial Intelligence Unit's goAML portal is the entry point to a wider anti-money-laundering duty that sits alongside your other UAE corporate tax and compliance obligations.

Direct answer. DNFBPs (Designated Non-Financial Businesses and Professions) must register on the goAML platform run by the UAE Financial Intelligence Unit, appoint a compliance officer, and build an AML program covering risk assessment, customer due diligence and suspicious-transaction reporting. The framework comes from Federal Decree-Law No. 10 of 2025 on anti-money laundering, which repealed and replaced the earlier Federal Decree-Law No. 20 of 2018. This guide explains who must register, and the obligations that follow.

What is a DNFBP under UAE law?

A DNFBP is a non-financial business that regulators treat as a front-line gatekeeper against money laundering, because criminals often move illicit funds through everyday commercial deals. Under Federal Decree-Law No. 10 of 2025 (which replaced the earlier Federal Decree-Law No. 20 of 2018) and its implementing decisions, several sectors fall inside the regime and are supervised in the mainland primarily by the Ministry of Economy.

The main DNFBP categories are:

• Real estate agents and brokers, when they carry out transactions involving the buying and selling of real property.
• Dealers in precious metals and precious stones, once a single or linked cash transaction reaches a regulatory threshold (AED 55,000).
• Auditors and accountants providing professional services to clients.
• Corporate service providers — firms that form, administer or provide registered offices for companies incorporated under the Commercial Companies Law.

Independent legal professionals and notaries can also be caught when they prepare defined transactions for clients. Entities licensed inside certain free zones may answer to their own free-zone AML supervisor, so confirming who regulates you is the first step.

Why goAML registration in the UAE is mandatory

goAML is the national reporting platform of the UAE Financial Intelligence Unit (FIU). It is the channel through which reporting entities file suspicious-transaction reports, receive feedback, and act on freeze instructions. The obligation to be registered exists from the moment you operate as a DNFBP, not from your first report.

The reporting duty flows directly from Federal Decree-Law No. 10 of 2025 (which replaced the earlier Federal Decree-Law No. 20 of 2018), which requires DNFBPs to identify money-laundering risks, report suspicions, and cooperate with the FIU. Failing to register is itself a breach that can draw an administrative penalty ranging from AED 10,000 to AED 5,000,000, separate from any penalty for failing to report a suspicion later. In practice, most DNFBPs also register on the sanctions-list reporting system, which pushes UN and local designation updates to them.

How to complete your goAML registration step by step

The process is document-heavy but linear. Prepare before you start.

1. Confirm your supervisor. Mainland DNFBPs in the main sectors are supervised by the Ministry of Economy; free-zone entities may register through their own authority. This sets your registration path.
2. Appoint a compliance officer (often called the Money Laundering Reporting Officer). This person must be senior enough to act independently and will become the registered user on the portal.
3. Gather documents. Typically your valid trade licence, the entity's details, and the compliance officer's Emirates ID and passport.
4. Register the organisation on goAML. Create the entity account, entering business and contact details and uploading the required documents.
5. Register the compliance officer as the portal user linked to that organisation.
6. Enrol in the sanctions-list reporting system so you receive designation updates and can file freeze-related reports.
7. Await activation. Once the FIU approves the account, log in to submit reports and manage your profile.

Keep the login credentials and the compliance officer's contact details current, because an inactive or unreachable account is treated as a compliance failure.

Building an AML compliance program that holds up

UAE supervisors expect a documented, risk-based AML/CFT program. At a minimum it should contain:

• A written enterprise-wide risk assessment that scores your exposure across customers, products, delivery channels and geographies.
• Policies and procedures approved by senior management that translate that risk assessment into day-to-day controls.
• A named compliance officer with the authority, independence and resources to do the job.
• Customer due diligence and ongoing monitoring (covered below).
• Sanctions and PEP screening at onboarding and on a continuing basis.
• Record-keeping, staff training, and periodic independent review to test whether the controls actually work.

Customer due diligence, KYC and beneficial ownership

Before establishing a business relationship, a DNFBP must identify the customer and verify their identity using reliable, independent documents. For a corporate customer, that extends to identifying the ultimate beneficial owner — the natural person who ultimately owns or controls it — and understanding the purpose of the relationship.

Higher-risk relationships call for enhanced due diligence: additional verification, senior-management sign-off, and closer ongoing monitoring, with politically exposed persons and high-risk jurisdictions as the classic triggers. Because this process means collecting and storing sensitive personal information, it also engages the UAE Personal Data Protection Law: collect only what the AML rules require, keep it secure, and retain it only for as long as the law allows.

How to file a suspicious transaction report

A suspicious transaction report (STR) — and its sibling, the suspicious activity report — is filed through goAML whenever you have reasonable grounds to suspect that funds are the proceeds of crime, or are linked to money laundering or terrorist financing. The trigger is suspicion, not proof: you do not need to establish that a crime occurred before reporting.

Three rules matter most. First, report without delay once suspicion crystallises. Second, never commit the offence of tipping off — you must not tell the customer or any third party that a report has been made. Third, filing an STR in good faith protects you; failing to file when you should have is the exposure. goAML also supports other report types, such as those tied to sanctions-list matches and funds-freeze instructions, so choose the correct form for the situation.

Record-keeping, sanctions screening and ongoing duties

AML compliance is a continuing obligation. You must retain customer identification records, transaction records and the supporting evidence for STRs for a minimum period of 5 years, measured from the end of the relationship or the date of the transaction, and make them available on request.

Sanctions screening runs in parallel. You must screen customers and beneficial owners against the UN Consolidated List and the UAE Local Terrorist List, and act on any match, including freezing funds within the window prescribed by the authorities and filing the relevant report. Beyond that, keep your risk assessment current, refresh staff training, and arrange an independent review of the program at sensible intervals. Official guidance, sector alerts and designation updates are published through UAE government channels such as the UAE Government Portal.

Penalties for getting AML compliance wrong

Non-compliance carries graduated, sometimes severe consequences. Supervisors may impose administrative fines of up to AED 5,000,000, issue warnings, restrict or suspend the business licence, and in serious cases refer matters for criminal prosecution under Federal Decree-Law No. 10 of 2025 (which replaced Federal Decree-Law No. 20 of 2018). Reputational damage and loss of banking relationships often follow.

Because the framework is technical, many DNFBPs have their program reviewed by a qualified adviser before an inspection. If you need that support, you can browse independent legal professionals on the LEXAI directory and contact them directly to arrange a review — LEXAI is a directory, so you deal with the lawyer on your own terms.

Frequently asked questions

Who has to register on goAML in the UAE?

Any business classified as a DNFBP must register on goAML. That includes real estate brokers and agents dealing in property sales, dealers in precious metals and stones, auditors and accountants, and corporate service providers, along with independent legal professionals and notaries in defined situations. Registration is mandatory once you operate in one of these sectors, not only when you first encounter a suspicious transaction, and it is supervised in the mainland mainly by the Ministry of Economy.

Is goAML registration the same as reporting a suspicious transaction?

No. Registration and reporting are two separate stages. Registration sets up your organisation and compliance officer on the FIU's goAML platform so you are connected to the system. Filing a suspicious transaction report is a later action you take through that platform whenever a specific transaction raises reasonable grounds for suspicion. You must be registered first; you then use the portal to submit STRs, sanctions-related reports and freeze reports as situations arise during your business.

What is the difference between a DNFBP and a financial institution?

Financial institutions — banks, exchange houses, insurers and similar regulated firms — are supervised by the Central Bank and other financial regulators. DNFBPs are non-financial businesses, such as real estate agents, precious-metals dealers, auditors and corporate service providers, that regulators bring into the AML regime because criminals use ordinary commercial deals to launder money. Both must apply anti-money-laundering controls under Federal Decree-Law No. 10 of 2025, but their supervisors, registration paths and sector-specific reporting forms differ.

Do I need a compliance officer if my business is small?

Yes. The obligation to appoint a compliance officer applies to DNFBPs regardless of size, because the risk-based approach still requires someone accountable for AML controls. In a very small firm this can be an owner or senior manager, provided they have the authority and independence to report suspicions without interference. The scale of the program can be proportionate to your risk, but the requirement to have a responsible person does not disappear.

What happens if I do not register or report?

Failing to register, failing to file a suspicious transaction report when required, or tipping off a customer are all breaches under the UAE AML framework. Supervisors can impose administrative fines, issue warnings, and suspend or restrict your licence, and serious cases can be referred for criminal prosecution under Federal Decree-Law No. 10 of 2025. Beyond the direct penalty, non-compliance frequently damages banking relationships and reputation, which can be more costly than the fine and harder to repair.

How long do I have to keep AML records?

UAE AML rules require DNFBPs to retain customer identification records, transaction records and the evidence supporting any suspicious-transaction report for a legally specified minimum period — currently 5 years — measured from the end of the business relationship or the date of the transaction. Records must be organised so you can produce them promptly if the FIU or your supervisor requests them. Retention periods can change with amendments, so confirm the current figure before setting policy.