Why that is the answer
goAML is the technical front door to the UAE’s anti-money-laundering and counter-terrorist-financing obligations for non-financial businesses. It is the system, operated for the Financial Intelligence Unit, through which regulated businesses register and file the reports the AML framework requires, principally suspicious transaction and suspicious activity reports.
The key question for most businesses is not what goAML is but whether they are a DNFBP, because that status is what makes registration mandatory. The DNFBP categories are specific: independent accountants and auditors; company and trust service providers (those who set up companies, provide registered offices, act as directors, and similar); real estate brokers and agents in transactions above a threshold; and dealers in precious metals and precious stones above a threshold. Businesses in these categories are treated as gatekeepers who could be used to launder money, so they carry AML obligations that ordinary trading companies do not.
Registration on goAML is only the visible first step. Behind it sits a substantive compliance obligation: appointing a compliance officer, carrying out customer due diligence, assessing money-laundering risk, keeping records, and, the operative purpose, recognising and reporting suspicious transactions through the portal. A business that registers but does nothing further has met the form and missed the substance, which is its own exposure. The framework is enforced actively, and both failing to register and failing to meet the underlying obligations attract significant penalties.
Are you a DNFBP?
Whether goAML registration applies to you turns entirely on whether you fall into a DNFBP category. The main ones are:
- Auditors and independent accountants: providing accounting or audit services to others as a business
- Company and trust service providers: forming companies, providing registered offices, acting as or arranging directors or nominee shareholders
- Real estate brokers and agents: involved in buying and selling real estate above the relevant threshold
- Dealers in precious metals and precious stones: transacting above the relevant threshold
- Certain other designated categories as specified in the AML framework
If your business is in one of these categories, goAML registration and the underlying AML obligations apply to you. If it is an ordinary trading or service business outside these categories, they generally do not, but the company service provider category in particular can catch businesses that arrange corporate structures as part of what they offer, so check rather than assume.
What registration commits you to
Registering on goAML is the start of a live compliance programme, not the discharge of a one-off duty, and understanding what it commits you to prevents the common mistake of registering and stopping.
A DNFBP is expected to build and run an AML/CFT compliance framework proportionate to its risk. That means appointing a compliance officer responsible for the programme; carrying out customer due diligence, knowing who your clients are, verifying their identity, and understanding the ownership behind corporate clients; assessing the money-laundering and terrorist-financing risk your business faces; keeping the required records; training staff to recognise red flags; and, crucially, filing suspicious transaction or activity reports through goAML when something warrants it.
The reporting is the point of the whole exercise. The framework exists so that businesses positioned to see suspicious activity actually report it, and the obligation to report, promptly and through the portal, is not optional or discretionary once a genuine suspicion arises. A DNFBP that has registered, appointed an officer and built controls but would not actually recognise or file a report has the machinery without the outcome. Getting the substance right, not just the registration, is what compliance here means.
Why this is not a gap to leave open
Among UAE compliance obligations, AML for DNFBPs is one where the cost of getting it wrong is disproportionately high, and it is worth being clear about why.
The penalties for failing to register on goAML, or for failing to meet the underlying AML obligations, are substantial. This is an area the authorities enforce actively, reflecting the UAE’s commitment to international anti-financial-crime standards. Beyond the direct penalties, an AML failure carries reputational and licensing consequences that a routine tax slip does not, because it touches the integrity of the business itself rather than a filing deadline.
The difficulty is that many businesses do not realise they are DNFBPs. An accounting or audit practice clearly is; a business that, as part of a broader offering, forms companies or provides corporate services for clients may be one without having framed itself that way. That uncertainty is precisely the risk, an unrecognised DNFBP obligation is an open, penalised gap that the business does not know it has.
So the responsible first step for any business that might be a DNFBP is to establish the point definitively. If you are one, register on goAML and build the compliance framework properly. If you are not, confirm that and move on. What you should not do is leave the question unanswered, because in this area, not knowing is not a defence, and it is the one compliance gap where the downside is severe enough to warrant resolving with certainty rather than assumption.
Where this goes wrong
- Assuming AML obligations are only for banks, when DNFBPs including accountants and company service providers are caught.
- Registering on goAML and stopping, without building the underlying compliance framework.
- Not realising you are a DNFBP, particularly if you provide company or corporate services.
- Treating suspicious transaction reporting as discretionary once a genuine suspicion arises.
- Skipping customer due diligence and understanding of client ownership.
- Failing to appoint a compliance officer or train staff on red flags.
- Leaving the DNFBP question unanswered, when not knowing is not a defence.
Your next step
- Establish definitively whether you are a DNFBP: especially if you offer corporate services.
- Register on goAML if you are, within the required timeframe.
- Appoint a compliance officer and build an AML/CFT framework proportionate to your risk.
- Carry out customer due diligence and understand client ownership.
- Set up suspicious transaction reporting so a genuine suspicion is actually filed.
Related questions
Frequently Asked Questions
What is goAML registration?
goAML is the UAE’s online anti-money-laundering reporting portal, and registration on it is a legal requirement for Designated Non-Financial Businesses and Professions (DNFBPs). Designated non-financial businesses and professions must register on the goAML portal and meet AML/CFT obligations If you are a DNFBP you must register, build AML controls, and file suspicious transaction reports through the portal.
Who has to register on goAML?
DNFBPs, auditors and independent accountants, company and trust service providers, real estate brokers above a threshold, and dealers in precious metals and stones above a threshold, among other designated categories. If your business is a gatekeeper of this kind, registration and the underlying AML obligations apply.
Am I a DNFBP?
You are if you fall into a designated category, most commonly accounting or audit services, or company and corporate service provision. Ordinary trading and service businesses outside these categories generally are not. The company service provider category in particular can catch businesses that arrange corporate structures, so check rather than assume.
Is registering on goAML enough?
No. Registration is the visible first step; behind it sits a substantive obligation to appoint a compliance officer, carry out customer due diligence, assess risk, keep records, train staff, and file suspicious transaction reports. A business that registers but does nothing further has met the form and missed the substance.
What is the penalty for not registering?
Failing to register on goAML, or to meet the underlying AML obligations, attracts substantial penalties. This is an actively enforced area reflecting the UAE’s anti-financial-crime commitments. Beyond direct penalties there are reputational and licensing consequences, making it one of the more serious compliance gaps to leave open.
What are my ongoing AML obligations?
Appointing a compliance officer, customer due diligence and understanding client ownership, a money-laundering risk assessment, record-keeping, staff training, and filing suspicious transaction or activity reports through goAML when warranted. The reporting is the point of the exercise. The framework exists so businesses positioned to see suspicious activity actually report it.
What if I did not know I was a DNFBP?
Establish the position now and regularise. Not knowing is not a defence, and an unrecognised DNFBP obligation is an open, penalised gap. If you might provide services that make you a DNFBP, particularly company or corporate services, confirm your status definitively rather than assuming you are outside.
How does goAML relate to UBO?
Both serve the transparency and anti-financial-crime framework, knowing who is really behind entities and transactions. UBO information about ultimate ownership supports AML customer due diligence, and a DNFBP carrying out due diligence on corporate clients relies on exactly the ownership clarity that UBO rules require. The obligations are related expressions of the same goal.
Should I get help with AML compliance?
For a DNFBP, generally yes. The framework is substantive and the penalties are high. Help to establish your status, register correctly, appoint a compliance officer, build proportionate controls and set up reporting removes a serious and actively enforced risk. Confirming you are not a DNFBP, where that is the case, is equally valuable.
Tell us what services you provide, especially any company formation or corporate services. We will establish whether you are a DNFBP, and if so help you register on goAML and build the controls the law requires.
Check my compliance status 058 101 9570
Last reviewed 27 July 2026. Rates, thresholds and deadlines change, the e-invoicing provider deadline has already moved once. Confirm current requirements with the Federal Tax Authority before acting, or ask us to check your position.