Most free zone companies are exempt from goAML registration
If you have recently received a notification from your free zone authority regarding Anti-Money Laundering (AML) compliance, your first instinct might be to panic about missing a deadline. However, for the vast majority of business owners in the UAE, goAML registration is not a requirement. This platform is not a general registration tool for every business; it is a specific reporting system for companies that the government deems “gatekeepers” to the financial system. If your company focuses on consultancy, software development, e-commerce, or general trading, you are likely outside the scope of these rules.
The goAML platform is the reporting tool used by the UAE Financial Intelligence Unit (FIU). It exists to track suspicious financial activity. Unless your specific licensed activity falls under the category of a Designated Non-Financial Business or Profession (DNFBP) or a Financial Institution, you do not need to register. This guide helps you work out whether your free zone company is actually on the hook and, if it is, how to register without falling into the common traps. FreezonEra does not provide legal or AML advice; confirm your obligations with a licensed compliance professional.
The goAML platform serves as the central hub for UAE financial intelligence
goAML is the reporting platform operated by the UAE Financial Intelligence Unit, accessed through the FIU portal at uaefiu.gov.ae. Its purpose is to let regulated businesses file Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) directly with the authorities.
The legal basis for this system was originally established under Cabinet Decision No. 10 of 2019. However, the entire AML framework in the UAE underwent a massive overhaul recently. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, repealing the previous 2018 legislation. This was followed by Cabinet Resolution No. 134 of 2025, which took effect on 14 December 2025. These new laws have tightened the definitions of money laundering and increased the penalties for failing to report suspicious activity. For you as a business owner, this means the “wait and see” approach is no longer viable. If you are required to register, the authorities expect it to be done immediately after your licence is issued.
Licensed activities determine your registration requirements
The most common mistake free zone owners make is thinking that their revenue or transaction volume triggers goAML registration. It does not. You could have a consultancy firm making AED 50 million a year and you would not need to register. Conversely, a solo real estate broker making AED 100,000 a year must register. The trigger is your LICENSED ACTIVITY.
The Ministry of Economy (MoE) acts as the AML supervisor for DNFBPs holding licences from mainland registrars and from commercial free zones. This includes popular zones like DMCC, IFZA, Meydan, and Shams. If your activity falls into one of the categories in the table below, you are considered a DNFBP and must register on goAML.
| Activity Category | Specific Trigger for Registration | Must Register? |
|---|---|---|
| Real Estate Brokers | Involved in transactions for the buying or selling of real estate. | Yes |
| Auditors and Accountants | Providing professional accounting or auditing services to third parties. | Yes |
| Corporate Service Providers | Acting as a formation agent, providing registered offices, or acting as a nominee shareholder. | Yes |
| Precious Metal/Stone Dealers | Any dealer conducting cash transactions at or above AED 55,000. | Yes |
| Legal Professionals | Lawyers or notaries carrying out financial transactions for clients (e.g., managing money or assets). | Yes |
| Commercial Gaming | Operators of gaming facilities (added to the list on 14 December 2025). | Yes |
| Virtual Asset Providers | Brokers, exchanges, or custodians of crypto/virtual assets. | Yes |
| General Trading/Consultancy | Standard business services without the specific triggers above. | No |
It is important to note that if you are simply an employee of a firm that is registered, you do not register individually. The “legal person” (the company) is the entity that registers. While your UAE free zone VAT guide covers your tax obligations, goAML is a separate regulatory hurdle that focuses on the nature of your clients and the source of their funds.
Financial free zones operate under separate regulatory frameworks
Not all free zones are treated the same under the Ministry of Economy’s regime. The UAE has two primary “Financial Free Zones”: the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM). These zones are excluded from the MoE’s DNFBP regime because they have their own independent regulators.
If your company is based in the DIFC, your AML supervisor is the Dubai Financial Services Authority (DFSA). If you are in the ADGM, you are supervised by the Financial Services Regulatory Authority (FSRA). While companies in these zones still have strict AML duties and must report suspicious transactions, they do not follow the MoE/goAML DNFBP route described for commercial free zones. This distinction is vital; trying to register a DIFC company through the Ministry of Economy’s portal will only lead to administrative confusion and potential delays in your compliance filing.
The registration process follows a specific multi-step sequence
If you have confirmed that your activity requires goAML registration, you cannot simply “log in.” The UAE uses a tiered authentication system to ensure that only authorized individuals can access the FIU portal. You will need to prepare your documentation before starting the online process. You will need a valid commercial trade licence, which you should have kept current during your last free zone licence renewal. You also need an official authorisation letter on company letterhead appointing a Compliance Officer or Money Laundering Reporting Officer (MLRO), along with that person’s passport, Emirates ID, and residency visa copies.
The registration steps must be followed in this exact order:
- SACM Registration: Sign up on the Ministry of Economy’s Self-Assessment Compliance Management (SACM) platform at uaefiu.gov.ae. This platform captures your sector, ownership details, and a self-rated AML risk profile. Once approved, you receive a certificate that goAML requires.
- Secret Key Acquisition: After the initial sign-up, you will receive a username and a “secret key” via email from the FIU.
- Authentication Setup: Install Google Authenticator on your mobile device. Enter the secret key to generate time-sensitive login codes. You cannot bypass this step; the system requires two-factor authentication for every login.
- goAML Portal Access: Log in to the goAML portal using your SACM credentials and the code from your authenticator app.
- Organisation Registration: Select “Register a New Organisation” and fill in all mandatory fields, including your licence details and the details of the MLRO.
- Document Upload: Upload the trade licence, MLRO appointment letter, and identification documents.
- Verification: Wait for the FIU to verify your application. This typically takes a few business days if the paperwork is complete and accurate. You will receive an email confirmation once the account is activated.
Maintaining compliance requires more than just an active portal login
Many free zone business owners believe that once they have their goAML login, the job is done. This is a dangerous misconception. Registration is merely the “entry ticket.” Once you are registered as a DNFBP, you are subject to ongoing inspections and audits by the Ministry of Economy. This regulatory environment is becoming increasingly transparent, mirroring the requirements for free zone corporate tax and QFZP status.
Inspectors expect to see documented evidence of a full AML program. This includes an enterprise-wide risk assessment that must be updated at least annually and tailored to your specific business model. You must also have written procedures for Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) for high-risk clients. You are required to perform sanctions screening against local and international lists, and this screening must be refreshed every time the lists change. Furthermore, you must appoint a UAE-resident MLRO who is senior enough to act independently and has direct access to your company’s board. Finally, you must retain all records for five years and provide annual, role-based AML training to your staff.
New legislation has significantly increased the risks of non-compliance
The 2025 legislative changes have moved the goalposts for enforcement. Under Federal Decree-Law No. 10 of 2025, the authorities no longer need to prove you had “actual knowledge” of money laundering to hold you liable. Knowledge can now be inferred from “objective circumstances.” This means that if a reasonable person in your position should have suspected money laundering, you can be prosecuted.
The penalties for failing to comply are severe and can be financially ruinous for a small free zone company. The Ministry of Economy has already demonstrated its willingness to enforce these rules, imposing more than AED 130 million in administrative fines on DNFBPs since late 2022, with AED 42 million of that occurring in the first half of 2025 alone. The table below outlines the current penalty framework.
| Violation Type | Administrative Fine Range | Criminal Penalties (If Applicable) |
|---|---|---|
| General AML/UBO Violations | AED 50,000 to AED 1,000,000 | Varies by severity |
| Other violations under the 2025 framework | AED 10,000 to AED 5,000,000 | Varies by severity |
| Operating without required registration or licence (Article 20) | — | Imprisonment + AED 200,000 to AED 10,000,000 |
| Failure to submit a Suspicious Transaction Report (STR) | AED 100,000 (minimum) | Potential criminal proceedings |
| Supplying false/misleading Beneficial Ownership info | Administrative fine applies | Distinct criminal offence under 2025 Law |
| Legal Person (Company) Criminal Fine | N/A | AED 5,000,000 to AED 100,000,000 |
The 2025 law also introduced a crucial change regarding the “tipping-off” offence. Previously, you were only liable if you intentionally told a client they were being investigated. Now, even “grossly negligent” disclosure is a crime. Additionally, there is now no statute of limitations on money laundering or terrorist financing offences in the UAE. If you commit a violation today, the authorities can pursue you for it indefinitely.
Common registration errors can lead to avoidable inspections
Most companies that run into trouble with the Ministry of Economy do so through simple administrative errors rather than any criminal intent. One common mistake is registering under the wrong sub-sector on the SACM platform. If you select “Real Estate” when you are actually a “Corporate Service Provider,” your risk profile will be calculated incorrectly, which often triggers an automated red flag for an inspection.
Another frequent error is the appointment of an MLRO who does not reside in the UAE. The law is clear: the person responsible for reporting to the FIU must be a resident and must have the authority to act. If your MLRO is a silent partner living abroad, your registration will likely be rejected, or worse, flagged for non-compliance. Finally, many owners forget to update their goAML profile when they renew their trade licence. Because the system is linked to the national registry, a discrepancy between your goAML data and your current licence can lead to a suspension of your reporting portal access, making it impossible to file reports and leaving you vulnerable to fines.
The UAE is preparing for the FATF 2026 mutual evaluation cycle, so enforcement pressure is only going to increase. If you fall into a DNFBP category, do not guess: have a licensed compliance professional review your licence and activities against the 2025 laws.
Frequently Asked Questions
Does my e-commerce free zone company need to register on goAML?
No, a standard e-commerce or general trading licence does not trigger goAML registration. The requirement is based on specific “Designated Non-Financial Business and Profession” (DNFBP) activities. Unless your e-commerce business is also acting as a virtual asset provider or a dealer in precious metals for cash transactions over AED 55,000, you are generally exempt from the Ministry of Economy’s goAML registration mandate.
What is the deadline for a new free zone company to register?
While the original deadline for existing entities was 30 April 2021, the current rule for new businesses is that you must register promptly after obtaining your trade licence. There is no specific “grace period” defined in the 2025 law; the expectation is that compliance systems, including goAML access, should be established as part of your initial business setup phase to avoid administrative fines.
Can I appoint a third-party consultant as my company’s MLRO?
The law requires the Money Laundering Reporting Officer (MLRO) to be a person with sufficient seniority and authority within the company. While you can hire consultants to help build your AML framework and conduct training, the named MLRO on the goAML portal must be an individual who is a UAE resident and has the power to access all company records and report directly to the board of directors.
What happens if I forget to report a suspicious transaction?
Failing to submit a Suspicious Transaction Report (STR) is a serious violation under Federal Decree-Law No. 10 of 2025. It carries a minimum administrative fine of AED 100,000 per violation and can lead to criminal proceedings. Under the new law, even “gross negligence” in failing to identify or report a suspicious activity can result in significant legal exposure for both the company and the MLRO.
Are precious metal dealers always required to register on goAML?
Registration is mandatory for dealers in precious metals and stones only if they conduct cash transactions at or above the threshold of AED 55,000. If your business model strictly prohibits cash payments and only accepts bank transfers or credit cards, your AML risk profile changes, but you should still consult a professional to ensure your specific licence activity doesn’t require registration regardless of the payment method.
Is there a statute of limitations for AML violations in the UAE?
Under the Federal Decree-Law No. 10 of 2025, there is no statute of limitations for money laundering, terrorist financing, or proliferation financing offences. This means that the authorities can investigate and prosecute these crimes regardless of how much time has passed since the violation occurred, making it vital to maintain accurate records and a robust compliance program from day one.
Navigating the evolving landscape of UAE compliance requires a clear understanding of which rules apply to your specific business model. Whether you are managing a new setup or an established firm, staying informed is your best defense against administrative penalties. Explore UAE Freezone options today →