goAML Registration in the UAE: A Step-by-Step Guide for Real Estate Brokers

This guide covers the whole goAML registration process in the UAE: who has to register, the documents you need, both stages step by step, logging in with Google Authenticator, the errors that most often hold an application up, and what happens if you don’t register.

What is goAML in the UAE?

goAML is the UAE FIU’s electronic reporting system. Since 27 June 2019, all reporting entities in the UAE have had to send their reports to the FIU through it. For a real estate broker that means:

• REAR (Real Estate Activity Report): cash deals of AED 55,000 or more, and deals paid in crypto;
• STR and SAR: suspicious transactions and suspicious activity;
• HRC / HRCA: deals linked to high-risk countries;
• CNMR (formerly FFR) / PNMR: a customer matching a sanctions list. These two go through goAML to the EOCN and your supervisor.

goAML is also how the FIU and your supervisor reach you: notifications, requests for information and messages arrive on the goAML Message Board and by email.

Which report applies to which deal is covered in our guide to AML for real estate agents in the UAE.

Who must register on goAML

Every DNFBP (Designated Non-Financial Business or Profession) supervised in the UAE has to register. Real estate brokers and agents are DNFBPs when they conclude purchase or sale transactions, with no minimum threshold (Cabinet Resolution 134/2025, art. 3(2)). One sale is enough.

• Leasing only. Renting out property does not on its own make you a DNFBP. If you do both sales and leasing, you have to register, and the AML rules apply to your sales. More in What is a DNFBP in the UAE.
• Mainland or free zone. Brokers licensed in Dubai, Abu Dhabi or any other emirate, on the mainland or in a commercial free zone, register with the Ministry of Economy and Tourism (MoET) as their supervisory body.
• ADGM or DIFC. Firms in the financial free zones have their own supervisors and are outside the scope of this guide.

goAML and EOCN are two separate registrations

Brokers often confuse the two. You need both:

This guide covers goAML. EOCN notifications have their own sign-up.

Before you start: documents and details

The FIU’s registration guide asks for the following. Have everything ready before you begin, because the codes you receive expire quickly.

The company

• Legal name exactly as on the trade licence, and the trade licence number
• A scanned PDF of the valid trade licence (the steps to get one are in our trade licence guide)
• Your supervisory body (MoET for most brokers)
• A company email that the right people can access; goAML sends system notifications and your Org ID there

The Compliance Officer, who registers the company

• Full name, nationality, Emirates ID number (or passport)
• Scanned PDF of the Emirates ID, front and back
• Their own email address
• A UAE mobile number, because international numbers can’t receive the SMS codes
• A smartphone with Google Authenticator

The letter

• An authorisation letter appointing the Compliance Officer and authorising them to register the company on goAML. There is no official template or required wording. A signed letter on company letterhead naming the Compliance Officer, with their Emirates ID number, is enough.

Who should be your Compliance Officer? Under Cabinet Resolution 134/2025 (art. 22), the Compliance Officer is appointed at management level, with independence in decision-making. In a small brokerage it is often the owner or manager. The Compliance Officer becomes the organisation’s administrator on goAML.

Two rules from the FIU’s FAQ save a rejection:

• Each email address and each mobile number can be used for only one pre-registration request.
• Combine all documents into one PDF under 5 MB, with a short English file name and no special characters.

Checklist

goAML readiness checklist

Tick what you already have. The ticks stay in this browser and are not sent anywhere.

Based on the FIU’s goAML registration guide and FAQ. General information, not legal advice; your Compliance Officer is responsible for the registration.

How to register on goAML: step by step

Registration has two stages. First you get access to the FIU’s secure portal, SACM (Services Access Control Management). Then you register your organisation on goAML itself. Your supervisor approves each stage.

Step 1. Submit the pre-registration request. Go to the SACM portal (`https://services.uaefiu.gov.ae`) and choose Registration. Fill in:

• Registration type: Reporting Entity
• Entity name, as on the trade licence
• Supervisory body: Ministry of Economy and Tourism
• ID / registration number: your trade licence number
• The Compliance Officer’s details: name, nationality, ID type and number, email, UAE mobile
• Attachment: the single PDF with the licence, the ID and the authorisation letter

Tick the terms and conditions and submit. The FIU’s own registration guide, available from the SACM portal and the goAML home page, shows each screen if you want to follow along.

Step 2. Verify your email. An email arrives from `no-reply.sacm@uaefiu.gov.ae` with a temporary registration number and a link. Click the link, and the request goes to your supervisor.

Step 3. Wait for supervisor approval. MoET’s AML team reviews the request and approves or rejects it, and you get an email either way. MoET doesn’t publish a processing time, so allow some slack.

Step 4. Get your secret key within 24 hours. The approval email contains a link to `https://services.uaefiu.gov.ae/sacm/getkey.php` and an email code, and an SMS code arrives separately. Open the link, enter your email, the email code and the SMS code, and click Get Secret Key.

The email and SMS codes are valid for 24 hours. Pick up the key on the day the approval arrives.

The page shows a QR code and the same secret key as text. A second email brings your username and the access link. Keep this email, because you will need it to recover access later.

Step 5. Set up Google Authenticator. On the Compliance Officer’s phone, install Google Authenticator, tap Get started, then Scan a QR code (or Enter a setup key). Name the account `goAML Portal`, keep Time based selected and add it. The app now shows a 6-digit code that changes every 30 seconds.

The secret key is personal. Each user in your company sets up their own, and keys can’t be shared.

Step 6. Log in to goAML. Go to `https://services.uaefiu.gov.ae` → SYSTEMS → goAML. In the pop-up, enter your SACM username and, as the password, the current 6-digit code from Google Authenticator.

Step 7. Choose “Register a new Organization”. On the goAML home page, choose the option to register a new organisation and select Reporting Entity.

Don’t choose “Register as a Person” at this point. That option adds users once the organisation is active, and trying it first returns an “Organization ID not recognized” error.

Step 8. Fill in the organisation details.

• Organisation type that matches your licensed activity under MoET
• Name, incorporation number (trade licence number), commercial name
• Incorporation city, emirate and country
• Contact person: your Compliance Officer
• Acronym, business activity, website (if any)
• Is financial? No; SWIFT/BIC: N/A
• Email: the company email that will receive goAML notifications
• Phone numbers: country code `971`, then the number without `00`, `+`, spaces or hyphens

Then enter the Compliance Officer’s details as the registering person and upload the documents. The Compliance Officer is registered automatically as the organisation’s administrator (RE Admin), with no separate person registration.

Step 9. Upload and submit. Click Browse, select the PDF, click Upload and wait for the confirmation pop-up. If no pop-up appears, your browser is blocking pop-ups and the file hasn’t uploaded.

Step 10. Wait for MoET to finalise the registration. Once your supervisor approves the registration, an email from `no-reply.goaml@uaefiu.gov.ae` arrives at the company email with your Org ID. You are registered.

Registering in Dubai, Abu Dhabi or a free zone

goAML is a federal platform, so the process is the same in every emirate. Your supervisor decides the path. A broker licensed in Dubai, Abu Dhabi, Sharjah or a commercial free zone selects MoET; only ADGM and DIFC firms use a different supervisor.

How long goAML registration takes

Your own work takes about an hour: preparing documents, submitting the SACM request, picking up the key and filling in the goAML form. The rest is waiting for MoET twice, to approve the SACM request (step 3) and to finalise the organisation (step 10). Neither MoET nor the FIU publishes a processing time for either step, and a rejection restarts the wait. Start as soon as your licence is issued instead of leaving it to the week of your first deal.

Checking your status. Every approval or rejection arrives by email: SACM decisions to the Compliance Officer’s email, goAML decisions and the Org ID to the company email. Check the junk folder first.

Common reasons goAML registration fails

The FIU’s FAQ lists these problems:

• “ERROR 2” during registration. Type the details by hand instead of pasting them from documents. Keep attachments under 5 MB and file names short, in English, with no special characters.
• Documents “not uploaded” although you uploaded them. You clicked Browse but not Upload, or the confirmation pop-up was blocked.
• Several documents and one upload field. Merge everything into one PDF.
• No email code. Check junk mail. If your company’s mail server blocks it, ask IT to whitelist `no-reply.sacm@uaefiu.gov.ae` and `no-reply.goaml@uaefiu.gov.ae`, then ask the FIU to resend.
• “Unable to validate your input” when picking up the key. The codes have expired; email the FIU to refresh them.
• Wrong mobile number or wrong details. Submitted details can’t be edited. Email the FIU to cancel the request and submit a new one.
• A foreign mobile number. SMS codes only reach UAE numbers.
• The Compliance Officer is still registered at a previous employer. The old employer has to deactivate them on SACM and goAML first.

When MoET rejects a request, the cause is usually an error in it: details that don’t match the trade licence or the Emirates ID, a missing, expired or unreadable document, the wrong supervisory body, or no authorisation letter. The rejection email states the reason. Fix it and submit a new request.

goAML login, 2FA and password reset

Logging in each time:

1. Go to `https://services.uaefiu.gov.ae` → SYSTEMS → goAML.
2. In the pop-up, enter your SACM username and the current Google Authenticator code.
3. On the goAML page, enter your goAML username and password.

Forgot your goAML password? Click Forgot Password on the goAML login screen, enter your username and email, and follow the link sent to you.

Forgot your username? Email `goaml@uaefiu.gov.ae` with the entity name, your name, registered email, Emirates ID number, passport number, date of birth, Org ID and nationality.

Google Authenticator code not accepted? The phone’s clock is usually out of sync. In Google Authenticator, go to Settings → Time correction for codes → Sync now, or reinstall the app.

New phone? Install Google Authenticator again and repeat the secret key set-up from your original SACM emails. This is why you keep them.

Test environment. The SACM portal also links to a goAML UAT (test) environment, where you can practise filing reports without sending anything to the FIU.

Adding users and changing the Compliance Officer

Adding a user. The new user completes their own SACM pre-registration, MoET approves it, and they set up their own Google Authenticator. They then log in to goAML and choose Register as a Person under your Org ID, and your Compliance Officer approves them as the organisation’s admin.

Changing the Compliance Officer needs your supervisor:

1. Appoint the new Compliance Officer and email MoET for approval before they register.
2. The new Compliance Officer completes SACM pre-registration, and MoET approves it.
3. They register on goAML as a Person under your Org ID.
4. MoET asks the FIU to deactivate the old officer and activate the new one.
5. The new officer updates the contact person under My goAML → My Org Details, and MoET approves the change.

Keep the old officer active until the new one is, or nobody will be able to file reports in the gap.

Is there a goAML registration deadline?

There is no separate deadline counted from the date of licensing. The obligation has applied since 2021, when the Ministry of Economy set a deadline for existing DNFBPs to register and announced fines for those who didn’t. For a new brokerage the rule is that you must be registered before you start working with your first customer on a sale or purchase, because without an account you can’t file a report that deal may need. Approval times aren’t published, so start right after your licence is issued. The full sequence from licence to bank account is in our guide on how to open a company in the UAE.

What happens if you don’t register

• Criminal liability. Running a DNFBP business without the required registration is punishable by imprisonment and/or a fine of AED 200,000 to AED 10,000,000 (Federal Decree-Law No. 10 of 2025, art. 32).
• Administrative fines. MoET can fine AED 10,000 to AED 5,000,000 per violation, increase the fine if the same violation recurs within a year, and publish the sanction (art. 17).
• Suspension. In August 2023 the Ministry of Economy suspended 50 DNFBPs for three months for failing to register on goAML.
• No way to report. Without goAML you can’t file a REAR or an STR, so every cash or crypto deal becomes a second violation.

How much does goAML registration cost?

Neither the FIU nor MoET lists a fee for goAML registration. The cost is your time: getting the documents and the letter right, waiting for approvals and fixing rejections.

If you’d rather not do it alone, our AML subscription for brokers includes goAML registration. We prepare the authorisation letter, the merged PDF and a sheet with every field pre-filled, then guide your Compliance Officer through three short screen-share sessions, about an hour in total. Your Compliance Officer submits everything personally. We never ask for your codes, passwords or authenticator, and the accounts stay in your company’s name.

We’ll do the registration with you →

This guide is general information, not legal advice.

What this means for you

goAML registration is short work that gets delayed by small mistakes. Three things decide how fast it goes: