Under Federal Decree-Law No. 10 of 2025 and its Executive Regulations (Cabinet Resolution No. 134 of 2025), every UAE DNFBP must keep a current record of its ultimate beneficial owners and file its anti-money-laundering reports through the Financial Intelligence Unit's goAML portal. The workflow has four fixed steps: maintain the UBO and shareholders registers and update them within 15 days of any change, pre-register on SACM and enrol on goAML at no charge, appoint a Money Laundering Reporting Officer (MLRO), and file suspicious transaction reports without delay plus the regulated-activity reports your sector triggers. Administrative fines reach AED 5 million per violation, and the Ministry of Economy has suspended establishments that never registered at all.
Who must run this workflow
The Executive Regulations define Designated Non-Financial Businesses and Professions (DNFBPs) by activity, not company size. The categories include auditors and accountants, real estate agents and brokers, dealers in precious metals and stones, trust and company service providers, and other specified professions — with virtual asset service providers (VASPs) held to the same reporting architecture. For most DNFBPs the supervisory authority is the Ministry of Economy and Tourism; financial free zones such as DIFC and ADGM follow their own rulebooks on top of federal law.
Step 1 — Keep the UBO register current
Cabinet Resolution No. 109 of 2023 requires every legal person in the UAE to maintain a Real Beneficiary (UBO) Register and a Partners or Shareholders Register. Amendments must be recorded within 15 days of coming to the company's knowledge, the registers must be retained for at least 5 years after dissolution or liquidation, and a liquidator hands the registers back to the registrar within 30 days of liquidation.
Two practical points decide most inspections: the register must match the trade licence and share certificates at all times, and the person who signs it must be able to evidence the chain of ownership — including indirect holders, where a foreign parent sits at the top of the chain.
Step 2 — Pre-register on SACM and enrol on goAML
goAML is the reporting portal of the UAE Financial Intelligence Unit (FIU). Every reporting entity first pre-registers on SACM — the FIU's Services Access Control Manager — which captures the entity type and supervisory authority and issues the credentials that open goAML. There is no government fee for registration on either step; the FIU does not charge a DNFBP to enrol.
Step 3 — Appoint the MLRO and adopt written policies
A named compliance officer (MLRO) must review records, assess suspicion, and decide whether a transaction is reported to the FIU or retained. Written policies covering customer due diligence, record-keeping, sanctions screening and reporting escalate the firm from "registered" to "defensible" — the difference that supervisory visits actually test.
Step 4 — File through goAML
Where a transaction or funds are suspected — in whole or in part — to represent criminal proceeds, the firm must notify the FIU without delay, regardless of value, with all available data (FDL 10/2025, Art. on FIU notification). There is no minimum reporting threshold. Separately, sector activity reports — such as the Dealers in Precious Metals and Stones Report for cash dealings at or above the AED 55,000 threshold in the Ministry of Economy's revised guidelines and real-estate activity reports — are filed through goAML within the deadlines set by Cabinet Resolution No. 134 of 2025.
The filing map at a glance
| Obligation | Rule | Deadline | Where filed |
|---|---|---|---|
| UBO / Real Beneficiary Register | Keep current at all times | Record amendments within 15 days of knowledge | Company records (available to the registrar) |
| Partners / Shareholders Register | Keep current at all times | Within 15 days of knowledge | Company records |
| goAML enrolment | Mandatory for FIs, DNFBPs, VASPs | Before first report is due | SACM → goAML portal |
| STR / SAR | On suspicion, any value | Without delay | goAML |
| DPMSR (precious metals/stones) | Cash dealings at or above AED 55,000 | Within the CR 134/2025 window | goAML |
| Register retention | Keep after liquidation | At least 5 years from dissolution | Company / liquidator records |
Penalties for missing the workflow
Failure to report a suspicious transaction without delay is a federal crime under FDL 10/2025, and administrative fines reach AED 5,000,000 per violation for DNFBP breaches. Enforcement is active: the Ministry of Economy suspended the operations of 50 DNFBP establishments for three months in a single quarter for failing to register on goAML — registration gaps alone are enough to stop a business from trading.
Frequently asked questions
Do I still need goAML if my UBO register is already filed with the registrar? Yes. The registrar filing and the FIU portal are two separate obligations; goAML registration is what allows you to file reports, and DNFBPs are required to register even in quiet periods.
How long does goAML registration take? SACM pre-registration issues credentials first; goAML enrolment follows once your licence data and MLRO details are ready. A registration submitted before the paperwork is ready is the most common cause of a stalled login.
What UBO changes must be recorded? Any change in ultimate beneficial ownership or shareholder data must be recorded in the register within 15 days of the company coming to know of it.
Can a group entity file for the whole group? Each legal person maintains its own registers and its own goAML enrolment; a parent cannot file on behalf of a subsidiary.
Need the workflow built and inspected before the next supervisory visit? Finanshels' AML compliance team sets up goAML registration, UBO registers, policies and MLRO support for UAE DNFBPs.
Finanshels is an FTA Registered Tax Agency and is not affiliated with the FTA, the FIU or any government body.
