FIC goAML Registration in Zambia: Who Registers, the Portal Steps and What to Prepare (2026)

Short answer: Zambian reporting entities submit electronic reports to the Financial Intelligence Centre (FIC) on its goAML portal, goaml.fic.gov.zm, and must register before they can log in. The portal tells new users to "register as a reporting entity" under "Register as an Organisation". The form has an organisation-details step, an "Administrator" step and one to five attachments. The FIC accepts or rejects each registration by email. Further staff then join as "User (Reporting Entity)".

This guide is for compliance officers, money laundering reporting officers (MLROs) and IT teams at Zambian banks, non-bank financial institutions, insurers, securities firms, bureaux de change, money transfer businesses, casinos, professional firms, estate agents, dealers in precious metals and stones, virtual asset service providers (VASPs) and accountable institutions. It is a practical guide, not legal advice. We found no FIC goAML user guide or registration notice, so the steps below come from the portal's public pages and settings as they stood on 1 October 2026. Confirm anything unclear with the FIC.

---

goAML in Zambia

The FIC began implementing the UNODC's goAML system in 2023. Its bulletin for the first quarter of 2024 said: "We envisage to go-live in quarter 3 of 2025." We found no announcement of the actual go-live date.

The production portal is at goaml.fic.gov.zm. Its home page opens with "Welcome to the FIC Zambia goAML System" and explains: "The goAML system is for electronic submission of various reports to the FIC and engagement with Competent Authorities." It adds: "You have to login for you to be able to submit a report." On 1 October 2026 the footer showed goAML version 5.6.1.61046.

---

Who registers

Since the 2020 amendment, the Financial Intelligence Centre Act, 2010 defines a reporting entity as "an institution required to make reports under this Act which is regulated by a supervisory authority, and includes a financial service provider, a designated non-financial business or profession or a virtual asset service provider".

Accountable institutions are a separate class with their own duties, including reporting currency transactions at or above the Kwacha equivalent of USD 10,000 (SI No. 54 of 2022, Fourth Schedule). The portal's list of business types includes "Accountable Institutions", so ask the FIC how it expects yours to register. The list also names, for example, "Commercial Bank", "Micro Finance Institution", "Bureau de Change", "Money Value Transfer", "Casino", "Legal Practitioner" and "Real Estate Agent". It has no separate entry for VASPs.

VASPs also register with the FIC itself. The FIC's VASP Sector Guidelines (December 2022) say that, on top of company registration with the Patents and Companies Registration Agency (PACRA), "VASPS are required to register with the Centre", and list the documents to supply. The FIC counted three registered VASPs in Zambia in 2024.

---

Before you register: an FIC-approved compliance officer

Section 23 of the Act, as substituted in 2020, requires every reporting entity to designate a compliance officer "at senior management level". The officer needs "two years' experience in the field of regulatory compliance" and no disqualifying conviction, and must be "certified and approved by the Centre".

The FIC's approval form must be submitted "before an Officer is appointed as a Compliance Officer", and the FIC's Director-General signs the approval. A second form covers MLROs, who support the compliance officer and also need FIC approval before appointment. In 2024 the FIC approved 112 compliance officers and 28 MLROs.

FIC guidelines tie portal access to that approval. The Banking Sector Reporting Guidelines (2019) say: "In order for a reporting entity to report an STR or CTR to the FIC, the designated compliance officer should obtain login credentials from the FIC for the FIC online reporting portal." Other officers' names and documents go to the FIC "for vetting, approval and subsequent configuration to the online reporting portal". The VASP Sector Guidelines (2022) make the same link: "Once approved by the FIC, the VASP should ensure that the designated compliance officer is provided with credentials to the online reporting portal."

These guidelines predate goAML and do not name it. We found nothing that says the goAML Administrator must be the approved compliance officer. Plan on the same order, approval first and portal access second, and confirm it with the FIC.

---

Step 1: register the organisation

The home page calls the option "Register as an Organisation". The registration screen labels it "Register an Organisation" and offers two types, "Reporting Entity" and "Stakeholder". Following the home page's instruction, choose "Reporting Entity".

The form, as configured on 1 October 2026:

Clear two gaps with the FIC before you start:

• Attachments. The FIC has not published which documents it expects.
• SWIFT/BIC. The field is mandatory in the form's settings. The FIC has not said what an organisation without a SWIFT/BIC code should enter.

---

Step 2: wait for the FIC's decision

After submission the portal confirms "Registration info has been submitted". It asks you to "wait for notification of acceptance/rejection by email" and gives a reference number. Keep that number for any follow-up.

Once the FIC accepts, the home page explains: "Once the registration process has been successfully completed, you can log in with the credentials you have previously defined." Set those credentials for a named person, not a shared mailbox, and register well before your first report is due.

---

Step 3: add the other users

Other staff do not register the organisation again. Under "Register a User" they choose "User (Reporting Entity)", which the portal describes as "Register as a user of an existing organisation." The user form asks for the "Organization ID", a user name, first and last names and an email address. The NRC number, nationality, occupation and ID number are optional. A passport number becomes mandatory if a passport country is entered.

The portal's settings also contain options for individual users and supervisory bodies, but both are set not to show.

A second approved officer with their own login means a three-working-day deadline never depends on one person.

---

Test site and technical settings

The FIC also runs a goAML test environment, labelled "TEST ENVIRONMENT", on the same goAML version as production. We found no FIC statement on whether you must test there before you file live.

The production portal's settings on 1 October 2026:

If you generate reports as XML, build them to the schema version the portal reports and validate every file before upload. The FIC's goAML report-type codes are not public: the list needs a login, so check them once registered.

---

Registration in law

We found no provision that names goAML or requires goAML registration. Four rules frame it:

• The FIC's register. Section 36A of the Act, added in 2016: "The Centre shall maintain a register of all reporting entities, which shall contain such particulars as are prescribed." We found no regulation that prescribes those particulars.
• Supervisory registration. Regulation 20 of the Financial Intelligence Centre (General) Regulations, 2022 (SI No. 54 of 2022): "A reporting entity shall be registered or licensed by a designated supervisory authority for the purposes of the Centre supervising and enforcing compliance under the Act and these Regulations." A breach makes a person "liable to an administrative sanction provided under the Act".
• The compliance officer. Section 23(4) requires the officer to be "certified and approved by the Centre".
• The forms. The report forms prescribed in 2022 say to file via the online portal, with email or post only in exceptional circumstances. They predate goAML and do not name it.

Administrative sanctions under section 49C run from a caution up to a financial penalty of one million penalty units, after 14 days' written notice, with an appeal to the High Court within 30 days.

For entities the Bank of Zambia licenses or designates, its 2017 AML Directives add a rule: if the compliance officer resigns or is dismissed, the Bank and the FIC get a written statement of the reasons within ten days. Update the portal's users at the same time.

---

What you file once registered

For the law behind both, see the Financial Intelligence Centre Act explained, our Zambia FIC goAML compliance guide and our buyer's guide to AML compliance software in Zambia.

---

Getting help

The portal's help text says: "Kindly contact the FIC for any assistance with the system." The goAML support line is (+260) 211 220 254 and the email address is gosprt@fic.gov.zm. We found no FIC goAML user guide, registration manual or registration notice on the FIC's website or on the portal.

---

Registration checklist

1. Confirm whether your institution is a reporting entity, an accountable institution or a VASP, and which supervisory authority covers it.
2. Have your compliance officer, and any MLROs, approved by the FIC before appointment.
3. Gather the organisation's business type, name, acronym, email address, SWIFT/BIC, addresses and phone numbers, and the Administrator's details.
4. Ask the FIC which attachments it expects and, if you have no SWIFT/BIC code, what to enter.
5. Register under "Register an Organisation" as a "Reporting Entity", upload one to five files and keep the reference number.
6. Wait for the FIC's email, then log in with the credentials you defined.
7. Have other approved staff register as "User (Reporting Entity)" with your "Organization ID".
8. Build XML to schema version 5.0, and ask the FIC whether to test on its test environment first.
9. Review the user list whenever a compliance officer or filer changes.

---

Frequently asked questions

How do I register on goAML in Zambia?

Go to goaml.fic.gov.zm and register the institution under "Register an Organisation" as a "Reporting Entity", with the organisation details, the Administrator and at least one attachment. Once the FIC accepts the registration by email, you log in with the credentials you defined.

Who should be the Administrator?

The FIC has not published a rule. Its pre-goAML guidelines gave portal credentials to the FIC-approved compliance officer, so confirm with the FIC before naming anyone else.

Which documents does the FIC want with a registration?

It has not published a list. The form accepts one to five .doc, .docx, .png, .jpg or .pdf files, so ask the FIC on gosprt@fic.gov.zm or (+260) 211 220 254 what to attach.

Can more than one person use the portal for an institution?

Yes. Once the organisation is registered, other staff register as "User (Reporting Entity)" using the organisation's ID.

Is there a goAML test environment in Zambia?

Yes. The FIC runs a site labelled "TEST ENVIRONMENT" on the same goAML version as production, but we found no statement on whether you must test there first.

Does the law require goAML registration?

We found no provision that names goAML. The Act requires the FIC to keep a register of all reporting entities (section 36A), and SI No. 54 of 2022 requires each reporting entity to be registered or licensed by a designated supervisory authority (regulation 20).

---

goAML reporting for Zambian institutions with Creodata

Creodata's goAML Reporting Platform generates schema-valid goAML XML from core-banking data, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. Registration on the FIC's portal remains your institution's own step: the platform prepares and validates what you file there. See goAML reporting software for Zambia, and AML compliance software in Zambia for the monitoring and case management behind each report.

See it on your own report types — request a demo.