goAML Registration in the UAE: SACM, the Authenticator and Entity Registration, Step by Step (2026)

Short answer: Designated non-financial businesses and professions (DNFBPs) supervised by the Ministry of Economy & Tourism (MoET) register on goAML in two steps on the Financial Intelligence Unit's (FIU's) eServices. First comes the Services Access Control Manager (SACM), which issues a user name used with an authenticator app. Then comes the entity registration on goAML itself. MoET approves both steps. You need the trade licence, a letter appointing your compliance officer, and their Emirates ID or passport.

This guide is for compliance officers, money laundering reporting officers (MLROs) and owners of UAE real estate brokerages, dealers in precious metals and stones, accounting and audit firms, corporate service providers and other DNFBPs. It follows MoET's own registration guides. It is a practical guide, not legal advice: if your supervisor or the FIU tells you something different, follow them.

---

Who must register

Every suspicious transaction report in the UAE goes to the FIU, "exclusively", from financial institutions, DNFBPs and virtual asset service providers (Article 11 of Federal Decree by Law No. 10 of 2025). The executive regulations require reports to go "through the Unit's electronic system". That system is goAML.

MoET's "Register in goAML" page is blunt: "Registration of Designated Non-Financial Companies on goAML Portal is Mandatory", and "Failure to register on goAML may result in severe penalties invoked by the Ministry of Economy." Its registration guide applies to the DNFBPs defined in Article 3 of Cabinet Resolution No. 134 of 2025:

• real estate brokers and agents;
• dealers in precious metals and stones;
• lawyers, notaries, other independent legal professionals and independent accountants, for listed transactions;
• company and trust service providers;
• commercial gaming operators.

MoET supervises the DNFBP trade licences issued by mainland registrars and commercial free zones. The financial free zones are excluded and have their own supervisors: MoET's guide names the FSRA (Abu Dhabi Global Market) and the DFSA (Dubai International Financial Centre).

Banks, exchange houses, finance companies and other institutions the Central Bank of the UAE supervises must register too: the Central Bank's rulebook makes goAML registration mandatory for its supervised entities. The SACM form asks for your supervisory body, so follow your own supervisor's instructions. The steps below are MoET's, for DNFBPs.

---

Before you start

---

Step 1: SACM and the authenticator

The Services Access Control Manager (SACM) is the FIU's access gate. Register at services.uaefiu.gov.ae/sacm/.

Entity details

The person registering (the compliance officer or MLRO)

Accept the terms and submit, and the system gives you a reference number. Then:

1. Verify your e-mail. The request does not reach MoET until you click the verification link.
2. Wait for MoET-AML's decision. It approves the request, or rejects it with a reason. If rejected, fix the issue and resubmit, and ask MoET at aml@moet.gov.ae if anything is unclear.
3. Get your user name and secret key. The approval e-mail carries an e-mail one-time password (OTP) and a link, and a second OTP goes to your mobile. At services.uaefiu.gov.ae/sacm/getkey.php, enter your registered e-mail and both OTPs, then choose "Get Secret Key". An e-mail then brings your user name and secret key. The OTP is valid for 24 hours; if it expires, e-mail goaml@uaefiu.gov.ae from the registered address and ask for a new one.
4. Set up the authenticator. Register the user name and secret key in the authenticator app. It generates a six-digit code that you need every time you use goAML.

---

Step 2: register the entity on goAML

Have your SACM user name (it starts UMOEC), the authenticator on your phone and the same PDF ready.

1. Go to services.uaefiu.gov.ae/goaml/ and log in with the SACM user name and the authenticator code as the password.
2. Choose Register.
3. Enter the entity's details, then its address and phone number.
4. Register the compliance officer or MLRO as the Administrator, with their address and phone number.
5. Upload the documents.
6. Choose Preview and Submit, check everything, enter the captcha and submit. Incomplete or missing information can get the request rejected.

The system issues a reference starting REP, and you receive it by e-mail. MoET-AML reviews the request again. If it approves, an e-mail headed "FIU: Request for account accepted" gives your entity its Organisation ID. If it rejects, repeat the registration after fixing the stated reason.

---

Logging in afterwards

goAML in the UAE has two levels of login:

1. Your SACM user name and the six-digit authenticator code.
2. The goAML user name and password you created in step 2.

The FIU publishes guides to each report type and to using the system on its website. For help, write to goaml@uaefiu.gov.ae (the FIU) or aml@moet.gov.ae (MoET's AML department).

---

Changing the registered MLRO

When your compliance officer changes, MoET's guide sets out four steps:

1. MoET approval. E-mail aml@moet.gov.ae with the trade licence, the authorisation letter appointing the new MLRO and their ID. The e-mail must come from the owner or ultimate beneficial owner, the outgoing MLRO or the incoming MLRO.
2. A new SACM request in the new MLRO's name, with the same documents plus a print-out of MoET's approval e-mail.
3. A new goAML user. Log in, choose Register, then "User (Reporting Entity)", and register the new MLRO against the entity's Organisation ID. If you do not have the Organisation ID, ask aml@moet.gov.ae.
4. Update the contact person details on the entity's record.

Do this as soon as the appointment is approved. Reports keep falling due while you have no working account.

---

What you file once registered

Each is explained in our guide to goAML report types in the UAE. For the law behind them, see our Federal Decree-Law No. 10 of 2025 explainer, and for the reporting rules in one place, our UAE goAML reporting guide.

---

Registration checklist

1. Confirm you are a DNFBP under Article 3 of Cabinet Resolution 134 of 2025, and which supervisor licenses you.
2. Appoint the compliance officer at management level, with your supervisor's approval.
3. Scan the trade licence, authorisation letter and ID into one PDF under 5MB.
4. Whitelist the FIU's no-reply addresses, and install an authenticator app on the compliance officer's phone.
5. Complete SACM, verify the e-mail, collect the user name and secret key within 24 hours of approval, and set up the authenticator.
6. Register the entity on goAML with the compliance officer as Administrator, and keep the REP reference and the Organisation ID.
7. Record both logins, and plan how a replacement MLRO will be approved and registered.

---

Frequently asked questions

How do I register on goAML in the UAE?

A DNFBP registers in two steps on the FIU's eServices. First, SACM at services.uaefiu.gov.ae/sacm/, which after MoET's approval gives you a user name for an authenticator app. Second, the entity registration on goAML at services.uaefiu.gov.ae/goaml/, which after MoET's approval gives you an Organisation ID.

What documents are needed for goAML registration in the UAE?

The trade licence, an authorisation letter appointing the compliance officer or MLRO (on letterhead or with the entity's seal), and the compliance officer's Emirates ID or passport. MoET asks for them scanned into one PDF of no more than 5MB.

Is goAML registration mandatory for DNFBPs in the UAE?

Yes. MoET states that registration of DNFBPs on the goAML portal is mandatory, and that failure to register may result in penalties from the Ministry.

What is SACM in goAML?

The Services Access Control Manager, the FIU's access layer in front of goAML. It issues the user name you register in an authenticator app, and the app's six-digit code is your first-level password every time you log in.

How do I change the MLRO on goAML?

Get MoET's approval by e-mail at aml@moet.gov.ae, submit a new SACM request in the new MLRO's name with the approval attached, register the new MLRO as a user under the entity's Organisation ID, and update the contact details.

---

goAML reporting for UAE institutions with Creodata

Creodata's goAML Reporting Platform generates schema-valid goAML XML for STRs and SARs, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. It can be configured to support DPMSR and REAR reports. Registration on the FIU's portal remains your institution's own step: the platform prepares and validates what you file there. See goAML reporting software for the UAE, and AML compliance software in the UAE for the screening, monitoring and case management behind each report.

See it on your own report types — request a demo.