NFIU goAML Registration in Nigeria: How Reporting Entities Register, Test and File (2026)
Short answer: A Nigerian reporting entity must register on the Nigerian Financial Intelligence Unit's goAML portal, goaml.nfiu.gov.ng, "as an Organisation" before it can file anything. Once the NFIU approves the registration, the compliance officer logs in with the credentials set at registration and files reports through the online web form or by uploading XML. Bureaux de change, designated non-financial businesses and professions (DNFBPs) and non-profit organisations also use the NFIU's RapidAML portal for some reports, and a DNFBP must first declare its activities to the Special Control Unit Against Money Laundering (SCUML). For software that generates and validates NFIU goAML files, see goAML reporting software for Nigeria.
This guide is for chief compliance officers (CCOs), money laundering reporting officers (MLROs) and project teams at Nigerian banks, microfinance banks, payment service providers, insurers, capital-market operators, virtual asset service providers and DNFBPs. It is a practical guide, not legal advice. The NFIU's published registration steps come from a guideline it issued in 2012, before the Money Laundering (Prevention and Prohibition) Act, 2022 and the current goAML version, so confirm the current procedure with the NFIU before you start.
goAML or RapidAML: which portal is yours?
The NFIU runs two portals. goAML is the main one: the NFIU's 2023 guidance says suspicious transaction and activity reports "are primarily filed on the goAML platform", either as a WEB Report (the online form) or by XML Upload of files built to its schema. The NFIU publishes the goAML schema guide, the lookup tables, the web guide and an XML validator for reporting entities.
RapidAML (apps.nfiu.gov.ng/rapidaml) is a simplified portal that, in the NFIU's words, complements goAML. It replaced the old Nil Reports Portal. Its home page lists who files what there:
| Reporting entity | On RapidAML |
|---|---|
| CBN-regulated entities other than bureaux de change | Nil reports and PEP reports |
| Bureaux de change | STRs, currency transaction reports, nil reports and PEP reports |
| SEC-regulated entities | Nil reports |
| NAICOM-regulated entities | Nil reports |
| DNFBPs supervised by SCUML | STRs |
Everything else goes through goAML. A bank, for example, files its suspicious and currency transaction reports on goAML and its nil and PEP reports on RapidAML, so it needs a working registration on both.
Who registers
The NFIU's 2012 reporting guideline says that only chief compliance officers and money laundering reporting officers register on the web portal, "for control purposes". That fits the Act: every financial institution and DNFBP must designate compliance officers at management level at its headquarters and at every branch and local office (section 10 of the MLPPA 2022). Treat the registration as belonging to the compliance function, and update it the day a CCO or MLRO changes: reports filed under a departed officer's account are hard to defend in an examination.
Registering on goAML, step by step
The goAML home page tells new users to register "as a reporting entity under 'Register as an Organisation'" and to log in, once registration is complete, with the credentials they defined. The NFIU's 2012 guideline sets out the steps:
- Open the NFIU's electronic reporting portal and choose Register.
- Complete every required field on the registration form.
- Use the entity code the NFIU has given your institution.
- Wait for approval: the NFIU's compliance unit verifies the data and tells the requesting officer.
- Log in with the username and password set during registration, and test before you file live.
Keep a record of what you submitted and when, because the NFIU's approval is the start of your reporting relationship.
RapidAML has its own registration. Its form asks for a password and then the organisation's RC number, name, entity type (financial institution, DNFBP, other financial institution or non-profit organisation), regulator and sector, followed by the officer's full name, designation and phone number.
DNFBPs: SCUML first
A DNFBP whose business involves cash must submit a declaration of its activities to SCUML before it starts business (section 6 of the MLPPA 2022). SCUML, a department of the Economic and Financial Crimes Commission, registers, certifies and supervises DNFBPs and receives their cash-based and currency transaction reports (section 17). Before any transaction above US$1,000, a DNFBP identifies the customer with a standard data form and photo identification and records the transaction in a numbered register for SCUML, kept for at least five years. Missing the identification and returns deadline of seven days from the transaction is an offence carrying ₦250,000 for each day and possible loss of licence.
In practice a DNFBP deals with three channels: SCUML for registration and currency transaction reports, RapidAML for suspicious transaction reports, and the NFIU's guidance for how those reports should read. Our guide to AML compliance for betting companies and casinos in Nigeria shows how this works for one DNFBP sector.
After approval: testing and filing
- Validate before you upload. The NFIU provides a validator, and its 2012 guideline advises passing every file through it first. A file that passes the schema still goes through the NFIU's quality checks.
- Batch size. The same guideline caps an XML file at 500 transactions.
- Watch the message board. Fully rejected and partially accepted reports are notified on the goAML message board, and the guideline asks CCOs to check it daily. Correct the report and re-send it within 24 hours of the rejection, quoting the original reference. Rejected and partially accepted reports count as not reported.
- Attachments. STRs carry supporting documents: the NFIU's 2023 guidance lists a summary of the internal investigation, the account or policy opening package, statements of account converted to Excel and the instruments used. Our NFIU STR guide covers the full list.
- When goAML is down. The NFIU accepts STRs by e-mail only after a formal application and its permission, and every e-mailed report must be re-sent on goAML once the system is restored.
Registration checklist
- Map each of your report types to its portal: goAML, RapidAML or SCUML.
- Register the CCO and MLRO, and keep a record of the submission and the NFIU's approval.
- DNFBPs: file the SCUML declaration before business starts.
- Validate every XML file with the NFIU's validator before upload, and keep batches within 500 transactions.
- Check the goAML message board daily and re-send any rejection within 24 hours under the original reference.
- Update both registrations when a compliance officer changes.
- Keep every submission, acknowledgement and rejection message with the case; the Act's record-keeping period is at least five years (section 8).
Frequently asked questions
How do I register on the NFIU goAML portal?
Open goaml.nfiu.gov.ng, choose Register as an Organisation, complete the form with the entity code the NFIU gave your institution, and wait for the NFIU to verify and approve the registration. You then log in with the credentials you set. Confirm the current steps with the NFIU, because its published guideline on registration dates from 2012.
Who should register on goAML for a Nigerian institution?
The NFIU's guideline says only the chief compliance officer and the money laundering reporting officer register. The MLPPA 2022 requires compliance officers at management level at head office and every branch (section 10), so registration belongs to the compliance function.
Do DNFBPs use goAML or RapidAML?
DNFBPs supervised by SCUML file suspicious transaction reports on RapidAML, declare their activities to SCUML before starting business, and send currency transaction reports to SCUML (sections 6, 11 and 17 of the MLPPA 2022).
What happens if the NFIU rejects a report?
Rejections and partial acceptances are posted on the goAML message board. The NFIU's guideline asks for the corrected report within 24 hours of the rejection, under the original reference, and treats rejected and partially accepted reports as not reported until then.
Can we e-mail an STR to the NFIU instead?
Only in a system failure and only with the NFIU's prior permission, using its sector e-mail addresses, and the report must be re-sent through goAML once the system is restored.
goAML reporting for Nigerian institutions with Creodata
Creodata's goAML Reporting Platform generates schema-valid goAML XML, validates every report against the schema and business rules before submission, compiles parties, accounts and narrative in one STR workspace, and keeps an immutable record of every report, amendment and filing. Registration on the NFIU's portals remains your institution's own step: the platform prepares and validates what you file there. See goAML reporting software for Nigeria, our Nigeria NFIU goAML reporting guide for the report types, and AML compliance software in Nigeria for the monitoring and case management behind each report.
See it on your own report types — request a demo.