AML compliance software for reporting entities in Dubai and across the UAE.
Customer due diligence and risk rating, sanctions and PEP screening, transaction monitoring, case management and reporting to the UAE Financial Intelligence Unit through goAML, in one analyst workspace for banks, exchange houses, virtual asset service providers and DNFBPs under the UAE's 2025 anti-money laundering law.
Built for Federal Decree-Law No. 10 of 2025 and the Financial Intelligence Unit.
Federal Decree by Law No. (10) of 2025, its executive regulations in Cabinet Resolution No. (134) of 2025, and supervisors' guidance set out what a reporting entity has to do. Each duty maps to a module, so the evidence sits where an examiner will look for it.
Identify customers and rate their risk
Six-factor customer risk rating across country, industry, product, channel, behaviour and PEP/sanctions exposure, with four-eyes overrides, plus a beneficial-owner graph for legal-entity customers.
Apply enhanced due diligence to PEPs and higher-risk customers
An EDD workflow inside case management, with periodic reviews scheduled automatically by risk band so a high-risk file does not go stale.
Screen customers against sanctions lists and PEP data
Multi-script, locale-aware matching against lists synced from providers such as Dow Jones and World-Check, plus manual upload for lists you maintain yourself, with versioned lists and freshness dashboards.
Monitor transactions for suspicious activity
A rule engine running in batch and streaming, with typology-aligned starter rules, back-testing and versioned promotion, fed by REST, SFTP, Kafka, CDC or ISO 20022 connectors.
Report suspicious and cash transactions to the FIU
A draft, review, approve and submit lifecycle with acknowledgement handling. The goAML XML is generated and validated by the goAML reporting module, with a manual download if the portal is down.
Keep records and show supervisors the evidence
An append-only audit log behind every decision, evidence packs for inspections, a read-only regulator portal, and an obligation registry that turns new guidance and amendments into tracked tasks.
This maps software capability to obligations; it is not legal advice. For registration and filing mechanics, see the UAE goAML reporting guide.
What the UAE requires, control by control.
For the UAE's reporting institutions, whichever regulator supervises them.
Each sector answers to the authority that supervises or licenses it; the Ministry of Economy & Tourism and the Ministry of Justice supervise designated non-financial businesses and professions.
Supervised by the authority that licenses them, such as the Central Bank of the UAE or the Capital Market Authority (formerly the Securities and Commodities Authority), or in the financial free zones the Dubai Financial Services Authority and Abu Dhabi Global Market.
The 2025 AML law explainedLicensed by the Central Bank under its Exchange Business Regulation (Circular No. 7/2025). Its Standards require real-time sanctions screening of every party before a transaction, and enhanced due diligence on an individual's exchanges of AED 55,000 or more within 90 days.
AML for exchange housesMust apply customer due diligence to occasional transactions of AED 3,500 or more, and report suspicions to the FIU like any other reporting entity.
AML for VASPsDNFBPs for cash transactions of AED 55,000 or more, which they report to the FIU on goAML as a DPMSR; supervised by the Ministry of Economy & Tourism.
AML for gold and jewellery dealersReport qualifying freehold sales on goAML as a REAR, and register on goAML through the Ministry of Economy & Tourism like other DNFBPs.
AML for real estate brokersCompany and trust service providers and independent accountants are DNFBPs for listed activities, such as forming companies or managing client money. The Ministry of Economy & Tourism supervises them in the mainland and the commercial free zones.
AML for CSPs and auditorsSix questions to put to any AML software provider in the UAE.
UAE supervisors carry out desk-based and field inspections, and the Ministry of Economy & Tourism asks the MLRO to document why each report was or was not filed. These questions test a system against that in a demo, each with the duty behind it and how the Creodata AML software answers it.
Does screening cover the Local Terrorist List and the UN Consolidated List?
A confirmed match means freezing within 24 hours and a Confirmed Name Match Report within five business days; a partial match that cannot be cleared means suspending the transaction and a Partial Name Match Report. Lists you maintain yourself can be uploaded beside provider lists, every list is versioned, and each match decision is kept in an append-only audit log. The freeze itself is applied in your core system.
Is customer due diligence scaled to risk?
The 2025 law asks for CDD and monitoring scaled to the risks you have assessed and to the national risk assessment. A six-factor risk rating with configurable weights and bands sets each customer's level, and periodic reviews are scheduled by risk band.
Can it apply the AED thresholds for your sector?
Financial institutions apply CDD to occasional transactions of AED 55,000 or more and wire transfers of AED 3,500 or more; virtual asset service providers from AED 3,500. Rules are written in the engine's own rule language, so a threshold can be set at your sector's line, and a new or changed rule is back-tested on historical data before it goes live.
Does goAML reporting cover your report types?
STRs and SARs go to the FIU through goAML from a draft, review, approve and submit lifecycle. Dealers in precious metals and stones and real estate brokers also file DPMSRs and REARs, which the goAML reporting module can be configured to support.
Is the MLRO's decision recorded, either way?
The Ministry of Economy & Tourism's guidance for DNFBPs has the MLRO or compliance officer document the decision to file, or not to file, with the reasons. Every alert becomes an owned case, and each decision and its reason is kept in the audit log.
Can it show a supervisor five years of evidence?
Records are kept for at least five years. Evidence packs and a read-only regulator portal let an inspector see the decisions and the data behind them.
- goAML Registration in the UAE: SACM, the Authenticator and Entity Registration, Step by Step (2026)
- UAE Federal Decree-Law No. 10 of 2025 Explained: The New AML Law and What It Requires
- How to Choose AML Compliance Software in the UAE: A Buyer's Guide for Financial Institutions, VASPs and DNFBPs (2026)
- AML for Corporate Service Providers, Accountants and Auditors in the UAE: DNFBP Duties, UBO Rules, goAML and Fines (2026)
- AML for Exchange Houses in the UAE: CBUAE Rules, Wire Transfers, Fines and goAML Reporting (2026)
- AML for Gold and Jewellery Dealers in the UAE: DPMSR, goAML and the AED 55,000 Rule (2026)
- AML for Real Estate Brokers in the UAE: REAR Reports, goAML and Virtual Asset Payments (2026)
- AML for Virtual Asset Service Providers in the UAE: VARA's AML Rulebook, the Travel Rule, goAML and Fines (2026)
- goAML Report Types in the UAE: STR, SAR, DPMSR, REAR, CNMR, PNMR, HRC and More (2026)
Frequently asked questions.
Does the software report to the FIU?
Yes, through goAML. Suspicious and threshold transaction reports move through a draft, review, approve and submit lifecycle in the AML software, with retry, reconciliation and acknowledgement handling. The goAML reporting module then generates and validates the goAML file for the FIU's portal, and a manual download is available if the portal is down.
When must a UAE reporting entity file a suspicious transaction report?
Immediately and without delay once it suspects, or has reasonable grounds to suspect, that a transaction or funds are linked to the crime, whatever the amount and including attempted transactions, through the FIU's electronic system (Article 18 of Federal Decree by Law No. 10 of 2025 and of Cabinet Resolution No. 134 of 2025). Lawyers, notaries, other legal professionals and independent auditors are exempt for information covered by professional privilege.
Which goAML reports do DNFBPs file besides STRs?
Dealers in precious metals and stones record cash transactions of AED 55,000 or more in goAML as a Dealers in Precious Metals and Stones Report (DPMSR), and real estate brokers and agents file a Real Estate Activity Report (REAR) for freehold sales paid with AED 55,000 or more in cash, or with virtual assets, under Ministry of Economy circulars 08/AML/2021 and 05/2022. DNFBPs must first register on goAML. The goAML reporting module can be configured to support both report types.
How do we compare AML software providers in the UAE?
Run each provider through the same scenarios on your own data: a confirmed and a partial match against the UAE Local Terrorist List, an occasional transaction at your sector's AED threshold, a suspicious transaction taken from alert to goAML submission, and an MLRO's decision not to file. Then ask each to show the audit trail behind all four. The six questions above, and our UAE buyer's guide, set out what each test proves.
Can the software be hosted in the UAE?
Microsoft Azure has regions in the UAE (UAE North in Dubai and UAE Central in Abu Dhabi), and the software also runs on-premises on your own Kubernetes cluster with the same features as the Azure edition. Ask us which deployment fits your data-residency requirements.
How much does AML software cost in the UAE?
There is no public price list. Each capability is licensed separately and grouped into Starter, Growth and Enterprise tiers, so a quote depends on the modules you switch on and whether you deploy on Azure or on-premises. A demo is the quickest route to a quote scoped to your institution.
Can a smaller institution start small?
Yes. The Starter tier covers screening, customer risk rating and case basics in the cloud. Growth adds transaction monitoring, STR/CTR reporting and ingestion connectors, which a deposit-taking institution will need for its monitoring and reporting duties. Modules switch on per tenant, so moving up a tier adds capability without starting again.
How long does implementation take?
It depends on how many modules you start with and how your data arrives. Screening and risk rating need customer data; transaction monitoring also needs transaction feeds, which connect over REST, SFTP, Kafka, change data capture or ISO 20022 with replay and a dead-letter queue, so a failed load is visible rather than silent. After scoping, we propose a phased path to your first production go-live.
See the AML software run on a UAE reporting profile.
Screening, monitoring, cases and FIU reporting on a realistic alert queue, in a live demo.