goAML Explained: How FIU Reporting Works and What AMLA Changes

You can run flawless transaction monitoring, spot a genuinely suspicious pattern, and still fall foul of the regulator if the report never lands properly. In a growing number of countries, including much of the EU, the report lands through goAML, the software a Financial Intelligence Unit uses to receive and analyse what regulated businesses file. If you are an obliged entity, goAML is the door your suspicious reports go through, and it is fussy about how they arrive.

This guide explains what goAML is, how the reporting flow actually works for a business, why data quality decides whether a report is accepted or bounced, and how EU reporting is changing under the new authority AMLA.

It deliberately stays on the system and the mechanics. For what makes a transaction suspicious and how to decide whether to file, see our separate guide to the suspicious transaction report; for the wider obligations, the AMLR pillar.

What Is goAML?

goAML is an anti-money-laundering software application built by the United Nations Office on Drugs and Crime (UNODC) for use by Financial Intelligence Units. An FIU is the national body that receives reports of suspected money laundering and terrorist financing, makes sense of them, and passes intelligence to law enforcement.

goAML is the platform that lets it do all three: collect reports, analyse them, and disseminate the results. Each FIU runs its own instance of the same UN-maintained software, which is why the login page of one country's portal looks much like another's.

It is widely adopted. By 2026 the goAML user community spanned around 75 financial intelligence units worldwide, a figure that keeps rising as more countries move off paper and email and onto a single electronic channel.

For a business, the practical consequence is simple: in a goAML jurisdiction, this is where your reports go, and there is no informal alternative.

One UN System, Run Locally

A detail that matters for anyone operating in more than one country: goAML is a single piece of UN software, but every FIU runs its own copy and sets its own rules on top of it. The core is shared, so the registration flow, the XML schema and the report structure feel familiar from one country to the next.

What varies is local: which report types are required, the mandatory fields, the deadlines, the indicator lists, and the language. A firm filing in three EU states is using three separate goAML instances, each with its own account, its own quirks and its own go-live history. The upside of a common platform is real, but it is not a single pan-EU inbox, at least not yet.

goAML vs AML: Not the Same Thing

The two get muddled, so it is worth being precise. AML, anti-money laundering, is the whole discipline: the laws, the customer due diligence, the screening, the monitoring and the risk assessment a business runs to detect and prevent financial crime. goAML is one tool inside that discipline, the system through which the reporting step happens. Put another way, AML is the obligation and the judgement that produces a suspicion; goAML is the channel through which you report it. You do AML to find the problem; you use goAML to tell the FIU about it.

How goAML Works, From Report to FIU

For a reporting entity, goAML is less a single act than a short sequence, and the diagram shows where each part sits.

The reporting entity registers and submits; goAML validates and routes; the FIU collects, analyses and disseminates.

The steps a business actually goes through:

• Register the organisation. You enrol as an entity, not as a loose individual, and nominate a reporting officer or MLRO. The FIU reviews and approves the registration before granting access and credentials.

• Prepare the report. You assemble the parties, accounts, transactions and the narrative that explains the suspicion, to goAML's prescribed structure.

• Submit it. Either by typing into the portal's web form, by uploading a file built to goAML's XML schema, or, at volume, through a bulk or web-service upload that pushes many reports straight from your systems.

• Validation and acknowledgement. goAML checks the submission against the schema and mandatory-field rules. A valid report is accepted into the FIU's workflow; an invalid or incomplete one is rejected and has to be fixed and resent.

• Two-way messaging. A secure message board lets the FIU ask for more and you respond inside the platform, rather than over email.

The report types goAML handles

goAML is not only for suspicious reports. Depending on the jurisdiction, an entity may file several report types through it:

The decision about whether a transaction is suspicious enough to report, and the red flags behind it, is a separate topic covered in our suspicious transaction report guide. Here the point is only that goAML is the channel those reports travel through.

Is goAML Mandatory?

goAML is not a law in itself; it becomes mandatory when a national FIU names it as the only route for reporting, and across the EU many have. Luxembourg's FIU made electronic filing through goAML the sole channel back in 2017, Ireland in the same year, and Belgium's CTIF-CFI adopted it in 2023, after which only reports submitted through the application are accepted.

Malta's FIAU runs on it too. The pattern is consistent: once an FIU goes live, paper and email stop being options, so for an obliged entity in that country, registering and filing through goAML is effectively compulsory.

Not using it where it is mandated means you cannot discharge your reporting duty at all, which carries the same exposure as any reporting failure.

Why Data Quality Makes or Breaks a goAML Report

Here is the part most firms underestimate. goAML will reject a report that does not meet its schema and completeness rules, and a rejected report is, until you fix it, an unfiled one. The burden of getting the data right sits with the reporting entity, not the FIU.

Small defects are enough to cause trouble: a missing mandatory field, a mistyped identifier, an abbreviated or misspelled name that stops the FIU linking the report to anything else it holds.

The deeper issue is that report quality is downstream of onboarding quality. If the identity and customer risk data captured at the start is incomplete or scattered across systems, the report built from it later will be too. The common failure points are predictable:

This is the same discipline that keeps false positives down: clean, consistent, verified data upstream makes everything downstream work. For the beneficial-ownership detail that often trips reports up, see our guide to the ultimate beneficial owner.

goAML and the EU: AMLR, AMLA and FIU.net

goAML is national plumbing: each FIU runs its own instance and sets its own rules. The EU framework sits on top of that. The AMLR and the regulation creating AMLA, the new EU Authority for Anti-Money Laundering, are pushing toward a single rulebook and more consistent reporting across member states, rather than 27 variations.

One concrete change is worth watching. FIU.net, the secure network that lets EU financial intelligence units exchange information with each other, moves under AMLA's management, with a legal deadline of 10 July 2027 set by the latest AML directive.

The direction of travel is clear even where the detail is still settling: today reporting runs through national goAML instances; tomorrow those national channels sit within a more connected, more harmonised EU system coordinated by AMLA.

Firms that get their reporting data clean now will adapt to that more easily than those still wrestling with rejections.

How Qoobiss Helps

Qoobiss does not file to goAML for you, and no responsible vendor should claim to. What it does is make sure that what reaches the FIU is clean, complete and defensible, by getting the data right long before a report is built:

• Clean data at the source. Ontrace and Origin verify identity and capture structured, validated data at onboarding, so the customer details a report depends on are right from the start.

• Current screening and risk. Omnicheck keeps sanctions and PEP screening current, so a report reflects the latest picture.

• Audit-ready case preparation. Overwatch consolidates the alerts and evidence behind a case and keeps the audit trail, so the report you prepare for goAML is complete and traceable, and passes validation the first time.

Get Your Reporting Data Right with Qoobiss

goAML rewards clean data and punishes messy data, and the cleanest reports start at onboarding, not at submission. Qoobiss helps obliged entities capture verified identity data, keep screening current, and prepare audit-ready cases so the report that reaches the FIU is accepted the first time. Read the AMLR pillar guide for the obligation behind it, our suspicious transaction report guide for what to report, or get in touch to talk through your reporting workflow.

goAML - Frequently Asked Questions