Blog Image

Before You Register: Prepare Your Company Mailbox for goAML Messages

When a company starts goAML registration in the UAE, attention usually goes to documents, organisation details, mobile numbers and the registration form. Email readiness can easily be overlooked.

However, email is an important part of the registration and access process. The UAE Financial Intelligence Unit (UAEFIU) states that email OTPs and registration-related messages are sent during the process. Its official FAQ specifically addresses situations where an applicant receives an SMS OTP but does not receive the corresponding email OTP.

That means preparing the company's mailbox before starting registration can prevent avoidable delays.

This does not mean creating a complicated email system. It means making sure the nominated email address can receive, display and securely handle messages associated with the goAML registration process.

Why Email Readiness Matters for goAML Registration

During the UAEFIU registration process, the email address provided by the applicant may be used to receive important registration-related communications.

The official UAEFIU registration page currently instructs applicants to whitelist specific UAEFIU email addresses, including no-reply.sacm@uaefiu.gov.ae and no-reply.goaml@uaefiu.gov.ae.

The UAEFIU FAQ also explains that if an email OTP is not received, the message may have been placed in the junk mailbox or blocked by the entity's mail server. In such cases, the FAQ recommends checking the junk mailbox and asking the IT team to whitelist the relevant UAEFIU system email address.

So, email preparation should be treated as a simple registration-readiness check, not as an afterthought.

1. Confirm Which Email Address Will Be Used

Before submitting the registration request, identify the email address that will actually be monitored during the process.

Avoid choosing an inbox that nobody regularly checks.

The nominated mailbox should have:

  • A responsible person who monitors it
  • Reliable access during working hours
  • Sufficient mailbox capacity
  • Access to the relevant IT or email administrator
  • Appropriate security controls
  • A clear process for identifying legitimate UAEFIU messages

The goal is simple: when a registration message arrives, the responsible person should be able to see it promptly.

2. Check Whether the Mailbox Can Receive External Messages

Some company email environments have strict inbound filtering.

A message from an unfamiliar external domain may be quarantined or blocked before it reaches the normal inbox.

This is particularly important when a company uses:

  • Microsoft 365
  • Google Workspace
  • Corporate email gateways
  • Spam-filtering appliances
  • Managed IT security services
  • Custom email security rules

The person handling the registration does not necessarily need administrator access.

Instead, ask the company's IT or email administrator to confirm that the nominated mailbox can receive messages from the UAEFIU registration systems.

3. Whitelist the Relevant UAEFIU Email Addresses

This is one of the most important preparation steps.

The current UAEFIU SACM registration page specifically asks applicants to whitelist:

  • no-reply.sacm@uaefiu.gov.ae
  • no-reply.goaml@uaefiu.gov.ae

The UAEFIU FAQ similarly explains that registration emails may be blocked by an entity's mail server and recommends involving the IT team to whitelist the system's email address.

The exact configuration method depends on the company's email provider.

Therefore, the practical instruction for a business is not to change random spam settings. Instead:

Ask the IT/email administrator to allow the relevant official UAEFIU registration addresses.

This should be done before the registration request is submitted where possible.

4. Check the Junk and Quarantine Areas

Even when a message is not completely blocked, it may be classified as spam.

Before starting registration, the responsible person should know where the company's:

  • Junk folder
  • Spam folder
  • Quarantine area
  • Security-filter notifications

are located.

If an expected UAEFIU message does not appear in the normal inbox, check these areas before assuming that the registration system failed to send it.

The UAEFIU FAQ specifically instructs users who do not receive an email OTP to check the junk mailbox and consider whether the message has been blocked by the entity's mail servers.

5. Make Sure the Person Handling Registration Has Mailbox Access

Registration can involve more than one person inside an organisation.

For example, an organisation may have:

  • An MLRO or Compliance Officer
  • An internal IT administrator
  • A company administrator
  • A person responsible for registration

These roles may not be the same individual.

Before beginning, establish who will monitor the nominated email address.

A simple internal arrangement can prevent confusion:

Registration owner: Responsible for completing the registration

Email owner: Responsible for monitoring the nominated mailbox

IT contact: Responsible for filtering, whitelisting and quarantine issues

Compliance/MLRO: Responsible for organisational registration decisions

The exact roles will vary between businesses, but assigning responsibility beforehand can make the process smoother.

6. Understand the Difference Between Email OTP and SMS OTP

Applicants should not assume that all verification messages arrive through the same channel.

The UAEFIU's pre-registration guide explains that, after the approval notification, applicants may be prompted to provide the email used in the pre-registration request, an email OTP (EOTP), and an SMS OTP (MOTP). The guide states that these OTPs have a validity period specified in the notification.

This is why a company should make sure both communication channels are ready.

For email:

  • Confirm mailbox access
  • Check spam filtering
  • Check quarantine
  • Whitelist relevant official addresses

For SMS:

  • Confirm the registered mobile number is accessible
  • Make sure the person responsible can receive the SMS
  • Avoid sharing OTPs unnecessarily

Email and SMS readiness should be checked separately.

7. Do Not Forward OTPs to Unnecessary People

Email readiness is also a security issue.

A registration mailbox may receive authentication information or other account-related messages. These should not be forwarded casually across the organisation.

Instead, establish who is authorised to handle the registration.

If an IT administrator needs to investigate delivery problems, they may need to review mail-flow or quarantine information, but that does not mean registration credentials or OTPs should be circulated.

The principle should be:

Give people access to the information they need to solve the delivery problem, not unnecessary authentication information.

8. Verify the Authenticity of Registration Emails

Receiving an email does not automatically mean that it should be trusted.

When a registration-related message arrives, check:

  • Sender address
  • Expected registration stage
  • Message context
  • Links before opening them
  • Whether the message relates to an action you actually initiated

The UAEFIU's official registration resources identify its official registration and support channels. The current SACM registration page, for example, uses UAEFIU government-domain email addresses for registration communications.

If a message looks suspicious or requests information that does not make sense for the current registration stage, do not provide sensitive information simply because the message mentions goAML.

Verify through the appropriate official channel.

9. Keep the Registration Email Consistent

Changing the nominated email address unnecessarily during a registration process can create confusion.

Before submitting the application, verify the address carefully.

Check for:

  • Spelling mistakes
  • Incorrect domain
  • Personal email entered instead of the intended company email
  • Old employee mailbox
  • Inactive group mailbox
  • Mailbox that is not monitored

The UAEFIU's registration guidance indicates that the organisation's email address is used for registration-related communications. Its registration guide states that the outcome of an organisation registration request is sent to the organisation's group email address provided during registration.

For that reason, choosing the correct mailbox is more important than simply choosing an email address that happens to work.

10. Create a Simple Email Readiness Checklist

A company does not need a complicated project plan.

A short checklist is enough:

Before registration:

☐ Confirm the nominated company email address

☐ Confirm the responsible person can access it

☐ Check mailbox capacity

☐ Check junk/spam filtering

☐ Check quarantine rules

☐ Ask IT to whitelist relevant UAEFIU addresses

☐ Confirm the registered mobile number

☐ Identify who will monitor registration messages

☐ Make sure the responsible person knows how to recognise legitimate registration emails

☐ Keep a record of the email address used

This checklist can be completed before the registration request is submitted.

What If the Email OTP Does Not Arrive?

If an expected email OTP does not arrive, do not immediately submit another registration request.

First check:

1. Inbox

Look for the expected UAEFIU message.

2. Junk or spam

The message may have been filtered.

3. Quarantine

A company security system may have held the message.

4. Mail-server filtering

Ask the IT administrator whether the message was blocked.

5. Whitelisting

Confirm that the relevant UAEFIU address has been allowed.

The UAEFIU FAQ specifically says that applicants who receive an SMS OTP but not the email OTP should check the junk mailbox and consider whether their entity's mail server has blocked the message.

If the issue remains, follow the current UAEFIU support instructions rather than repeatedly creating new registration requests.

Email Readiness Is Part of Registration Readiness

A successful goAML registration is not only about completing an online form.

The process also depends on having the right communication channels available when registration-related messages are sent.

Preparing the company mailbox beforehand can reduce simple problems such as:

  • Missing email OTPs
  • Registration emails going to junk
  • Messages being held in quarantine
  • Delays caused by mail-server filtering
  • Confusion about who is responsible for monitoring the mailbox

The UAEFIU provides current registration resources, including a reporting-entity pre-registration guide and official FAQs. Its current guidance also identifies the email addresses that should be whitelisted for the registration system.

The best approach is therefore straightforward: confirm the mailbox, involve IT where necessary, whitelist the relevant official addresses, and make sure the responsible person can monitor the inbox before beginning registration.

That small preparation step can make the registration process more organised and reduce avoidable communication problems.

Frequently Asked Questions

1. Why should a company prepare its mailbox before goAML registration?

Because registration-related communications and OTPs may be sent by email. UAEFIU guidance specifically addresses situations where email OTPs are not received because of junk filtering or mail-server blocking.

2. Which UAEFIU email addresses should be whitelisted?

The current SACM registration page specifically instructs applicants to whitelist no-reply.sacm@uaefiu.gov.ae and no-reply.goaml@uaefiu.gov.ae.

3. What should I do if I receive the SMS OTP but not the email OTP?

First check the junk mailbox and ask the IT team whether the email was blocked by the company's mail server. The UAEFIU FAQ provides this troubleshooting guidance.

4. Should the registration email be a personal email address?

The appropriate email should be the one designated for the organisation's registration and monitored by the responsible person. The UAEFIU registration guidance refers to the organisation's email/group email used during registration.

5. Should IT receive the company's goAML OTPs?

IT may need to investigate mail delivery, filtering or quarantine issues, but authentication codes should not be unnecessarily shared. Access to mailbox administration and access to authentication information should be kept separate where practical.

6. Can email filtering cause goAML registration delays?

Yes. UAEFIU's FAQ specifically notes that registration emails may be blocked by an entity's mail servers and recommends checking junk mail and involving IT to whitelist the relevant system email address.

7. Where can I find current official goAML registration guidance?

The UAEFIU publishes its current goAML registration resources through its official policies and guidance pages. The current resources include a reporting-entity pre-registration guide and registration-related FAQs.