How to Maintain goAML Reporting Continuity During an AML System Outage

UAE businesses subject to anti-money laundering (AML) requirements rely on accurate records, dependable systems, and organised reporting procedures to meet their compliance responsibilities. When a technical problem interrupts access to an internal AML platform or the goAML portal, compliance teams may face delays in reviewing information, preparing reports, submitting information, or responding to outstanding requests.

A system outage can occur because of internet connectivity problems, server failures, software updates, cybersecurity incidents, or temporary unavailability of an external platform. Regardless of the cause, businesses need a clear procedure for maintaining operational continuity without compromising reporting accuracy or confidentiality.

Maintaining goAML reporting continuity does not mean bypassing the official portal or assuming that reporting deadlines are automatically extended. It means preparing for disruptions, preserving relevant information, documenting decisions, and resuming the required process as soon as the appropriate systems become available.

This guide explains how UAE businesses can establish a practical contingency plan for goAML-related reporting interruptions.

1. Identify the Source and Scope of the Outage

The first step is to establish which system is affected. An outage involving an organisation's internal AML software requires a different response from a disruption affecting the official goAML portal.

For example, an internal software failure may prevent employees from retrieving transaction records or completing an internal review. In contrast, an external portal-access issue may prevent a team from completing an online submission even when the report and supporting information are ready.

Compliance teams should record:

• The date and time the disruption began.
• The affected system, application, or service.
• The error message or technical problem observed.
• The business activities affected by the disruption.
• The steps taken to investigate the issue.
• Whether the problem affects one employee, one department, or the wider organisation.

Where appropriate, the team should check official portal communications and contact the relevant technical support channel. Avoid assuming that an issue is a system-wide outage based on a single failed login attempt.

2. Establish a goAML Reporting Contingency Plan

A contingency plan defines what employees should do when normal reporting procedures cannot be completed. Businesses should prepare this plan before an outage occurs rather than creating an improvised process during a time-sensitive situation.

The plan should identify the employees responsible for technical troubleshooting, report preparation, compliance decisions, and management escalation. It should also specify who can authorise alternative internal arrangements and who must be informed when a disruption affects reporting activities.

A practical plan should include:

• A documented outage-response procedure.
• Primary and backup contacts for IT and compliance teams.
• A secure method for preserving working records.
• A process for identifying urgent and outstanding reporting tasks.
• A method for recording delays and decisions.
• A recovery and reconciliation checklist.

The procedure should be consistent with the organisation's AML policies, applicable UAE requirements, and any relevant instructions from the competent authority.

Businesses can also use a structured AML case management process to maintain oversight of open investigations and related reporting tasks during a disruption.

3. Protect Reporting Information During the Disruption

An outage should not lead to uncontrolled sharing of sensitive customer information or suspicious transaction records. Compliance teams may need to continue internal preparation while access to a particular system is unavailable, but they must use approved and secure methods.

For example, an organisation may maintain a restricted-access continuity register containing reference numbers, assigned owners, pending actions, deadlines, and the status of each task. Sensitive supporting documents should remain in approved storage locations with appropriate access restrictions.

Employees should avoid sending confidential reports or customer records through personal email accounts, unsecured messaging applications, or unauthorised file-sharing services.

Access to temporary records should be limited to employees who need the information for their assigned responsibilities. The organisation should also establish how temporary working files will be transferred back into the approved system and how unnecessary copies will be securely removed under its retention policy.

These safeguards help preserve confidentiality, accountability, and data integrity while normal operations are interrupted.

4. Prioritise Outstanding Reporting Activities

Not every task affected by an outage will have the same urgency. Compliance teams should review their outstanding workload and identify matters requiring immediate attention.

The review may include reports awaiting internal approval, information requests with approaching deadlines, investigations requiring additional evidence, and submissions that have not yet been completed.

A continuity register can help track each task using fields such as:

• Internal reference number.
• Type of reporting activity.
• Assigned compliance owner.
• Current stage of preparation.
• Relevant deadline or response date.
• Reason for the delay.
• Next action and responsible person.

Prioritisation should reflect applicable legal and regulatory obligations, the circumstances of each case, and internal escalation procedures. Teams should not postpone urgent reporting decisions merely because a technical issue is unresolved.

If a deadline may be affected, the responsible compliance officer should promptly assess the applicable requirements and seek guidance through the appropriate official channel where necessary. Do not assume that recording an outage, contacting support, or notifying management automatically changes a regulatory deadline.

5. Maintain an Accurate Record of the Outage

A clear audit trail helps an organisation explain what happened, which tasks were affected, and how the disruption was managed.

The outage record should include the start and end times, known cause, affected systems, troubleshooting steps, communications with technical support, reporting activities affected, decisions made, and actions taken after recovery.

Where a report was ready but could not be submitted, the team should distinguish between internal preparation and successful submission through the official channel. A saved draft or internal reference number should not be treated as proof that a report was successfully received.

The organisation should also record when system access was restored and whether any pending activity remained incomplete.

Maintaining this documentation supports internal reviews and helps identify improvements to the contingency plan. For further guidance on record accuracy, businesses can review AML data reconciliation before goAML reporting.

6. Verify Information Before Resuming Submissions

Once the affected system becomes available, teams should not immediately process every pending item without checking its status. During an outage, employees may have prepared drafts, updated internal records, or attempted actions whose final status is uncertain.

The recovery process should establish which tasks were completed, which remain pending, and whether any attempted submission was successfully received.

Before resuming normal activity, compliance staff should:

1. Confirm that the required system or portal is accessible.
2. Review the current status of outstanding reporting tasks.
3. Check that supporting records remain complete and accurate.
4. Verify whether any submission was successfully received.
5. Resolve duplicate drafts or conflicting versions.
6. Complete pending actions through the appropriate official process.
7. Update the continuity register and close resolved outage actions.

Where the status of a submission is unclear, use the available official records and appropriate support channels to establish its status before attempting to submit it again.

This is particularly important when duplicate submissions could create confusion or when a report contains information that has changed since its initial preparation.

7. Handle Outstanding Requests and Follow-Up Actions

A technical interruption may affect more than the initial reporting process. The organisation may also have pending requests for information, internal review actions, or follow-up work associated with a previous submission.

After service is restored, the compliance team should review each outstanding action individually. Confirm the relevant reference, the information required, the applicable response date, and the person responsible for completing it.

Where a request for information (RFI) is involved, the team should check the original request and the applicable response instructions rather than relying solely on an internal reminder. See the goAML RFI guide for the UAE for related guidance.

If a deadline has passed or may have been affected, the responsible officer should follow the applicable regulatory procedure and obtain guidance where necessary. The business should retain records of relevant communications and the action taken to address the outstanding matter.

8. Test and Improve the Contingency Procedure

A written continuity plan is useful only if employees understand how to apply it. Businesses should periodically test their procedures using realistic scenarios, such as an internal AML platform becoming unavailable, loss of access to supporting records, or a prolonged interruption affecting several reporting tasks.

The exercise should assess whether employees can identify the outage, escalate the problem, protect confidential information, maintain an accurate task register, and resume normal work without losing records.

After each test or actual disruption, the organisation should document weaknesses and assign corrective actions. Possible improvements include clearer responsibilities, better backup arrangements, more reliable recordkeeping, or additional staff training.

Testing should also consider whether the contingency arrangements remain suitable after significant changes to the business, reporting process, or technology.

Conclusion

Maintaining goAML reporting continuity during an AML system outage requires preparation, secure recordkeeping, clear responsibilities, and a controlled recovery process. UAE businesses should be able to identify affected activities, prioritise outstanding obligations, document decisions, protect sensitive information, and verify the status of reporting actions once systems become available.

Most importantly, an internal contingency process should support compliance with applicable requirements rather than replace official reporting procedures. Businesses should follow current instructions from the relevant UAE authorities and seek appropriate guidance when a disruption may affect a reporting obligation or deadline.

A regularly reviewed contingency plan can help compliance teams respond consistently to technical interruptions while preserving the accuracy, confidentiality, and traceability of their reporting activities.

Frequently Asked Questions

1. What should a business do if the goAML portal is unavailable?

The business should verify the issue, document the outage, notify the responsible compliance personnel, protect relevant records, and review any reporting obligations that may be affected. It should follow official instructions and avoid assuming that the disruption automatically extends a deadline.

2. Does a goAML system outage automatically extend a reporting deadline?

No. Businesses should not assume that an outage automatically changes a regulatory deadline. They should check the applicable requirements and seek guidance through the appropriate official channel when necessary.

3. Can a business prepare reporting information during an outage?

Internal preparation may continue where appropriate, provided the business follows its approved procedures, protects confidential information, and maintains accurate records. Submission must be completed through the applicable official process.

4. What records should be maintained during an AML system outage?

Records should include the outage timeline, affected systems, troubleshooting steps, outstanding tasks, responsible employees, relevant communications, decisions, and recovery actions. Sensitive information should be stored securely with appropriate access restrictions.

5. What should a compliance team do after the system is restored?

The team should verify system availability, reconcile pending tasks, check the status of attempted submissions, confirm data accuracy, complete outstanding actions, and update its audit trail. Any unresolved deadline or reporting issue should be handled under the applicable requirements and official guidance.