In 75 financial intelligence units (FIUs) worldwide, suspicious transaction reports (STR) feed into goAML. It is the reporting and analysis platform built by the United Nations Office on Drugs and Crime (UNODC).
In 2026, goAML evolves on two fronts.
- In July, UNODC launched a new two-year strategy for the platform, with AI and graph analysis on the roadmap.
- The same month, the EU Anti-Money Laundering Authority (AMLA) opened its consultation on a common EU reporting format. AMLA will send its draft to the European Commission by 30 November 2026.
Here is what goAML is, how it works, and what the EU's new format changes for the reports you file.
What is goAML?
goAML is a software platform developed by UNODC. Over 70 countries use it. Fundamentally, it consists of two parts: the front-end and the back-end. The front-end is an online form or XML format report to submit reports helping payment institutions, crypto-asset service providers, and other entities fulfil their legal obligations. The back-end is used by FIUs to collect, analyze, and share financial intelligence.
What goAML is and how it works
UNODC's information technology service built goAML with its Global Programme against Money Laundering, and launched it in 2007.
It was created because many FIUs, especially in developing countries, had no affordable software to receive and analyze reports. UNODC filled that gap and still deploys goAML at low cost.
One platform, two faces
goAML has two faces.
Behind the scenes, on the back-end, it is the FIU's own software solution for analyzing reports, linking cases, and sharing intelligence. On your side, in the front-end, goAML is the gateway to your FIU: a web portal where you register and file, and an XML schema your systems must match. (This post focuses on that second face, the one your team works with every day.)
The platform is shaped by the FIUs that use it. They meet in the goAML International User Group (IUG), founded in 2012, and their feedback feeds a yearly release cycle.
How you file in goAML: portal, web forms, and XML upload
For your team, goAML is the gateway to your FIU. The flow is the same almost everywhere:
- Register your organization and its users on your FIU's goAML portal
- Choose the report type that matches your suspicion
- File it through step-by-step web forms, or by uploading an XML file
- goAML validates the report against your FIU's schema and business rules. Missing mandatory fields block submission
- The FIU receives, analyzes, and follows up. This often comes with a request you answer through the same portal
Web forms suit occasional filers. However, it is the XML route that makes goAML scale. Your FIU publishes an XSD schema, and your systems generate files that match it. One XML report belongs to one reporting entity. But it can contain many transactions. (Many FIUs also provide an XML validator, too. So you can catch errors before the FIU does.)
The main report types include (among potentially many other, depending on your jurisdiction(s)):
Report typeWhat it coversSAR/STR – Suspicious activity/transaction reportA suspicion tied to activity, behavior, or transaction. The two terms tend to be interchangeable, but the specific naming depends on your jurisdiction. In the EMEA and APAC regions the usual designation is STR, while in the US and UK, SAR is the common name.CTR – Currency transaction reportCurrency transactions above a national threshold (especially in the US)AIF – Additional information fileYour answer to an FIU request for more information (especially in the UK)
Not every FIU uses all five, and some add their own. Malta's FIAU, for example, also accepts a pending transaction report. Choosing the right type matters: each one is handled differently, and the wrong type can send a report back.
The goAML XML schema: one standard, many local versions
goAML is one platform, but it is not one format.
UNODC ships a base XML schema with the software. Nevertheless, each FIU configures its own instance on top of it: the schema version, the report types it accepts, its reason-for-reporting codes and lookup values, which fields are mandatory, and its rejection rules.
Same skeleton, different rules. That is why a file accepted by one goAML FIU can be rejected by another. Some FIUs still run schema version 4, others have moved to version 5.
The differences are concrete. Switzerland's MROS sets which report types each sector can file. Malta's FIAU adds a pending transaction report and publishes its own indicator updates. FIU Latvia defines when a cash threshold declaration is due. Hence, for a group active in several countries, "goAML-ready" means several mappings maintained in parallel.
Who uses goAML: countries and FIUs
Over 70 UN Member States use goAML, with more than 500,000 active users. Its International User Group counts 75 FIUs. goAML belongs to goPortfolio, UNODC's wider software suite, used by over 100 Member States.
In Europe, FIUs in Germany, the Netherlands, Latvia, Malta, and Denmark run goAML, as does Switzerland's. In Germany, filing suspicions through goAML is mandatory.
What's changing for goAML in 2026
Two changes will start affecting goAML in the next few years.
A new UN strategy: in July 2026, Lisette Heerze, Head of FIU-the Netherlands and Chair of the IUG, handed UNODC a two-year strategy for goAML. It sets up Regional User Groups, pilots AI and machine learning, and integrates full graph analysis. In Heerze's words: "Strong financial intelligence is perhaps the most critical weapon against these networks." The platform is constantly evolving. goAML 5.0 already added crypto-asset reporting, hybrid reports that mix transactions and activity, exchange with other FIUs through the Egmont Secure Web, text and document ingestion, and more than 130 new fields.
A common EU format: under the Anti-Money Laundering Regulation (AMLR), the EU Anti-Money Laundering Authority (AMLA) is defining common data points for reporting suspicions. AMLA's draft Implementing Technical Standards (ITS) (which have to be submitted to the European Commission by 30 November 2026) will likely mandate:
- A common core data set: standardized data fields classified as mandatory, conditional, or jurisdiction-specific.
- Obliged entity templates: calibrated reporting burdens, including distinct data sets for the non-financial sector and crypto-asset service providers (CASPs).
- Platform continuity: goAML will not be replaced. The software remains the ingestion container, but national FIU schemas must align with AMLA's core data points over an estimated five-year implementation runway.
AMLA foresees about five years until this system is fully implemented in the EU. From July 2032, the Commission will assess whether a single EU reporting system makes sense.
What this means for your compliance team
AMLA standardizes what a report says. That means that your data and your case files might need updating. Four areas are worth having a look today:
- Map your data to the report, not to the portal
List the fields each of your FIUs requires today. Then follow AMLA's annexes as they evolve. - Make every report traceable
Each field should lead back to its source: the alert, the transactions, the investigation notes, and the decision. - Treat the narrative as evidence
The reason for suspicion should rest on facts already in the case file, written down. - Build one data model, many outputs
If you operate across borders, maintain a single internal schema and translate it into each FIU’s custom XSD. Marble’s platform solves this fragmentation. It anchors alerts, entity profiles, and transaction records into a single case file, automating the mapping to local goAML or incoming AMLA formats without manual re-entry. All this while remaining always traceable.
Frequently asked questions
What is goAML?
goAML is a reporting and analysis platform developed by the United Nations Office on Drugs and Crime for financial intelligence units. Reporting entities use it to file suspicious transaction reports and other reports. FIUs use it to analyze and share financial intelligence.
Is goAML a reporting format?
Partly. goAML is software, but reporting entities experience it as a format: an XML schema published by their FIU, plus web forms built on the same structure. Each FIU adapts the schema to its own rules. So goAML formats differ from country to country.
Which countries use goAML?
Over 70 UN Member States use goAML, and 75 FIUs belong to its International User Group. European users include the FIUs of Germany, the Netherlands, Latvia, Malta, Denmark, and Switzerland.
What reports can you file in goAML?
Common report types are the suspicious transaction report (STR), suspicious activity report (SAR), currency transaction report (CTR), and additional information file (AIF). Each FIU decides which types it accepts.
Will AMLA's common format replace goAML?
No. AMLA's draft ITS sets common data points but no file format or technical language. FIUs keep their reporting platforms, including goAML, and align their schemas over time.
When does the AMLA reporting format apply?
Not yet. AMLA submits its draft to the European Commission by 30 November 2026. Implementation is then phased, over about five years in AMLA's current plan.
Can you submit goAML reports automatically?
Yes. Most FIUs on goAML accept XML files that match their published schema. AMLA's draft ITS also lets firms automate reporting from their own systems, under conditions it sets.
Sources: UNODC goAML · UNODC news, July 2026 · FIU-the Netherlands, 15 July 2026 · AMLA consultation paper, 2 July 2026 · UNODC, goAML 5.0
