HRCA Reporting Services in the UAE
Not every high-risk country link starts with a payment. Maybe a new client lives in Iran. Maybe a shareholder in a company you are setting up is a North Korean national. Maybe an enquiry comes from Myanmar before any fee is paid. In each case, a UAE-regulated business may need to file a High-Risk Country Activity Report (HRCA) on the goAML portal.
- Trigger
- Activity or onboarding linked to high-risk countries
- FATF call-for-action list
- DPRK, Iran, Myanmar
- goAML template
- HRCA
- Legal basis
- CR 134/2025, Art. 23
Our HRCA Reporting Services focus on the onboarding stage, where most high-risk country links first appear. We help corporate service providers, accountants, auditors, real estate firms and other businesses identify these situations and file HRCAs correctly. We can also handle your goAML registration if you are not yet on the system.
What Does HRCA Mean?
HRCA stands for High-Risk Country Activity Report. It is the goAML report used to tell the UAE Financial Intelligence Unit (FIU) about activities, not payments, connected to countries on the FATF "call for action" list, often called the FATF blacklist.
It is designed for situations where you know who is involved and what service is being provided, but you do not have the transaction details goAML needs for a payment report.
FATF Black List Countries That Trigger an HRCA
Based on the FATF's June 2026 statement, the call-for-action jurisdictions are North Korea (DPRK), Iran and Myanmar. The FATF updates its lists every February, June and October, so build a habit of checking after each meeting.
UAE Laws That Apply to High-Risk Country Activity
Most HRCA cases start at onboarding, so the key rules are about knowing exactly who you are dealing with and applying deeper checks where a high-risk country is involved:
“understand the nature of the Customer’s business and the ownership and control structure thereof”
Cabinet Resolution No. 134 of 2025, Article 9(4)
| Law and article | What it means for your business |
|---|---|
| CR 134/2025, Art. 23(1) | A relationship with a person or company from a country the National Committee lists as high-risk calls for enhanced due diligence. |
| CR 134/2025, Art. 7(1)(a) | Customer due diligence starts at the beginning of a business relationship, before any payment. |
| CR 134/2025, Art. 9(1)(a) | Nationality and home address are part of the identity details you must capture, which is often how a high-risk country link first shows up. |
| CR 134/2025, Art. 10(1)(a) | For companies, identify every person who owns 25% or more, so a listed-country owner is not missed. |
| CR 134/2025, Art. 5(2)(c)(4) | Take reasonable steps to find out where the client's and owner's money and wealth come from. |
| CR 134/2025, Art. 5(2)(c)(7) | Get senior management approval before starting or continuing the relationship. |
| Ministry of Economy and Tourism Circular No. (2) of 2026 (14 September 2026) | Activities linked to black-list countries go to the FIU on the goAML High-Risk Jurisdiction Activity template, and DNFBPs may not rely on third parties based in those countries for customer checks. |
When Do You Need to File an HRCA?
- Onboarding a client who lives in, or is a citizen of, a listed country.
- Forming a company where a shareholder, beneficial owner or director is linked to a listed country.
- Receiving instructions or enquiries from a person or firm in a listed country before any money moves.
- Providing accounting, audit, legal or advisory services to a client with a listed-country link.
- Any case where you can describe the people and the service, but not a transaction.
Like the HRC, the HRCA has no minimum value. It is triggered by the country connection.
HRCA Example From a Company Formation Desk
A corporate service provider is asked to set up a UAE company. One proposed shareholder is a national of a listed country. No invoice has been raised yet. The compliance officer files an HRCA describing the requested service, the shareholders and the expected value, then carries out enhanced checks before deciding whether to continue.
HRCA or HRC: Which One Should You File?
- File an HRCA when the link is through a relationship or service and no payment details exist.
- File an HRC when money is moving and you have the transaction data.
Usually only one report is needed for the same event. If you later receive a payment from the same client, that payment may need its own HRC.
How Our HRCA Reporting Service Works
You need an active goAML account, set up through the FIU's SACM portal and a Google Authenticator login, to send any HRCA. With access in place, we:
- 01Screen the relationship: check nationality, residence, place of incorporation and ownership.
- 02Decide HRCA vs HRC: based on whether transaction details exist.
- 03Record the parties: every individual and company involved, with identifiers.
- 04Describe the activity: the service requested, the relationship and its likely value.
- 05Submit from your account: your compliance officer sends the HRCA through goAML.
- 06Plan enhanced checks: document the extra due diligence and any FIU instruction.
Mistakes Businesses Make With HRCAs
- Screening only the client, not the owners and directors.
- Assuming no report is needed because no money has changed hands.
- Relying on a FATF list that is months out of date.
- Not filing an STR or SAR when the activity also looks suspicious.
Consequences of Not Reporting
Failing to apply the rules for high-risk countries is a breach of Cabinet Resolution No. (134) of 2025. Supervisors can respond under Article 17 of the AML law with warnings, fines from AED 10,000 to AED 5,000,000 for each breach, and limits on, or cancellation of, your licence.
Why Choose Our HRCA Reporting Services?
- Strong experience with DNFBPs, especially company formation and accounting firms.
- Clear, case-by-case HRCA vs HRC decisions.
- Screening of owners and directors, not just clients.
- goAML registration and ongoing reporting support in one place.
Frequently Asked Questions
Can I file an HRCA if no payment has been made?
Yes. That is the main purpose of the HRCA.
Is there a threshold for HRCA reporting?
No. It depends on the link to a listed country, not on value.
Does filing an HRCA mean the client is a criminal?
No. It is a country-based report. Only file an STR or SAR if there is also suspicion.
Which countries are on the FATF blacklist?
As of June 2026, North Korea, Iran and Myanmar.
Onboarding a client with a high-risk country link?
We will check the relationship and file the right report from your goAML account.