AML Compliance in the UAE: What Your Company Actually Has to Do
The UAE replaced its anti-money laundering law in 2025. Federal Decree-Law No. 10 of 2025 repealed Federal Decree-Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 is its executive regulation. The full compliance stack — risk assessment, customer due diligence, a compliance officer, goAML registration and reporting to the Financial Intelligence Unit — applies to financial institutions and to Designated Non-Financial Businesses and Professions (DNFBPs). A typical trading, consulting or tech company is not a DNFBP, but it meets AML rules every time its bank reviews the account.
This page is for founders and finance teams asking one practical question: are we in scope, and if so, what does "compliant" mean on a working day?
The legal framework as of September 2026
- Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing. Article 41 repeals the 2018 law; Article 42 brings it into force two weeks after publication (law-firm reports date this to 14 October 2025).
- Cabinet Resolution No. 134 of 2025 — the executive regulation: who is a DNFBP, thresholds, CDD, record keeping, the compliance officer.
- Transitional rule (Art. 41(3)): regulations and circulars issued under the 2018 law stay in force insofar as they do not conflict with the new law, until replaced. That is why some ministry pages still cite the 2018 law and Cabinet Decision No. 10 of 2019.
Criminal liability for money laundering is outside the scope of this article and is a matter for criminal counsel.
Are you a DNFBP? The five categories
Cabinet Resolution 134/2025, Article 3, defines DNFBPs by activity and, in some cases, by transaction size:
- Real estate brokers and agents — when they conclude transactions or settlements for clients on the purchase or sale of property.
- Dealers in precious metals and stones — for any cash transaction, single or linked, of AED 55,000 or more.
- Lawyers, notaries, other independent legal professionals and independent accountants — when they prepare or carry out transactions for clients involving real estate, client money, bank or securities accounts, company contributions, the creation or management of legal persons, or buying and selling businesses.
- Company and trust service providers — company formation, acting as or arranging nominee directors, secretaries or shareholders, providing a registered address, acting as trustee.
- Commercial gaming operators — for transactions of AED 11,000 or more.
Supervision is split. The Ministry of Economy and Tourism (formerly the Ministry of Economy) supervises real estate agents and brokers, precious metals and stones dealers, independent accountants and auditors, and corporate and trust service providers, and its guidance applies to DNFBPs on the mainland and in the free zones. Lawyers and notaries are supervised by the Ministry of Justice. The financial free zones (DIFC, ADGM) run their own regimes, which we check case by case.
The compliance programme a DNFBP needs
| Obligation | Where it comes from | What it looks like in practice |
|---|---|---|
| Enterprise-wide risk assessment | Law, Art. 19 | Written, updated, available to the supervisor on request |
| Customer due diligence | Resolution 134, Arts. 7–10 | At onboarding, on suspicion, when data looks unreliable; for companies, the beneficial owner holding 25% or more or otherwise in control |
| Enhanced measures for PEPs | Resolution 134, Art. 16 | Senior-management approval, source of funds and wealth |
| Compliance officer | Resolution 134, Art. 22 | Management-level, independent, competent |
| Suspicious transaction reporting | Law, Art. 18 | Without delay, regardless of amount, via the FIU system |
| No tipping off | Law and MoET guidance | The client is never told a report was filed |
| Record keeping | Resolution 134, Art. 25 | At least 5 years, counted from the latest relevant event |
| Targeted financial sanctions | Law, Art. 19 | Screening and immediate freezing on a confirmed match |
Legal professionals are exempt from reporting only for information obtained under professional secrecy.
goAML: registration and the reports you will file
The Ministry of Economy and Tourism states that registration of DNFBPs on goAML is mandatory and that failure to register may lead to severe penalties. This is enforced: in Q3 2023 the ministry suspended 50 DNFBP businesses for three months for not registering, with the suspension lasting until they did.
Registration runs through the goAML portal: a user account in the portal's security system, access through an authenticator app, then the entity's application naming its MLRO. The ministry publishes a registration guide and a guide for changing the registered MLRO.
Report types, per the ministry's March 2026 guidance for DNFBPs:
- STR — a transaction or attempted transaction with reasonable grounds for suspicion.
- SAR — suspicious activity without a transaction.
- REAR — real estate: any purchase or sale where payment includes cash of AED 55,000 or more (single or multiple payments), or where virtual assets are used or converted for any part of the price.
- DPMSR — precious metals and stones: cash deals with individuals of AED 55,000 or more; deals with companies of AED 55,000 or more in cash or by wire.
- CNMR — confirmed sanctions match: freeze within 24 hours, report within 5 business days.
- PNMR — partial match you cannot resolve: suspend or reject, report within 5 business days.
- HRC / HRCA — transactions or activity linked to high-risk countries: may proceed 3 working days after reporting if the FIU does not object.
REAR and DPMSR are threshold reports — they are filed whether or not anything looks suspicious. They do not replace an STR when there is suspicion.
Penalties
Under Article 17 of the 2025 law, the supervisory authority may impose on a financial institution or DNFBP:
- a warning;
- an administrative fine of AED 10,000 to AED 5,000,000 per violation;
- a ban from the sector, restrictions on or suspension of directors and managers, or appointment of a temporary supervisor;
- suspension or restriction of the activity, and licence revocation;
- an escalated fine for a repeat of the same violation within a year, and publication of the sanction.
A detailed schedule of violations is issued by Cabinet resolution under Article 39; we check the current version on the date.
Scenario: a corporate service provider in a free zone
A free zone company sets up entities for international clients and provides registered addresses. That places it squarely in the corporate service provider category. Its first-year checklist:
- Register on goAML and appoint a management-level MLRO.
- Write the risk assessment: client nationalities, structures with trusts or nominees, clients who never visit the UAE.
- For every client company, identify each individual with 25% or more, or effective control, and verify from reliable sources.
- Screen clients and beneficial owners against UAE and UN sanctions lists and keep evidence of each screening.
- Build a suspicion-escalation route: who reviews, who decides, how fast an STR goes out.
- Keep files for at least five years after the relationship ends.
Not a DNFBP? Here is what still reaches you
- Your bank runs CDD on you. It must identify the beneficial owner (25% or more), understand your business and the purpose of the account, and monitor transactions against that profile. Expect questions on large inflows, contracts and invoices, and periodic KYC refreshes. See our guides on opening a corporate bank account and bank compliance for higher-risk profiles.
- Beneficial ownership filing with your registrar is your own obligation — covered in UBO and ongoing reporting.
- Your DNFBP counterparties — brokers, formation agents, accountants — must verify you and may decline the engagement if verification fails.
- A change of activity (for example, starting to trade gold) switches on DNFBP duties from the first qualifying transaction.
Common mistakes
- Assuming a free zone licence takes you outside AML — it does not.
- Filing only REARs or DPMSRs and never an STR, or the reverse.
- Naming a junior employee as MLRO with no authority or time.
- Leaving internal policies anchored to the repealed 2018 law.
- Never refreshing KYC on long-standing clients.
Frequently asked questions
Does an ordinary trading company need goAML?
Not if it is neither a financial institution nor in any DNFBP category. It will still go through its bank's AML review and must keep beneficial ownership information current with its registrar.
Is there a minimum amount for a suspicious transaction report?
No. The law requires reporting regardless of value. The AED 55,000 figures apply to threshold reports (REAR, DPMSR) and to CDD on occasional transactions, not to STRs.
Are auditors covered?
Independent accountants are DNFBPs when they carry out the listed transactions for clients, and the Ministry of Economy and Tourism includes independent accountants and auditors in its supervisory guidance.
Who supervises law firms?
The Ministry of Justice, which has issued AML guidance specifically for lawyers.
What happens if we never registered on goAML?
Administrative measures under Article 17, from a warning and fines to suspension. Register first, then address any gaps in policies and records.
Sources
- Federal Decree-Law No. 10 of 2025 (Arts. 17–20, 41–42) — CBUAE Rulebook: https://rulebook.centralbank.ae/en/rulebook/federal-decree-law-no-10-2025-regarding-anti-money-laundering-and-combating-financing — checked 24.09.2026
- Cabinet Resolution No. 134 of 2025 (Arts. 3, 7, 10, 16, 22, 25) — CBUAE Rulebook: https://rulebook.centralbank.ae/en/rulebook/cabinet-resolution-no-134-2025-regarding-executive-regulations-federal-decree-law-no-10 — checked 24.09.2026
- Ministry of Economy and Tourism — Register in goAML: https://www.moet.gov.ae/en/registering-companies-in-goaml — checked 24.09.2026
- Ministry of Economy and Tourism — STR/SAR guidance for DNFBPs (March 2026): https://www.moet.gov.ae/documents/20121/0/STR-SAR+Guidance++Red+Flag+Indicators.pdf/1584101a-df1b-d128-5607-8d0ee642ce8e — checked 24.09.2026
- Ministry of Economy — suspension of 50 DNFBPs for failing to register on goAML: https://www.moet.gov.ae/en/-/ministry-of-economy-suspends-operations-of-50-dnfbp-establishments-for-3-months-for-failure-to-register-in-goaml-system — checked 24.09.2026
- Ministry of Justice — AML guidelines for lawyers: https://www.moj.gov.ae/assets/6efd8410/guidelines-for-lawyers-on-countering-money-laundering-crimes-and-combating-terrorist-financing-638564063532422858.aspx — checked 24.09.2026
This is a general framework, not legal advice. Whether a business is a DNFBP depends on the transactions it actually carries out, not only on its licence, and supervision differs between the mainland, free zones and financial free zones. We review each situation individually.