Understand UAE AML/CFT compliance requirements for DNFBPs — registration, CDD, STRs and penalties. See how BWMC keeps your business compliant.
At BWMC, we work directly with real estate brokers, gold dealers, auditors and corporate service providers who need clarity on UAE AML/CFT compliance. We have seen firsthand how quickly a missed goAML registration or an outdated policy turns into a regulatory penalty.
This guide explains what UAE AML/CFT compliance means for your DNFBP in 2026, who it applies to, and the exact steps we recommend to stay fully compliant.
Why UAE AML/CFT Compliance Matters More in 2026
The UAE has built one of the most robust anti-money laundering and counter-terrorist financing frameworks in the region. Since its removal from the FATF grey list in February 2024 and the EU's high-risk list in 2025, the UAE's reputation as a trusted global business hub depends on every regulated business doing its part.
With the FATF's next mutual evaluation scheduled for 2026, we are advising every client that regulators are not relaxing oversight — they are intensifying it. UAE AML/CFT compliance is no longer a paperwork exercise; it is an operating requirement for staying licensed.
A Brief Look at the UAE AML/CFT Law
The legislation behind UAE AML/CFT compliance was modernised recently. Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, replaced the earlier Federal Decree-Law No. 20 of 2018 and now governs the prevention of money laundering, terrorism financing, and the financing of arms proliferation.
It is supported by Cabinet Resolution No. 134 of 2025 (the Executive Regulations, effective 14 December 2025) and Cabinet Resolution No. 71 of 2024 (the unified administrative fines). Together, these place clear obligations on financial institutions and on every business the law calls a Designated Non-Financial Business or Profession, or DNFBP.
The Ministry of Economy and Tourism (MoET) supervises most DNFBP categories, the Ministry of Justice supervises lawyers and notaries, and the UAE Financial Intelligence Unit (UAEFIU) receives all suspicious activity reports through its goAML portal.
Which Businesses Are Considered DNFBPs?
Under Article 3 of Cabinet Resolution No. 134 of 2025, the following businesses fall within UAE AML/CFT compliance requirements:
Real estate brokers and agents — covered whenever they conclude a property purchase or sale transaction on behalf of a client. There is no minimum threshold, and every brokered transaction triggers compliance obligations. We often see smaller real estate offices assume that a single-owner LLC operating quietly is somehow exempt — it is not.
Dealers in Precious Metals and Stones (DPMS) — including gold retailers, jewellery shops, diamond dealers and refineries — are covered when they conduct any single cash transaction, or linked series of transactions, equal to or greater than AED 55,000.
Auditors and independent accountants — covered when they prepare or carry out transactions on behalf of clients involving the buying or selling of real estate, the management of client money or accounts, the organisation of contributions for company creation, or the establishment, operation or management of legal persons or arrangements.
Lawyers, notaries and other independent legal professionals — fall within scope when carrying out the same categories of activity on behalf of a client, supervised by the Ministry of Justice rather than MoET.
Corporate service providers and trust service providers (TCSPs) — covered when they act as registered office agents, act as nominee directors, secretaries or shareholders, or serve as trustees of express trusts. This is where our Compliance Advisory team spends most of its time, since TCSPs face some of the most detailed reporting obligations.
Commercial gaming operators — added as a new DNFBP category in 2025, supervised by the General Commercial Gaming Regulatory Authority.
If your business falls into any of these categories, UAE AML/CFT compliance applies regardless of your size, employee count, or whether you operate from a free zone, mainland, or single office.
What You Must Do to Achieve Full Compliance
Compliance is not a one-time task. We always advise clients to treat it as an ongoing programme built around eight core obligations.
1. Register on the goAML portal.
Every DNFBP must register on the UAEFIU's goAML reporting system and the Automatic Reporting System for Sanctions Lists (SACM). Operating without registration is itself a violation. New companies must register immediately upon receiving their trade licence. We support clients through this exact process as part of our goAML Compliance service.
2. Appoint a Compliance Officer (MLRO).
You must designate a qualified, sufficiently senior person to take responsibility for your AML programme, file reports with the FIU, and act as the contact point with regulators. In smaller firms, the owner may appoint themselves or a trusted manager, but the role must be formally documented.
3. Conduct a Business Risk Assessment.
A written assessment of the money laundering and terrorism financing risks your business is exposed to must consider customer type, geographic exposure, products and services, delivery channels, and transaction patterns. This assessment must align with the UAE's National Risk Assessment and be reviewed at least annually.
4. Implement written policies and procedures.
Your AML/CFT manual must reflect the current law: Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. Policies still citing the old 2018 law are now non-compliant on their face — a mistake we still see in nearly half of the manuals we review.
5. Perform Customer Due Diligence (CDD).
CDD must be carried out before establishing any business relationship, before conducting an occasional transaction at or above AED 55,000, whenever there is suspicion of money laundering or terrorism financing, and whenever there is doubt about previously obtained customer information. This requires verifying customer identity from a reliable source, identifying the beneficial owner, understanding the purpose of the relationship, and monitoring it on an ongoing basis. Our KYC & Due Diligence service is built specifically around this obligation.
6. Apply Enhanced Due Diligence (EDD) in higher-risk situations.
EDD is mandatory for Politically Exposed Persons and their family members, customers from high-risk jurisdictions, complex or unusually large transactions without clear economic purpose, and non-face-to-face onboarding. EDD requires senior management approval, additional verification of source of funds and wealth, and more frequent monitoring.
7. File Suspicious Transaction Reports without delay.
Whenever you have reasonable grounds to suspect that funds or a transaction are linked to a crime, you must file a report through goAML. There is no minimum threshold for an STR — the legal standard is "without delay," meaning as soon as suspicion is reasonably formed. Real estate brokers must additionally file a Real Estate Activity Report (REAR) on any property transaction involving cash payments of AED 55,000 or more, or any use of virtual assets, under MoET Circular 05/2022. DPMS must file a Dealers in Precious Metals and Stones Report (DPMSR) for cash transactions of AED 55,000 or more. The law also strictly prohibits "tipping off" — informing the customer or any third party that a report has been filed.
8. Maintain records and train staff.
All customer files, transaction records, and reports must be retained for at least five years. Every staff member must receive AML/CFT training at onboarding and at least annually thereafter, with documented attendance.
The Cost of Non-Compliance: Heavy Penalties
We treat this section as essential reading for every DNFBP owner. The Ministry of Economy and Tourism has dramatically scaled up enforcement. In the first half of 2025 alone, MoET imposed fines exceeding AED 42 million on more than 1,000 DNFBPs, including AED 18.5 million on real estate brokerages and AED 20 million on precious metals dealers. In 2024, the Ministry suspended the licences of 32 gold refineries for AML violations.
Under Cabinet Resolution No. 71 of 2024, administrative fines for individual violations range from AED 50,000 to AED 1,000,000, and these amounts are doubled for repeat offences. Criminal penalties under the 2025 law are far more severe: companies convicted of money laundering can be fined between AED 5 million and AED 100 million, managers can face personal criminal liability and imprisonment, and licences can be suspended or revoked entirely.
A common — and dangerous — assumption among smaller businesses is that regulators only target large institutions. We have found the opposite to be true. Inspectors look for the basic deficiencies most often found in smaller firms: no goAML registration, no appointed compliance officer, no written policy, no risk assessment, and no staff training. These are the easiest violations to detect and the quickest to penalise.
Move From Risk to Confidence — Speak With BWMC
We help real estate brokers, gold and jewellery dealers, auditors, accountants, lawyers and corporate service providers across the UAE achieve full UAE AML/CFT compliance — from goAML registration and risk assessments to policy writing and MoET inspection readiness.
We register your business on goAML and SACM correctly the first time
We build AML/CFT policies aligned with Federal Decree-Law No. 10 of 2025
We conduct your business risk assessment and CDD/EDD framework
We prepare your team for MoET inspections before regulators arrive
We act as your ongoing compliance point of contact
Book a free consultation with our Compliance Advisory team today to protect your business, your licence, and your reputation before a regulator's letter arrives at your door.
Frequently Asked Questions
1. What does UAE AML/CFT compliance mean for a small business?
It means registering on goAML, appointing a compliance officer, writing a risk-based AML policy, performing customer due diligence, and filing suspicious transaction reports without delay — regardless of your company size.
2. Which businesses in the UAE must follow AML/CFT compliance rules?
Real estate brokers, dealers in precious metals and stones above AED 55,000, auditors, accountants, lawyers, notaries, corporate service providers, and commercial gaming operators are all classified as DNFBPs under UAE law.
3. What happens if a DNFBP fails to register on goAML?
Operating without goAML registration is itself a violation. MoET has issued administrative fines up to AED 1,000,000 for individual violations, with penalties doubling for repeat offences.
4. Is there a minimum transaction value for filing a Suspicious Transaction Report?
No. There is no minimum threshold for an STR. The legal standard is filing "without delay" once reasonable suspicion is formed, regardless of transaction size.
5. How often should a business review its AML risk assessment?
At least once a year, or immediately after any significant change in your customer base, services, delivery channels, or geographic exposure.
Written By
Written by
Mahesh Thadani
Director
Mahesh Thadani is a seasoned Certified Chartered Accountant and senior finance professional with extensive expertise across taxation, financial advisory, and international business structuring. With a strong command over UAE regulatory frameworks—including VAT, Corporate Tax, ESR, AML, and KYC compliance—he advises businesses on navigating complex financial and legal landscapes with precision and strategic clarity.