goAML registration, DNFBP framework setup, and ongoing anti-money laundering compliance for UAE businesses.
The UAE’s anti-money laundering framework is among the most actively enforced in the MENA region. The Ministry of Economy imposed over AED 130 million in administrative fines on Designated Non-Financial Businesses and Professions between 2022 and mid-2025 — and enforcement is intensifying ahead of the FATF’s 2026 mutual evaluation. Al Arabiya Group advises UAE businesses on their AML obligations, manages goAML registration, establishes compliant internal frameworks, and ensures clients remain inspection-ready throughout the year.
Anti-money laundering (AML) compliance in the UAE refers to the set of legal obligations requiring businesses to identify, assess, and mitigate the risk that their services are used to facilitate money laundering, terrorist financing, or the financing of illegal organisations. These obligations apply not only to banks and financial institutions, they extend to a broad category of businesses designated under UAE law as Designated Non-Financial Businesses and Professions (DNFBPs).
The legislative foundation for UAE AML compliance was substantially overhauled by Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combatting the Financing of Terrorism and Financing of Illegal Organisations, which came into force on 14 October 2025. Its executive regulations, established by Cabinet Resolution No. 134 of 2025 (effective 14 December 2025), define the scope of DNFBP obligations in granular detail. These instruments replace and consolidate the prior framework, extending personal liability provisions to compliance officers and senior management and substantially increasing the penalty range for first-instance violations.
Enforcement has accelerated following the UAE’s removal from the FATF grey list in February 2024 a significant achievement the government is determined to protect. The Financial Intelligence Unit (FIU), operating under Cabinet Decision No. 74 of 2020, coordinates goAML reporting. The Ministry of Economy supervises DNFBP compliance and conducts inspections with increasing frequency. For businesses operating in the UAE particularly those in real estate, corporate services, accounting, legal services, or precious metals — implementing a compliant AML framework is now a baseline requirement for continued operation.
AML obligations apply to businesses classified as Designated Non-Financial Businesses and Professions (DNFBPs) under Article 3 of Cabinet Resolution No. 134 of 2025. The six DNFBP categories are defined by business activity, not by company size or structure. A sole-trader accountant and a large corporate services group are subject to identical obligations if they conduct the same regulated activities.
The six DNFBP categories in the UAE are:
DNFBP Category | Who Is Covered |
|---|---|
Real Estate Brokers & Agents | All entities buying, selling, or letting real estate on behalf of clients — including off-plan developers and property management firms conducting financial transactions |
Dealers in Precious Metals & Stones | Gold traders, jewellers, and gemstone dealers — particularly those conducting or accepting cash transactions above AED 55,000 |
Auditors & Accountants | External auditors, bookkeepers, and preparers of financial statements and tax returns acting on behalf of clients |
Corporate Service Providers | Businesses that form companies, act as registered agents, provide nominee director or shareholder services, or manage corporate structures on behalf of clients — including business setup consultancies |
Legal Professionals | Lawyers and notaries involved in financial transactions, company formation, real estate transfers, or management of client funds or assets |
Trust & Company Service Providers | Entities providing trust administration, foundation management, or nominee services on behalf of third parties |
Business setup consultancies that form companies, act as registered agents, or provide nominee services are classified as DNFBPs under Article 3 of Cabinet Resolution 134 of 2025. The full UAE AML framework applies — including goAML registration, institutional risk assessment, CDD, and STR filing. Size of the business is not a mitigating factor.
If your business conducts any of the activities above, the obligations described on this page are mandatory. If you are uncertain whether your specific activity falls within scope, Al Arabiya Group can conduct a DNFBP status assessment before committing to any compliance programme.
Al Arabiya Group provides end-to-end AML/CFT compliance advisory for UAE Designated Non-Financial Businesses and Professions. Our four core service areas cover every element of the DNFBP compliance framework from initial registration with the UAE authorities through to annual policy review and staff certification.
We manage the complete registration of your business with the relevant UAE authorities for AML/CFT compliance, ensuring your entity is correctly listed in the goAML portal — the UAE Financial Intelligence Unit’s platform for reporting suspicious transactions. Our registration service covers:
We draft and implement a comprehensive AML/CFT policy tailored to your business’s size, nature, and risk profile — ensuring full alignment with UAE AML laws and applicable international standards. Our AML Policy service includes:
Customer Due Diligence and Enhanced Due Diligence procedures
Reporting mechanisms for suspicious transactions
Record-keeping requirements
Employee training protocols
Internal controls and audit procedures
We deliver AML/CFT training to your employees to ensure every member of staff understands their individual roles and responsibilities under UAE law. Training covers identifying suspicious activities, reporting obligations, and compliance with internal policies. Our AML Training service includes:
We develop and implement Know Your Customer (KYC) and Customer Due Diligence (CDD) forms and procedures to enable your business to collect, verify, and monitor customer information in line with regulatory requirements. Our KYC & CDD service includes:
Most businesses benefit from a DNFBP status assessment before committing to a full compliance programme. It takes two to three working days and gives you a clear picture of your obligations and immediate gaps.
Cabinet Resolution No. 134 of 2025 sets out the following obligations for all DNFBPs operating in the UAE. Each applies regardless of business size, entity type, or free zone jurisdiction. Non-compliance with any of them constitutes a violation subject to administrative penalty.
Every DNFBP must register on the UAE Financial Intelligence Unit’s goAML platform. Registration enables mandatory filing of Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), Threshold Transaction Reports (TTRs), and sector-specific filings — including Real Estate Activity Reports and DPMS transaction notifications for precious metals dealers. Registration is not optional and does not lapse; entities must remain active on the platform throughout their operational life. Non-registration is treated as a direct AML violation and is one of the primary triggers for Ministry of Economy inspection.
Every DNFBP must maintain a documented Institutional Risk Assessment (IRA) — a written analysis of the money laundering, terrorist financing, and proliferation financing risks specific to the business. The IRA must assess risks by customer type, geographic exposure, products and services offered, delivery channels, and transaction profile. It must be reviewed and updated annually, and immediately upon any material change to business structure, ownership, customer base, or services. Regulators assess the IRA as a primary document during inspections; an absent or outdated IRA is itself a compliance failure.
Standard CDD must be applied to all clients before entering a business relationship or executing a transaction above the applicable threshold. CDD requires verification of the client’s identity, identification of the Ultimate Beneficial Owner, and understanding of the purpose and nature of the business relationship. Enhanced Due Diligence (EDD) is mandatory for Politically Exposed Persons (PEPs), clients from high-risk jurisdictions, and complex or opaque ownership structures. All CDD records must be retained for a minimum of five years from the end of the business relationship.
Continuous screening of all customers, beneficial owners, and transaction counterparties is mandatory against the UAE Local Terrorist List, the UN Consolidated Sanctions List, and — where the entity’s risk profile warrants it — the OFAC SDN List, EU Consolidated List, and UK HMT Sanctions List. Screening must be conducted at onboarding, at periodic review, and whenever a material change occurs. Every potential match must be documented, investigated, and resolved — both clear outcomes and match outcomes must be recorded.
Every DNFBP must appoint a UAE-resident MLRO with sufficient seniority to act independently of business development functions, and with direct access to senior management and the board. The MLRO receives and evaluates internal suspicious activity disclosures, makes STR filings via goAML, and serves as the regulatory point of contact. Under Federal Decree-Law No. 10 of 2025, personal liability for AML failures attaches to the MLRO individually — not only to the entity. The MLRO’s qualifications, appointment date, and reporting line must be documented and available to regulators.
All DNFBPs must maintain written, board-approved AML/CFT policies and procedures covering: customer acceptance policy, CDD and EDD procedures, sanctions screening methodology, internal suspicious activity reporting, STR and SAR filing procedures, record-keeping requirements, staff training schedule, and the MLRO’s authority and escalation procedures. Policies must reflect the entity’s current business model and must be reviewed at minimum annually.
Annual AML training is mandatory for all employees, with role-differentiated content: client-facing staff must be trained in CDD obligations and red flag recognition; compliance staff in policy implementation and goAML reporting; senior management in governance obligations and personal liability. Training must be documented — records of attendance, content delivered, and assessment results must be maintained for a minimum of five years and produced on demand during an inspection.
UAE AML law requires a minimum five-year retention period for all customer identification records, CDD documentation, transaction records, STR and SAR filings, all versions of the Institutional Risk Assessment, AML policy documents, and staff training records. Records must be maintained in a format that allows full production within 48 to 72 hours during a Ministry of Economy inspection.
Administrative enforcement of AML obligations against DNFBPs is carried out primarily by the Ministry of Economy. Penalties are not fixed-sum fines applied uniformly — they are imposed per violation, and multiple violations identified in a single inspection are penalised cumulatively. The Ministry imposed over AED 130 million in fines against DNFBPs between 2022 and mid-2025.
Violation | Penalty Range | Additional Consequence |
|---|---|---|
Failure to register on goAML or maintain active registration | AED 50,000 – AED 1,000,000 per violation | Regulatory inspection triggered; potential licence referral |
Failure to maintain or update Institutional Risk Assessment | Administrative fine; amount determined by inspection outcome | Considered aggravating factor in all subsequent violations |
CDD failures — inadequate due diligence on clients or beneficial owners | AED 50,000 – AED 1,000,000 per instance | Enhanced supervisory monitoring; potential referral to FIU |
Failure to file an STR or SAR where required | Significant administrative penalty; escalation risk | Criminal referral possible in severe cases under FDL 10/2025 |
Failure to appoint or maintain a qualified MLRO | Administrative penalty against the entity | Personal liability of acting MLRO and senior management |
Sanctions screening failures — transacting with listed persons | Substantial penalty; criminal referral in serious cases | Immediate regulatory escalation; potential licence suspension |
Record-keeping failures — records unavailable or incomplete | Administrative penalty; repeat offence escalation | Restricts ability to contest other inspection findings |
Failure to deliver annual staff AML training | Administrative penalty | Treated as systemic non-compliance; broader audit scope triggered |
Beyond financial penalties, AML enforcement carries significant secondary consequences. Banks in the UAE are required to conduct AML due diligence on all corporate clients and may restrict or terminate accounts where the client’s own AML framework is inadequate or unverifiable. For related compliance obligations that intersect with AML law, see our UBO Register Compliance page UBO register accuracy is assessed during AML inspections and forms part of the CDD compliance review.
Al Arabiya Group delivers tangible, documented outputs for every AML compliance engagement, not verbal guidance. At the conclusion of our engagement, your business will hold the following:
Deliverable | Description |
|---|---|
Confirmation of goAML Registration | Written confirmation of successful registration in the goAML portal, with your entity’s registration details and portal access credentials |
AML/CFT Policy Document | A finalised, board-ready AML/CFT policy document tailored to your business size, sector, and risk profile — aligned with UAE law and international standards |
Risk Assessment Report | A completed Institutional Risk Assessment covering ML, TF, and PF risks across your customer types, geographies, and transaction channels |
Training Materials | Role-differentiated AML/CFT training materials — presentations, staff handbooks, and assessment quizzes — ready for immediate delivery |
Attendance Records & Certificates | Signed attendance records and certificates of completion for all staff who complete AML training, maintained in inspection-ready format |
Finalised KYC & CDD Forms | Completed KYC and Customer Due Diligence forms covering all required data fields — customer identification, beneficial ownership, source of funds, nature of relationship |
CDD Staff Training | A dedicated session training your team on how to use the KYC and CDD forms effectively — including how to identify red flags and escalate to the MLRO |
FAQ's
AML compliance refers to the legal obligations requiring businesses to identify and prevent the risk of money laundering or terrorist financing through their services. In the UAE, AML obligations apply to all Designated Non-Financial Businesses and Professions (DNFBPs) — a category that includes real estate brokers, auditors, accountants, corporate service providers, lawyers, and dealers in precious metals and stones. These obligations are set out in Federal Decree-Law No. 10 of 2025 and its executive regulations (Cabinet Resolution No. 134 of 2025). Company size is not a factor — the obligation is triggered by the activity, not the scale of the business.
goAML is the online platform operated by the UAE Financial Intelligence Unit (FIU) through which businesses file mandatory Suspicious Transaction Reports, Suspicious Activity Reports, and other regulatory submissions. Every DNFBP operating in the UAE mainland or a commercial free zone must register on goAML and maintain an active registration throughout its operational life. Non-registration is treated as a direct AML violation by the Ministry of Economy. Administrative fines for goAML non-compliance range from AED 50,000 to AED 1,000,000 per violation.
Yes. Corporate service providers — defined as businesses that form companies, act as registered agents, provide nominee director or shareholder services, or manage corporate structures on behalf of clients — are classified as DNFBPs under Article 3 of Cabinet Resolution No. 134 of 2025. This classification applies to UAE business setup consultancies. The full AML framework applies: goAML registration, institutional risk assessment, CDD, sanctions screening, MLRO appointment, written AML policies, staff training, and record-keeping. There is no exemption based on business size.
An Institutional Risk Assessment (IRA) is a documented evaluation of the money laundering, terrorist financing, and proliferation financing risks specific to a business — assessed across its customer types, geographic exposure, products and services, delivery channels, and transaction profile. Every UAE DNFBP is required to maintain a current IRA and to review it at minimum annually, and immediately upon any material change to the business. The IRA is a primary document reviewed by Ministry of Economy inspectors — its absence, or the presence of an outdated version, constitutes a compliance failure.
AML obligations under Federal Decree-Law No. 10 of 2025 apply to UAE entities based on their business activity, not their jurisdiction of registration. A free zone company whose activities fall within the DNFBP categories is subject to the full AML framework, including goAML registration. DIFC and ADGM entities are subject to separate frameworks administered by the DFSA and FSRA respectively. Commercial free zone entities outside these two financial free zones follow the same federal DNFBP regime as mainland companies.
The Ministry of Economy imposes administrative fines ranging from AED 50,000 to AED 1,000,000 per violation for goAML and CDD failures, with penalties accumulating across multiple violations identified in a single inspection. Failure to file a required Suspicious Transaction Report carries a significant administrative penalty and may be referred for criminal consideration in severe cases under FDL 10 of 2025. Personal liability for AML failures attaches to the MLRO and to senior management. Secondary consequences include bank account restrictions or termination, loss of government contracting eligibility, and reputational damage.
Federal Decree-Law No. 10 of 2025 requires a minimum five-year retention period for all AML-related records — including customer identification and CDD documentation, transaction records, Suspicious Transaction Reports, Suspicious Activity Reports, all versions of the Institutional Risk Assessment, AML policy documents, and staff training records. Records must be maintained in a form that allows them to be produced in full during a Ministry of Economy inspection, typically within 48 to 72 hours of a formal request.
