AML Compliance in UAE: A Practical Guide for Businesses

Table of Contents

1. What Is AML Compliance? (Definition)

AML compliance is the set of internal policies, procedures, and controls a business puts in place to detect, prevent, and report money laundering and terrorism financing. In the UAE, these controls must follow the standards set by Federal Decree-Law No. 10 of 2025 and its executive regulations, Cabinet Resolution No. 134 of 2025.

A working AML compliance programme typically covers:

• Verifying who a customer is before doing business with them (KYC/CDD)
• Assessing the money-laundering and terrorism-financing risk of each customer and transaction
• Monitoring transactions on an ongoing basis for unusual patterns
• Reporting suspicious activity to the UAE Financial Intelligence Unit (FIU) through goAML
• Screening customers against sanctions and politically exposed persons (PEP) lists
• Keeping records for a minimum retention period
• Training staff to recognise red flags

These are not abstract best practices. Each one maps to a specific legal obligation, and regulators expect to see documented evidence of all of them during an inspection.

2. Why AML Compliance Matters for UAE Businesses

The UAE is a member of the Financial Action Task Force (FATF), the global body that sets anti-money laundering standards. After a period of intensified scrutiny, the UAE strengthened its national AML framework and was removed from the FATF grey list in early 2024.

Rather than easing off after that milestone, the UAE has continued tightening enforcement. Federal Decree-Law No. 10 of 2025 expands the range of businesses covered, raises penalties, and gives regulators broader powers to freeze funds and suspend transactions. Compliance is now treated as an ongoing national priority, not a one-time box to tick.

The Business Case, Not Just the Legal One

Banks in the UAE are increasingly cautious about clients with weak AML controls. A business that cannot show a documented risk assessment, UBO records, or a registered compliance officer may find its bank account frozen, delayed, or closed.

Investors and acquirers also check AML posture during due diligence. A clean compliance record protects deal value and speeds up transactions, while gaps can stall a funding round or acquisition entirely.

3. Who Must Comply? Financial Institutions, DNFBPs, and VASPs

UAE AML law applies to three broad categories of regulated entities:

• Financial Institutions (FIs) — banks, finance companies, insurers, investment firms, and exchange houses, supervised by the Central Bank of the UAE
• Designated Non-Financial Businesses and Professions (DNFBPs) — a wide group of non-banking businesses, supervised mainly by the Ministry of Economy and Tourism
• Virtual Asset Service Providers (VASPs) — crypto exchanges and digital asset custodians, regulated through the Central Bank and, in Dubai, VARA

DNFBPs cover more sectors than most owners expect, including:

• Real estate brokers and agents
• Dealers in Precious Metals and Stones (DPMS), including gold and jewellery traders
• Trust and Corporate Service Providers (TCSPs), including company formation agents
• Accountants, auditors, and tax consultants
• Independent legal professionals handling certain client transactions
• Commercial gaming operators, including casinos and online gaming platforms, newly designated as DNFBPs in 2026

The obligation applies regardless of company size. A two-person corporate services firm and a 200-person accounting practice carry the same legal duty to register, assess risk, and report. “We’re not a bank” is not a valid defence during a supervisory inspection.

4. The UAE AML Regulatory Framework

Federal Decree-Law No. 10 of 2025

This is the UAE’s primary AML/CFT/CPF (counter-proliferation financing) legislation. It came into force on 14 October 2025, replacing Federal Decree-Law No. 20 of 2018, and expands obligations across financial institutions, DNFBPs, and VASPs. It is supported by detailed executive regulations under Cabinet Resolution No. 134 of 2025.

Key Regulators and Bodies

Central Bank of the UAE (CBUAE) — supervises AML/CFT compliance for licensed financial institutions and publishes binding guidance through its rulebook. See the CBUAE AML/CFT Rulebook for the current regulatory text.

Ministry of Economy and Tourism (MoET) — the primary supervisory authority for DNFBPs, running risk-based inspections across real estate, precious metals, and corporate service sectors.

UAE Financial Intelligence Unit (FIU) — receives and analyses Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) submitted through the goAML reporting portal.

Executive Office for AML/CFT — coordinates national policy and represents the UAE in international assessments, including with FATF.

5. Core AML Compliance Requirements for UAE Businesses

Customer Due Diligence (CDD) and KYC

Before onboarding any customer, a business must verify identity using reliable, independent documents — passport or Emirates ID for individuals, trade licence and ownership documents for companies. This is the foundation every other control is built on.

Enhanced Due Diligence (EDD) for High-Risk Customers

Higher-risk customers require deeper checks. This includes politically exposed persons (PEPs), customers from high-risk jurisdictions, complex ownership structures, and unusually large or cash-heavy transactions. EDD means verifying source of funds and source of wealth, not just identity.

Ultimate Beneficial Owner (UBO) Identification

Businesses must identify the individual — not just the corporate entity — who ultimately owns or controls a customer, typically anyone holding 25% or more, directly or indirectly. UBO records must be kept current, including after ownership changes.

Business Risk Assessment

Every regulated entity must document how money-laundering and terrorism-financing risk applies to its own products, customers, delivery channels, and geographies. A generic, unedited template will not survive a supervisory review — the assessment has to reflect the actual business.

goAML Registration and Suspicious Transaction Reporting

Every FI, DNFBP, and VASP must register on goAML, the UAE FIU’s reporting platform, and file Suspicious Transaction Reports (STRs) or Suspicious Activity Reports (SARs) whenever a transaction raises red flags. Reports filed in good faith carry legal immunity for the reporting business.

Record-Keeping

Customer files, transaction records, and internal reports must be retained for a minimum of five years after the end of the business relationship or the completion of a transaction.

Appointing a Compliance Officer (MLRO)

Regulated businesses must designate a Money Laundering Reporting Officer or Compliance Officer responsible for the AML programme, STR filings, and liaison with regulators. Many SMEs outsource this role to a qualified external provider rather than hiring in-house.

Staff Training

Employees who deal with customers or transactions need regular, role-specific AML training, with attendance records kept as evidence for inspections.

Sanctions Screening

Customers and transactions must be screened against UAE and international sanctions lists before onboarding and on an ongoing basis, with documented follow-up on any potential match.

6. Penalties for Non-Compliance

Federal Decree-Law No. 10 of 2025 significantly raised the financial and personal stakes of getting AML wrong:

• Administrative fines for legal entities: AED 5 million to AED 100 million
• Fines for natural persons: up to AED 10 million
• Operating without required licensing or registration: AED 200,000 to AED 10 million, plus potential imprisonment
• Suspension or freezing of funds and transactions for up to 30 days, extendable
• Deportation for foreign nationals convicted of money-laundering offences
• No limitation period — criminal proceedings for money laundering, terrorism financing, or proliferation financing do not expire with time
• Licence suspension, revocation, or business dissolution in serious cases

Senior managers and compliance officers can also face personal liability, including asset freezes and travel bans, when a business fails to meet its obligations.

7. A Practical AML Compliance Checklist for UAE Businesses

Use this as a starting point before your next inspection or renewal cycle:

• Confirm whether your business activity falls under FI, DNFBP, or VASP classification
• Register on goAML if you have not already done so
• Appoint and document a Compliance Officer or MLRO
• Write a business risk assessment specific to your operations — not a generic template
• Build or update CDD/EDD procedures, including UBO identification
• Set up sanctions and PEP screening at onboarding and periodically after
• Confirm your record-keeping covers a minimum of five years
• Schedule role-based AML training and keep attendance records
• Test your programme with an independent AML review before regulators do
• Align your policies with Federal Decree-Law No. 10 of 2025 — not the repealed 2018 law

8. Common AML Compliance Mistakes UAE Businesses Make

• Assuming AML rules only apply to banks and exchange houses
• Treating goAML registration as a one-time task rather than an active reporting duty
• Copying a generic AML policy template without adapting it to the actual business
• Having no documented, dated risk assessment on file
• Under-training frontline staff who handle customers day to day
• Failing to update UBO records after a shareholding or ownership change
• Referencing the repealed 2018 law or 2019 regulations in current policies

9. How to Build an Effective AML Compliance Programme

A strong programme is risk-based, not one-size-fits-all. It starts with an honest assessment of where your business is exposed — cash-heavy transactions, cross-border clients, complex ownership structures, or high-value assets — and builds controls proportionate to that risk.

From there, the programme needs to be living, not static: ongoing transaction monitoring, periodic risk-assessment refreshes, regular training, and a clear escalation path when something looks wrong. Regulators increasingly expect evidence of effectiveness, not just a policy document sitting in a drawer.

An independent review — ideally from a party outside daily operations — is the most reliable way to find gaps before an inspector does.

10. The Role of Auditors in AML Compliance

External auditors play a practical role beyond year-end financial statements. A qualified audit and assurance partner can test whether your AML controls actually work in practice, help draft a risk assessment that matches your real business activity, and prepare the documentation regulators expect to see during an inspection.

This overlaps closely with core audit and assurance services, statutory accounting services in the UAE, and, for free zone entities, audit requirements in UAE free zones. Businesses that also handle VAT filings benefit from aligning AML record-keeping with their broader compliance calendar — see our VAT consultancy services in Dubai for how the two connect.

Internal Linking Suggestions (For Publishing)

When this article goes live on alyaauditors.com, link the following existing pages within the body copy:

• Audit and Assurance Service — anchor: “audit and assurance services” (Section 10, role of auditors)
• Accounting Services in UAE — anchor: “statutory accounting services in the UAE” (Section 10)
• Audit in Free Zones — anchor: “free zone audit requirements” (Section 3, DNFBP scope for free zone entities)
• VAT Consultants in Dubai — anchor: “VAT compliance in Dubai” (Section 10, compliance calendar)
• Company liquidation content (if published) — anchor: “closing a UAE company” (Section 6, penalties/dissolution)

Consider building a dedicated AML/CFT advisory service page so future articles in this cluster (goAML registration, AML training, business risk assessments) have one strong page to link back to for conversions.

Frequently Asked Questions

What is AML compliance in the UAE?

AML compliance in the UAE is the set of controls a business must have to detect and report money-laundering and terrorism-financing risk under Federal Decree-Law No. 10 of 2025, including customer due diligence, UBO checks, goAML reporting, and staff training.

Who needs to register with goAML in the UAE?

Every financial institution, DNFBP, and VASP operating in the UAE must register on goAML, the UAE Financial Intelligence Unit’s reporting platform, to file Suspicious Transaction Reports and related reports.

What is the penalty for AML non-compliance in the UAE?

Penalties range from AED 5 million to AED 100 million for legal entities and up to AED 10 million for individuals, alongside possible imprisonment, fund freezes, licence suspension, and deportation for foreign nationals convicted of money-laundering offences.

What is Federal Decree-Law No. 10 of 2025?

It is the UAE’s current primary AML, CFT, and counter-proliferation financing law. It came into effect on 14 October 2025, replacing Federal Decree-Law No. 20 of 2018, and is supported by executive regulations under Cabinet Resolution No. 134 of 2025.

Do small businesses and startups need AML compliance in the UAE?

Yes, if their activity falls under a regulated category such as real estate, precious metals, corporate services, or accounting. Obligations apply based on business activity, not headcount or revenue.

How often should a business risk assessment be updated?

At minimum once a year, and immediately after any material change such as new products, ownership changes, expansion into new markets, or significant regulatory updates.

Can Alya Auditors help with AML compliance in the UAE?

Yes. Alya Auditors supports UAE businesses with AML risk assessments, compliance documentation, and control reviews alongside its core audit and assurance and accounting services. Get in touch with Alya Auditors to assess where your business currently stands.

Conclusion

AML compliance in the UAE has moved well past banks and exchange houses. Real estate firms, jewellers, corporate service providers, accountants, and a growing list of other businesses now carry direct legal obligations under Federal Decree-Law No. 10 of 2025 — with penalties serious enough to threaten a company’s licence, bank relationships, and leadership personally.

The businesses that handle this well treat AML compliance as an ongoing operational discipline: a documented risk assessment, registered reporting channels, trained staff, and records that hold up to scrutiny. The businesses that struggle are usually the ones still working off outdated templates or the repealed 2018 law.

If your AML policies haven’t been reviewed since before October 2025, that is the first place to start.

Talk to Alya Auditors

Alya Auditors helps UAE businesses build AML compliance programmes that hold up under Central Bank and Ministry of Economy scrutiny — from risk assessments and UBO documentation to goAML readiness and staff training. Visit alyaauditors.com or call +971 52 975 0690 to book an AML compliance review.