Last updated: September 2026
AML compliance in the UAE means registering on the goAML portal, appointing a Money Laundering Reporting Officer, and running Customer Due Diligence on every client. These duties sit in Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, and its Executive Regulations, Cabinet Resolution No. 134 of 2025. The trigger is your business activity, not your size, revenue, or free zone status.
Three things matter most. First, company formation agents, registered agents, and PRO firms are regulated as DNFBPs under AML compliance UAE rules. Second, the administrative fine for a single violation runs from AED 10,000 to AED 5,000,000, separate from criminal liability. Third, free zone status changes who supervises you, not whether AML compliance UAE obligations apply.
What Is AML Compliance in the UAE?
AML compliance UAE refers to the legal duties a regulated business must carry out to identify customers, assess money laundering risk, and report suspicious activity. It rests on Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025. The duties apply whether or not a business has ever encountered a suspicious client. Three groups fall under AML compliance UAE: Financial Institutions, Designated Non-Financial Businesses and Professions, and Virtual Asset Service Providers.
Which Businesses Must Comply With AML Law in the UAE?
AML compliance UAE law regulates three groups: Financial Institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs). Coverage does not depend on trade licence type, mainland versus free zone status, or company size. DNFBPs cover six defined categories rather than all non-bank businesses: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, lawyers and legal consultants, Trust and Company Service Providers, and commercial gaming operators. That third-to-last category is where most formation and PRO firms sit. A trading company, e-commerce business, IT consultancy or passive holding company is not a DNFBP on activity alone.
The framework itself is recent. Federal Decree-Law No. 10 of 2025 has been in force since 14 October 2025, repealing Federal Decree-Law No. 20 of 2018. Its Executive Regulations took effect on 14 December 2025, replacing Cabinet Decision No. 10 of 2019, widening the regulated population to include commercial gaming operators and raising the evidentiary standard for what a business is deemed to have known about a suspicious transaction.
| Supervised entity | Supervisory authority | Jurisdiction |
|---|---|---|
| Financial institutions (banks, exchange houses, insurers) | Central Bank of the UAE | UAE excluding financial free zones |
| Lawyers, notaries, legal consultants | Ministry of Justice | Entire UAE excluding financial free zones |
| Company service providers, accountants, real estate brokers, precious metals dealers | Ministry of Economy and Tourism | UAE excluding financial free zones |
| Capital markets participants | Securities and Commodities Authority | UAE excluding DIFC and ADGM |
| All regulated entities in DIFC | Dubai Financial Services Authority | DIFC |
| All regulated entities in ADGM | Financial Services Regulatory Authority | ADGM |
Customer Due Diligence thresholds differ by category under AML compliance UAE rules. Financial institutions apply CDD to occasional transactions of AED 55,000 or more, and a separate threshold of AED 3,500 applies to wire transfers and virtual-asset transfers, under Article 7 of Cabinet Resolution No. 134 of 2025. The AED 3,500 figure is a transfer threshold, not a general onboarding trigger for Virtual Asset Service Providers.
What Is a DNFBP?
A DNFBP is a Designated Non-Financial Business and Profession, a non-bank business category the UAE treats as high-risk for money laundering under AML compliance UAE rules. The category includes real estate brokers, precious metals dealers, accountants, lawyers, and company service providers. A business becomes a DNFBP by performing a specific listed activity, not by its trade licence label. The Ministry of Economy and Tourism or the Ministry of Justice supervises most DNFBPs, depending on the activity.
What Are the Six Triggers That Make a Company Formation Agent a DNFBP?
A company formation agent, registered agent, or PRO services firm becomes a DNFBP the moment it performs any one of six activities listed in Cabinet Resolution No. 134 of 2025, regardless of how the business describes itself on its trade licence. There is no minimum transaction count or company size that exempts a firm from this classification under AML compliance UAE rules.
Under AML compliance UAE rules, the six triggers are: acting as an agent in the incorporation of a legal person, acting as or arranging for another person to act as a company director or secretary, acting as or arranging a nominee partner in a partnership, providing a registered office or administrative address, acting as or arranging a trustee of an express trust, and acting as or arranging a nominee shareholder.
Cabinet Resolution No. 134 of 2025 classifies a firm that provides any one of these services as a Trust and Company Service Provider (TCSP), a specific DNFBP subcategory under AML compliance UAE law. The rule holds in DMCC, JAFZA, DIFC, ADGM, RAKEZ, and mainland Dubai alike. Under Article 10 of the same resolution, Customer Due Diligence for a TCSP includes identifying the natural person who owns 25% or more of a client entity, the same threshold used in UAE beneficial ownership rules.
What Are the Core AML Obligations Every Regulated Business Must Meet?
Every regulated entity, regardless of category, must build the same core AML compliance UAE programme, scaled to its size and risk. These obligations are not optional extras layered onto a trade licence; they are the licence condition itself for any DNFBP, financial institution, or VASP under Cabinet Resolution No. 134 of 2025.
- Enterprise-Wide Risk Assessment, documenting exposure to money laundering, terrorist financing, and proliferation financing across customers, products, geography, and delivery channels.
- Written AML/CFT policies and procedures, approved by senior management and reviewed when risk factors change, not a generic downloaded template.
- An appointed Money Laundering Reporting Officer, senior enough to act independently and report directly to the board.
- Customer Due Diligence on every client before a business relationship begins, including identification of beneficial owners.
- Enhanced Due Diligence for politically exposed persons, high-risk jurisdictions, and opaque ownership structures.
- Sanctions and name screening against the UAE Local Terrorist List and the UN Security Council Consolidated List.
- Suspicious Transaction Reporting through goAML, without delay and without a minimum value threshold.
- Staff training, documented and repeated on a set schedule, not a one-time induction.
- Record retention of CDD files, risk assessments, and reports for a minimum of five years, under Article 25 of Cabinet Resolution No. 134 of 2025.
An MLRO does not need to be a full-time hire in a small business. AML compliance UAE rules require a designated, competent individual with genuine authority and independence, which in many smaller DNFBPs is an existing director or manager supported by external compliance expertise, rather than a new full-time role. One step is easy to miss here: Cabinet Resolution No. 134 of 2025 requires the supervisory authority to approve the compliance officer in advance. Appointing a director internally and filing the paperwork afterwards does not satisfy the rule. Get the prior approval before the person starts acting in the role.
What Is goAML?
goAML is the UAE Financial Intelligence Unit’s official reporting platform for AML compliance UAE filings. Every Financial Institution, DNFBP, and VASP must complete goAML registration before operating lawfully. The platform receives Suspicious Transaction Reports, Suspicious Activity Reports, and related sanctions filings. Registration is mandatory even for a business that has never encountered a suspicious client.
How Do You Register on goAML in Two Stages?
Every Financial Institution, DNFBP, and VASP must register on goAML before it can lawfully operate, and the process runs through two separate UAE Financial Intelligence Unit systems, not one form. Skip either stage and the FIU rejects the application.
Stage 1: SACM pre-registration. Every entity first registers on SACM, the FIU’s Services Access Control Manager, at services.uaefiu.gov.ae. This step captures the entity type and supervisory body, and issues a username and secret key used to set up a Google Authenticator account. These credentials are the only way to reach the full goAML form.
Stage 2: goAML portal registration. This is the step where AML compliance UAE registration becomes official. Using the SACM credentials, the entity logs into the goAML portal, selects “Register New Organization,” and enters legal name, trade licence number, licensing authority, registered address, and MLRO details exactly as they appear on official records. Supporting documents include the trade licence, Memorandum of Association, an MLRO appointment letter, and the MLRO’s Emirates ID or passport. FIU staff review each submission by hand, so approval takes several business days rather than arriving instantly.
Regulators treat a missing goAML registration as a standalone AML compliance UAE failure. Failing to register on the FIU’s approved electronic system carries its own administrative fine, separate from any other AML violation. For DNFBPs the tariff sits in the Unified List of violations under Cabinet Resolution No. 71 of 2024, where the line items run from AED 50,000 to AED 1,000,000.
What Are the Penalties for AML Non-Compliance in the UAE?
Penalties for AML compliance UAE violations run on two separate tracks, administrative and criminal, and a single failure can trigger both. Article 17 of Federal Decree-Law No. 10 of 2025 empowers supervisory authorities to fine a regulated entity between AED 10,000 and AED 5,000,000 per violation, alongside warnings, suspension of staff, restriction of activity, or licence revocation. Repeat violations within one year can attract incremental fines.
| Violation type | Penalty range | Legal basis |
|---|---|---|
| Administrative fine, per violation | AED 10,000 to AED 5,000,000 | Article 17(1)(b), FDL 10/2025 |
| Money laundering (basic offence) | Up to 10 years imprisonment and AED 100,000 to AED 5,000,000 | FDL 10/2025 |
| Aggravated money laundering | Temporary imprisonment and AED 1,000,000 to AED 10,000,000, or twice the value of the criminal property, whichever is greater | Article 26(2), FDL 10/2025 |
| Corporate (legal person) liability | Criminal fine of AED 5,000,000 to AED 100,000,000 | Article 27(1), FDL 10/2025 |
| Tipping off a client under investigation | Imprisonment and a fine of not less than AED 50,000, or either penalty | Article 29(1), FDL 10/2025 |
Enforcement in 2026 shows these numbers are not theoretical. On 24 June 2026, the Central Bank of the UAE fined a foreign bank branch AED 20 million for repeated AML and sanctions control failures, under the Central Bank Law rather than the AML decree-law. That is a separate and higher penalty ladder, which is why the figure sits above the AED 5,000,000 administrative ceiling in Article 17. The Central Bank separately fined its Head of Compliance and MLRO AED 300,000 personally for failing the duties of the role. Across 2025, the Central Bank of the UAE issued more than AED 370 million in AML and CFT related fines in total. Supervisory authorities can and do fine the individual compliance officer directly, in addition to fining the company, so AML compliance UAE liability reaches founders acting as their own MLRO.
Do Free Zone Companies Need Separate AML Compliance?
Yes. Federal AML compliance UAE law applies across the entire country, including every commercial free zone, and free zone registration does not create an exemption. What changes by jurisdiction is which authority supervises a business and which additional rulebook layers on top of AML compliance UAE obligations.
A DMCC, JAFZA, or RAKEZ company follows the same Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 obligations as a mainland company, supervised by the Ministry of Economy and Tourism if it is a DNFBP. DIFC and ADGM are the exception in structure rather than substance, and it is worth being precise about which part is separate. The criminal provisions of Federal Decree-Law No. 10 of 2025 apply across the whole country, financial free zones included, and goAML reporting to the Financial Intelligence Unit is federal, so a DIFC or ADGM entity files there like anyone else. What is administered separately is the preventive and supervisory rulebook. For DIFC that is the Dubai Financial Services Authority rulebook and for ADGM the Financial Services Regulatory Authority rulebook, in place of Cabinet Resolution No. 134 of 2025 rather than on top of it.
A founder comparing jurisdictions should check AML compliance UAE cost and process against the specific regulator, rather than assume every free zone runs the same rulebook.
Related Articles
- Economic Substance Regulations in the UAE: What Free Zone Founders Must File to Avoid Penalties
- LLC or Sole Establishment in Dubai: Which Legal Form Should You Actually Register?
- Corporate Structuring in Dubai: Building a Structure That Survives Growth
This article is for informational purposes and does not constitute tax or legal advice. GCG Structuring advises on UAE corporate structuring, tax residency, and free zone setup.
FAQ
1. 0 Who needs AML compliance in the UAE?
Any Financial Institution, Designated Non-Financial Business and Profession (DNFBP), or Virtual Asset Service Provider operating in the UAE needs AML compliance UAE registration. DNFBPs include real estate brokers, precious metals dealers, accountants, lawyers, and company service providers. The trigger is the business activity performed, not the trade licence category, company size or free zone status, under Cabinet Resolution No. 134 of 2025.
2. 0 What is goAML and how do you register?
goAML is the UAE Financial Intelligence Unit’s mandatory reporting platform for filing Suspicious Transaction Reports and related filings. Registration is a two-stage process: first SACM pre-registration at services.uaefiu.gov.ae to obtain login credentials, then full entity registration on the goAML portal itself with trade licence and MLRO details. The FIU reviews and approves each submission manually.
3. 0 Do free zone companies need AML compliance in the UAE?
Yes, free zone companies are not exempt from AML compliance in the UAE. Federal Decree-Law No. 10 of 2025 applies across mainland and all free zones equally. DIFC and ADGM entities additionally follow the AML rulebooks of the Dubai Financial Services Authority and the Financial Services Regulatory Authority, on top of the federal law.
4. 0 What are the penalties for AML non-compliance in the UAE?
Penalties range from an administrative fine of AED 10,000 to AED 5,000,000 per violation under Article 17 of Federal Decree-Law No. 10 of 2025, up to a criminal fine of AED 5,000,000 to AED 100,000,000 for a convicted legal person under Article 27(1). In June 2026, the Central Bank of the UAE fined a bank branch AED 20 million and its compliance officer AED 300,000 personally for repeated failures, under the separate penalty regime of the Central Bank Law.
5. 0 Does a small business need a full-time AML compliance officer?
No, UAE law requires a designated, competent AML compliance officer, also called a Money Laundering Reporting Officer, with genuine independence and board access, not necessarily a dedicated full-time hire. In many small DNFBPs, an existing director or manager holds the role, supported by external compliance expertise, provided the appointment carries real authority rather than a title alone. Note that Cabinet Resolution No. 134 of 2025 requires prior approval of the compliance officer by the supervisory authority, so the appointment has to be cleared before the person takes up the role.
6. 0 Is a company formation agent a DNFBP in the UAE?
Yes, a company formation agent is a DNFBP under AML compliance UAE rules the moment it performs any of six listed activities in Cabinet Resolution No. 134 of 2025, including incorporating legal entities, arranging nominee directors or shareholders, or providing a registered office address. This classification applies regardless of the jurisdiction the agent operates from within the UAE.
7. 0 What is the difference between the current AML law and the previous one?
Federal Decree-Law No. 10 of 2025 replaced Federal Decree-Law No. 20 of 2018, and its Executive Regulations, Cabinet Resolution No. 134 of 2025, replaced Cabinet Decision No. 10 of 2019. The update expanded the regulated population to include commercial gaming operators and raised the standard for what a business is deemed to have known about a suspicious transaction.
