AML compliance UAE requirements apply to a wide range of businesses beyond banks and exchange houses, and many designated non-financial businesses and professions (DNFBPs) are still unsure exactly what is expected of them. If you deal in real estate, precious metals and stones, or provide corporate services, understanding your obligations under UAE anti-money laundering law is no longer optional. This guide walks through who is covered, what a proper AML policy looks like, and how to stay on the right side of regulators such as the Ministry of Economy and the Financial Intelligence Unit.

Who is required to comply with AML rules in the UAE?

The UAE's AML/CFT/CPF framework is primarily governed by Federal Decree-Law No. (10) of 2025 Regarding Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, together with its implementing regulations and related regulatory decisions and guidance. The law came into force on 14 October 2025 and replaced Federal Decree-Law No. (20) of 2018.

DNFBPs typically include:

  • Real estate brokers and agents when carrying out transactions relating to the purchase and sale of real estate
  • Dealers in precious metals and stones when carrying out transactions covered by the AML legislation
  • Independent legal professionals and accountants carrying out specified activities
  • Company service providers, including those forming or managing legal entities
  • Trust and corporate service providers

If your business falls into any of these categories, you are legally required to implement AML controls, register with the relevant regulator, and file reports through the goAML platform when needed. For businesses unsure of their exact classification, our AML compliance services can help confirm your obligations.

What does goAML registration actually involve?

goAML is the UAE Financial Intelligence Unit's online platform used for registering entities and submitting suspicious transaction reports (STRs) and suspicious activity reports (SARs). Registration is a mandatory first step for all obligated DNFBPs.

The registration process generally requires:

  • goAML is the UAE Financial Intelligence Unit's electronic platform for reporting suspicious transactions and activities. DNFBPs that are required to report must register for access to goAML and maintain accurate registration information.

    The registration process generally involves:

    • Identifying the reporting entity and its supervisory authority
    • Appointing a nominated Compliance Officer/MLRO
    • Providing the required entity and Compliance Officer information
    • Submitting the required supporting documents through the FIU's registration/access process
    • Maintaining the goAML profile and authorised-user information up to date

    Once registered, the DNFBP must use the system to submit the relevant reports when a reporting obligation arises.

What should an AML policy for a UAE business include?

A written AML policy is not just a formality — regulators expect it to reflect how your business actually operates day to day. A generic, copy-pasted policy will not withstand scrutiny during an inspection.

Core components of an effective AML policy:

  • A documented business-wide risk assessment identifying money laundering and terrorist financing risks specific to your sector
  • Customer due diligence (CDD) and enhanced due diligence (EDD) procedures for higher-risk clients
  • Clear procedures for screening customers against UN and local sanctions lists
  • Record-keeping requirements, typically maintaining documents for at least five years
  • Internal reporting lines for staff to escalate suspicious activity to the compliance officer
  • Staff training schedules and records to demonstrate ongoing awareness

Your AML policy should be reviewed and updated regularly, especially after any change in business activity, ownership structure, or regulatory guidance. Many businesses also align their AML controls with broader corporate governance requirements, including Ultimate Beneficial Owner (UBO) reporting obligations, since ownership transparency is a key pillar of AML compliance.

What are the penalties for non-compliance with AML regulations?

UAE authorities have significantly increased enforcement activity in recent years, and penalties for AML violations can be severe.

Common consequences include:

  • Financial penalties ranging from tens of thousands to millions of dirhams depending on the violation
  • Suspension or revocation of trade licences for repeated or serious breaches
  • Personal liability for compliance officers and management in certain cases
  • Reputational damage that can affect banking relationships and client trust

Common triggers for penalties include failure to register on goAML, absence of a risk assessment, missing or outdated AML policies, lack of staff training records, and failure to file suspicious transaction reports when required. Regular internal reviews or an external audit can help identify gaps before a regulator does — our auditing services team can support this kind of independent review.

How often should AML risk assessments be updated?

A one-time risk assessment is not sufficient. Regulators expect businesses to treat AML risk assessment as a living process.

Best practice suggests reviewing your risk assessment:

  • Annually, as a minimum, regardless of business changes
  • Whenever you onboard clients from higher-risk jurisdictions or sectors
  • After any significant change in ownership, services offered, or business model
  • Following updates to UAE AML legislation or guidance from the Ministry of Economy

Keeping a dated log of each review, along with any changes made to your controls, provides valuable evidence of an active, functioning compliance programme rather than a document created purely for licensing purposes.

Frequently Asked Questions

Do all businesses in the UAE need to register for AML compliance?
No. AML obligations primarily apply to DNFBPs and regulated financial institutions. However, many company service providers, real estate businesses, and dealers in precious metals are automatically in scope and must register on goAML.

What is the difference between an STR and a SAR?
Both are reports submitted to the UAE Financial Intelligence Unit through goAML when the relevant reporting conditions are met. Broadly, an STR is used where the suspicious transaction and relevant bank-account information are available, while a SAR is used where suspicious activity is identified but the relevant bank-account or statement information required for an STR is not available. The appropriate report type depends on the circumstances and information available.

Can a business appoint an external AML compliance officer?
Many small and medium businesses outsource this function to a qualified third party, provided the appointed officer has appropriate access, authority, and understanding of the business to fulfil regulatory duties effectively.

Is AML compliance linked to corporate tax or VAT obligations?
They are separate regulatory regimes, but a well-run business typically manages them together as part of overall governance, alongside services such as corporate tax registration and VAT compliance.

How Elite Edge can help

Navigating AML compliance UAE requirements — from goAML registration to building a defensible AML policy — can be time-consuming without the right expertise. At Elite Edge Accounting & Bookkeeping, based in Office No. 1810, Tamani Arts Building, Business Bay, Dubai, we help DNFBPs and other regulated businesses assess their risk exposure, register correctly, and maintain ongoing compliance with confidence. Contact us today to discuss your AML obligations and put a practical compliance framework in place.

This article is provided for general informational purposes only and does not constitute professional, legal, or regulatory advice. AML rules and enforcement practices in the UAE can change, so please consult a qualified advisor for guidance specific to your business.