AML compliance UAE requirements do not end once a business completes goAML registration — they continue in the form of ongoing monitoring, reporting and record-keeping duties that regulators expect to see evidence of at any time. Many Designated Non-Financial Businesses and Professions (DNFBPs), including real estate agents, jewellers, company service providers and auditors, understand they need to register but underestimate the reporting obligations that follow. This article explains what UAE businesses must report, when, and how to stay ahead of deadlines.

The UAE's AML/CFT/CPF framework is governed by Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, together with Cabinet Resolution No. 134 of 2025 and other applicable regulations, decisions and supervisory guidance. The UAE Financial Intelligence Unit (FIU) receives and analyses suspicious transaction and activity reports through goAML, while relevant supervisory authorities oversee compliance within their respective sectors.

What must be reported through goAML, and when?

Once registered on goAML, a business's compliance officer is responsible for submitting specific reports whenever certain triggers occur. These are not filed on a fixed calendar date like VAT returns — they are event-driven, meaning the deadline is tied to when suspicion or a qualifying transaction arises.

Key report types

  • Suspicious Transaction Report (STR): submitted when a transaction or attempted transaction is suspected, or there are reasonable grounds to suspect, that it involves criminal proceeds or is connected with money laundering, terrorist financing, proliferation financing or another relevant offence under the applicable framework.
  • Suspicious Activity Report (SAR): used to report suspicious activity in circumstances covered by the FIU's reporting framework, including activity that may not involve a completed transaction. The appropriate report type depends on the facts and the FIU's current reporting instructions
  • Real Estate Report: required for specified real estate transactions that meet the applicable reporting criteria, including certain freehold property transactions involving cash payments of AED 55,000 or more and qualifying transactions involving virtual assets.

  • Other sector-specific reports: additional reporting obligations may apply depending on the business activity, risk indicators and applicable FIU instructions. Businesses should identify the reports relevant to their sector rather than assume that the same reporting forms apply to every DNFBP.

Required suspicious transaction or activity reports must be submitted to the FIU without delay once the applicable reporting threshold is met. The reporting obligation may apply even if the transaction is attempted, declined or not completed. Staff must also avoid tipping off the customer or another person about a report or a related investigation.

What ongoing obligations apply between reports?

Even in periods with no suspicious activity to report, a business must actively maintain its AML compliance UAE infrastructure. Supervisory authorities expect to see continuous evidence of a functioning programme, not just a policy document sitting in a drawer.

Continuous obligations include

  • Screening customers against UN and local sanctions lists before onboarding and periodically thereafter
  • Conducting and updating customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk clients

  • Maintaining customer due diligence, transaction, business relationship and relevant reporting records for at least the applicable statutory retention period. The general AML framework provides for a minimum five-year retention period in relevant circumstances; businesses should confirm the applicable starting point and any longer retention requirement under the rules governing their activities.

  • Refreshing the business-wide AML risk assessment as operations, clients or geographies change
  • Delivering AML training to relevant staff on a recurring basis
  • Renewing or updating the goAML registration profile if company details change

Businesses that already have a documented risk assessment and policy should review our related guidance on building and maintaining an AML compliance programme to ensure ongoing obligations are properly scheduled and assigned.

What happens if a report or obligation is missed?

Failure to file required reports, or lapses in ongoing monitoring, can result in administrative penalties, license-related consequences, and reputational damage. Supervisory authorities carry out inspections and audits, and During supervisory inspections, authorities may examine the effectiveness of reporting procedures alongside customer due diligence, risk assessments, sanctions screening, staff training, record-keeping and other AML controls.

Common consequences of missed reporting

  • Financial penalties that can escalate for repeated or severe non-compliance
  • Formal warnings or corrective action notices from the supervisory authority
  • Increased scrutiny in future audits or inspections
  • In serious cases, referral for further regulatory or legal action

Because reporting triggers are based on judgement calls by staff, businesses should ensure their compliance officer and frontline employees are properly trained to recognise red flags in real time rather than after the fact.

How can a business stay on top of AML reporting deadlines?

Since goAML reporting is trigger-based rather than calendar-based, the practical challenge for most UAE businesses is building internal habits and checks that catch suspicious activity quickly and route it to the compliance officer without delay.

Practical steps

  • Set clear internal escalation procedures so staff know exactly who to notify and how quickly
  • Log every screening check and due diligence review with dates, even when no issue is found

  • Schedule regular reviews of the business-wide risk assessment, AML policies and controls, with additional reviews when there are material changes in activities, customers, delivery channels or geographic exposure. Set a documented review frequency appropriate to the business's risk profile and applicable supervisory requirements.

  • Keep the goAML registration and compliance officer contact details current with the FIU
  • Consider periodic independent reviews to test whether the AML programme would hold up under a real supervisory audit

Businesses that outsource elements of their finance function often find it easier to keep these obligations on track when they are integrated with broader accounting and bookkeeping processes, since transaction records and customer data overlap significantly with AML documentation.

Frequently Asked Questions

Do all DNFBPs have the same reporting obligations?
No. While the core STR/SAR framework applies broadly, some obligations — such as real estate transaction reporting — are specific to certain business categories. It's important to confirm which reports apply to your sector.

Is there a fixed annual AML filing deadline like VAT or corporate tax?
Not in the same sense. Most goAML reports are triggered by events rather than fixed dates, though internal reviews such as risk assessment updates should be scheduled at least annually.

Can a business be penalised even if no suspicious activity ever occurred?
Yes. Penalties can arise simply from failing to maintain required policies, training, screening or records — regulators assess the programme's existence and quality, not only reporting history.

How Elite Edge can help

Elite Edge Accounting & Bookkeeping, based at Office No. 1810, Tamani Arts Building, Business Bay, Dubai, supports DNFBPs and other regulated businesses with goAML registration, AML policy development, risk assessments and ongoing reporting support so nothing slips through the cracks. Get in touch via our contact page to discuss your AML compliance obligations today.

This article is for general information only and does not constitute professional or legal advice. AML rules and enforcement practices in the UAE can change, so please seek tailored guidance for your specific circumstances.