An effective AML compliance policy in the UAE is a core requirement for Designated Non-Financial Businesses and Professions (DNFBPs) subject to the UAE's anti-money laundering framework. Compliance involves more than registering on goAML and submitting reports when necessary. Businesses must assess their exposure to money laundering, terrorist financing, and proliferation financing (ML/TF/PF), and implement documented, risk-based policies, procedures, and controls suited to their activities, customers, and operating environment. This guide explains the key steps for building and maintaining an effective AML compliance framework.
Whether you operate a real estate brokerage, a precious metals and stones business, an audit or accounting practice, or a trust and company service provider, your obligations depend on whether your activities fall within the applicable DNFBP definitions and supervisory framework. Where the AML requirements apply, internal policies, procedures, and controls must be documented, approved by senior management, communicated to relevant staff, and implemented in practice. The framework should reflect the business's actual risk profile rather than rely on a generic policy template.
What must an AML policy in the UAE actually contain?
The UAE's current federal AML/CFT/CPF framework includes Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, together with Cabinet Resolution No. 134 of 2025, which sets out its Executive Regulations. DNFBPs within the scope of the framework must establish and implement documented, risk-based internal policies, procedures, and controls proportionate to the nature, size, complexity, and assessed risks of their business. Businesses should also check applicable supervisory instructions and sector-specific requirements:
A documented business-wide ML/TF/PF risk assessment covering relevant customers, countries and geographic areas, products and services, transactions, and delivery channels
Internal policies, procedures, and controls approved by senior management and tailored to the identified risks
Customer due diligence (CDD), beneficial-owner identification, ongoing monitoring, and enhanced due diligence (EDD) where required
PEP identification and assessment procedures, including appropriate additional measures for higher-risk relationships
Sanctions screening and procedures for implementing applicable targeted financial sanctions and competent-authority directives
Record-keeping arrangements that meet the applicable statutory retention periods
Procedures for identifying, escalating, and reporting suspicious transactions or activities through goAML, as applicable
Appointment and clearly defined responsibilities of a competent AML Compliance Officer / MLRO, as required
Employee screening, role-appropriate training, internal reporting channels, and controls to test and improve the effectiveness of the AML programme
Businesses that also fall under Ultimate Beneficial Owner rules should ensure their AML policy cross-references their UBO compliance obligations, since ownership transparency and AML risk assessment are closely linked.
Who needs to register on goAML and file reports?
Businesses and professionals that fall within the applicable DNFBP definitions must comply with the relevant AML requirements, including goAML registration where required by their supervisory framework. Relevant categories can include real estate brokers and agents involved in property transactions, dealers in precious metals and stones, specified accounting and audit professionals, trust and company service providers, and legal professionals carrying out activities covered by the applicable rules. The precise scope depends on the nature of the activity and the applicable supervisory authority. The UAE Financial Intelligence Unit (FIU) operates goAML for the submission of relevant suspicious transaction and activity reports:
Complete goAML registration where required and maintain accurate registration and contact details.
Appoint a competent AML Compliance Officer / MLRO with clearly documented responsibilities and appropriate access to relevant records.
Establish internal procedures to identify, assess, escalate, and report suspicious transactions or activities to the FIU without delay when the applicable reporting obligation is triggered.
Respond to lawful requests from the FIU and other competent authorities, and maintain the supporting records required by law.
Common triggers for filing a report
- A customer refuses to provide identification or ownership documents
- Payment structured to avoid reporting thresholds
- Transactions inconsistent with the customer's known business activity
- Use of third parties or shell companies with no clear commercial rationale
How do you carry out customer due diligence correctly?
Due diligence isn't a one-off box-tick exercise — it should scale with risk. A risk-based AML policy should define the due diligence measures applicable to different customer and transaction risk levels. Depending on the circumstances and the applicable rules, these may include:
Simplified Due Diligence (SDD): reduced measures where the customer and relationship are assessed as low risk and simplified measures are legally permitted. SDD must not be used where suspicion exists or where the applicable rules prohibit it.
Customer Due Diligence (CDD): appropriate identification and verification of the customer and beneficial owner, understanding the purpose and intended nature of the relationship or transaction, and ongoing monitoring where required.
Enhanced Due Diligence (EDD): additional checks and controls where higher risks are identified, including relevant PEP relationships, high-risk jurisdictions, complex ownership structures, or transactions with unusual characteristics.
The policy should explain the risk factors, approval steps, additional information required, monitoring measures, and review frequency applicable to each category. It should also specify the records to be collected and retained, taking account of the customer's risk and the nature of the business relationship or transaction.
How often should the AML policy be reviewed and updated?
Regulators expect AML policies to be living documents, not static PDFs filed away after the initial goAML registration. AML policies and controls should be reviewed regularly and updated whenever needed to remain effective and reflect the business's current risk profile and applicable requirements. A practical review programme should include:
Periodic review of the policy and business-wide risk assessment, with the review frequency determined by the business's risk exposure and applicable requirements.
Prompt updates following relevant legal or regulatory changes, new supervisory instructions, or changes in the business's activities.
Reassessment when customer types, products or services, transaction patterns, delivery channels, ownership, or geographic exposure change materially.
Appropriate staff communication and refresher training when procedures change.
Documented approvals, review dates, identified gaps, corrective actions, and evidence that the controls operate in practice.
Keeping a paper trail of policy reviews, sign-offs, and training sessions is often what separates a business that passes an inspection from one that gets fined. Depending on the engagement and applicable requirements, an external auditor or an independent AML reviewer may examine relevant compliance documentation, risk assessments, training records, and evidence of internal controls. Businesses should retain these records for review by the appropriate supervisory authority and other competent authorities when lawfully requested.
What happens if your AML policy is inadequate?
DNFBPs that breach applicable AML/CFT/CPF requirements may face administrative penalties imposed by the competent supervisory authority. Depending on the nature of the violation and the applicable legal provisions, consequences may include warnings, financial penalties, restrictions or suspension of activities, measures against responsible management, or licence cancellation. The competent authority, applicable penalty schedule, and circumstances of the violation determine the consequences in each case:
A generic AML policy that does not reflect the business's activities, customer base, or assessed risks
An incomplete, outdated, or undocumented business-wide ML/TF/PF risk assessment
Inadequate evidence of customer due diligence, beneficial-owner checks, ongoing monitoring, or staff training
Missing or inaccurate goAML registration information, where registration is required
Failure to escalate and report suspicious transactions or activities when the applicable reporting obligation is triggered
Because these obligations sit alongside your wider regulatory duties — VAT, corporate tax, and licensing renewals — many businesses choose to build AML compliance into their overall governance framework rather than treating it as a standalone task.
Frequently Asked Questions
Does every UAE business need an AML policy?
No. Only entities classified as DNFBPs under UAE law — such as real estate agents, precious metals dealers, auditors, and corporate service providers — are legally required to have one, alongside financial institutions.
Can a small business use a template AML policy?
A template can be a starting point, but regulators expect the policy to be tailored to your actual customer base, transaction types, and risk profile. A generic, unmodified template is a common reason businesses fail inspections.
Who should hold the AML Compliance Officer role?
The business should appoint a competent and knowledgeable AML Compliance Officer / MLRO in accordance with the applicable requirements. The role, reporting line, authority, access to relevant information, and responsibilities should be clearly documented. The appointed individual should be able to escalate concerns, oversee the AML framework, and ensure suspicious matters are assessed and reported through the required channels without inappropriate interference. Confirm any specific eligibility, residency, or appointment requirements with the relevant supervisory authority.
Is goAML registration a one-time task?
Initial registration is not the end of an entity's AML obligations. Businesses must maintain accurate registration details, follow applicable access and reporting procedures, and submit reports when the relevant legal reporting conditions are met. They must also continue to maintain their risk assessment, customer due diligence, monitoring, record-keeping, and staff training arrangements for as long as the relevant obligations apply.
How Elite Edge can help
Elite Edge Accounting & Bookkeeping, based in Office No. 1810, Tamani Arts Building, Business Bay, Dubai, helps DNFBPs draft, implement, and review AML policies that satisfy UAE regulators without disrupting day-to-day operations. From goAML registration to ongoing risk assessments and staff training, our team can build a compliance framework tailored to your business. Contact us today to get your AML policy in order before your next inspection.
This article is for general information only and does not constitute professional, legal, or regulatory advice. UAE AML rules and enforcement practices can change, so always confirm current requirements with a qualified advisor or the relevant authority.