AML (anti money laundering) compliance in the UAE means registering on the FIU’s goAML portal, appointing a UAE-resident compliance officer, running customer due diligence (KYC), screening clients against sanctions lists, keeping records, training staff and reporting suspicious transactions. It applies to financial institutions, DNFBPs and virtual asset providers under Federal Decree-Law No. 10 of 2025. Gaps can cost up to AED 5 million per violation.
Most UAE business owners don’t think about AML compliance until a bank asks an awkward question. Or a Ministry inspector books a visit. By then it’s late — and expensive.
Here’s the thing. Anti-money laundering rules aren’t just for banks anymore. If you sell property, trade gold, audit accounts or set up companies for clients, the law already treats you as a gatekeeper. And since October 2025, that law has teeth it didn’t have before.
This guide walks through what the rules actually require, who they cover, what the penalties look like, and how to get a working AML programme in place without drowning your team in paperwork. (If you’d rather skip ahead and talk to someone, our AML and UBO compliance team offers a free first review.)
What Is AML (anti money laundering) Compliance in the UAE?
AML compliance is the set of controls a business uses to make sure it isn’t being used to clean dirty money, fund terrorism or finance weapons programmes. In practice, that means knowing who your customers are, knowing where their money comes from, and speaking up when something doesn’t add up.
The legal backbone is Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025 and replaced the old 2018 law entirely. Its executive regulations, Cabinet Resolution No. 134 of 2025, followed in December 2025. The rules apply everywhere in the country — mainland, free zones, ADGM and DIFC.
What changed with the 2025 law
If your AML policy was written before late 2025, it’s probably out of date. Three changes matter most for ordinary businesses:
- Proliferation financing is now its own offence. Screening for weapons-related financing sits alongside money laundering and terrorist financing, not buried beneath them.
- “I didn’t know” is a weaker defence. Knowledge can now be inferred from the circumstances. If the warning signs were there and you should have seen them, that can be enough.
- Senior people are personally exposed. Accountability now lands on the compliance officer and senior management, not just the company as a legal entity.
Honestly, that last point is the one that gets owners’ attention. AML used to feel like an admin task. Now it’s a personal risk.
Who Must Comply With UAE AML Rules?
The law calls them “reporting entities.” There are three groups: financial institutions, virtual asset service providers (VASPs), and Designated Non-Financial Businesses and Professions — DNFBPs. That third group is where most SMEs get caught out.
| DNFBP category | Typical businesses | Main supervisor |
| Real estate | Brokers and agents handling property sales | Ministry of Economy and Tourism |
| Precious metals and stones | Gold, jewellery and diamond traders (cash deals of AED 55,000 or more) | Ministry of Economy and Tourism |
| Accountants and auditors | Audit firms, independent accountants | Ministry of Economy and Tourism |
| Corporate service providers | Company formation agents, registered office and nominee services | Ministry of Economy and Tourism |
| Lawyers and notaries | When they handle certain client transactions | Ministry of Justice |
| Commercial gaming | Licensed gaming operators (new under the 2025 rules) | GCGRA |
Not sure if your trade licence puts you on this list? Check the licensed activities, not just the company name. A general trading licence with a precious-metals activity tucked into it is a classic way to end up a DNFBP without realising.
Core AML Compliance Requirements for UAE Businesses
The obligations are the same core set whatever sector you’re in. What changes is how heavy each one needs to be, and that depends on your risk.
1. AML registration on goAML
This is step one, and it’s the one regulators check first. DNFBPs must register on goAML, the UAE Financial Intelligence Unit’s reporting platform, which is also the channel for filing suspicious transaction reports. Skipping it has already cost businesses dearly — in 2023 the Ministry suspended 50 DNFBP firms for three months for not registering.
Registration isn’t hard, but it is fiddly. Documents get rejected for small mismatches, and the wrong supervisor gets approached more often than you’d think. Our AML registration support handles the portal setup and user access end to end.
2. KYC setup and customer due diligence
You need to know who you’re dealing with — and who really owns them. That means verifying identity, identifying the ultimate beneficial owner (UBO), understanding the purpose of the relationship and checking where the funds come from. High-risk clients get enhanced due diligence.
The weak spot is usually consistency. One salesperson collects a passport copy; another collects nothing. A proper KYC setup gives every team member the same forms, the same risk scoring and the same sign-off rules.
3. A written AML policy and risk assessment
Inspectors will ask for your policy before they ask anything else. It has to reflect your business, your customers and the UAE National Risk Assessment — not a template downloaded from somewhere else with the company name swapped. Pair it with a documented enterprise-wide risk assessment, reviewed at least yearly.
This is where AML policy design earns its fee: a policy your staff can actually follow is worth far more than a 60-page document nobody opens.
4. Sanctions and PEP screening
Every customer — and every UBO — needs to be screened against the UAE Local Terrorist List and UN sanctions lists, plus checks for politically exposed persons. Not just at onboarding, either. Lists change, so screening has to be ongoing.
Manual screening works for a handful of clients a month. Beyond that, mistakes creep in. AML screening software automates the checks, logs every result and gives you an audit trail an inspector will accept.
5. A compliance officer and staff training
You need a designated AML compliance officer who’s resident in the UAE, senior enough to act independently and able to reach management directly. Everyone else who deals with customers needs regular, role-specific training.
Generic online modules tick a box. But they rarely teach a property agent what a suspicious cash buyer looks like in Dubai. Practical AML training built around real red flags in your sector is far more useful — and easier to defend.
6. Suspicious transaction reporting and record keeping
If something looks off, it goes to the FIU through goAML, without delay. And you can’t tell the customer you’ve reported them (that’s tipping off, a separate offence). Keep CDD files, transaction records and reports for at least five years, organised well enough to produce on request. Clean bookkeeping and accounting records make this part much less painful.
AML Penalties in the UAE: What Non-Compliance Really Costs
Administrative fines for AML failures can reach AED 5 million per violation. Not per inspection — per violation. Missing goAML registration alone has historically drawn fines starting around AED 50,000.
And the regulator isn’t bluffing. In 2023, the Ministry of Economy fined 225 DNFBP companies roughly AED 76.9 million and suspended 50 businesses for failing to register on goAML.
The fines are only part of it, though. Banks watch for this too. A business operating in a DNFBP sector without visible AML controls is exactly the kind of account a compliance desk flags — and a frozen account hurts faster than any penalty notice. Then there’s the criminal side, where the 2025 law sets prison terms of one to ten years for money laundering itself.
So the real question isn’t whether compliance is worth the cost. It’s whether you can afford to find out the hard way.
How to Set Up AML Compliance in the UAE: 7 Steps
There’s a sensible order to this. Get it backwards — buying software before you know your risks, say — and you’ll redo half the work.
- Confirm your status. Check your licensed activities and identify your supervisor (Ministry of Economy and Tourism, Ministry of Justice or GCGRA).
- Register on goAML. Create the entity profile and set up user access for your compliance officer.
- Appoint a compliance officer. UAE-resident, independent, with a direct line to management.
- Run a business-wide risk assessment. Look at your customers, products, payment methods and geographies.
- Write the AML policy and procedures. Base them on the risk assessment, then cover CDD, screening, escalation and reporting.
- Put KYC and screening into practice. Standard onboarding forms, risk scoring and screening software that logs results.
- Train staff and review regularly. Train at onboarding and at least yearly, then test the programme with an independent review.
Most small businesses can get steps one to five done in a few weeks with the right help. Steps six and seven never really finish — that’s the point.
In-House Compliance vs a Monthly AML Retainer
A full-time, experienced compliance officer in Dubai doesn’t come cheap. For a 10-person brokerage or jewellery shop, that salary can be hard to justify — yet the work still has to be done every month.
That’s why many SMEs split it. The business names its own compliance officer (the law requires one), and an outside team does the heavy lifting behind them. A monthly AML retainer typically covers ongoing screening, CDD file reviews, goAML reporting support, policy updates when the rules move, and inspection prep.
Is outsourcing right for everyone? No. A bank or large exchange house needs a dedicated in-house function. But for most DNFBPs, a retainer gives you specialist cover at a fraction of the cost — and someone whose whole job is noticing when the regulations change.
Frequently Asked Questions
Is AML compliance mandatory for all UAE companies?
The full AML regime applies to financial institutions, virtual asset service providers and DNFBPs such as real estate brokers, precious metals dealers, accountants and corporate service providers. Other companies still have UBO disclosure duties and must not deal with sanctioned parties. If your licence includes a DNFBP activity, the full rules apply.
What is goAML registration in the UAE?
goAML is the UAE Financial Intelligence Unit’s online platform for registering reporting entities and filing suspicious transaction reports. DNFBPs must register before they can report. Failing to register is one of the most common reasons businesses are fined or suspended.
What is the fine for AML non-compliance in the UAE?
Administrative fines can reach AED 5 million per violation under Federal Decree-Law No. 10 of 2025. Supervisors can also suspend business activity, and serious offences carry criminal penalties, including imprisonment.
Do I need a dedicated AML compliance officer?
Yes. Reporting entities must appoint a compliance officer who lives in the UAE, can act independently and reports directly to senior management. Smaller firms often pair an internal officer with an external retainer for day-to-day support.
How often should AML training be done?
New staff should be trained before they deal with customers, and all relevant employees should receive refresher training at least once a year. Training should also be updated whenever the law or your risk profile changes.
What’s the difference between KYC and AML?
KYC (know your customer) is one part of AML compliance — it covers verifying who a customer is and who owns them. AML is the wider framework, including risk assessment, screening, monitoring, reporting, record keeping and training.
Get Your AML Programme Inspection-Ready
AML compliance in the UAE has moved from “nice to have” to “someone could be personally liable.” The good news? A sensible, well-documented programme isn’t out of reach for a small business — it just needs to be built properly once, then kept alive.
Midwaters helps UAE businesses with goAML registration, KYC setup, AML policy design, screening software, staff training and ongoing monthly support. If you’re not sure where you stand, book a free consultation and we’ll tell you exactly what’s missing — before an inspector does.
