UAE AML requirements: who must comply, and what they must actually do

Who the rules apply to

UAE anti-money-laundering obligations fall on two broad groups: financial institutions, and what the law calls designated non-financial businesses and professions (DNFBPs). DNFBPs are defined in Article 3 of Cabinet Decision No. 10 of 2019, the implementing regulation to Federal Decree-Law No. 20 of 2018.

• Financial institutions — banks, finance companies, exchange houses and money changers, insurance, securities and fund firms, and payment or stored-value providers.
• Real estate brokers and agents — including agencies and developers acting for buyers and sellers.
• Dealers in precious metals and precious stones — gold, jewellery and related trading businesses.
• Trust and company service providers — corporate services, nominee director and nominee shareholder services.
• Accountants and external auditors.
• Law firms, notary firms and independent legal consultants — when they carry out specified transactions for a client, such as a property sale or a company formation.

If your activity falls into one of these categories, being small does not take you out of scope. The depth of your controls scales with your risk; registration, screening and reporting do not disappear.

Who supervises you

Your supervisory body decides where you register, what you report, and who may inspect you. The main supervisors are:

• UAE Central Bank — banks, exchange houses, money changers and other financial institutions it licences.
• Securities and Commodities Authority — firms in the securities and commodities sector.
• Dubai Financial Services Authority — firms operating inside the Dubai International Financial Centre.
• Financial Services Regulatory Authority — firms inside the Abu Dhabi Global Market.
• Ministry of Economy and Tourism — DNFBPs at state level and in commercial free zones. The financial free zones supervised by the DFSA or FSRA sit outside its remit.
• Virtual Assets Regulatory Authority — virtual asset service providers in Dubai.

What is actually expected of you

The framework is risk-based: you identify your risks and put proportionate controls around them. In practice, supervisors look for the same core elements.

1. 1A documented business-wide risk assessment covering customers, products, delivery channels and geographies, reviewed when something changes.
2. 2Written policies, controls and procedures staff can actually follow — not a document written for an inspection.
3. 3A named compliance officer or money laundering reporting officer with authority to escalate and to file reports.
4. 4Customer due diligence — identify and verify the customer, understand the purpose of the relationship, and identify who ultimately owns or controls a corporate customer.
5. 5Screening against sanctions and other watchlists at onboarding and on an ongoing basis.
6. 6Ongoing monitoring of the relationship, including transaction monitoring where you handle flows of funds.
7. 7Record-keeping sufficient to reconstruct a decision years later.
8. 8Staff training that is recorded and repeated.

The lists you are expected to check

• The UN Security Council Consolidated List.
• The UAE National Terrorist List, maintained by the Executive Office for Control and Non-Proliferation.
• The US OFAC Specially Designated Nationals list and the EU consolidated sanctions framework — relevant because of correspondent banking, currency and counterparties.
• Supervisory and enforcement records for your sector, such as licensing and violation records from the Central Bank, the Securities and Commodities Authority, the DFSA, ADGM and Dubai's Virtual Assets Regulatory Authority.

A regulatory or enforcement record is not the same thing as a sanction. It is a reason to look closer and to write down what you concluded — not an automatic refusal.

Reporting: goAML and the UAE FIU

Suspicious activity is reported to the UAE Financial Intelligence Unit through goAML, the reporting platform developed by the UN Office on Drugs and Crime. The UAE FIU has used it since June 2019, and registration on the portal is mandatory for DNFBPs.

Registration runs in two steps — first the Services Access Control Manager, then entity registration. You will normally need your trade licence, an appointment letter for your compliance officer or MLRO on company letterhead, and a copy of that officer's Emirates ID or passport.

Where businesses most often fall short

• Screening once at onboarding and never again, even though lists change constantly.
• Matching only exact spellings, which misses transliterated or reordered names.
• No record of who was screened, when, against which list version, and why an alert was dismissed.
• No beneficial-owner information held for corporate customers.
• No compliance officer appointed, or one appointed on paper with no training or authority.
• Cash and third-party payments accepted without a documented explanation.