AML Compliance for DNFBPs in UAE: A Practical Guide

 

AML Compliance for DNFBPs in UAE: A Practical Guide

Key takeaways

- The UAE's current AML law is Federal Decree-Law No. 10 of 2025, which replaced the 2018 law.

- DNFBPs include real estate, precious metals and stones, accounting and audit, legal and corporate service providers.

- Every DNFBP needs a risk assessment, written policies, KYC procedures, goAML registration, a UAE-based compliance officer, training and records.

- Regulators can infer knowledge from circumstances, so "we did not know" is a weaker defence than before.

- Documented evidence is what protects you in an inspection.

If your business sells property, trades gold, keeps clients' books or sets up companies in Dubai, AML compliance for DNFBPs in the UAE is a legal duty, not a formality. Supervisors now check for it, and gaps can be expensive. This guide explains who is covered, what you must have in place, how goAML and the MLRO role work, and what an inspection looks at.

Visit Our Website :https://kumanoconsulting.com/

Who Must Comply With AML Regulations in the UAE?

AML duties apply to financial institutions, virtual asset service providers and Designated Non-Financial Businesses and Professions (DNFBPs). A DNFBP is a non-financial business that falls under the AML perimeter because of the activities it carries out. Typical examples are real estate agents and brokers, dealers in precious metals and stones (including jewellery businesses), accountants and auditors, lawyers and notaries, and company service providers.

The federal law applies across the UAE, including free zones. Supervision is split by sector, for example between the Ministry of Economy and Tourism and the Ministry of Justice. Check which supervisor covers your licence, because that supervisor will inspect you.

What Are the AML Requirements for DNFBPs in the UAE?

Every DNFBP, regardless of sector, needs the same core building blocks:

Risk assessment (EWRA): a written assessment of your clients, services, countries and delivery channels.

Policies and procedures: written, approved by management and tailored to your business.

KYC / customer due diligence: identify and verify customers and beneficial owners.

Enhanced due diligence: extra checks for high-risk customers and PEPs.

Sanctions screening: screen customers and counterparties, and keep evidence.

Ongoing monitoring: review transactions and keep client files up to date.

goAML reporting: register on goAML and report suspicious activity without delay.

Compliance officer (MLRO): a senior, UAE-resident person responsible for the programme.

Training: role-specific training with attendance records.

Record keeping: keep client and transaction records for the required period, commonly five years.

Independent review: periodic testing of whether your controls actually work.

KYC Requirements: What Good Looks Like

KYC (customer due diligence) means more than collecting a passport copy. For each client, your file should show who they are, who ultimately owns and controls them, the purpose of the relationship and, where risk requires it, the source of funds. For companies, record the ownership chain up to the natural persons. Incomplete beneficial owner information is one of the most common file gaps.

Enhanced Due Diligence and PEPs

Enhanced due diligence (EDD) applies when the risk is higher: politically exposed persons (PEPs), complex ownership, high-risk countries or unusual transactions. For PEPs, expect senior management approval, source of wealth checks and closer monitoring. Document why you accepted or declined the relationship.

EWRA: The Risk Assessment Everything Else Depends On

An enterprise-wide risk assessment (EWRA) is your written analysis of how your business could be misused for money laundering or terrorist financing. It sets the controls you apply. A jewellery dealer taking cash faces different risks from an accounting firm managing company formations, so a copied template will not hold up.

How often should it be reviewed? At least annually, and whenever something material changes, such as a new service, a new market, a new client type or a change in the law. Keep each version and the approval record.

goAML Registration: Who Needs It and How

goAML is the reporting portal of the UAE Financial Intelligence Unit. DNFBPs must register to file suspicious transaction reports and other mandatory reports. In practice:

Step 1: Appoint your compliance officer first.

Step 2: Prepare your licence, signatory and officer details.

Step 3: Submit the registration on the FIU's goAML portal and wait for approval.

Step 4: Test internal escalation so staff know how to raise a concern.

Step 5: Keep a log of internal alerts and decisions, including those you decide not to report.

Register before you need to report. Suspicious activity must be reported without delay, and a missing account is not an acceptable reason for a late report. Some sectors also have specific report types, such as cash-threshold reports for real estate and precious metals dealers.

The MLRO in the UAE: More Than a Name on Paper

The MLRO (also called the AML compliance officer) runs the programme. They review internal alerts, decide whether to file a report on goAML, advise management and oversee training. The role requires seniority, independence from sales targets and UAE residence. Under the 2025 law, accountability can attach to the individual as well as the firm.

Small firms can outsource support, but the appointed officer must still understand the business and be able to explain decisions to an inspector.

Sector Snapshots

Real estate: Brokers and developers must identify buyers and sellers, screen them and report certain cash and virtual asset transactions above a set threshold (AED 55,000). Documenting source of funds on high-value deals is critical.

Accountants and auditors: AML duties apply when you prepare for or carry out transactions for clients in covered activities, such as company formation, managing client money or buying and selling real estate. Routine bookkeeping alone may not trigger them, but confirm the scope for your services.

Jewellery and precious metals: Dealers must report cash transactions at or above AED 55,000 and apply due diligence to customers and suppliers. Keep supplier and origin records.

AML Compliance Framework: Document Checklist

Inspectors work from documents. Have these ready:

- Enterprise-wide risk assessment, approved and dated

- AML/CFT policy and procedures

- KYC/CDD and EDD procedures and client forms

- PEP and sanctions screening procedure, plus screening evidence

- STR and internal escalation procedure, plus alert log

- Compliance officer appointment letter

- goAML registration confirmation

- Training plan and attendance records

- Sample client files with beneficial owner and source of funds evidence

- Independent review or audit report

- Record retention policy

How a UAE AML Inspection Works

Processes vary by supervisor, but a typical inspection follows this pattern:

1. Notice or request. You are asked for documents or told to expect a visit.

2. Document review. The supervisor reads your risk assessment, policies and logs.

3. Sampling. Inspectors test client files and reports against your own procedures.

4. Interview. The compliance officer explains how decisions are made.

5. Findings. You receive gaps and a deadline for remediation.

6. Sanctions. Serious or repeated failures can lead to administrative penalties.

The common failure is not missing policies. It is a gap between what the policy says and what the files show.

Penalties for Non-Compliance

Consequences can include administrative fines, warnings, licence action and criminal liability for serious breaches. The 2025 law raised the maximum corporate fine to AED 100 million. Loss of banking relationships and reputational damage often cost more than the fine.

Common Mistakes to Avoid

- Using a generic policy that does not match your services

- Completing the risk assessment once and never updating it

- Registering on goAML but having no one who logs in

- Appointing a compliance officer in name only

- KYC files without beneficial owner or source of funds evidence

- Screening clients but not saving the results

- No training records for new joiners

Frequently Asked Questions

Who is required to comply with AML regulations in the UAE?

Financial institutions, virtual asset service providers and DNFBPs must comply. DNFBPs include real estate agents and brokers, dealers in precious metals and stones, accountants and auditors, lawyers, and company service providers, when they carry out the activities listed in the law. Free zone and mainland businesses are both covered.

What is an EWRA in UAE AML?

An enterprise-wide risk assessment (EWRA) is a documented review of how your business could be misused for money laundering or terrorist financing. It looks at your clients, services, countries and delivery channels, rates the risks and sets the controls you will apply. It should be approved by management and reviewed regularly.

What is goAML and who needs to register?

goAML is the UAE Financial Intelligence Unit's online portal for reporting suspicious activity and other mandatory reports. Financial institutions, DNFBPs and virtual asset service providers must register, usually through their compliance officer, so they can file reports without delay. Register before you need to report, not after.

What is an MLRO in the UAE?

An MLRO (money laundering reporting officer), also called the AML compliance officer, runs your AML programme. They review internal alerts, decide whether to file a suspicious transaction report on goAML, advise management and oversee training. The role needs seniority, independence and UAE residence.

What are the consequences of AML non-compliance in the UAE?

Consequences can include administrative fines, warnings, suspension or licence action, and criminal liability for serious breaches. The 2025 law raised maximum corporate fines to AED 100 million and allows knowledge to be inferred from circumstances. Reputational damage and loss of banking relationships are further risks.

Summary

AML compliance for DNFBPs in the UAE comes down to six things you can prove on paper: a tailored risk assessment, clear policies, solid KYC files, an active goAML registration, a real compliance officer and records that match your procedures. Gaps found in an inspection are far cheaper to close beforehand.

Book a free consultation with Kumano Consulting [link: /contact/] to review your AML framework before the regulator does. You can also read about our AML compliance support [link: /antimoneylaundering/], explore our full range of services [link: /services/], or learn more about Kumano Consulting [link: /overview/].