Does UAE AML Compliance Apply to Your Business?
If you deal in real estate, precious metals, company formation, or accounting, UAE AML compliance almost certainly applies to you, and getting it wrong is now personal. The 2025 anti-money-laundering law reaches far beyond banks, pulls in whole categories of ordinary businesses, and can hold the person running the company criminally liable. The first thing to know is simply whether you’re caught.
Key takeaways
- AML compliance in the UAE runs on Federal Decree-Law No. 10 of 2025, which replaced the 2018 law.
- It covers financial institutions, DNFBPs (designated non-financial businesses and professions), virtual-asset providers and non-profits.
- DNFBPs include real estate brokers, dealers in precious metals and stones, auditors and accountants, and company/trust service providers.
- Core duties: register on goAML, run customer due diligence, identify beneficial owners, screen for sanctions, monitor, and report suspicious transactions.
- Managers can now be personally, criminally liable — not just the company.
- Administrative fines reach AED 5 million per violation; criminal exposure runs far higher.
What is AML compliance, and who has to do it?
AML, anti-money laundering, compliance is the set of controls a business must run to stop criminals moving illicit money through it. In the UAE it’s governed by Federal Decree-Law No. 10 of 2025, which replaced the 2018 framework with broader offences, higher penalties, and, the headline change, personal liability for the people in charge.
Crucially, it doesn’t only apply to banks. The law reaches financial institutions, DNFBPs, virtual-asset service providers, and non-profit organisations. If your business falls into one of those buckets, AML compliance is a legal obligation, not an optional policy — and “we’re small” is not an exemption.
Are you a DNFBP? Who UAE AML compliance covers
This is where ordinary UAE businesses get caught by surprise. A DNFBP, a designated non-financial business or profession, is a business that isn’t a bank but handles the kind of transactions criminals exploit. Supervised largely by the Ministry of Economy, the main categories are:
| DNFBP category | Typical UAE business |
|---|---|
| Real estate brokers/agents | Property brokerages arranging sales or purchases |
| Dealers in precious metals & stones | Gold, jewellery and diamond traders (above cash thresholds) |
| Auditors & accountants | Accounting and audit firms |
| Company & trust service providers | Company-formation agents, corporate service providers |
| Independent legal professionals | Lawyers/notaries for certain transactions |
If that’s you, the obligations below aren’t optional — and a licence to operate assumes you’re meeting them.
What does AML compliance actually require?
More than collecting a passport copy. A workable AML programme has several moving parts:
- Register on goAML — the UAE Financial Intelligence Unit’s portal. This is the entry ticket; operating without registration is itself a criminal offence.
- Appoint a compliance officer to own the programme.
- Customer due diligence (CDD) — identify and verify who you’re dealing with, and identify the beneficial owner behind them.
- Risk-assess your customers and transactions, and apply enhanced checks to higher-risk ones.
- Screen against sanctions lists before you transact.
- Monitor relationships on an ongoing basis.
- Report suspicious transactions immediately via goAML.
- Keep records for five years, train your staff, and run periodic independent AML audits.
Miss the beneficial-owner step and you’re also exposed on a related front, the same person behind your customer is exactly what UBO rules require you to identify and file.
What happens if you don’t comply and why it’s personal now
The 2025 law changed the stakes in a way every business owner should register.
The company faces serious money. Administrative fines run from AED 10,000 to AED 5,000,000 per violation, alongside activity suspension, restrictions on directors, and licence revocation. Criminal fines for money-laundering offences reach far higher, up to AED 100 million at the corporate level.
And now it’s personal. The old regime rarely reached individuals. The new law extends criminal liability to the person responsible for the company’s actual management where violations happen through their knowledge, wilful misconduct or gross negligence. Failing to report a suspicious transaction, or operating without goAML registration, carries imprisonment as well as fines. In other words, “the company will pay a fine” is no longer the worst case, you can be.
That shift is why AML compliance moved from a back-office formality to a board-level priority in 2025.
How Legal Cover helps
Most DNFBPs don’t have a compliance team, they have an owner who just learned they’re a DNFBP. We help UAE businesses work out whether AML compliance applies to them, build the programme the law requires (goAML registration, CDD, a compliance officer, policies and record-keeping), and get it audit-ready, before a supervisor or an inspection makes it urgent. All at a fixed monthly fee, handled by licensed UAE lawyers.
Not sure whether your business is a DNFBP, or whether your controls would survive an inspection? Book a complimentary Legal Clarity Call.
Frequently asked questions
Does AML compliance apply to a small business?
Size is not an exemption. What matters is your activity: if you’re a DNFBP, real estate, precious metals, accounting, company-formation services, AML compliance applies regardless of how small you are.
What is goAML and do I need to register?
goAML is the UAE Financial Intelligence Unit’s reporting portal. Regulated businesses must register on it, and it’s how you file suspicious-transaction reports. Operating without registering can be a criminal offence.
Who counts as a DNFBP?
The main categories are real estate brokers, dealers in precious metals and stones, auditors and accountants, company and trust service providers, and independent legal professionals carrying out certain transactions.
Can I be personally liable for my company’s AML failures?
Yes. Under the 2025 law, the person responsible for the company’s actual management can face personal criminal liability where breaches result from their knowledge, wilful misconduct or gross negligence. This is one of the biggest changes from the old regime.
How long do I have to keep AML records?
Generally five years. You must also keep customer due-diligence records, transaction records and your risk assessments available for inspection by your supervisory authority.
