A real estate brokerage came to us after a Ministry of Economy inspection notice landed on the manager's desk. They had registered on goAML fourteen months earlier and assumed that was the job done. It was not. There was no written AML policy, no Business Risk Assessment, no documented customer due diligence, no record of who actually owned the companies buying property through them, and not one suspicious transaction report had ever been filed. None of that was deliberate. Nobody had told them that goAML registration is the first of eight obligations, not the whole of it.
That gap is the most expensive mistake we see in UAE anti-money laundering compliance, and it is entirely avoidable. This guide walks through what AML actually requires in 2026, who it applies to, what changed under the new law, and where the costly gaps sit for each type of business.
The short version
| Question | Answer |
|---|---|
| What governs AML in the UAE now? | Federal Decree-Law No. 10 of 2025 (effective 14 Oct 2025), with Cabinet Resolution No. 134 of 2025 as the implementing regulation. It replaced the 2018 law. |
| Who must comply? | Financial institutions and DNFBPs: real estate brokers, precious-metals and stones dealers, auditors/accountants, lawyers/notaries, and corporate service providers. |
| Is registering on goAML enough? | No. It is one of eight obligations — policy, risk assessment, CDD, UBO checks, monitoring, STR filing and training are the rest. |
| What are the penalties? | Administrative fines of AED 50,000–1,000,000 per violation, with corporate exposure up to AED 100M under the 2025 law, plus possible licence suspension. |
| How long to get compliant? | Roughly 3–6 weeks for a DNFBP starting from zero to audit-ready. |
What is anti-money laundering (AML) in the UAE?
Anti-money laundering (AML) is the set of laws, procedures and controls that stop criminals from disguising illegally obtained money as legitimate funds. Money laundering itself moves through three stages: placement (introducing illicit cash into the system), layering (moving it through transactions to obscure its origin), and integration (bringing it back as apparently clean money). In the UAE, AML sits alongside two related obligations: combating the financing of terrorism (CFT) and combating proliferation financing (CPF). Together they are usually written as AML/CFT/CPF.
The UAE's framework follows the standards set by the Financial Action Task Force (FATF), the global standard-setter. That alignment matters commercially: the UAE was placed on the FATF "grey list" in March 2022 and removed in February 2024 after overhauling enforcement, and it is the reason inspections and penalties have intensified since.
The UAE AML law in 2026: Federal Decree-Law No. 10 of 2025
This is where most existing guidance — and the previous version of this page — is now out of date. The governing law is Federal Decree-Law No. 10 of 2025, issued 30 September 2025 and effective 14 October 2025. It repeals and replaces the older Federal Decree-Law No. 20 of 2018. Its implementing regulation is Cabinet Resolution No. 134 of 2025, which replaced Cabinet Decision No. 10 of 2019. If your AML policy still cites only the 2018 law and the 2019 regulation, it is referencing a repealed framework.
What actually changed for your business
Most of the core machinery — goAML reporting, the Business Risk Assessment, customer due diligence, beneficial-ownership checks and suspicious transaction reports — already existed under the 2018 law. Treating everything as brand new wastes resources. Three additions, though, are genuinely new and are what inspectors will look for:
- Proliferation financing (CPF) as a standalone obligation. Risk assessments built under the 2018 regime usually have no CPF dimension. That gap is now visible to an inspector.
- Virtual assets and VASPs inside the framework. Accepting crypto, or dealing with crypto-adjacent clients, raises the intensity of due diligence required on those specific transactions.
- Tax evasion as a predicate offence. Direct and indirect tax evasion now sits inside AML monitoring obligations rather than outside them — the point that most often confuses accountants and corporate service providers, because their tax and AML functions now intersect.
The 2025 law also strengthened enforcement mechanics: the UAE Financial Intelligence Unit can now freeze funds for up to 30 days (previously 7) and suspend transactions for up to 10 working days without prior notice, and a Supreme Committee was established to oversee the national AML/CFT/CPF strategy. Money laundering committed through digital systems, virtual assets or encryption is now expressly covered.
Who needs AML compliance? The UAE's DNFBP categories
AML in the UAE is no longer just a bank problem. Banks and financial institutions are supervised by the Central Bank of the UAE (CBUAE). A second group — Designated Non-Financial Businesses and Professions, or DNFBPs — is supervised by the Ministry of Economy (operating as the Ministry of Economy and Tourism). Businesses in the financial free zones (DIFC, ADGM) also answer to the DFSA and FSRA respectively. If your business falls in the table below, the obligations in this guide apply to you.
| DNFBP Category | When AML Obligations Are Triggered |
|---|---|
| Real estate brokers & agents | Concluding buy or sell transactions in real estate on behalf of customers. |
| Dealers in precious metals & stones | Single or linked cash transactions at or above AED 55,000. |
| Auditors & accountants | Independent professionals managing funds, accounts, or company structures for clients. |
| Lawyers, notaries & legal professionals | Preparing or executing financial transactions, managing client money, or forming legal entities. |
| Corporate service providers & trusts | Forming companies, acting as director/secretary/nominee shareholder, or providing registered offices for clients. |
Note: financial free-zone entities (DIFC, ADGM) follow the federal law plus their own DFSA/FSRA rulebooks. setting up a company in the UAE .
The 8 core AML compliance obligations (goAML is only the first)
Registering on goAML is the most visible and easiest step, which is exactly why so many businesses mistake it for the finished job. A defensible AML programme has eight parts:
- goAML registration. Register the business and appoint a Compliance Officer on the UAE FIU's goAML portal.
- Business Risk Assessment (BRA). Assess your money-laundering, terrorism-financing and proliferation-financing risk across customers, products, geographies and delivery channels.
- AML policy & procedures. A written, board-approved policy that turns the risk assessment into day-to-day rules.
- Customer Due Diligence (CDD). Verify customer identity, understand the relationship, and apply Enhanced Due Diligence to higher-risk clients.
- Ultimate Beneficial Owner (UBO) verification. Identify the natural person who ultimately owns or controls the customer — not just the person signing.
- Ongoing monitoring. Monitor transactions and re-screen existing relationships against sanctions and PEP lists over time, not only at onboarding.
- Suspicious Transaction Reporting (STR). File complete STRs/SARs to the FIU through goAML whenever trigger criteria are met.
- Training & record-keeping. Train staff to recognise red flags and escalation routes, and retain records for the required period.
The point
A regulator inspecting your business does not stop at "are you registered on goAML?" It asks for the policy, the risk assessment, the CDD files, the UBO records and the STR history. Seven of the eight obligations are the ones that fail an inspection.
How to register on goAML — and what trips businesses up
goAML registration: step by step
- Create an organisation account on the goAML portal via the supervising authority (Ministry of Economy for DNFBPs).
- Appoint and register your AML Compliance Officer, submitting their Emirates ID and credentials.
- Select the correct DNFBP activity classification that matches your trade licence.
- Submit the organisation's documents (trade licence, ownership/UBO details, contact and address information).
- Await validation, then maintain the account: file STRs, and update details whenever the officer or address changes.
The four most common goAML mistakes
From the registrations we handle, these are the friction points in order of frequency:
- Compliance Officer appointment. The portal validates the officer's Emirates ID and stalls on recent renewals or name-transliteration mismatches — adding 3–7 working days to what should take one.
- Activity classification. goAML's DNFBP categories do not map neatly onto trade-licence activity wording. Choose wrong and the reporting obligations shown on screen will not match your real regulatory category — something inspectors check specifically.
- Keeping registration current. Firms renew the trade licence every year but forget to update goAML when the Compliance Officer or address changes. That is a technical non-compliance inspectors flag directly.
- Incomplete STRs. A structurally incomplete suspicious transaction report is treated as a reporting failure, not an attempt. Submitting something is not the same as satisfying the obligation.
Realistic timeline from a standing start to audit-ready — goAML registration, Business Risk Assessment, AML policy, CDD procedures and staff awareness documentation — is three to six weeks for a DNFBP beginning from zero.
Suspicious Transaction Reports (STRs): when and how to file
A Suspicious Transaction Report (STR) is a confidential report filed to the UAE Financial Intelligence Unit through goAML when you know, suspect, or have reasonable grounds to suspect that funds are linked to crime. You file based on suspicion — you do not need proof, and you must not "tip off" the customer. Reports should be filed promptly once the trigger is identified, and the obligation applies even to a transaction that is never completed.
Common trigger red flags
Unusual cash volumes, reluctance to provide identity or UBO information, transactions inconsistent with the customer's profile, complex ownership structures with no clear commercial purpose, or third parties paying on a customer's behalf.
AML requirements by sector
Is Your AML Policy Outdated?
With corporate fines reaching up to AED 100M under the 2025/2026 updates, relying on old templates is a major risk. Let us audit your framework before an inspector does.
Every DNFBP shares the same obligation categories, but the gaps live in completely different places. These are the patterns we see most often when we review programmes in each sector.
Real estate brokerages
The CDD trigger is transaction execution. The near-universal gap: brokers verify the individual standing in front of them but not the corporate structure behind a corporate buyer. Full CDD on a corporate purchaser means identifying the natural person who ultimately owns or controls the entity — not just the person signing the paperwork.
Dealers in precious metals and stones
This is the highest-risk DNFBP category, specifically cited by FATF in UAE assessments. The AED 55,000 single-transaction identification threshold is the regulatory floor, not the ceiling — risk does not switch off below it. The most consistent gap is applying CDD at onboarding and then never monitoring the relationship again. A customer who passed checks three years ago can present a very different risk profile today.
Corporate service providers
CSPs carry the deepest obligation of the three. When you incorporate a company for a client, CDD extends to the beneficial owners of the entity being created, not only the person instructing the work. Most CSPs apply individual-client CDD correctly; almost none document the UBO identification process for the corporate structures they create. That is the gap inspection notices in this sector cite most frequently — and the hardest to remediate after the fact.
Penalties for AML non-compliance in the UAE
Enforcement is no longer theoretical. Administrative fines run from AED 50,000 to AED 1,000,000 per violation under Cabinet Resolution No. 71 of 2024, and the 2025 law raises corporate exposure for offences up to AED 100 million. Beyond fines, businesses face licence suspension or revocation, account freezes, blacklisting by banks, and reputational damage. The Ministry of Economy publishes its enforcement actions: in the first half of 2025 alone it imposed more than AED 42 million in AML fines on DNFBPs, with precious-metals traders and real-estate brokerages most heavily represented.
| Consequence | What It Looks Like in Practice |
|---|---|
| Financial penalty | AED 50,000–1,000,000 per violation; corporate exposure up to AED 100M under the 2025 law. (Confirm current figures with the supervising authority.) |
| Licence action | Activity restriction, suspension, or revocation of the trade licence. |
| Business disruption | Account freezes, loss of banking relationships, and potential personal liability for management. |
The most expensive AML mistake — and how to avoid it
Return to that real estate brokerage. Their genuine objection was not really "we don't think the rules apply." Underneath it was "we don't want to spend money on compliance we're not sure we'll need." Two things are worth knowing before making that bet. Compliance rarely stands alone; stay current on the latest VAT rules alongside your AML duties.
First, size is not your protection. The Ministry of Economy does not prioritise inspections by turnover — it prioritises by sector, risk profile and registration status. Small brokerages and sole-trader corporate service providers have been fined, and the penalty range is not calibrated to how big you are.
Second, the economics favour acting early. Building a programme proactively costs a fraction of building one under a regulatory deadline — in our experience two to three times less than remediation once an inspection notice is already in hand, and without a finding on your record. Outsourcing the work does not mean losing control: what gets outsourced is programme architecture, documentation and goAML setup, while your Compliance Officer keeps the day-to-day CDD and STR decisions.
AML compliance services from Best Solution
Best Solution has handled 2,500+ AML compliance filings for 500+ active compliance clients, and has documented more than AED 10 million in penalty reduction across real estate brokerages, jewellers, corporate service providers and accountants — the full Ministry of Economy DNFBP spectrum. Our Compliance & Audit Lead, Teena Thomas, brings more than seven years of financial oversight specialising in AML.
Our approach rests on three layers — policy, procedure and people — because documentation alone does not survive an inspection without a culture of vigilance behind it. In practice that means:
- Business Risk Assessment, including the proliferation-financing dimension the 2025 law now requires.
- AML policy and CDD/EDD procedures tailored to your sector and risk profile.
- goAML registration, correct activity classification, and Compliance Officer setup (including outsourced MLRO where needed).
- Staff training, ongoing monitoring, STR readiness, and independent compliance reviews.
Whether you are registering for the first time or have an inspection notice in hand, the goal is the same: a programme that is complete, current and audit-ready .Talk to our compliance consultants
