As the United Arab Emirates cements its status as a premier global financial hub, the federal government has instituted some of the most rigorous financial governance and regulatory frameworks in the world. For corporate leaders, multinational enterprises, and startups operating across free zones and the mainland, maintaining strict AML compliance in the UAE is no longer optional—it is a critical operational mandate for sustainable growth.
Direct Answer: AML compliance UAE requirements are governed by Federal Decree-Law No. 20 of 2018 and strictly enforced by the Ministry of Economy (MoE), Central Bank of the UAE (CBUAE), and Financial Intelligence Unit (FIU). Every business classified as a Financial Institution (FI), Virtual Asset Service Provider (VASP), or Designated Non-Financial Business and Profession (DNFBP)—including real estate agencies, corporate service providers, auditors, and gold/jewellery traders—must complete mandatory goAML registration, appoint a certified Money Laundering Reporting Officer (MLRO), execute Customer Due Diligence (CDD), submit Suspicious Transaction Reports (STRs), and maintain Ultimate Beneficial Ownership (UBO) registers to avoid fines reaching up to AED 5,000,000.
Whether you are establishing a new enterprise in Dubai or managing an existing holding structure, understanding the complete framework for AML compliance UAE protects your organization from severe regulatory penalties, license suspensions, and commercial bank account closures.
The AML Compliance UAE Legislative Framework
The regulatory foundation underpinning AML compliance UAE laws is anchored in comprehensive federal legislation and aligned with international standards set by the Financial Action Task Force (FATF). The primary legal statutes include:
- Federal Decree-Law No. (20) of 2018: On Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations (as amended by Decree-Law No. 26 of 2021).
- Cabinet Decision No. (10) of 2019: The Executive Regulation of Decree-Law No. (20) of 2018, specifying the operational duties of reporting entities.
- Cabinet Decision No. (109) of 2023: Regulating Real Beneficiary Procedures (Ultimate Beneficial Ownership / UBO), mandating transparent disclosure of corporate ownership.
- Cabinet Decision No. (74) of 2020: Establishing the UAE National Sanctions List and implementing United Nations Security Council Resolutions (UNSCRs).
Executive & Intelligence
- Executive Office for AML/CFT: National policy formulation and FATF coordination.
- Financial Intelligence Unit (FIU): goAML portal administration & STR processing.
Federal Supervisors
- Ministry of Economy (MoE): Direct supervision of DNFBPs & commercial entities.
- Central Bank (CBUAE): Banks, exchange houses & payment institutions.
- SCA: Capital markets, brokerage & listed securities.
Financial Free Zones & Web3
- DFSA (DIFC) & FSRA (ADGM): Common law financial center regulators.
- VARA: Virtual Assets Regulatory Authority for Dubai digital assets.
Who is Subject to AML Compliance UAE Rules?
Federal law divides businesses under AML compliance UAE supervision into three distinct tiers. Identifying which category your company belongs to dictates your regulatory reporting duties:
1. Financial Institutions (FIs)
Commercial banks, non-banking financial companies, investment firms, currency exchange companies, payment processors, and insurance brokers operating in mainland UAE or free zones.
2. Designated Non-Financial Businesses and Professions (DNFBPs)
Under Cabinet Decision No. 10 of 2019, non-banking businesses operating in sensitive sectors are classified as DNFBPs and subject to Ministry of Economy AML oversight:
- Real Estate Brokers & Developers: Intermediaries involved in property sales, purchases, and off-plan marketing.
- Dealers in Precious Metals & Precious Stones (DPMS): Wholesalers, retailers, and refineries trading in gold, diamonds, bullion, and luxury jewellery.
- Corporate Service Providers & Trust Administrators: Entities providing company incorporation, registered office services, nominee directors, and trade license formation.
- Independent Legal Practitioners & Law Firms: When structuring corporate deals, buying real estate, or managing client escrow accounts.
- Independent Auditors & Accounting Firms: Professionals preparing financial audits, corporate tax records, and books of account.
3. Virtual Asset Service Providers (VASPs)
Crypto exchanges, digital asset brokers, custody platforms, and Web3 entities operating under VARA or federal SCA regulations. To explore digital asset licensing in detail, see our complete guide on how to get a crypto license in the UAE.
Core Pillars of an AML Compliance UAE Program
Establishing an effective system for AML compliance UAE requires implementing structured internal controls, screening mechanisms, and independent reporting processes:
| AML Pillar | Regulatory Mandate | Implementation Standard |
|---|---|---|
| 1. goAML Portal Registration | Mandatory FIU onboarding | Active account on UAE FIU goAML system & SACM integration |
| 2. MLRO Designation | Appoint a Compliance Officer | Designate a qualified resident Money Laundering Reporting Officer |
| 3. Risk-Based Approach (RBA) | Enterprise Risk Assessment (ERA) | Documented assessment of customer, country, and product risks |
| 4. Customer Due Diligence (CDD) | KYC & UBO verification | Identify beneficial owners (≥25%), PEP screening & source of funds |
| 5. Sanctions Screening | EOCN / IEC portal registration | Automated daily screening against UAE Local & UN Sanctions Lists |
| 6. Suspicious Activity Reports | Immediate STR/SAR filings | Prompt reporting of suspicious client behaviour to the FIU via goAML |
Step-by-Step Implementation: How to Execute AML Compliance UAE
Step 1: Onboard to the goAML System and Sanctions Portal
All regulated businesses must complete registration on the UNODC goAML portal managed by the FIU. Simultaneously, companies must subscribe to the Executive Office for Control and Non-Proliferation (EOCN) portal to receive instant alerts whenever the UAE Cabinet updates local terrorist and sanctions lists.
Step 2: Appoint and Train a Qualified MLRO
Your designated Money Laundering Reporting Officer must have direct access to senior management and law enforcement authorities. The MLRO conducts internal compliance audits, reviews client transactions, submits STR filings, and delivers annual anti-money laundering training to company staff.
Step 3: Build an Enterprise Risk Assessment (ERA)
Under FATF recommendations, your organization must adopt a Risk-Based Approach (RBA). The ERA documents your business exposure across four core risk parameters: Customer Profiles, Geographic Exposure, Products and Services, and Delivery Channels. The assessment must be updated at least once every 12 months.
Step 4: Execute Customer Due Diligence (CDD & EDD)
Before executing transactions or onboarding clients, execute thorough identity verification:
- Standard Customer Due Diligence (CDD): Collecting passport copies, Emirates IDs, proof of address, trade licenses, and verifying corporate registries.
- Enhanced Due Diligence (EDD): Mandatory for Politically Exposed Persons (PEPs), high-risk nationalities, complex holding corporate webs, or transactions involving unusual volumes.
Step 5: Maintain Ultimate Beneficial Ownership (UBO) Registers
Under Cabinet Decision No. 109 of 2023, every commercial entity in the UAE must maintain three mandatory registers at its registered office: Register of Beneficial Owners (≥25% shares or control), Register of Shareholders, and Register of Directors. Corporate amendments must be reported to the registry within 15 days. For holding entity strategies, review our guide on how a UAE holding company operates.
Step 6: Retain Compliance and KYC Records for 5 Years
Under Federal Decree-Law No. 20 of 2018, all Customer Due Diligence records, identity documents, transaction invoices, and MLRO logs must be retained for at least 5 years following transaction completion or client account closure.
Penalties and Fines for AML Compliance UAE Violations
Supervisory bodies enforce zero tolerance for non-compliance. Under Cabinet Decision No. 16 of 2021, failure to comply with AML compliance UAE laws triggers substantial financial and operational penalties:
| Non-Compliance Incident / Violation | Administrative Penalty |
|---|---|
| Failure to register on the goAML portal | AED 50,000 |
| Failure to appoint a certified Compliance Officer / MLRO | AED 50,000 |
| Failure to conduct Customer Due Diligence (CDD) before onboarding | AED 100,000 |
| Failure to submit Suspicious Transaction Reports (STR) on goAML | AED 100,000 – AED 1,000,000 |
| Failure to maintain accurate Ultimate Beneficial Ownership (UBO) data | AED 20,000 – AED 100,000 |
| Repeated non-compliance or obstruction of regulatory audits | AED 1,000,000 – AED 5,000,000 + License Revocation |
Beyond monetary penalties, non-compliant firms face immediate commercial bank account freezes, trade license suspensions, and reputational damage. To safeguard your business banking relationships, read our comprehensive guide on how to open a UAE corporate bank account.
Intersection Between AML Compliance and UAE Corporate Tax
Under the UAE Corporate Tax law (Federal Decree-Law No. 47 of 2022), the Federal Tax Authority (FTA) coordinates closely with the FIU and Ministry of Economy. Clean, audited accounting books and transparent invoicing protocols are essential to prove commercial substance and ensure seamless tax filing. Learn more about corporate tax brackets and exemptions in our UAE Corporate Tax 2026 Guide.
Achieve Full AML Compliance in the UAE with SCORP
Protect Your Enterprise with Turnkey AML & Compliance Solutions
Setting up goAML registration, designing internal compliance manuals, outsourcing the MLRO role, and managing Ministry of Economy audits can be complex. SCORP delivers complete end-to-end AML framework setup, staff training, and regulatory audit representation to ensure your enterprise stays 100% compliant.
Frequently Asked Questions
What is goAML registration in the UAE?
goAML is an online reporting platform developed by the UNODC and managed by the UAE Financial Intelligence Unit (FIU). Regulated entities, including financial institutions and DNFBPs, must register on goAML to submit Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs).
Who is classified as a DNFBP under AML compliance UAE rules?
Designated Non-Financial Businesses and Professions (DNFBPs) include real estate brokers and developers, precious metal and gemstone dealers, independent accountants and auditors, independent legal consultants, and corporate service providers operating in the UAE.
Can a UAE company outsource its MLRO function?
Yes, DNFBPs and eligible corporate entities in the UAE are permitted to outsource the Money Laundering Reporting Officer (MLRO) and compliance functions to accredited third-party corporate service providers and compliance advisory firms like SCORP.
What are the penalties for failing to register on goAML?
Failing to register on the goAML portal incurs an administrative fine of AED 50,000 from the Ministry of Economy. Continued non-compliance can lead to commercial trade license suspension, corporate bank account freezes, and cumulative penalties up to AED 5,000,000.
How long must AML compliance records be maintained in the UAE?
Under UAE Federal Decree-Law No. 20 of 2018, all Customer Due Diligence (CDD) files, client identity documents, transaction invoices, UBO registers, and risk assessment records must be securely retained for a minimum of 5 years.