Why AML Compliance Is No Longer Optional for UAE Businesses in 2026
If you run a business in the UAE and have not yet reviewed your anti money laundering obligations, 2026 is the year that inaction becomes genuinely costly.
The UAE has fundamentally restructured its anti money laundering law. Federal Decree-Law No. 10 of 2025, which replaced the previous 2018 legislation, came into force in October 2025 and introduced personal criminal liability for company managers, lower thresholds for prosecution, and expanded the scope of regulated entities to include virtual asset service providers (VASPs). Simultaneously, the Central Bank of the UAE issued updated AML guidance in April 2026, signaling a decisive shift away from tick-box compliance toward continuous, technology-enabled risk management.
The stakes are real. In 2025 alone, the Central Bank issued over AED 370 million in fines for AML non-compliance across multiple sectors. With the Financial Action Task Force (FATF) conducting its next mutual evaluation of the UAE in mid-2026, regulators have adopted a zero-tolerance posture. Enforcement actions are increasing, inspections are more frequent, and the window to get compliant is shrinking.
This guide explains everything UAE businesses need to know about AML compliance services in UAE, what the law requires, who must comply, what the process looks like, and where professional AML consulting UAE firms fit in.
What Is Anti Money Laundering in UAE and Why Does It Matter?
Anti money laundering in UAE (AML) compliance refers to the set of controls, processes, and reporting obligations that businesses must maintain to detect and prevent financial crime. In the UAE, this is not a voluntary best-practice framework. It is a legal obligation under federal law, and non-compliance can result in criminal prosecution, license revocation, and fines that can reach into the millions of dirhams.
The UAE’s position as a global financial and trade hub connecting Asia, Africa, and Europe makes it a high-priority jurisdiction for FATF scrutiny. Following the UAE’s removal from the FATF grey list in February 2024 and its exit from the EU list of high-risk third countries in August 2025, the country has invested heavily in proving that its AML framework is not only technically sound but operationally effective.
For business owners, this means the regulatory environment has fundamentally changed. Compliance that might have been tolerated as minimal or delayed in previous years is now subject to active enforcement.
UAE Anti Money Laundering Law: What Changed Under Federal Decree-Law 10 of 2025
Understanding the UAE anti-money laundering law in its current form requires understanding what changed and why.
Federal Decree-Law No. 10 of 2025 replaced Federal Decree-Law No. 20 of 2018 as the primary legislative instrument governing AML, countering the financing of terrorism (CFT), and countering the financing of proliferation (CPF) in the UAE. Its implementing regulations are contained in Cabinet Resolution 134 of 2025.
The key changes introduced by the new law include:
Personal liability for managers. For the first time, individual managers and compliance officers can face criminal prosecution, not just corporate fines, if their company fails to meet AML obligations. This has fundamentally changed how seriously senior management must engage with compliance.
Lower knowledge threshold. Previously, prosecutors had to demonstrate that individuals knowingly facilitated money laundering. The new law lowers this threshold, meaning negligence or wilful ignorance can now trigger liability.
Expanded scope to virtual assets. Virtual asset service providers (VASPs), including crypto currency exchanges and digital asset platforms operating in the UAE, are now explicitly covered by the AML framework.
Tax evasion as a predicate offence. Tax evasion is now specifically defined as a predicate offence for money laundering, meaning businesses that facilitate tax evasion can face AML prosecution.
Stronger supervisory tools. Regulators, including the Central Bank of the UAE (CBUAE), the Ministry of Economy, the DFSA, and ADGM, now have expanded powers to issue directives, freeze assets, and impose sanctions with fewer procedural barriers.
The accompanying Cabinet Resolution 134 of 2025 provides detailed implementing regulations covering CDD procedures, STR reporting timelines, record-keeping requirements, and MLRO appointment obligations.
Who Needs AML Compliance Services in UAE? A Full Breakdown
This is the most common area of confusion for business owners. AML regulations UAE 2026 apply far more broadly than many assume. The framework covers two categories of regulated entities.
Financial Institutions
Banks, exchange houses, insurance companies, investment firms, and fintech businesses that manage client funds or facilitate financial transfers are subject to full AML/CFT obligations under the supervision of the CBUAE. This includes digital payment platforms and any licensed virtual asset service provider (VASP).
Designated Non-Financial Businesses and Professions (DNFBPs)
DNFBPs are non-bank businesses that are nonetheless exposed to money laundering risk by the nature of their work. Under UAE AML regulations UAE 2026, the following must comply in full:
- Real estate agents and brokers, including property developers, are involved in buying and selling
- Auditors and accounting firms
- Legal consultants and law firms
- Dealers in precious metals and precious stones, gold traders, jewellery businesses, diamond dealers
- Company formation agents and corporate service providers (CSPs)
- Trust service providers
If your business falls into any of the DNFBP categories above, you are legally required to register on the goAML portal, implement a formal AML policy and procedures UAE framework, appoint a Money Laundering Reporting Officer (MLRO), conduct Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) where applicable, and file Suspicious Transaction Reports (STRs) to the Financial Intelligence Unit UAE (FIU).
Core AML Compliance Requirements for Businesses in UAE 2026
Meeting AML compliance requirements for businesses in UAE 2026 involves a set of interconnected obligations. Here is what the law requires in practical terms.
goAML Registration UAE
The goAML portal is the UAE’s national platform, operated by the Financial Intelligence Unit UAE (FIU), through which regulated entities submit Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other regulatory filings.
Registration on the goAML portal is mandatory for all DNFBPs. It must be completed as soon as a trade license is issued. Businesses already operating that have not yet registered are in breach of UAE AML law and should take immediate steps to register.
The goAML registration process for DNFBP UAE typically takes 5 to 10 working days when all documentation is in order. Required documents generally include a valid trade license, a memorandum of association (MOA), proof of UBO (Ultimate Beneficial Owner), and the appointed MLRO’s credentials.
AML Policy and Procedures UAE
Every regulated entity must develop and maintain a formal written AML policy and procedures document. This is not a template; you can download it, but it must be tailored to your specific business type, risk profile, client base, and geographic exposure.
A compliant AML policy and procedures UAE document must cover:
- Business risk assessment methodology
- Customer acceptance criteria and risk categorization
- CDD and EDD procedures
- Transaction monitoring protocols
- STR and SAR filing procedures
- Record-keeping requirements (minimum five years)
- Staff training obligations
- MLRO responsibilities and escalation procedures
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)
Customer Due Diligence (CDD) is the process of verifying who your clients are and understanding the nature of your business relationship with them. Under the risk-based approach mandated by FATF and adopted in UAE law, CDD is not a one-time onboarding check; it is an ongoing obligation.
For higher-risk clients, those from high-risk jurisdictions, politically exposed persons (PEPs), or clients with complex ownership structures, Enhanced Due Diligence (EDD) must be applied. EDD involves deeper verification, source-of-funds documentation, senior management approval, and more frequent monitoring.
Ultimate Beneficial Owner (UBO) Identification
Every regulated entity must identify and verify the Ultimate Beneficial Owner (UBO) of any corporate client, the natural person or persons who ultimately own or control the entity. Under UAE law, UBO information must be collected, verified, and kept up to date as part of your CDD process.
Failure to properly document UBOs is one of the most common compliance gaps identified during Ministry of Economy inspections.
Suspicious Transaction Reporting (STR)
When your monitoring processes identify a transaction or pattern of activity that raises suspicion of money laundering, terrorist financing, or proliferation financing, you are legally obligated to file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit UAE through the goAML portal.
Filing an STR does not require certainty; suspicion alone is sufficient, and the legal threshold is deliberately low. Failure to file a required STR is itself a criminal offense.
Appointing a Money Laundering Reporting Officer (MLRO)
Every regulated entity must appoint a qualified individual as its Money Laundering Reporting Officer (MLRO) or compliance officer. This person is responsible for overseeing the day-to-day operation of the AML framework, receiving internal reports, making STR filing decisions, and serving as the primary point of contact with regulators.
For businesses without in-house compliance expertise, outsourced MLRO services are permitted and widely used. An outsourced AML compliance officer UAE provides the same regulatory coverage without the cost of a full-time hire.
AML Training UAE
All staff who interact with clients or handle transactions must receive regular AML training UAE covering their obligations under UAE law, red flags to watch for, how to escalate suspicious activity internally, and any regulatory updates. Training records must be maintained and may be requested during regulatory inspections.
AML Risk Assessment
As part of building a compliant framework, regulated entities must conduct and document a formal AML/CFT risk assessment. This assesses the likelihood and impact of money-laundering risks across your business activities, client types, transaction channels, and geographic exposure, and forms the foundation on which all other compliance controls are built.
AML Compliance Checklist for UAE Companies
Use this AML compliance checklist for UAE companies to assess your current position:
- goAML portal registration completed
- Written AML policy and procedures UAE document in place, tailored to your business
- Business-wide AML/CFT risk assessment conducted and documented
- MLRO or outsourced AML compliance officer in UAE appointed
- CDD procedures implemented for all new and existing clients
- EDD applied for high-risk clients and PEPs
- UBO identification and verification process in place
- Transaction monitoring system operational (manual or automated)
- STR/SAR filing process tested and understood by relevant staff
- AML training in UAE was conducted for all relevant employees, and records were maintained
- Record retention system in place (minimum 5 years)
- Sanctions screening UAE integrated into onboarding and ongoing monitoring
- Annual AML audit in UAE or internal review conducted
If you cannot check every box above, your business has compliance gaps that require urgent attention.
Penalties for AML Non-Compliance in the UAE
The question business owners most frequently ask is: What is the penalty for AML non-compliance in UAE?
The answer is severe and has become more so under Federal Decree-Law 10 of 2025.
Financial fines for AML violations range from AED 50,000 to AED 5 million per violation, depending on severity. Some violations carry fines of up to AED 1,000,000, such as failing to register on the goAML portal.
Criminal liability now extends to individual managers and directors, not just the corporate entity. Managers who fail to ensure adequate AML controls can face imprisonment.
Asset freezes can be imposed immediately upon regulatory direction, without a court order in urgent cases, under powers granted by Federal Decree-Law 10 of 2025.
License suspension or cancellation is available to the Ministry of Economy and other supervisory authorities as an enforcement tool for persistent non-compliance.
Reputational damage, including public disclosure of enforcement actions, is increasingly used as a deterrent, particularly in sectors such as real estate and financial services, where client trust is central to business viability.
Beyond regulatory penalties, non-compliant businesses face operational consequences, including banking restrictions (banks conduct their own AML due diligence on business clients), loss of institutional partnerships, and exclusion from government contracts.
Need help building or updating your AML compliance UAE framework for the April 2026 CBUAE update?
AMLUAE’s In-House AML Compliance Setup service builds your complete AML function from risk assessment and policy documentation to goAML registration, CDD frameworks, and role-based staff training, all aligned with the latest 2026 regulatory requirements.
How Professional AML Consulting UAE Firms Can Protect Your Business
For many UAE businesses, particularly SMEs, real estate agencies, auditing firms, and gold traders, building an in-house AML function from scratch is neither practical nor cost-effective. This is where professional AML consulting UAE services provide measurable value.
A qualified AML consultant in UAE provides end-to-end support across the compliance lifecycle: gap analysis against Federal Decree-Law 10 of 2025, bespoke AML policy drafting, goAML registration, outsourced MLRO services, CDD and EDD framework implementation, sanctions screening UAE integration, AML training UAE, and ongoing regulatory advisory to keep your framework current as the rules evolve.
AML Compliance for Specific Sectors in 2026
AML Compliance for Real Estate Agents in UAE
Real estate is one of the highest-risk DNFBP sectors for money laundering. The Ministry of Economy has intensified inspections of property agencies in 2026, and AML compliance for real estate agents UAE is now an active enforcement priority.
Under UAE AML regulations UAE 2026, every real estate agency and individual agent involved in buying and selling must conduct CDD on all parties to a transaction, verify UBO where corporate buyers are involved, report suspicious transactions through the goAML portal, and maintain records of all transactions for a minimum of five years.
AML Compliance for Gold Traders and Dealers in Precious Metals
Dealers in precious metals and precious stones (DPMS) are among the most scrutinized DNFBP categories. The UAE’s position as a global gold trading hub means that this sector receives heightened attention from both domestic regulators and FATF assessors. Cash-based transactions, complex supply chains, and cross-border counterparties make robust CDD and transaction monitoring UAE essential.
AML Compliance for Accounting and Audit Firms
Accounting and auditing firms that provide services involving client funds, corporate structuring, or business advisory are DNFBPs under UAE law. This includes reviewing the source of funds for transactions your clients are involved in and filing STRs where suspicious activity is identified. The professional obligation to file exists regardless of client confidentiality considerations.
AML Compliance for Corporate Service Providers and Free Zone Companies
Company formation agents and corporate service providers (CSPs) face some of the most stringent AML obligations because of their role in establishing corporate structures. UBO identification is particularly important in this sector, as complex, multi-layered ownership structures are a known typology for money laundering. Free zone businesses are subject to the same federal AML obligations as mainland companies.
Understanding the Risk-Based Approach to AML in UAE
One of the central principles of the UAE’s AML framework and of FATF recommendations globally is the risk-based approach to AML in UAE. This means that compliance obligations are not one-size-fits-all. They are calibrated to the actual risk your business faces.
Under a risk-based approach, businesses must:
- Conduct a business-wide risk assessment, identifying the money laundering and terrorist financing risks relevant to their sector, client base, geography, and transaction types.
- Allocate compliance resources proportionately, applying higher scrutiny to higher-risk relationships and simplified procedures where risk is demonstrably low.
- Document the rationale for all risk-categorisation decisions so they can be defended during a regulatory review.
The Central Bank of the UAE’s April 2026 guidance specifically reinforces this approach, requiring licensed financial institutions to deploy real-time transaction monitoring systems and apply dynamic, risk-based CDD with ongoing reassessment rather than one-time onboarding checks.
Central Bank UAE AML Guidance and the FATF Mutual Evaluation 2026
The FATF mutual evaluation of the UAE is anticipated in mid-2026. This is the most significant external assessment of the UAE’s AML/CFT framework since its grey-listing period, and regulators are preparing intensively.
What this means for businesses is that Ministry of Economy AML inspections, CBUAE supervisory reviews, and DFSA compliance assessments are intensifying both before and after the evaluation. Regulators need to demonstrate to FATF that their supervised populations are genuinely compliant, not just technically registered but operationally effective.
The Central Bank of the UAE AML guidance updated in April 2026 reflects this by requiring:
- Real-time transaction monitoring with automated anomaly detection
- Dynamic, risk-based CDD with ongoing reassessment
- Strengthened controls for trade-based money laundering, particularly in gold, commodities, and re-export sectors
- Tighter integration between trade compliance and financial compliance functions
For businesses in high-value sectors, such as real estate, gold trading, and virtual assets, the scrutiny will be particularly intense. Businesses that are not demonstrably compliant by mid-2026 face a significantly elevated risk of enforcement action.
How to Comply with AML Regulations in UAE: A Step-by-Step Summary
Here is a practical summary of how to comply with AML regulations in UAE for any business starting the process:
Step 1: Determine your regulatory status. Confirm whether your business is a financial institution or a DNFBP under UAE AML law. If uncertain, book an AML/CFT Health Check with a specialist AML compliance consultant Dubai.
Step 2: Conduct an AML risk assessment. Document the money-laundering and terrorist-financing risks specific to your business, clients, transaction types, and geographic exposure. Commission a formal AML/CFT Risk Assessment Report if you do not have one.
Step 3: Draft your AML policy and procedures UAE. Develop a written AML framework tailored to your business, covering all required elements under Cabinet Resolution 134 of 2025. AMLUAE’s AML/CFT Policy & Documentation service delivers a fully customized, regulator-ready document.
Step 4: Appoint your MLRO. Designate a qualified Money Laundering Reporting Officer or set up your In-House AML Compliance function with professional support.
Step 5: Register on the goAML portal. Complete goAML registration UAE, submitting all required documentation to the Financial Intelligence Unit UAE.
Step 6: Implement CDD and EDD procedures. Put your due diligence processes into operation for all new client onboarding and for retrospective review of existing high-risk clients.
Step 7: Integrate sanctions screening UAE. Ensure all clients and transactions are screened against UAE, UN, OFAC, and EU sanctions lists as part of your standard workflow.
Step 8: Deliver AML training UAE to all relevant staff. Train your team, document the training, and schedule annual refresher sessions. AMLUAE’s AML Training Program covers all 2026 regulatory requirements.
Step 9: Establish your STR filing process. Ensure your MLRO understands STR obligations and that all staff know how to escalate internal suspicious activity reports. AMLUAE’s Regulatory Reporting Services can manage this end-to-end.
Step 10: Run your AML/CFT Health Check. Before regulators visit, verify that your controls are working as intended, your documentation is complete, and your framework is inspection-ready with an AML/CFT Health Check.
Ready to Get Compliant? Start Here.
Whether you are starting your compliance journey from scratch, updating an existing framework for the new 2025 law, or preparing for an upcoming regulatory inspection, AMLUAE has the service that fits exactly where you are.
We serve businesses across Dubai, Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, and all UAE free zones, including DIFC, ADGM, JAFZA, DMCC, and Meydan.
Our specialists are here to guide you through every aspect of anti money laundering in UAE, from policy documentation and goAML registration to staff training and regulatory reporting.
