The UAE Just Renamed Your Business Category And Tightened Every AML Obligation That Comes With It

AML compliance corporate service providers UAE 2026 is not what it was under the 2018 framework, and the change is more significant than most company formation agents, registered office providers, nominee directors, trust service providers, and PRO services companies in the UAE currently realise.

Table of Contents

Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025 did not just update the AML rules. They rewrote the category definition entirely. The 2019 regulations described this sector as “credit companies and funds service providers,”  awkward, imprecise language that created a genuine ambiguity about whether a pure corporate services firm was captured. The 2025 regulations replaced this with “Company and Trust Service Providers”  the name the sector has always used in practice and in doing so removed any argument that a company formation or PRO services business sits outside the DNFBP definition.

If you run a company formation business, a registered office service, a PRO services company, a corporate secretarial firm, or a trust service provider in the UAE, your AML obligations are now unambiguous, actively enforced, and backed by personal criminal liability for partners and compliance officers under Article 27(5) of Federal Decree-Law No. 10 of 2025.

This guide explains exactly what AML compliance corporate service providers UAE 2026 requires, what activities trigger your obligations, what the UBO identification rules demand, what inspectors check, how to build a compliant AML programme, and how to protect yourself and your partners from personal liability.

For the complete background on Federal Decree-Law No. 10 of 2025, see our UAE AML Law 2025 Guide.

What Is a Corporate Service Provider Under UAE AML Law 2026?

A corporate service provider under UAE AML law 2026 is formally defined as a “Company and Trust Service Provider” (CTSP) under Cabinet Resolution 134 of 2025, a Designated Non-Financial Business or Profession (DNFBP) that assists clients in establishing, managing, or administering legal persons and legal arrangements.

The formal renaming from the 2019 definition is significant. Under the old “credit companies and funds service providers” label, some corporate services businesses argued they did not clearly fall within the DNFBP perimeter. Under the 2025 definition, that argument is gone. The category is now precisely named, precisely defined, and precisely enforced.

The corporate service providers DNFBP UAE category covers any person or entity that, as a business activity, provides any of the following services to clients:

Acting as an agent in the incorporation or creation of legal persons: company formation agents who act on behalf of clients to establish companies, partnerships, and other legal entities in the UAE.

Acting as a director or secretary of a company: businesses that provide nominee director or corporate secretary services, or that arrange for another person to serve in these roles for a client.

Acting as a partner or in an equivalent position in another legal person: arranging for a person to serve as a partner in a partnership or equivalent structure on behalf of a client.

Providing a registered office, business address, residence, correspondence address, or administrative address: registered office providers and businesses that provide virtual office addresses for companies.

Acting as a trustee of an express trust or performing an equivalent function: trust service providers and businesses that administer or manage trusts on behalf of clients.

Acting as a nominee shareholder for another person: businesses that provide nominee shareholder services, holding shares on behalf of the beneficial owner.

The critical point is that the trigger is the service activity, not the trade licence category or the business name. A company with a trade licence for “business services” or “management consulting” that provides any of the above activities is a CTSP and is therefore subject to full AML compliance corporate service providers UAE 2026 obligations. Regulatory inspection does not stop at the trade licence; it assesses what the business actually does.

Is AML CFT Risk Assessment Mandatory in the UAE?

Yes, PRO services companies need AML compliance in UAE where their activities involve assisting clients in establishing or administering legal persons. A PRO services business that acts as an agent in company formation, provides registered office addresses, arranges nominee directors or shareholders, or assists in establishing legal structures for clients falls within the Company and Trust Service Providers DNFBP category under Cabinet Resolution 134 of 2025.

A pure PRO services business that provides only visa processing, government liaison, document clearing, and emiratisation support with no involvement in company formation, registered address provision, or nominee services may fall outside the AML compliance CSP UAE perimeter for those specific activities. However, most PRO services businesses in the UAE offer a combination of services that includes at least one of the triggering activities.

If you are uncertain whether your PRO services business triggers AML compliance obligations, an independent assessment from a qualified AML compliance consultant Dubai will give you a formal classification opinion based on your actual service portfolio.

What Activities Trigger AML Obligations for CSPs in UAE 2026?

AML obligations for CSPs in UAE 2026 are triggered by the specific services listed above: acting as a company formation agent, providing nominee directors or shareholders, providing registered office services, acting as a trustee, or arranging for another person to perform any of these functions.

The trigger is not the size of the business, the number of clients, or the frequency of the activity. A small company formation agent with ten clients carries the same AML compliance corporate service providers UAE 2026 obligations as a large corporate services firm with thousands of clients because the obligation is categorical, not proportional.

The risk-based approach UAE AML law requires means that the intensity of controls must be proportionate to risk; a smaller, lower-risk CSP may apply simplified procedures for lower-risk clients, but the obligation to have an AML programme, register on goAML, conduct CDD, identify UBOs, and file STRs where suspicious activity is identified applies universally to every regulated CTSP.

Why Are Corporate Service Providers High-Risk for Money Laundering in UAE?

Corporate service providers are classified as high-risk for money laundering in UAE because of their central role in creating and managing the legal structures that can be misused to conceal the origins of illicit funds. The FATF identifies corporate service providers as one of the highest-risk DNFBP categories globally, and UAE enforcement data supports this classification.

See also  The Future of goAML UAE: What to Expect in 2026

The specific money laundering typologies that make AML compliance corporate service providers UAE 2026 critical include:

Shell company creation: A shell company is a legal entity with no genuine business activity used to hold assets, conduct transactions, or move funds in a way that obscures the connection to the ultimate beneficial owner. Company formation agents who create shell companies without adequate CDD and UBO identification are the entry point for this typology.

Multi-layered ownership structures: Complex, multi-layered ownership structures using multiple holding companies, special purpose vehicles, trusts, and nominee arrangements are a known money laundering typology. Each layer adds complexity and distance between the illicit funds and their origin. CSPs who establish and administer these structures without understanding the ultimate beneficial owner are directly facilitating potential financial crime.

Nominee director and shareholder arrangements: Nominee services where one person holds a directorship or shareholding on behalf of another are legitimate commercial tools. But they are also used to conceal the true ownership and control of companies from regulators, banks, and counterparties. CSPs providing nominee services must identify the actual beneficial owner behind every nominee arrangement.

Registered office misuse: Registered office addresses provided to companies that have no genuine business activity at that address can be used to establish a veneer of legitimacy for entities engaged in financial crime. Registered office providers must understand who their clients are and what business those clients conduct.

Trust structures: Trusts can be misused to conceal the beneficial ownership of assets, particularly in cross-border arrangements where the settlor, trustee, and beneficiaries are in different jurisdictions. Trust service providers must identify the settlor, trustees, protector if any, and all beneficiaries as part of their CDD obligations.

What Are the AML Obligations of Corporate Service Providers in UAE?

AML obligations company formation UAE under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025 cover the complete set of AML/CFT/CPF requirements. Every CTSP must implement and maintain the following:

1. goAML Registration

Every corporate service provider must register on the goAML portal operated by the Financial Intelligence Unit UAE. Registration is mandatory before commencing regulated activities. The registration requires designation of a qualified MLRO and submission of the firm’s trade licence and relevant documentation. goAML registration company formation agents UAE is non-negotiable; operating without registration carries an immediate fine.

2. AML/CFT/CPF Policy and Procedures

Every CTSP must maintain a written, senior-management-approved AML/CFT/CPF policy and procedures document tailored to its specific service portfolio, client base, and risk profile. A generic downloaded template is not compliant. For a comprehensive guide to what an AML policy must include, see our AML CFT Policy Documentation UAE guide.

3. Business-Wide AML/CFT Risk Assessment

Every CTSP must conduct and maintain a formal business-wide AML/CFT risk assessment covering its exposure to money laundering, terrorist financing, and proliferation financing risks. For corporate service providers, this must specifically address the shell company risk, multi-layered ownership structure risk, nominee arrangement risk, and cross-border structure risk specific to the sector.

4. Customer Due Diligence (CDD)

CDD for CSPs UAE 2026 must be conducted for every client before providing any regulated service. For corporate clients, the most common client type for CSPs, CDD must include:

  • Verification of the corporate client’s legal existence, registration, and legal form
  • Identification and verification of the corporate client’s directors, authorised signatories, and senior management
  • Identification and verification of the Ultimate Beneficial Owner (UBO) of the corporate client
  • Understanding the purpose and intended nature of the business relationship
  • Ongoing monitoring of the relationship throughout its duration

For individual clients, CDD includes the name as it appears on the identity document, nationality, address, date and place of birth, employer name and address, and a copy of a valid identity card or travel document.

5. Ultimate Beneficial Owner (UBO) Identification

UBO compliance corporate service providers UAE is the most critical and most frequently violated compliance obligation for the CSP sector. Every UAE company must identify, verify, and maintain records of its Ultimate Beneficial Owners, the natural persons who ultimately own or control the legal entity.

Under UAE law, a UBO is generally defined as any natural person who directly or indirectly owns or controls 25% or more of the shares or voting rights of a company, or who otherwise exercises control over the management of the entity.

For CSPs, the UBO obligation operates at two levels:

Level 1: UBO of corporate clients: CSPs must identify and verify the UBO of every corporate client before providing regulated services. For complex multi-layered ownership structures, this means tracing the ownership chain through every layer until the natural persons at the top are identified and verified.

Level 2: UBO declarations for UAE companies: Every UAE company, whether on the mainland or in a free zone, must file UBO declarations with the relevant registrar. CSPs who assist clients in establishing UAE companies are often the professionals who prepare and file these declarations. The UBO declaration must reflect the actual beneficial owners, not nominees or intermediaries.

UBO identification failures are among the most common findings in Ministry of Economy inspections of CSPs. Inspectors specifically assess whether UBO has been identified and documented for every corporate client and whether UBO information is kept current when ownership structures change.

6. Enhanced Due Diligence (EDD) for High-Risk Clients

EDD corporate service providers UAE must be applied for clients that present higher AML risk, including clients from FATF grey-listed jurisdictions (including Iraq, Kuwait, and Bosnia and Herzegovina following the 2026 grey list updates), PEPs and their associates, clients requesting complex multi-layered structures, and clients with opaque ownership arrangements that create difficulty in identifying the UBO.

For EDD, CSPs must obtain additional information and documentation, including source of funds, source of wealth, the purpose of the corporate structure, and the identities of all parties involved, and obtain senior management approval before establishing the relationship.

7. Suspicious Transaction Reporting (STR)

When a CSP identifies a transaction, structure, or pattern of activity that raises suspicion of money laundering, terrorist financing, or proliferation financing, it must file a Suspicious Transaction Report (STR) through the goAML portal without delay. Red flags specific to corporate service providers include:

  • Clients who cannot or will not explain the purpose of the corporate structure
  • Requests for complex, multi-layered structures with no apparent commercial rationale
  • Clients who are reluctant to identify the ultimate beneficial owner
  • Requests for nominee directors or shareholders where the beneficial owner wants to remain completely hidden
  • Clients from high-risk jurisdictions requesting rapid company formation with minimal documentation
  • Structures that appear designed to obscure the connection between funds and their origin

8. Targeted Financial Sanctions (TFS) Screening

Every CSP must screen all clients, directors, beneficial owners, and counterparties against UAE, UN Security Council, and other applicable international sanctions lists at onboarding and on an ongoing basis. A match requires immediate freezing of the relevant assets or services and notification to the supervisory authority.

9. MLRO Appointment

Every CTSP must appoint a qualified Money Laundering Reporting Officer (MLRO) with the authority, independence, and competence to oversee the AML/CFT compliance programme. For smaller CSPs without in-house compliance expertise, an outsourced MLRO service is permitted and widely used.

10. AML Training

All staff with client-facing or administrative responsibilities in connection with regulated activities must receive regular AML training covering their obligations under UAE law, red flags specific to the corporate services sector, the UBO identification process, and STR filing procedures.

11. Record Retention

All CDD documents, UBO records, transaction records, risk assessments, training records, and STR filings must be retained for a minimum of five years. In light of the statute of limitations removal under Federal Decree-Law No. 10 of 2025, CSPs should consider retaining records for higher-risk structures beyond the minimum period.

Is your current AML policy a generic template that does not reflect your actual business?

AMLUAE produces fully customised AML CFT policy documentation UAE  tailored to your specific business type, risk profile, client base, and regulatory obligations under Federal Decree-Law No. 10 of 2025.

What Is the UBO Identification Requirement for CSPs in UAE 2026?

The UBO identification requirement for CSPs in UAE 2026 is the most demanding and most specifically enforced obligation in the entire AML compliance corporate service providers UAE framework, and it operates at both the firm level and the client-service level.

See also  AML Compliance for Commercial Gaming Operators in UAE: The Complete 2026 Guide

At the firm level: Every UAE company, including the CSP firm itself, must maintain a UBO register and file UBO declarations with the relevant registrar. The UBO is any natural person who directly or indirectly owns or controls 25% or more of the shares or voting rights, or who otherwise exercises control over the management of the company. UBO declarations must be updated whenever there is a change in beneficial ownership.

At the client-service level: When a CSP provides regulated services to a corporate client, it must identify and verify the UBO of that corporate client as part of its CDD process. For complex multi-layered ownership structures which are common in the CSP client base, this means tracing ownership through every layer of the structure until the natural persons at the ultimate top are identified.

The UBO tracing obligation for multi-layered structures is where most CSPs encounter practical difficulty. A holding company owned by a foundation that is administered by a trust that has a corporate trustee may require tracing through four or five layers before the natural person UBO is identified. The obligation does not stop at the first corporate layer  it continues until a natural person is found.

Common UBO failures in Ministry of Economy CSP inspections include:

  • Stopping UBO identification at the first corporate layer without tracing to the natural person
  • Accepting nominee shareholder arrangements without identifying the person behind the nominee
  • Not updating UBO records when ownership structures change
  • Not obtaining UBO documentation for trust structures, failing to identify the settlor, trustees, and beneficiaries
  • Using UBO declarations that name the company itself rather than the natural persons who own it.

AML Compliance for Free Zone Company Formation Agents UAE

AML compliance for free zone company formation agents UAE applies equally to company formation businesses operating in or serving free zones  DIFC, ADGM, JAFZA, DMCC, Meydan, and all UAE commercial free zones.

Free zone registration does not exempt a CSP from AML obligations. The relevant distinction is supervisory authority, not AML obligation existence:

Free Zone

Supervisory Authority for CSP AML

DIFC

Dubai Financial Services Authority (DFSA)

ADGM

Financial Services Regulatory Authority (FSRA)

JAFZA, DMCC, Meydan, all other commercial free zones

Ministry of Economy

Mainland UAE

Ministry of Economy

A company formation agent registered in JAFZA that assists clients in forming mainland UAE companies is subject to Ministry of Economy supervision for its AML compliance corporate service providers UAE obligations. A corporate services firm licensed in DIFC is subject to DFSA supervision under its updated AML Module (effective March 2026).

For offshore company formation agents, those assisting clients in forming companies in other jurisdictions from a UAE base, the AML compliance obligation attaches to the service activity conducted in the UAE, regardless of where the resulting company is incorporated.

What AML Risks Are Specific to Corporate Service Providers in UAE?

AML risks specific to corporate service providers in UAE are recognised by FATF as among the most significant in any DNFBP category because CSPs occupy a structurally critical position in the corporate formation process. The specific risk indicators that every UAE CTSP must assess in its business-wide risk assessment include:

Client risk indicators:

  • Clients who are themselves from high-risk jurisdictions
  • Clients who are politically exposed persons or their associates
  • Clients who are reluctant to identify the beneficial owner behind the structure
  • Clients who request nominee arrangements without a clear commercial rationale
  • Clients who want rapid formation with minimal documentation

Structure risk indicators:

  • Requests for complex multi-layered ownership structures with no apparent commercial purpose
  • Structures involving jurisdictions with weak AML/CFT frameworks
  • Structures designed to separate the beneficial owner from the company as far as possible
  • Trust structures with non-transparent beneficiary arrangements
  • Structures that combine multiple nominee services  nominee directors, nominee shareholders, registered office  in a single arrangement

Transaction risk indicators:

  • Unusual urgency in the formation or dissolution of corporate structures
  • Requests to change ownership structure frequently with no explanation
  • Payments from third parties not identified in the CDD
  • Cash payments for corporate services above expected norms

Geographic risk indicators:

  • Clients from FATF grey-listed jurisdictions  following the June 2026 update; this includes Iraq, Kuwait, and Bosnia and Herzegovina among 22 current jurisdictions
  • Clients from FATF blacklist jurisdictions: Iran, North Korea, Myanmar, for whom EDD is mandatory

Does AML Compliance Apply to Trust Service Providers in UAE?

Yes, AML compliance applies to trust service providers in UAE as part of the Company and Trust Service Providers DNFBP category under Cabinet Resolution 134 of 2025. A trust service provider that acts as a trustee of an express trust, arranges for another person to act as a trustee, or performs equivalent functions for legal arrangements is subject to full AML/CFT/CPF obligations.

For trust service providers, the CDD obligation extends to all parties in the trust structure:

  • Settlor  the person who creates and funds the trust
  • Trustees  the persons who hold and manage trust assets
  • Protector  where a protector role exists, this person must also be identified
  • Beneficiaries  all persons who benefit from the trust, whether named or identified by class

The UBO of a trust structure is the natural person who ultimately controls the trust, which may be the settlor, the trustee, the protector, or in some cases a beneficiary who exercises effective control. Identifying the UBO of a complex trust structure requires a thorough analysis of the trust deed and the actual control arrangements in practice, not just the formal documentation.

What Happens if a CSP Fails AML Compliance in UAE 2026?

The penalties for AML compliance failures for corporate service providers UAE 2026 under Federal Decree-Law No. 10 of 2025 are significant and operate at both the firm level and the individual level:

Administrative fines at firm level: AED 10,000 to AED 5,000,000 per violation under Article 17. Multiple violations in a single inspection carry cumulative fines. Specific violations such as failure to register on the goAML portal carry fines at the higher end of the scale.

Criminal liability for partners and directors: Under Article 27(5) of Federal Decree-Law No. 10 of 2025, individual partners, directors, and MLROs can face personal criminal prosecution, including imprisonment and personal fines, where they were aware of compliance failures and those failures resulted from their breach of duty. For a dedicated guide to personal liability risk, see our AML Personal Liability UAE 2026 guide.

Trade licence suspension or cancellation: The Ministry of Economy can suspend or cancel the trade licence of a CSP that persistently or severely fails its AML obligations, an existential consequence for any company formation business.

Banking restrictions: Banks conduct their own AML due diligence on business clients. A CSP with a poor AML compliance record faces banking restrictions, including account closure or refusal of banking services, that are operationally damaging regardless of regulatory fines.

Reputational damage: Ministry of Economy enforcement actions are published. A named enforcement action against a company formation agent or registered office provider carries severe reputational consequences in a sector where client trust and professional reputation are central to business development.

How Do I Build an AML Programme for My UAE Corporate Service Provider?

Building an AML programme for a UAE corporate service provider requires ten sequential steps, each building on the previous one. Here is the complete guide:

Step 1: Confirm your regulatory classification 

Determine precisely which of your service activities trigger AML compliance corporate service providers UAE 2026 obligations. Review your full service portfolio: company formation, nominee services, registered office, secretarial services, trust services, PRO services, and identify which activities are regulated under Cabinet Resolution 134 of 2025.

Step 2: Register on the goAML portal

Complete goAML registration for your CSP on the Financial Intelligence Unit UAE’s platform. Designate your MLRO and register their details. Ensure registration is completed before providing any regulated services.

Step 3: Conduct your business-wide AML/CFT risk assessment

Assess your CSP’s specific exposure to money laundering, terrorist financing, and proliferation financing risks across your service types, client base, geographic exposure, and delivery channels. Pay particular attention to shell company risk, multi-layered ownership risk, and nominee arrangement risk. See our AML/CFT Risk Assessment service for professional support.

Step 4:  Appoint your MLRO

Formally appoint a qualified Money Laundering Reporting Officer with documented authority, independence, and competence. If your CSP does not have in-house compliance expertise, engage an outsourced MLRO service.

Step 5:  Draft your AML policy and procedures

Produce a written AML/CFT/CPF policy tailored to your specific service portfolio covering CDD and EDD procedures for corporate and individual clients, UBO identification for multi-layered structures, STR filing, TFS screening, record retention, and MLRO responsibilities. For professional support, see our AML/CFT Policy & Documentation service.

See also  5 Signs of AML Non-Compliance in UAE Businesses And How to Fix Each One

Step 6:  Implement CDD and UBO procedures

Put CDD and UBO identification processes into operation for all new client engagements. Conduct a retrospective review of existing client files to ensure CDD and UBO documentation is complete and current. Implement a process for updating UBO records whenever ownership structures change.

Step 7:  Implement TFS screening

Screen all clients, directors, beneficial owners, and counterparties against UAE, UN, OFAC, and EU sanctions lists at onboarding and on an ongoing basis. Establish a documented response procedure for matches.

Step 8:  Establish your STR process

Ensure your MLRO and all client-facing staff understand the red flags specific to the corporate services sector, how to escalate suspicious activity internally, and how the MLRO files STRs through the goAML portal.

Step 9:  Deliver AML training to all relevant staff

Train all staff involved in client onboarding, corporate structure establishment, nominee services, and trust administration on their AML obligations, including the UBO identification obligation, red flags for corporate services, and the STR filing process.

Step 10: Book an independent AML health check 

Before your first Ministry of Economy inspection or as part of your regular compliance cycle, commission an independent AML/CFT health check to verify your programme is complete, current, and inspection-ready. For details on what inspectors check, see our AML Inspection UAE 2026 guide.

What Does the Ministry of Economy Check During AML Inspections of CSPs?

Ministry of Economy AML inspections of corporate service providers UAE specifically focus on the obligations that are most commonly violated in the CSP sector. Based on the inspection methodology under the Ministry of Economy’s supervisory framework, here is what inspectors check:

goAML registration: Is the CSP registered? Are registration details current and accurate? Is there an active MLRO designated?

AML policy document: Is it present, tailored to the CSP’s specific services, updated for Federal Decree-Law No. 10 of 2025, and signed by senior management?

Business-wide risk assessment: Does it address the specific risks of the corporate services sector shell company risk, multi-layered ownership, nominee services?

CDD client files:  A sample of client files is reviewed for complete identity verification, corporate client documentation, and critically  UBO documentation through to the natural person.

UBO documentation: This is the area of deepest scrutiny for CSPs. Inspectors specifically check whether UBO has been traced through all ownership layers to the natural persons, whether nominee arrangements have been looked through to identify the actual beneficial owner, and whether UBO records are current.

STR filing history: CSPs in high-risk practice areas that have never filed a single STR attract significant scrutiny. Inspectors assess whether the filing history reflects genuine, active monitoring.

TFS screening records: Is screening being conducted at onboarding and ongoing? Are match records documented?

AML training records: Are training records present for all relevant staff? Has training been updated for the 2025 law?

How AMLUAE Helps Corporate Service Providers with AML Compliance UAE 2026

AMLUAE is a specialist AML compliance consultancy dedicated exclusively to UAE AML/CFT/CPF compliance. We understand the specific obligations of corporate service providers, company formation agents, registered office providers, trust service providers, and PRO services companies under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025, including the sector-specific UBO identification challenges, multi-layered ownership structure complexities, and shell company risk assessment requirements.

Our services for UAE corporate service providers include:

AML/CFT Health Check:  An independent diagnostic review specifically assessing your CSP’s UBO documentation, CDD files, goAML registration, risk assessment, and AML policy against the Ministry of Economy’s inspection standard for the corporate services sector.

AML/CFT Policy & Documentation: A fully customised AML/CFT/CPF policy for your CSP  covering company formation services, nominee arrangements, registered office provision, trust services, and the specific red flags and UBO identification procedures relevant to your service portfolio.

AML/CFT Risk Assessment Report: A formal business-wide risk assessment covering shell company risk, multi-layered ownership structure risk, nominee service risk, and geographic risk, updated for the June 2026 FATF grey list changes including Iraq and Kuwait.

In-House AML Compliance Setup: End-to-end AML programme build: goAML registration, MLRO appointment, risk assessment, policy documentation, CDD and UBO frameworks, TFS screening, and STR filing procedures, all aligned with Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025.

AML Training Program: Role-based AML training for CSP partners, directors, client-facing staff, and administrative teams covering the 2025 law changes, UBO identification obligations, CSP-specific red flags, and STR filing procedures. Fully documented with attendance records.

Regulatory Reporting Services: End-to-end management of STR and SAR filing obligations through the goAML portal, ensuring your CSP’s reporting history demonstrates active, quality engagement with the FIU.

AML Software: Automated TFS screening, CDD verification, UBO identification support, and ongoing monitoring tools configured for corporate services workflows.

We serve company formation agents, registered office providers, trust service providers, PRO services companies, and corporate secretarial firms across Dubai, Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, and all UAE free zones including DIFC, ADGM, JAFZA, and DMCC.

Whether you are building your CSP’s AML compliance programme from scratch following the 2025 law changes, remediating gaps identified in a previous Ministry of Economy inspection, or preparing for an upcoming supervisory review, AMLUAE has the service that fits exactly where you are.

Frequently Asked Questions About AML Compliance Corporate Service Providers UAE

What is a corporate service provider under UAE AML law 2026?

A corporate service provider under UAE AML law 2026 is formally defined as a "Company and Trust Service Provider" (CTSP) under Cabinet Resolution 134 of 2025, a DNFBP that provides services including company formation, nominee director or shareholder arrangements, registered office provision, trust administration, or corporate secretarial services. The category was renamed in 2025 from the previous "credit companies and funds service providers," removing any ambiguity that a pure corporate services firm sits outside the DNFBP perimeter.

What AML obligations do corporate service providers have in UAE?

AML obligations corporate service providers UAE 2026 cover eleven core requirements: goAML portal registration, a written AML/CFT/CPF policy tailored to the CSP's service portfolio, a business-wide risk assessment covering shell company and multi-layered ownership risks, CDD and full UBO identification for all corporate clients, EDD for high-risk clients and FATF grey-listed jurisdiction connections, TFS screening, STR filing for suspicious activity, a qualified MLRO, documented AML training for all relevant staff, five-year record retention, and an independent AML review.

Do company formation agents need to register on goAML in UAE?

Yes, company formation agents in UAE must register on the goAML portal operated by the Financial Intelligence Unit UAE. Registration is mandatory for all CTSPs before providing regulated services. The registration requires designation of a qualified MLRO and submission of the firm's trade licence. Operating without goAML registration is an immediate compliance violation carrying fines from AED 50,000 under Article 17 of Federal Decree-Law No. 10 of 2025.

What activities trigger AML obligations for CSPs in UAE 2026?

AML obligations for CSPs in UAE 2026 are triggered by six specific activities under Cabinet Resolution 134 of 2025: acting as an agent in company incorporation, providing or arranging nominee director or company secretary services, providing or arranging a nominee partner role in a legal person, providing a registered office or administrative address, acting as or arranging a trustee of an express trust, and providing or arranging nominee shareholder services. Any business providing one or more of these services is a regulated Company and Trust Service Provider regardless of its trade licence name.

What is the UBO identification requirement for CSPs in UAE?

The UBO identification requirement for CSPs in UAE requires tracing ownership through every layer of a corporate structure until the natural persons who own or control 25% or more of the entity are identified and verified. Stopping at the first corporate layer is non-compliant. Nominee arrangements must be looked through to identify the actual beneficial owner. UBO records must be updated whenever ownership changes and retained for a minimum of five years under Article 25 of Cabinet Resolution 134 of 2025.

What AML risks are specific to corporate service providers in UAE?

AML risks specific to corporate service providers in UAE include five key typologies: shell company creation to conceal illicit funds, multi-layered ownership structures that obscure beneficial ownership, nominee director and shareholder arrangements that hide true control, registered office provision that legitimises fictitious entities, and trust structures misused to conceal asset ownership. FATF identifies CSPs as one of the highest-risk DNFBP categories globally, and Ministry of Economy inspections of UAE CSPs specifically target these typologies.

Does AML compliance apply to free zone company formation agents UAE?

Yes, AML compliance applies to free zone company formation agents UAE regardless of free zone registration. The supervisory authority differs: DFSA for DIFC, FSRA for ADGM, Ministry of Economy for all other free zones and mainland, but AML compliance obligations under Federal Decree-Law No. 10 of 2025 apply universally. A company formation agent assisting clients with UAE company establishment from a free zone base is a regulated CTSP subject to full AML/CFT/CPF obligations.

What are the penalties for CSPs that fail AML compliance in UAE?ould an AML CFT risk assessment report contain?

Penalties for CSPs that fail AML compliance UAE 2026 include administrative fines of AED 10,000 to AED 5,000,000 per violation under Article 17 of Federal Decree-Law No. 10 of 2025, trade licence suspension or cancellation by the Ministry of Economy, personal criminal prosecution and imprisonment for partners and MLROs under Article 27(5), banking restrictions that can halt business operations, and reputational damage from published Ministry of Economy enforcement actions. Multiple violations in a single inspection carry cumulative fines.

How do I build an AML programme for my UAE corporate service provider?

To build an AML programme for a UAE corporate service provider, complete ten steps: confirm which services trigger AML compliance corporate service providers UAE 2026 obligations, register on the goAML portal, conduct a business-wide risk assessment covering shell company and multi-layered ownership risks, appoint a qualified MLRO, draft a tailored AML policy, implement CDD and UBO identification procedures tracing through all ownership layers, integrate TFS screening, establish STR filing processes for CSP-specific red flags, deliver role-based AML training to all staff, and commission an independent AML health check before your first Ministry of Economy inspection.

Does AML compliance apply to PRO services companies in UAE?

AML compliance applies to PRO services companies in UAE where their activities include company formation, registered office provision, nominee director or shareholder services, or trust administration. A pure PRO services business providing only visa processing, government liaison, and document clearing with no involvement in company establishment or nominee services may fall outside the CTSP perimeter for those specific activities. Most PRO services businesses in the UAE provide a combination that includes at least one triggering activity, making AML compliance the norm rather than the exception for this sector.