The Ministry of Justice Issued Four AML Circulars for UAE Law Firms in 2026. Here Is What Every Legal Practice Must Do
AML compliance law firms UAE 2026 is no longer a peripheral concern for UAE legal practices; it is a front-line regulatory obligation backed by four separate Ministry of Justice circulars issued in 2026, active inspection programmes, and personal criminal liability for partners and compliance officers under Article 27(5) of Federal Decree-Law No. 10 of 2025.
The four circulars issued by the Ministry of Justice for UAE law firms and legal consultants in 2026 are:
- Circular No. 1 of 2026 Obligation to update AML/CFT/CPF policies, procedures, and controls
- Circular No. 2 of 2026 Update of the list of high-risk countries and countries subject to enhanced monitoring
- Circular No. 3 of 2026 Obligation to undertake, document, review, and periodically update an institutional risk assessment
- Circular No. 4 of 2026 Targeted financial sanctions obligations
Together with Federal Decree-Law No. 10 of 2025, Cabinet Resolution 134 of 2025, and Ministerial Resolution No. 248 of 2025, which regulate the procedures and controls for supervising and monitoring law firms, legal consultants, and notaries in the field of combating money laundering, these instruments define the most comprehensive AML compliance framework the UAE legal profession has ever faced.
This guide explains exactly what AML compliance law firms UAE 2026 requires, what each circular mandates, who is covered, what the obligations are, what inspectors check, and how to build a compliant AML programme for your legal practice. For the full background on Federal Decree-Law No. 10 of 2025 and what changed from the 2018 law, see our UAE AML Law 2025 Guide.
Do Law Firms Need AML Compliance in UAE?
Yes, law firms and legal consultants in UAE need AML compliance under Federal Decree-Law No. 10 of 2025 and its implementing regulations. The Ministry of Justice is the AML supervisory authority for lawyers, notaries, and other independent legal professionals practising in mainland UAE when they carry out specified activities.
AML compliance for the legal profession in UAE is not a general obligation applied to everything a lawyer does. It is triggered by specific activities that bring the legal professional within the Designated Non-Financial Business and Profession (DNFBP) perimeter. Under Article 3(4) of Cabinet Resolution 134 of 2025, these specified activities include:
- Managing client funds: holding, receiving, or disbursing funds on behalf of clients
- Preparing or executing real estate transactions acting on behalf of a client in the buying or selling of property
- Managing bank, savings, or securities accounts operating accounts for or on behalf of clients
- Organising contributions for the creation, operation, or management of companies company formation and structuring work
- Creating, operating, or managing legal arrangements trusts, foundations, and similar structures
A lawyer or legal consultant who only provides legal advice, with no involvement in the above activities, falls outside the DNFBP perimeter for AML purposes. But any lawyer or legal consultant who regularly handles real estate transactions, company formations, client fund management, or trust structures is a fully regulated DNFBP with the complete set of AML/CFT/CPF obligations.
In practice, the vast majority of commercial law firms and legal consultancy offices in the UAE carry out one or more of these specified activities as part of their standard practice, making AML compliance law firms UAE 2026 a near-universal obligation across the UAE legal sector.
Who Is the AML Supervisory Authority for Law Firms in UAE?
The Ministry of Justice (MoJ) is the AML supervisory authority for lawyers, notaries, and other independent legal professionals in mainland UAE. The Ministry’s Anti-Money Laundering and Combating Terrorism Financing Department oversees and supervises the legal profession and legal consultancy sector across the UAE with a mandate that includes conducting inspections, issuing circulars and guidance, and imposing administrative penalties.
The supervisory jurisdiction depends on where the legal professional is licensed and practises, not on the nationality of their clients or the location of the underlying transaction:
Legal Practice Type | AML Supervisory Authority |
Mainland UAE law firms and legal consultants | Ministry of Justice (MoJ) |
Notaries in mainland UAE | Ministry of Justice (MoJ) |
Law firms practising within DIFC | Dubai Financial Services Authority (DFSA) |
Law firms practising within ADGM | Financial Services Regulatory Authority (FSRA) |
Independent legal professionals mainland UAE | Ministry of Justice (MoJ) |
This means a law firm with offices in both mainland Dubai and the DIFC is subject to two different supervisory regimes: the Ministry of Justice for its mainland practice and the DFSA for its DIFC practice. Both must be compliant.
The Ministry of Justice exercises its supervisory mandate through desk-based reviews, field inspections, and increasingly through more sophisticated inspection methodologies that assess operational effectiveness, not just policy documentation. Law firms that wait until they receive an inspection notice to address compliance gaps are positioning themselves for regulatory difficulty.
The Four Ministry of Justice AML Circulars for Law Firms in 2026
The most significant development in AML compliance law firms UAE 2026 is the issuance of four separate Ministry of Justice circulars, each targeting a specific compliance obligation. This is the first time the MoJ has issued multiple coordinated circulars in a single year, reflecting the heightened regulatory expectations ahead of and following the FATF Fifth Round Mutual Evaluation.
Ministry of Justice Circular No. 1 of 2026 AML Policy Update Obligation
Circular No. 1 of 2026 requires law firms and legal consultancy offices to update their AML/CFT and CPF policies, procedures, and controls whenever relevant risk factors change or regulatory requirements arise.
The circular mandates that changes to the AML framework must be triggered by:
- Changes in the National Risk Assessment
- Changes in the firm’s internal risk levels
- Changes in the client base
- Changes in the services offered
- Changes in legal obligations
This is a dynamic, continuous compliance obligation, not a one-time update requirement. A law firm that updated its AML policy when Federal Decree-Law No. 10 of 2025 came into force in October 2025 but has not reviewed it since is not compliant with Circular No. 1 of 2026 if any of the above triggers have since occurred.
The practical implication is that AML policy for law firms UAE must be a living document reviewed and updated as the regulatory environment changes and as the firm’s own operations evolve. A static AML policy written once and filed away is a compliance failure waiting to happen.
Ministry of Justice Circular No. 2 of 2026: High-Risk Countries Update
Circular No. 2 of 2026 requires law firms and legal consultancy offices to update their AML frameworks to reflect changes in the list of high-risk countries and countries subject to enhanced monitoring.
This circular directly connects to the FATF grey list updates of 2026, including the addition of Kuwait and Papua New Guinea in February 2026, and the addition of Iraq and Bosnia and Herzegovina in June 2026. Every UAE law firm that has clients, counterparties, or transactions connected to these newly listed jurisdictions must review and update its country risk model, customer risk ratings, and enhanced due diligence procedures accordingly.
For law firms involved in real estate transactions, company formations, or trust structures with buyers, sellers, directors, or beneficial owners from Kuwait, Iraq, or other grey-listed jurisdictions, Circular No. 2 of 2026 creates an immediate, documented action requirement. For a comprehensive guide to the 2026 FATF grey list updates and what UAE businesses must do, see our FATF Grey List Update UAE 2026 guide.
Ministry of Justice Circular No. 3 of 2026: Institutional Risk Assessment Obligation
Circular No. 3 of 2026 requires law firms and legal consultancy offices to undertake, document, review, and periodically update an institutional risk assessment on a regular basis.
This is the most operationally significant of the four 2026 circulars. Under Circular No. 3, every UAE law firm must:
- Conduct a formal, documented business-wide risk assessment covering money laundering, terrorist financing, and proliferation financing risks
- Review the risk assessment at defined intervals
- Update the risk assessment whenever material changes occur in the firm’s client base, services, risk environment, or regulatory obligations
- Document the review process and outcomes in a manner that is evidenced and reproducible during an inspection
A risk assessment that was completed once and filed without periodic review does not satisfy Circular No. 3 of 2026. The circular explicitly requires the risk assessment to be periodically updated on a regular basis, making it an ongoing compliance obligation, not a one-time exercise.
Ministry of Justice Circular No. 4 of 2026 Targeted Financial Sanctions
Circular No. 4 of 2026 requires law firms and legal consultancy offices to implement targeted financial sanctions (TFS) screening as part of their AML compliance framework, screening clients, counterparties, and beneficial owners against UAE, UN Security Council, and other applicable international sanctions lists.
For law firms, TFS screening is triggered at client onboarding and on an ongoing basis throughout the client relationship. Where a match is identified, the firm must freeze the relevant funds or assets and notify the supervisory authority immediately. Circular No. 4 applies to all transactions regardless of value; the TFS obligation has no monetary threshold.
What Are the AML Obligations of Law Firms in UAE 2026?
AML obligations lawyers UAE 2026 cover the complete set of AML/CFT/CPF requirements under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025. Here is every specific obligation your law firm must meet:
1. AML/CFT/CPF Policy and Procedures
Every law firm and legal consultancy office must maintain a written AML/CFT/CPF policy and procedures document tailored to its specific practice, covering the types of legal work it conducts, the clients it serves, the jurisdictions it operates in, and the risks it faces. Under Circular No. 1 of 2026, this policy must be updated dynamically, not just annually on a fixed schedule.
2. Institutional Risk Assessment
Under Circular No. 3 of 2026 and Cabinet Resolution 134 of 2025, every law firm must conduct and maintain a formal AML/CFT risk assessment covering its exposure to money laundering, terrorist financing, and proliferation financing risks. The risk assessment must be documented, periodically reviewed, and updated whenever material changes occur in the firm’s risk environment.
3. goAML Registration
All law firms and legal consultants carrying out specified activities are required to register on the goAML portal operated by the Financial Intelligence Unit UAE. goAML registration for law firms UAE is mandatory and must be completed before carrying out regulated activities. Operating without goAML registration is an immediate AML compliance violation.
4. Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)
Law firms must conduct CDD on all clients engaged in specified activities, verifying identity, understanding the nature and purpose of the business relationship, identifying the ultimate beneficial owner (UBO) of corporate clients, and conducting ongoing monitoring throughout the relationship. EDD must be applied for clients from high-risk jurisdictions, politically exposed persons (PEPs), and complex or high-value transactions.
5. Suspicious Transaction Reporting (STR)
When a law firm identifies a transaction or pattern of activity that raises suspicion of money laundering, terrorist financing, or proliferation financing, it must file a Suspicious Transaction Report (STR) through the goAML portal without delay. This obligation exists regardless of client confidentiality considerations; the AML reporting obligation overrides legal professional confidentiality for reporting purposes.
6. Targeted Financial Sanctions Screening
Under Circular No. 4 of 2026, law firms must screen all clients, counterparties, and beneficial owners against UAE, UN Security Council, and other applicable international sanctions lists at onboarding and on an ongoing basis. A match requires immediate asset freezing and supervisory notification, with no monetary threshold applying to the TFS obligation.
7. High-Risk Country Due Diligence
Under Circular No. 2 of 2026, law firms must update their country risk models following FATF grey list changes and apply appropriate due diligence measures to clients connected to high-risk jurisdictions. This includes updating CDD procedures for clients with connections to Kuwait, Iraq, Bosnia and Herzegovina, and all other current FATF grey list countries.
8. MLRO Appointment
Every law firm carrying out specified activities must appoint a qualified Money Laundering Reporting Officer (MLRO) or Compliance Officer with the authority, independence, and competence to oversee the firm’s AML/CFT programme. Notice No. 2471 of 2026 issued by the Ministry of Justice provides joint guidance on the MLRO function specifically for UAE law firms.
9. AML Training
All staff with client-facing or transaction-handling responsibilities must receive regular AML training covering their obligations under UAE law, red flags specific to the legal profession, and updates for the new 2025 law and 2026 circulars. Training must be documented with attendance records.
10. Record Retention
All CDD documents, transaction records, risk assessments, training records, and STR filings must be retained for a minimum of five years. Under Federal Decree-Law No. 10 of 2025’s removal of the statute of limitations for AML crimes, law firms should consider retaining higher-risk matter files well beyond the minimum period.
Does Lawyer-Client Privilege Override AML Obligations in UAE?
No, lawyer-client privilege does not override AML reporting obligations for law firms in UAE. This is one of the most common misconceptions among legal professionals encountering AML compliance for the first time.
Under Federal Decree-Law No. 10 of 2025, the obligation to file a Suspicious Transaction Report exists regardless of client confidentiality considerations when the suspicion arises from the firm’s own AML/CFT monitoring of transactions or activities. The legal professional privilege exception is narrowly defined it applies where the lawyer is assessing the legal position of the client in connection with legal proceedings or providing legal advice, not where the lawyer is facilitating a transaction.
In practice, this means:
- A lawyer providing purely legal advice about a client’s rights is not required to report suspicions arising solely from that advice
- A lawyer executing a real estate transaction, forming a company, managing client funds, or establishing a trust structure is required to report suspicious activity identified in connection with those activities regardless of client confidentiality
The tipping off prohibition under Federal Decree-Law No. 10 of 2025 also applies to law firms; a firm that has filed or is considering filing an STR must not disclose this to the client or any associated party.
Is your law firm’s AML framework ready for a Ministry of Justice inspection?
AMLUAE’s AML/CFT Policy & Documentation service produces a fully customised, MoJ-ready AML programme for UAE law firms and legal consultancies updated for all four 2026 circulars and Federal Decree-Law No. 10 of 2025.
What Activities Trigger AML Obligations for Lawyers in UAE?
AML obligations for lawyers in UAE are triggered by specific activities, not by the practice of law in general. A lawyer who provides only legal advice, represents clients in litigation, or drafts legal documents with no transactional or financial element is generally outside the DNFBP perimeter.
AML compliance obligations are triggered when the lawyer or legal consultant:
Buys or sells real estate on behalf of a client: This is the most common trigger for UAE lawyers given the volume of real estate transactions in Dubai and Abu Dhabi. Acting for a buyer or seller in a property transaction, even just reviewing the contract, triggers AML obligations where the lawyer is preparing or executing the transaction.
Manages client funds or accounts: Holding client money in a client account, transferring funds on behalf of a client, or operating a client’s bank or securities account triggers full AML obligations including CDD, STR filing, and sanctions screening.
Assists in company formation or management: Advising on or executing the formation of a company, establishing a trust or foundation, providing registered agent or nominee director services, or managing a legal arrangement on behalf of a client triggers AML compliance obligations.
Providing trust or company services: Setting up or managing trusts, foundations, or similar legal arrangements, including where the lawyer acts as trustee or holds assets on behalf of a third party, is explicitly within the DNFBP perimeter.
AML Compliance for Law Firms in DIFC and ADGM
AML compliance for DIFC law firms 2026 is governed by the DFSA rather than the Ministry of Justice. The DFSA updated its AML Module in March 2026 to align with Federal Decree-Law No. 10 of 2025, meaning DIFC-based legal practices are subject to equivalent AML/CFT/CPF obligations under the DFSA framework.
AML compliance for ADGM law firms 2026 falls under the FSRA’s jurisdiction. Legal professionals practising within ADGM must comply with the ADGM AML framework, which is substantively aligned with the federal regime under Federal Decree-Law No. 10 of 2025.
Key practical differences for DIFC and ADGM law firms:
- The supervisory authority is the DFSA or FSRA, not the Ministry of Justice
- The applicable rules are the DFSA AML Module or ADGM AML Rulebook, not Cabinet Resolution 134 of 2025 directly
- The Ministry of Justice’s 2026 circulars do not apply directly, but equivalent obligations exist under the DFSA and FSRA frameworks
- goAML registration obligations apply to all DNFBP activities within DIFC and ADGM require goAML portal registration
A law firm with practices in both mainland UAE and DIFC must comply with both regimes simultaneously.
What Does the Ministry of Justice Check During AML Inspections of Law Firms?
Ministry of Justice AML inspections of law firms in UAE assess both documentation and operational effectiveness. Based on the MoJ’s inspection methodology under Ministerial Resolution No. 248 of 2025, here is what inspectors specifically examine during AML compliance law firms UAE inspections:
AML policy and procedures document: Is it present, tailored to the firm’s specific practice, signed by senior management, and updated for Federal Decree-Law No. 10 of 2025? Has it been updated as required by Circular No. 1 of 2026 following relevant risk factor changes?
Institutional risk assessment: Does the firm have a documented business-wide risk assessment? Has it been periodically reviewed and updated as required by Circular No. 3 of 2026? Is it specific to the firm’s practice areas and client base, not a generic template?
goAML registration: Is the firm registered on the goAML portal with accurate, current details? Does the firm have an active MLRO designated and registered on the portal?
CDD and EDD client files: A sample of client files is reviewed to assess whether identity verification, UBO documentation, risk categorisation, and ongoing monitoring have been conducted correctly and consistently.
STR filing history: Does the firm’s STR filing history reflect genuine, active monitoring of transactions? Law firms in high-risk practice areas, such as real estate, company formations, and trust structures that have never filed a single STR, attract significant scrutiny.
Sanctions screening records: Is the firm conducting TFS screening as required by Circular No. 4 of 2026? Is screening applied at onboarding and ongoing? Are match investigations and outcomes documented?
Country risk compliance: Has the firm updated its country risk model following the FATF grey list changes in 2026 (Circular No. 2)? For firms with clients connected to Kuwait, Iraq, or other newly listed jurisdictions, have customer risk ratings been reviewed?
AML training records: Are training records present for all relevant staff? Has training been updated to cover the new 2025 law and 2026 circulars?
MLRO documentation: Is the MLRO formally appointed with documented authority, role description, and independence? Has the firm complied with Notice No. 2471 of 2026 on the joint MLRO guidance?
How to Build an AML Programme for Your UAE Law Firm in 2026
Here is the complete step-by-step guide for building an AML programme for a UAE law firm that meets Ministry of Justice requirements under all four 2026 circulars:
Step 1: Determine whether your practice triggers AML obligations
Confirm which of your practice areas involve specified activities: real estate transactions, company formations, client fund management, or trust structures. If any do, you are a regulated DNFBP with full AML/CFT/CPF obligations. If uncertain, seek a classification opinion from a qualified AML compliance consultant.
Step 2: Register on the goAML portal
Complete goAML registration for your law firm on the Financial Intelligence Unit UAE’s platform. Designate your MLRO and register their details on the portal. Ensure registration details are current and accurate.
Step 3: Appoint your MLRO
Formally appoint a qualified Money Laundering Reporting Officer with documented authority, independence, and competence. Comply with Notice No. 2471 of 2026 on the joint guidance for the MLRO function. Ensure the MLRO has an adequate mandate and resources to fulfil the role.
Step 4: Conduct your institutional risk assessment (Circular No. 3)
Conduct a formal, documented AML/CFT/CPF risk assessment covering your firm’s specific practice areas, client types, transaction types, and geographic exposure. Document the methodology, risk ratings, and findings. Establish a review schedule and trigger criteria as required by Circular No. 3 of 2026.
Step 5: Draft your AML policy and procedures (Circular No. 1)
Develop a written AML policy tailored to your law firm’s specific practice covering CDD and EDD procedures, UBO identification, STR filing processes, TFS screening, record retention, MLRO responsibilities, and the dynamic update obligation under Circular No. 1 of 2026.
Step 6: Implement CDD and EDD procedures
Put CDD processes into operation for all new client engagements involving specified activities. Conduct retrospective CDD reviews for existing clients in higher-risk categories. Establish EDD trigger criteria and procedures for PEPs, high-risk jurisdiction clients, and complex transactions.
Step 7: Integrate TFS screening (Circular No. 4)
Implement sanctions screening for all clients, counterparties, and beneficial owners against UAE, UN Security Council, and other applicable lists at onboarding and on an ongoing basis. Document screening outcomes and establish a process for responding to matches.
Step 8: Update country risk model (Circular No. 2)
Update your country risk model for the 2026 FATF grey list changes, including Kuwait (February 2026), Iraq and Bosnia and Herzegovina (June 2026), and the removal of Algeria and Namibia. Review client risk ratings for all clients with connections to affected jurisdictions.
Step 9: Deliver AML training to all relevant staff
Train all fee earners, paralegals, and administrative staff with client-facing or transaction-handling responsibilities on their AML obligations, including legal professional-specific red flags, the STR filing obligation, and the tipping-off prohibition. Document all training with attendance records.
Step 10: Book an independent AML health check
Before your first Ministry of Justice inspection or as part of your regular compliance cycle, commission an independent AML/CFT health check to verify your programme is complete, current, and inspection-ready. For guidance on what to expect during an MoJ inspection, see our AML Inspection UAE 2026 guide.
What Are the Penalties for Law Firms That Fail AML Compliance in UAE?
The penalties for AML non-compliance for law firms UAE 2026 under Federal Decree-Law No. 10 of 2025 and Article 17 are significant and apply at both the firm level and the individual partner or MLRO level.
Administrative fines: Range from AED 10,000 to AED 5,000,000 per violation. The minimum was lowered from AED 50,000 under the previous 2018 regime, meaning even minor violations now carry a financial penalty. Multiple violations identified in a single inspection carry cumulative fines.
Licence suspension or cancellation: The Ministry of Justice has the power to suspend or cancel a law firm’s licence for persistent or severe non-compliance, an existential consequence for any legal practice.
Personal liability for partners and the MLRO: Under Article 27(5) of Federal Decree-Law No. 10 of 2025, individual partners, managing partners, and MLROs face personal criminal prosecution, including imprisonment and personal fines, where they were aware of compliance failures and those failures resulted from their breach of duty. The June 2026 CBUAE enforcement action, where a compliance officer was personally fined AED 300,000, demonstrates that individual accountability is actively enforced. For the full picture of personal liability risk, see our AML Personal Liability UAE 2026 guide.
Reputational damage: The Ministry of Justice publishes enforcement actions. A named enforcement action against a law firm carries severe reputational consequences in a sector where client trust is central to practice viability.
How AMLUAE Helps UAE Law Firms and Legal Consultants with AML Compliance
AML compliance law firms UAE 2026 is a specialist compliance challenge, and AMLUAE is a specialist AML compliance consultancy. We understand the specific obligations of the UAE legal profession under all four 2026 Ministry of Justice circulars, Ministerial Resolution No. 248 of 2025, Notice No. 2471 of 2026, Federal Decree-Law No. 10 of 2025, and Cabinet Resolution 134 of 2025.
Our services for UAE law firms and legal consultants include:
AML/CFT Health Check: An independent diagnostic review of your law firm’s current AML framework against all four 2026 MoJ circulars and Ministry of Justice inspection standards. Identifies every gap before an inspector does.
AML/CFT Policy & Documentation: Fully customised AML/CFT/CPF policy and procedures for your law firm tailored to your specific practice areas, client base, and the obligations of Circular No. 1 of 2026. Includes the dynamic update framework required by the circular.
AML/CFT Risk Assessment Report: A formal institutional risk assessment as required by Circular No. 3 of 2026, documented, periodically reviewed, and updated for the 2026 FATF grey list changes under Circular No. 2.
In-House AML Compliance Setup: End-to-end AML programme build for your law firm, goAML registration, MLRO appointment per Notice No. 2471 of 2026, CDD and EDD frameworks, TFS screening per Circular No. 4, country risk model update per Circular No. 2, and full documentation.
AML Training Program: Role-based AML training for lawyers, legal consultants, paralegals, and administrative staff covering all four 2026 MoJ circulars, red flags specific to the legal profession, the STR filing obligation, and the tipping-off prohibition. Fully documented with attendance records.
Regulatory Reporting Services: End-to-end management of your STR and SAR filing obligations through the goAML portal, ensuring your reporting history demonstrates active, quality engagement with the FIU.
AML Software: Automated TFS screening, CDD verification, and ongoing monitoring tools configured for legal profession workflows, meeting the real-time screening standard required by Circular No. 4 of 2026.
We serve law firms, legal consultancies, and notaries across Dubai, Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, and all UAE free zones including DIFC and ADGM.
Whether you are building your law firm’s AML programme from scratch, updating it for all four 2026 MoJ circulars, or preparing for a Ministry of Justice inspection, AMLUAE has the service that fits exactly where you are.
