Understanding UAE AML/CFT Compliance: A Practical Guide for DNFBP Business Owners

The United Arab Emirates has built one of the most robust anti-money laundering and counter-terrorist financing frameworks in the region. Following the country's removal from the FATF grey list in February 2024 and the European Union's high-risk list in 2025, the UAE's reputation as a trusted global business hub depends on every regulated business doing its part. With the FATF's next mutual evaluation scheduled for 2026, regulators are not relaxing their oversight - they are intensifying it.

If you own or manage a real estate brokerage, a gold or jewellery shop, an audit or accounting firm, a law office, or a corporate service provider, this article explains what the UAE AML/CFT law requires of you, and the steps you must take to stay fully compliant.

A Brief Look at the UAE AML/CFT Law

The cornerstone legislation has recently been modernised. Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025, replaced the earlier Federal Decree-Law No. 20 of 2018 and now governs the prevention of money laundering, the financing of terrorism, and the financing of arms proliferation. It is supported by Cabinet Resolution No. 134 of 2025 (the Executive Regulations, effective 14 December 2025) and Cabinet Resolution No. 71 of 2024 (the unified schedule of administrative fines).

Together, these laws place clear obligations on financial institutions and on what the law calls Designated Non-Financial Businesses and Professions, or DNFBPs. The Ministry of Economy and Tourism (MoET) is the supervisory authority for most DNFBP categories, while the Ministry of Justice supervises lawyers and notaries, and the UAE Financial Intelligence Unit (UAEFIU) receives all suspicious activity reports through its goAML portal.

Which Businesses Are Considered DNFBPs?

Under Article 3 of Cabinet Resolution No. 134 of 2025, the following businesses fall within the DNFBP definition and must comply with the AML/CFT framework:

Real estate brokers and agents are covered whenever they conclude a property purchase or sale transaction on behalf of a client. There is no minimum threshold - every brokered transaction triggers compliance obligations. This is the sector under heaviest regulatory scrutiny today, and it is a common misconception among smaller real estate companies that a single-owner LLC operating quietly is somehow exempt. It is not.

Dealers in Precious Metals and Stones (DPMS) - including gold traders, jewellery shops, diamond dealers and refineries - are covered when they conduct any single cash transaction, or linked series of transactions, equal to or greater than AED 55,000.

Auditors and independent accountants are covered when they prepare or carry out transactions on behalf of clients involving the buying or selling of real estate, the management of client money or accounts, the organisation of contributions for company creation, or the establishment, operation or management of legal persons or arrangements.

Lawyers, notaries and other independent legal professionals fall within scope when carrying out the same categories of activity on behalf of clients. Importantly, these professionals are supervised by the Ministry of Justice rather than MoET.

Corporate service providers and trust service providers (TCSPs) are covered when they act as company formation agents, provide registered office services, act as nominee directors, secretaries or shareholders, or serve as trustees of express trusts.

Commercial gaming operators were added as a new DNFBP category in 2025 and are supervised by the General Commercial Gaming Regulatory Authority.

If your business falls into any of these categories, the law applies to you regardless of your size, the number of employees you have, or whether you operate from a free zone, mainland, or single office.

What You Must Do to Achieve Full Compliance

Compliance is not a one-time exercise. It is an ongoing programme built around eight core obligations.

1. Register on the goAML portal. Every DNFBP must register on the UAEFIU's goAML reporting system as well as the Automatic Reporting System for Sanctions Lists (SACM). Operating without registration is itself a violation. New companies should register immediately upon receiving their trade licence.

2. Appoint a Compliance Officer (MLRO). You must designate a qualified, sufficiently senior person to take responsibility for your AML programme, file reports with the FIU, and serve as the contact point with regulators. In smaller firms, the owner may appoint themselves or a trusted manager, but the role must be formally documented.

3. Conduct a Business Risk Assessment. You must carry out a written assessment of the money laundering and terrorism financing risks your business is exposed to - considering your customer types, geographic exposure, products and services, delivery channels, and transaction patterns. This assessment must be aligned with the UAE's National Risk Assessment and reviewed at least annually.

4. Implement written policies and procedures. Your AML/CFT manual must reflect the current law (Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025). Policies citing the old 2018 law are now non-compliant on their face.

5. Perform Customer Due Diligence (CDD). CDD must be carried out before establishing any business relationship, before conducting an occasional transaction at or above AED 55,000, whenever there is suspicion of money laundering or terrorism financing, and whenever there is doubt about previously obtained customer information. CDD requires you to identify the customer, verify their identity from a reliable source, identify the beneficial owner (any natural person owning 25% or more, or exercising ultimate control), understand the purpose of the relationship, and monitor the relationship on an ongoing basis.

6. Apply Enhanced Due Diligence (EDD) in higher-risk situations. EDD is mandatory for Politically Exposed Persons and their family members, customers from high-risk jurisdictions, complex or unusually large transactions without clear economic purpose, and non-face-to-face onboarding. EDD requires senior management approval, additional verification of source of funds and source of wealth, and more frequent monitoring.

7. File Suspicious Transaction Reports without delay. Whenever you have reasonable grounds to suspect that funds or a transaction are linked to a crime, you must file a report through goAML. There is no minimum threshold for an STR. The legal standard is "without delay" - meaning as soon as suspicion is reasonably formed. Real estate brokers must additionally file a Real Estate Activity Report (REAR) for any property transaction involving cash payments of AED 55,000 or more, or any use of virtual assets, under MoET Circular 05/2022. DPMS must file a Dealers in Precious Metals and Stones Report (DPMSR) for cash transactions of AED 55,000 or more. The law also strictly prohibits "tipping off" - informing the customer or any third party that a report has been filed.

8. Maintain records and train staff. All customer files, transaction records, and reports must be retained for at least five years. Every staff member must receive AML/CFT training at onboarding and at least annually thereafter, with documented attendance.

The Cost of Non-Compliance: Heavy Penalties

This is the section every DNFBP owner needs to read carefully. The Ministry of Economy and Tourism has dramatically scaled up enforcement. In the first half of 2025 alone, MoET imposed fines exceeding AED 42 million on more than 1,000 DNFBPs - including AED 18.5 million on real estate brokerages and AED 20 million on precious metals dealers. In 2024, the Ministry suspended the licences of 32 gold refineries for AML violations.

Under Cabinet Resolution No. 71 of 2024, administrative fines for individual violations range from AED 50,000 to AED 1,000,000, and these amounts are doubled for repeat offences. Criminal penalties under the new 2025 law are far more severe: companies convicted of money laundering can be fined between AED 5 million and AED 100 million, managers can face personal criminal liability and imprisonment, and licences can be suspended or revoked entirely.

A common - and dangerous - assumption among smaller businesses is that regulators only target large institutions. The opposite is true. Inspectors look first for the basic deficiencies most often found in smaller firms: no goAML registration, no appointed compliance officer, no written policy, no risk assessment, no customer files, and no staff training. These are the easiest violations to detect and the quickest to penalise.

Move From Risk to Confidence - Speak With BWMC

AML/CFT compliance is not a box-ticking exercise; it is a regulatory expectation, a reputational safeguard, and a legal duty. For most DNFBP owners, the challenge is not unwillingness to comply, but knowing where to begin and how to do it correctly without disrupting day-to-day business.

At BWMC, we help real estate brokerages, gold and jewellery dealers, auditors, accountants, lawyers and corporate service providers across the UAE achieve full AML/CFT compliance - from goAML registration and risk assessments to writing policies, training your team and preparing you for MoET inspections.

Book a free consultation with BWMC today. Visit www.bwmc.ae or contact our compliance team to schedule a confidential discussion. Let us help you protect your business, your licence and your reputation - before a regulator's letter arrives at your door.