AML Policy UAE: Protect Your Business in Dubai & Sharjah
Introduction
What Is an AML Policy in the UAE, and Why Does It Matter Now?
An AML policy is the written risk assessment procedure that your business uses to identify, assess, and report the money laundering and terrorist financing risks and practices, such as customer due diligence, screening, recordkeeping, and suspicious transaction reports. It's not best practice in the UAE to not have a license; it's a legal requirement, and if you do not have one, then you may be subject to suspension of your license according to Federal Law.
There was a significant shift in the stakes in October and December 2025. The UAE replaced Federal Decree-Law No. 20 of 2018 (as amended by Federal Decree-Law No. 7 of 2024) with Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, effective 14 October 2025. It supersedes the previous Cabinet Decision No. 10 of 2019 (with an amendment issued in 2022) with effect from 14 December 2025.
If your compliance documents, consultant proposals, or even your internal trainings still refer to "Cabinet Decision 10 of 2019" or "Decree-Law 20 of 2018" as the current "law," you are already behind the times. This new framework extends the range of covered activities, includes proliferation finance in the mandate, and increases the caps on penalties—the perfect timing to revisit or create a new AML policy.
Expert Insight — ModSolutions Compliance Team: "With each new client, we do a gap assessment to make sure they're compliant with the current law, not the one they last implemented their policy with. The first thing we do with every new client we get is the gap assessment to see if they're compliant with the current law. The definitions have changed and added a new dimension of proliferation financing, and some expectations in supervision have changed. The policy that was written eighteen months ago for the previous law, probably, may not stand against the most recent law.
Who Needs AML Registration in the UAE? (DNFBP Checklist)
Most compliance blogs mention "banks and real estate" and stop there. In reality, the UAE's Designated Non-Financial Businesses and Professions (DNFBP) net is wider—and two categories carry specific cash thresholds most businesses don't know about.
Under Article 3 of Cabinet Resolution No. 134 of 2025, you are likely a DNFBP—and need an AML policy, goAML registration, and an MLRO—if you are any of the following:
- Real estate brokers and agents concluding transactions or settlements on behalf of customers for the purchase or sale of property (pure residential leasing generally sits outside this unless your supervisory authority extends it to you)
- Dealers in precious metals and stones (including jewellers) handling single or linked cash transactions of AED 55,000 or more
- Lawyers, notaries, independent legal professionals, and independent accountants, when preparing or executing specified financial transactions for clients (property purchase/sale, managing client funds or accounts, forming or managing companies)
- Company and trust service providers—acting as agent for incorporation, serving as directors/secretaries/nominees, or providing registered office and related corporate services
- Commercial gaming operators, at single or linked financial transactions of AED 11,000 or more
- Any other activity a Supervisory Authority designates by resolution under Article 3(6)
In addition, under the broader AML/CFT framework (as financial institutions and not DNFBPs): Banks, finance companies, insurance and reinsurance companies, exchange houses, hawala providers, and virtual asset service providers (VASPs) are all supervised by the central bank or VARA and with sector-specific obligations.
If you invoice clients for real estate transactions, hold client money, register companies, deal in gold/diamonds above the threshold, or provide legal/accounting services in connection with the above transactions, you are in scope until told otherwise by the supervisory authority.
Who supervises you:
| Sector | Supervisory Authority |
| Real estate, precious metals, accountants/auditors, corporate service providers | Ministry of Economy & Tourism (MoET) |
| Lawyers and notaries | Ministry of Justice (MoJ) |
| Commercial gaming | General Commercial Gaming Regulatory Authority (GCGRA) |
| DIFC-registered entities | Dubai Financial Services Authority (DFSA) |
| ADGM-registered entities | Financial Services Regulatory Authority (FSRA) |
| Mainland/free zone banks, exchange houses, finance companies | UAE Central Bank |
The 4-Pillar AML Readiness Framework
Rather than a vague checklist, ModSolutions structures every AML/CFT Compliance Programme In The UAE through a repeatable methodology—four pillars that map directly to what regulators and inspectors look for.
Pillar 1: Assess
Perform an AML/CFT risk assessment for the entire enterprise, involving customers, locations, products, and distribution methods. It is the foundation of the entire policy—it is expected that it will be referenced, not tossed in a drawer.
Pillar 2: Appoint
Appoint a Money Laundering Reporting Officer (MLRO), a senior member of staff within the UAE who is tasked with overseeing AML, training staff, and reporting suspicious transactions. The appointment of the MLRO should be recorded and formally reported to your supervisory authority if appropriate.
Pillar 3: Register
Complete your goAML registration with the UAE Financial Intelligence Unit (FIU)—a two-stage process (entity registration, then compliance officer registration)—plus registration on the Automatic Sanctions List Screening system for UN, local terrorist, and relevant international sanctions lists.
Pillar 4: Report
Operationalize ongoing customer due diligence (CDD/EDD), transaction monitoring, sanctions screening, and—where grounds for suspicion exist—Suspicious Transaction Reports (STRs) filed through goAML with no minimum value threshold. This pillar never closes; it's the audit trail that proves your policy is lived, not laminated.
Your AML Compliance Roadmap: From Day 1 to Ongoing Audits
| Stage | Timeline | What Happens |
| Day 1–3 | Initial scoping | Confirm DNFBP status and identify applicable thresholds and supervisory authority |
| Week 1 | Risk assessment | Business-wide AML/CFT risk assessment drafted and documented |
| Week 1–2 | Policy drafting | AML/CFT policy and procedures manual customised to your operations (CDD, EDD, record-keeping, escalation) |
| Week 2 | MLRO appointment | Compliance officer designated, documented, and trained |
| Week 2–3 | goAML & sanctions registration | Two-stage FIU registration completed; sanctions screening system enrolled |
| Week 3–4 | Staff training | Onboarding training for customer-facing staff; escalation procedures tested |
| Ongoing | Ongoing monitoring | Client screening at onboarding and periodically; STR filing as triggered |
| Annually | Policy review & audit | Risk assessment refreshed, policy updated for regulatory changes, internal audit/health check performed |
Most businesses reaching out to ModSolutions want to know one thing first: how fast can I be compliant? A realistic, properly documented program—not a copy-pasted template—takes three to four weeks from kickoff to full registration, with ongoing obligations running indefinitely after that.
DIY AML Compliance vs. Hiring a Consultant
| Factor | DIY Compliance | Hiring a Consultant (ModSolutions) |
| Regulatory accuracy | Risk of relying on outdated templates (pre-2025 law) | Policy built against current Federal Decree-Law No. 10 of 2025 |
| Time to compliance | Weeks to months, often longer with internal back-and-forth | Typically 3–4 weeks, managed end-to-end |
| goAML registration | Self-navigated; common source of rejected/incomplete submissions | Handled directly, including compliance officer registration |
| MLRO capability | Must recruit, train, and retain in-house | Advisory support and training provided; MLRO-as-a-service available |
| Inspection readiness | A policy may exist "on paper" without operational evidence | Built with audit trail, training records, and screening logs from day one |
| Ongoing cost | Staff time + risk of fines from gaps | Predictable advisory fee, scoped upfront |
| Risk exposure | Higher—most fines stem from missing registration or an unused policy | Lower—active monitoring and annual review built in |
This is not necessarily a "bad" approach and can be done in-house if the compliance team is well-resourced. The real issue is, do you have somebody who can take ownership of the MLRO role and ensure they are up-to-date with any changes to regulations, such as the 2025 overhaul, and be able to evidence that during inspection? That's where a dedicated advisor fills the real estate, legal, and corporate structuring needs for most SMEs fastest.
AML Non-Compliance Penalties in the UAE (2026)
Penalties escalated meaningfully under the 2025 law. The table below summarizes publicly reported penalty ranges—always confirm current figures for your specific violation with legal counsel, as amounts vary by breach type and supervisory authority.
| Violation | Approximate Penalty Range |
| Operating a DNFBP activity without a license/registration | AED 200,000 – AED 10,000,000, plus possible imprisonment (Art. 32, FDL 10/2025) |
| No goAML registration | From AED 50,000 |
| No UBO filing / late update | From AED 15,000 |
| No documented AML/CFT policy | Around AED 200,000 |
| Failure to file a required STR | AED 500,000+ |
| General administrative violations (per violation) | AED 10,000 – AED 5,000,000 (Art. 17, FDL 10/2025) |
| Violations by legal persons (upper ceiling) | Up to AED 100,000,000 in aggravated cases |
Two additional points worth knowing: the UAE applies no statute of limitations to money laundering offenses, so historical gaps remain prosecutable even after the 2025 law came into force. And UBO records must be filed annually, with updates required within 15 days of any change in beneficial ownership.
Why the UAE Tightened AML Rules: 2026 Regulatory Context
The UAE's legal changes in 2025 continue the momentum and reforms that saw the country removed from the FATF grey list in February 2024. There are three trends this year that are important for every individual who is developing or updating an AML policy:
- Wider scope. Federal Decree-Law No. 10 of 2025 folds proliferation financing into the same framework as money laundering and terrorist financing, and inspection volumes across DNFBP sectors have continued to rise.
- Digital-first reporting. goAML remains the mandatory channel for STRs, SARs, and sector-specific filings (such as real estate activity reports), with narrative quality and timeliness now explicitly factored into supervisory action.
- Vision 2031 alignment. The UAE's push for financial transparency as part of its broader economic diversification agenda means AML compliance is increasingly treated as core business governance, not a back-office formality—a shift that's visible in how consistently DNFBP inspections are now being carried out across Dubai and Sharjah.
Frequently Asked Questions
Do all businesses in Dubai and Sharjah need an AML policy?
No—only regulated financial institutions and businesses meeting the DNFBP criteria (real estate brokers; precious metals dealers above AED 55,000; lawyers/accountants doing specified transactional work; corporate/trust service providers; and commercial gaming operators). Use the checklist above to confirm your status.
What is an MLRO and who can be appointed?
A money laundering reporting officer is the senior, UAE-based individual responsible for your AML program—risk assessments, staff training, and suspicious transaction decisions. Many smaller businesses use an outsourced or advisory MLRO arrangement rather than a full-time hire.
How long does goAML registration take?
Registration is a two-stage process (entity, then compliance officer) via the FIU's goAML platform. With documentation ready, most businesses complete both stages within one to two weeks.
How often should an AML policy be reviewed?
At minimum annually, and immediately after any material regulatory change — such as the October–December 2025 overhaul. Your risk assessment should also be refreshed whenever your customer base, products, or geographic exposure shifts materially.
What happens if I register late?
Late or missing goAML registration is one of the most commonly fined gaps, with penalties starting from AED 50,000 and rising sharply for repeat or aggravated cases. Operating without required licensing/registration can additionally trigger imprisonment exposure under Article 32 of the new law.
Is UBO registration the same as AML registration?
No. UBO (Ultimate Beneficial Owner) filing is a separate obligation—identifying and annually disclosing who ultimately owns or controls your company—but it's closely linked since AML (Anti-Money Laundering) due diligence requires you to know your own beneficial ownership as well as your customers'.
Can I use a generic AML policy template?
Generic templates are a common source of inspection failures because they're rarely updated for the current law or tailored to your actual risk profile, customer types, and transaction patterns. A policy needs to reflect how your business actually operates, not a boilerplate structure.
Does this apply UAE-wide or just to Dubai and Sharjah?
The AML/CFT law is federal and applies across all seven emirates plus financial free zones (DIFC and ADGM) under their own regulators. This guide focuses on Dubai and Sharjah because that's where ModSolutions' DNFBP and corporate-service clients are concentrated, but the underlying obligations are consistent nationwide.
Get Your AML Policy Right — Talk to ModSolutions
An AML policy that exists only on paper is one of the fastest ways to draw a fine in 2026. ModSolutions builds AML/CFT policies, MLRO support, and goAML registration around how your business actually operates—mapped to Federal Decree-Law No. 10 of 2025 from day one.
Book a Free Consultation with ModSolutions →WhatsApp ModSolutions for a same-day compliance check →
This article is for general informational purposes and reflects publicly available UAE regulatory sources as of August 2026. It does not constitute legal advice. Confirm specific obligations and current penalty amounts with a licensed legal advisor before acting