AML Regulations UAE 2026: Is Your Dubai Business Ready?

The AML Regulations In The UAE almost certainly apply to anyone who is involved in selling property, forming companies, trading in gold or diamonds, or offering legal or accounting advice in the UAE. The rulebook has been updated in late 2025, and there are still some guides on the internet that refer to the old rulebook. In this article, you will get an idea of where you are and what you need to do next, step by step. 

What Are the AML Regulations in the UAE?

The UAE’s anti-money laundering framework is built on Federal Decree-Law No. 10 of 2025, which took effect on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its executive regulations, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025 and replaced Cabinet Decision No. 10 of 2019.

If you are still working from the 2018 law and the 2019 decision, your policy is out of date. Here is the current stack:

What changed in 2025 that you should care about?

• The law now expressly covers proliferation financing, not only money laundering and terrorist financing.
• Commercial gaming operators were added as a DNFBP category.
• Personal accountability now attaches to the compliance officer, not just the company.
• The FIU can suspend transactions for up to 10 working days without prior notice.
• Companies can face fines of up to AED 10 million if representatives, managers, or agents commit offenses under the law.

The direction is consistent with FATF expectations and the UAE’s push for financial transparency. For you, it means supervisors will judge your program on evidence, not intentions.

Who Needs AML Registration in the UAE? (DNFBP Checklist)

All UAE businesses and professionals classified as DNFBP (Designated Non-Financial Business or Profession) pursuant to Article 3 of Cabinet Resolution No. 134 of 2025 are required to register on goAML and implement the AML program. There are six categories defined in the regulation. Tick those that apply to you: 

• Real estate brokers and agents acting in buying or selling property for clients
• Dealers in precious metals and stones (gold, jewelry, and diamonds) transacting in cash above the reporting threshold
• Lawyers, notaries, and independent legal professionals when preparing or carrying out certain transactions for clients (property, managing client assets, creating or running legal entities)
• Independent accountants and auditors performing covered services
• Corporate service providers that form companies, supply a registered office, or act as nominee directors or shareholders
• Commercial gaming operators (new in the 2025 regulations)

Where do you register and who supervises you? For most of these categories, the Ministry of Economy and Tourism (MoET) is the DNFBP supervisor, and lawyers and notaries fall under the Ministry of Justice. Your emirate’s licensing authority, such as Dubai Economy and Tourism or the Sharjah Economic Development Department, issues your trade license and is usually involved in UBO filings. Free zone companies are not exempt: the federal law applies UAE-wide. Firms licensed inside DIFC or ADGM also answer to their own financial regulators.

Not sure whether you qualify? Ask three questions. Do I help clients buy, sell, form, or manage something of value? Do I handle or advise on client money, property, or companies? Does my license activity match a category above? If you answer yes to any, get a formal applicability check before assuming you are exempt.

The 4-Pillar AML Readiness Framework: Assess → Appoint → Register → Report

The fastest way to become compliant is to treat AML as four connected pillars, built in order. This is the same sequence ModSolutions follows with real estate, legal, and corporate-service clients.

Pillar 1: Assess (business risk assessment and AML policy)

Start by documenting how criminals could misuse your business. Cover your customers, products or services, delivery channels, countries involved, and payment methods. The output is a written business risk assessment and an AML/CFT compliance program (your AML Policy) built on it.

A policy that holds up under inspection typically contains:

• Customer due diligence (CDD) and enhanced due diligence (EDD) procedures
• Beneficial owner identification and verification
• Sanctions and PEP screening steps
• Transaction monitoring and red-flag indicators for your sector
• Suspicious transaction reporting escalation
• Record-keeping rules, training plan, and independent audit plan

A generic template downloaded from the internet will not pass here. Supervisors expect the policy to reflect your actual client types and workflows.

Pillar 2: Appoint (compliance officer / MLRO)

The program needs to be run by a compliance officer (usually known as the MLRO in practice) who can be of the same stature, independence, and availability in the UAE. Be prepared to record the appointment, their task and their first point of contact with senior management.

Handing this responsibility to a junior who can't challenge the owner simply isn't a good idea, since accountability will now be personal. If you're thinking of outsourcing, check with your supervisor if it's okay for your category before you do. 

Pillar 3: Register (UBO register and goAML)

This pillar has two parts:

• UBO registration: Record your ultimate beneficial owners with your licensing authority’s register under the UBO framework (Cabinet Resolution No. 109 of 2023), and keep it current. Changes must be notified within a short statutory window, so build a trigger into your corporate-change workflow.
• goAML registration: Register your entity and compliance officer on goAML, the UAE FIU’s reporting platform. Registration typically follows supervisor approval, and banks increasingly treat a missing goAML registration as a red flag.

Pillar 4: Report (FIU reporting, training, and audit)

Registration is the start, not the finish. Ongoing duties include:

• Filing suspicious transaction/activity reports (STR/SAR) through goAML when you have reasonable grounds to suspect proceeds of crime or terrorist financing
• Filing sector-specific cash or transaction reports where your supervisor requires them (for example, dealers in precious metals and stones and real estate transactions above the cash thresholds set in MoET circulars; confirm the current threshold for your sector)
• Staff AML training, including new joiners
• Independent audit or review of the program
• Keeping records so you can reconstruct any transaction on request

This is the most important piece of bad advice we've received from the Expert Insight team at ModSolutions: Don't miss a policy. It's a policy no one observes. Brokers have the duty to pick up passports, but they never note the source of the money. Corporate-service clients do not trace the UBO when taking on offshore shareholders. Registration is done, then the file goes silent until a supervisor/bank demands proof. Practice first: one CDD file per client (before the transaction) every time. 

Is Your Business Ready? A 10-Question Self-Check

Answer yes or no. Each ‘no' is an opportunity to fill in.

1. I have verified in writing that I am a DNFBP and familiar with my supervisor.
2. Does my business have a documented and dated risk assessment that is no more than 12 months old?
3. Is my AML policy based on the 2025 law and Cabinet Resolution 134 of 2025, and not the 2018 and 2019 instruments?
4. Is there a compliance officer that I have designated with clear authority?
5. Do I have any entity registered on goAML, and is the date shown?
6. Have my beneficial owners been registered and kept in the UBO register up to date?
7. Do I run a customer check against a sanctions list before setting up a customer?
8. Are there ID, ownership information, and source of funds in all client files?
9. Are my staff familiar with red flags and who to report to?
10. May I provide evidence of training and my last audit/review?

If 7 or more responses are “no,” you should consider remediation to be urgent. Three to six indicates having a foundation, but with some evidence gaps. Two or less than two means that you are concerned with keeping the proof. 

AML Compliance Roadmap: From Day 1 to Ongoing Audits

The timelines below are ModSolutions planning estimates for a typical small or mid-sized DNFBP with its documents ready. Approvals by your supervisor or licensing authority are outside any consultant’s control.

What Happens If You Do Not Comply? AML Fines and Penalties in the UAE

Non-compliance can bring administrative fines, criminal liability, license consequences, and banking problems. Here is what the public sources show:

The Ministry has used its fining power. It has publicly announced fines on DNFBP companies for breaching AML legislation, issued under the earlier regulation and the unified violations list. Note that penalty schedules may be updated under the new framework, so confirm the current list with your supervisor or adviser before budgeting for risk.

DIY AML Compliance vs. Hiring a Consultant

You can build your own program. Many small firms try. This table shows what you are trading off:

A consultant does not transfer your legal liability. What you buy is accuracy, speed, and a defensible paper trail.

How Often Do You Renew, Review, and Audit?

There is no single “AML renewal” date, but there is a rhythm of obligations:

• goAML registration: One-time registration, followed by continuous reporting duties. Keep your entity and compliance officer details current.
• Business risk assessment: Review at least annually and whenever your business model, clients,, or services change materially.
• Training: Run it for all relevant staff on a regular cycle (annual is the common standard) and for new joiners promptly after hire.
• Independent audit or review: Supervisors expect periodic independent testing of the program; annual is a sensible default unless your supervisor specifies otherwise.
• UBO register: Update when ownership or control changes, within the statutory window.
• Late registration: If you missed your original deadline, register now. Delay does not reduce exposure, and unresolved gaps can attract administrative penalties.

One common myth: there is no government-issued "Anti-Money Laundering Certificate” that a business receives and renews. People use the phrase for goAML registration confirmation, a compliance officer’s professional qualification, or an AML training certificate. Ask exactly which document the requesting party needs.

AML Compliance in Dubai and Sharjah: What Is Different?

The law is federal, so your core obligations are the same in Dubai, Sharjah, and every other emirate. What changes is practical execution:

• Licensing authority: Dubai mainland businesses deal with Dubai Economy and Tourism; Sharjah mainland businesses deal with the Sharjah Economic Development Department. Free zone companies deal with their free zone authority.
• UBO filings: Submitted through the relevant licensing authority’s process.
• Inspections and queries: Can arrive from the federal supervisor, your licensing authority, or your bank.
• Sector concentration: Dubai’s deal flow in real estate and precious metals tends to attract close attention; Sharjah firms in trading, services, and property face the same federal standard.

If you operate in both emirates, run one group-wide program and tailor the local filing steps.

How ModSolutions Delivers AML Compliance

We follow the same 4-pillar process on every engagement so you know what you are getting:

1. Applicability and gap review: We confirm your DNFBP status, supervisor and existing documents.
2. Risk assessment and AML/CFT policy: Written documents tailored to your business, not a recycled template.
3. Compliance officer support: Appointment documentation and guidance on duties; discussion of arrangements that suit your size and category.
4. UBO and goAML setup: Preparation and submission support, plus a registration log for your records.
5. Training and file remediation: Staff sessions and a CDD file checklist you can use daily.
6. Ongoing monitoring support: Review calendar, update alerts, and audit preparation.

What we do not promise: instant approvals, guaranteed outcomes with regulators, or removal of your legal responsibility. We give you clear deliverables, realistic timelines, and documents you can show an inspector.

Frequently Asked Questions

What is the rule on AML in the UAE?

In coordination with Cabinet Resolution No. 134 of 2025, as the Executive Regulations of the core law, Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing, and proliferation financing. They superseded the provisions of the 2018 law and the 2019 Cabinet Decision.

Who should register for AML in the UAE?

Any DNFBP under Article 3 of Cabinet Resolution No. 134 of 2025, which includes real estate broker/agents, dealers in precious metals and stones, lawyers and notaries, independent accountants and auditors, commercial gaming operators, and corporate service providers. There are other responsibilities for financial institutions. 

Do compliance officers (MLROs) have to be mandatory?

Yes. DNFBPs are required to designate a compliance officer who has appropriate expertise, independence, and access to senior management. The 2025 framework makes it both the company and the individual that is held accountable. 

What is goAML, and do I have to register?

goAML is the UAE Financial Intelligence Unit’s platform for filing suspicious transaction and activity reports. Covered businesses must register and use it to report.

What are the fines for not complying with UAE AML rules?

Administrative fines for DNFBPs in the published list of violations can be as high as AED 1,000,000 per violation and a total of AED 5,000,000. Fines ranging up to AED 10 million are also applicable for the company, and criminal fines are applicable. Please refer to the current schedules with your supervisor. 

Do free zone companies need AML compliance?

Yes, if they carry out a DNFBP or financial activity. The federal AML Laws applies across the UAE, including free zones. DIFC and ADGM firms also follow their own regulators’ rules.

Do I need an AML policy if I am a small business?

If you are a DNFBP, yes. The policy should be proportionate to your size and risk, but it must exist, be approved by management, and be followed.

How long does AML compliance setup take?

For a typical small or mid-sized business with documents ready, ModSolutions plans for roughly four to six weeks from kickoff to a working program, with registrations dependent on authority approval times.

Book Your Free AML Consultation

Do not wait for a supervisor’s letter or a bank query to find out where you stand. Book a free consultation with ModSolutions and get a clear view of your obligations, gaps, and next steps.

Book Free Consultation | WhatsApp ModSolutions | Call

Disclaimer: This article is for general information only and is not legal advice. AML requirements depend on your activity, license type, and supervisor, and regulations change. Verify current obligations with the relevant authority or a qualified adviser before acting