If your business touches real estate, legal services, accounting, corporate structuring, gold, or gaming in Dubai or Sharjah, UAE AML Regulations apply to you—regardless of your size. Get it wrong, and you're looking at fines running into the millions of dirhams, not a warning letter. This guide walks you through exactly who needs to register, how the process works, and what changed when the UAE overhauled its entire AML framework in late 2025.

What Are the UAE AML Regulations? (The Legal Framework, Corrected for 2026)

The UAE anti-money laundering regime is regulated by the Federal Decree-Law on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing (No. 10 of 2025), which entered into force on 14 October 2025, and the Executive Regulation (Cabinet Resolution No. 134 of 2025), which entered into force on 14 December 2025.

Most UAE compliance blogs are still misinformed about the current law because they refer to Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. They were both formally abolished towards the end of 2025. If the compliance program you're developing is using a consultant, template, or article based on the 2018 law, then you're using a framework that no longer exists. This is important because there are real substantive changes contained in the law as of 2025: 

• Proliferation financing (PF) is now a standalone criminal offense, not folded into general terrorism-financing provisions
• Virtual asset service providers (VASPs) are directly and explicitly regulated, with their own customer due diligence threshold
• Personal criminal liability now attaches to managers, directors, and MLROs individually, not just the corporate entity
• The evidentiary bar dropped—prosecutors only need to show a person "knew or should have known" funds were connected to criminal activity
• Tax evasion is now a predicate offense to money laundering
• The statute of limitations on AML crimes has been removed
• Corporate fines can now reach AED 100 million
• The Financial Intelligence Unit (FIU) gained expanded powers to freeze or suspend suspicious funds

Both instruments work alongside the UAE Central Bank's regulatory framework for licensed financial institutions and the FIU's goAML reporting platform, which remains the operational backbone for suspicious transaction reporting.

Bottom line: the legal obligation to run an AML program in the UAE hasn't changed — it's tighter than ever. What's changed is the specific law you need to be compliant against, the penalties for getting it wrong, and who now counts as regulated.

Who Needs AML Registration in the UAE? (DNFBP Checklist)

You need an AML Compliance Program if you fall into any of these categories under Article 3 of Cabinet Resolution No. 134 of 2025. This is the checklist most guides skip—go through it line by line:

Financial Institutions

• Banks and credit organizations
• Exchange houses and money transfer/remittance services
• Insurance companies and insurance brokers
• Investment and finance companies, fintech providers

Designated Non-Financial Businesses and Professions (DNFBPs) — six categories:

• Real estate brokers and agents involved in the sale or purchase of property
• Dealers in precious metals and stones, for cash transactions at or above AED 55,000
• Accountants and auditors
• Lawyers, notaries, and independent legal professionals (when preparing or executing transactions for clients involving property, company formation, or fund/asset management)
• Corporate service providers (company formation agents, registered agents, trust and company service providers)
• Commercial gaming operators, for transactions at or above AED 11,000—a category newly added under the 2025 framework

Virtual Asset Service Providers (VASPs)

• Crypto exchanges, custodial wallet providers, and token-issuance platforms, with the lowest customer due diligence threshold in the regime at AED 3,500

Eligible Non-Profit Organizations

• NPOs identified as vulnerable to terrorism-financing abuse are now brought within scope under the 2025 law

The supervision of DNFBPs is delegated based on the activity: the Ministry of Economy and Tourism (MoET) is responsible for the supervision of real estate, precious metal dealers, corporate service providers, and accountants/auditors, and the Ministry of Justice (MoJ) is responsible for the supervision of lawyers and notaries, while the General Commercial Gaming Regulatory Authority (GCGRA) is responsible for the supervision of gaming operators. Even though the federal AML obligation does not differ by emirate, businesses should also confirm if they are subject to further obligations with respect to AML reporting from Dubai Economy or the Sharjah Economic Development Department in Dubai and Sharjah, respectively. 

There's no size exemption. A solo legal consultant carries the same registration obligation as a 200-person law firm—the trigger is your activity, not your revenue or headcount.

The ModSolutions 4-Pillar AML Readiness Framework

We built this framework from what actually gets flagged during Ministry of Economy inspections, not from a generic compliance checklist. It's the same order we work through with real estate, legal, and corporate-service clients across Dubai and Sharjah.

Pillar 1: Assess

Conduct a documented, business-wide AML/CFT/PF risk assessment covering your clients, geographies, products, and delivery channels. Under the 2025 regulations, this assessment must explicitly address proliferation-financing risk, not just money laundering and terrorism financing—a step many older templates still miss.

Pillar 2: Appoint

Appoint a Money Laundering Reporting Officer (MLRO) who is a UAE resident, senior enough to act independently, and has direct access to your senior management. Draft and board-approve your AML policy, customer due diligence (CDD) procedures, and staff training plan.

Pillar 3: Register

Register your business and your MLRO on the goAML platform operated by the FIU. This is a standing obligation — you register whether or not you ever file a suspicious transaction report.

Pillar 4: Report

Run ongoing CDD and enhanced due diligence (EDD) for higher-risk clients; monitor transactions; and file suspicious transaction reports (STRs) through goAML whenever reasonable suspicion arises—there's no minimum transaction value that exempts you from reporting.

Step-by-Step AML Compliance Roadmap

Realistic end-to-end timeline for a first-time DNFBP registration: 3–5 weeks to reach a fully documented, goAML-registered position, assuming documents are ready and there are no ownership-structure complications.

MLRO Appointment in the UAE: What's Required

Your Money Laundering Reporting Officer is the single point of accountability for your AML program, and under the 2025 law, that accountability is personal — not just institutional. Requirements include:

• UAE residency, with sufficient seniority to act independently of day-to-day sales or operational pressure
• Direct reporting line and access to senior management or the board
• Registration on goAML as the designated Compliance Officer, using Emirates ID, passport, and visa
• Real authority to file STRs without needing sign-off from a commercial manager

A common mistake we see among Dubai real estate and corporate-service clients: appointing an MLRO on paper without giving them real authority or budget. Inspectors test for this specifically, and it's one of the fastest routes to an administrative fine.

UBO Registration & Beneficial Ownership Transparency

Every regulated entity must identify and verify the Ultimate Beneficial Owner (UBO) of its corporate clients — the natural person or persons who ultimately own or control the entity, even through layered ownership structures. The 2025 Executive Regulation added formal definitions for "nominee director" and "nominee shareholder" specifically to close gaps in UBO identification that were previously exploited to obscure ownership.

UBO records must be:

• Verified at onboarding, not assumed from a trade license
• Kept current, not filed once and forgotten
• Available on demand during a Ministry of Economy or FIU inspection

UBO identification failures remain one of the most commonly cited findings in DNFBP inspections, particularly for corporate service providers handling company formation.

goAML Registration: What You Need

goAML is the FIU's mandatory reporting platform, and registration applies to financial institutions, DNFBPs, VASPs, and eligible NPOs alike—there's no opt-out based on size. To register, have ready:

• A valid trade license listing partners/owners
• Passport, Emirates ID, and visa copy of the appointed MLRO
• A signed, stamped authorization letter on company letterhead naming the MLRO as Compliance Officer
• A UAE mobile number for two-factor authentication setup

Once registered, you file suspicious transaction reports directly through the portal whenever reasonable suspicion is triggered — you don't wait for certainty, and you don't wait for a minimum transaction size.

DIY AML Compliance vs. Hiring a Consultant

DIY is workable for very small, low-risk operations with time to invest in learning the current framework properly. For real estate, legal, corporate-service, and DNFBP businesses with any transaction volume, the fine exposure alone usually justifies expert setup.

UAE AML Fines & Penalties in 2026

The Ministry of Economy has publicly announced it has imposed more than AED 130 million in administrative fines on DNFBPs since the end of 2022, of which it reported that it had imposed approximately AED 42 million in the first half of 2023 alone, prior to the enforcement of the new law. Enforcement is not declining but is picking up pace ahead of the UAE's next round of mutual evaluations with the FATF/MENAFATF in 2026.

The above fine figures are based on legal commentary that has been published on Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. Penalties will vary depending on the article that is being contravened and the facts of each case—check current penalties with the primary legislation and/or licensed adviser before making compliance decisions. 

Why Dubai & Sharjah Businesses Are Under Increased Scrutiny in 2026

Three forces are converging on UAE businesses right now:

1. FATF mutual evaluation pressure. The UAE is preparing for its next round of FATF/MENAFATF review, and regulators typically tighten enforcement in the run-up to demonstrate a credible, functioning system—not just a law on paper.
2. Vision 2031 and financial transparency. The UAE's broader economic diversification agenda depends on being seen as a clean, transparent jurisdiction for foreign investment, which puts sustained pressure on DNFBP and real estate compliance specifically.
3. Digital-first goAML enforcement. Reporting is now fully digital and cross-referenced across supervisory authorities, which means gaps that used to go unnoticed—a dormant MLRO appointment or an unregistered corporate service provider—surface faster in inspections.

For Dubai's high-value real estate and corporate services sector and Sharjah's growing SME and trading base, this translates into real inspection risk, not theoretical exposure

💡 Expert Insight — ModSolutions Compliance Team

"The businesses that get flagged aren't usually the ones ignoring AML altogether — they're the ones who set up a program once, in 2019 or 2021, and never touched it again. We regularly see real estate brokerages and corporate service providers in Dubai still operating policy documents that reference the repealed 2018 law. Under the 2025 framework, that's not a minor paperwork gap—it's a live compliance failure waiting to be found in an inspection. The fix isn't complicated, but it does need to happen against the current law, not the old one."

How ModSolutions Helps You Stay Compliant

We work through the same four-pillar process outlined above with every client—no generic templates, no vague promises. What's included when you work with us:

• Documented AML/CFT/PF risk assessment specific to your sector and client base
• MLRO appointment support, including goAML portal registration
• AML policy, CDD/EDD procedures, and record-retention policy drafted to current 2025 law
• UBO identification and documentation
• Staff training sessions, role-based for client-facing and compliance staff
• Ongoing monitoring support and annual policy refresh

Ready to get compliant without the guesswork?

Book Free Consultation with the ModSolutions Compliance Team, or WhatsApp us directly—we'll tell you exactly where you stand under the current 2025 AML law before you spend a single dirham on setup.

FAQ Section (Schema-Ready)

Q1: What are the current UAE AML regulations in 2026? 

A: The core law is Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism, and Proliferation Financing, in force since 14 October 2025, supported by Cabinet Resolution No. 134 of 2025, in force since 14 December 2025. These replaced the previous 2018 law and 2019 executive regulation.

Q2: Who needs to register for AML compliance in the UAE? 

A: Financial institutions, six categories of DNFBPs (real estate brokers, precious metals dealers, accountants/auditors, lawyers/notaries, corporate service providers, and commercial gaming operators), virtual asset service providers, and eligible non-profit organizations must all register and maintain an AML program, regardless of business size.

Q3: What is goAML and do I have to register even if I never file a report? 

A: goAML is the UAE Financial Intelligence Unit's mandatory reporting platform. Registration is a standing legal requirement for all regulated entities, independent of whether you ever file a suspicious transaction report.

Q4: Who can be an MLRO in the UAE? 

A: A UAE-resident individual with sufficient seniority to act independently, direct access to senior management, and real authority to file suspicious transaction reports without commercial sign-off. Under the 2025 law, MLROs carry personal accountability alongside the company.

Q5: What are the penalties for AML non-compliance in the UAE? 

A: Penalties range from administrative fines (commonly AED 10,000 to AED 5,000,000 per violation) to criminal penalties for unlicensed activity (AED 200,000 to AED 10,000,000 plus imprisonment) and, for principal money laundering offenses by legal entities, fines up to AED 100,000,000.

Q6: How often do I need to update my AML compliance program? 

A: Risk assessments and policies should be reviewed at least annually and immediately after any material change in your business activity, ownership structure, or client base. Internal audits are generally recommended every 6–12 months.

Q7: Do free zone companies in Dubai and Sharjah need AML compliance too? 

A: Yes. The federal AML obligation applies regardless of whether you're licensed on the mainland or in a free zone if your activity falls within the regulated categories.

Q8: How long does AML registration take in the UAE? 

A: A first-time DNFBP setup—risk assessment, MLRO appointment, policy drafting, and goAML registration—typically takes 3–5 weeks with documents ready and no ownership-structure complications