What is UAE AML compliance in 2026?
UAE AML compliance is the set of legal duties imposed on regulated businesses under Federal Decree-Law No. 10 of 2025 to prevent money laundering, terrorism financing, and proliferation financing. The law took effect on 14 October 2025, replaces the earlier Federal Decree-Law 20 of 2018, and sits alongside Cabinet Resolution No. 134 of 2025, which activated the executive regulations on 14 December 2025 (Al Tamimi, 2026).
The framework applies to Financial Institutions, Virtual Asset Service Providers (VASPs), and Designated Non-Financial Businesses and Professions (DNFBPs). Since the UAE exited the FATF grey list in February 2024, the country has moved from remediation to enforcement — with the Ministry of Economy & Tourism (MoET) now the primary DNFBP supervisor on the mainland.
Which businesses are covered as DNFBPs?
The DNFBP category is the widest net in the 2025 framework. Any UAE mainland or free zone entity operating in one of the listed sectors must register on the goAML portal, appoint a Compliance Officer, and file suspicious transaction reports (Corplex, 2026).
| DNFBP Sector | Typical Trigger Activity |
|---|---|
| Real estate brokers and developers | Sale, purchase, or lease of property |
| Dealers in precious metals and stones | Cash transactions above AED 55,000 |
| Independent accountants and auditors | Client fund handling, entity formation |
| Corporate service providers | Nominee, trustee, or company formation services |
| Lawyers and notaries (fee-earning transactions) | Property, company, or trust transactions |
| Commercial gaming operators | Added in the 2025 framework under GCGRA |
Entities in DIFC or ADGM fall under the DFSA and FSRA respectively — the goAML registration itself, however, remains a UAE-wide obligation coordinated through the Financial Intelligence Unit.
What are the core compliance obligations?
Every regulated business must operate a written AML programme covering five pillars: risk assessment, customer due diligence (CDD), transaction monitoring, sanctions screening, and record retention. Documentation must be complete before commercial engagement begins — retrospective onboarding is not accepted by MoET auditors.
CDD requires verifying the customer’s identity, understanding the purpose of the business relationship, and identifying the ultimate beneficial owner. Enhanced due diligence (EDD) is triggered for politically exposed persons, high-risk jurisdictions, and cash-intensive transactions. Sanctions screening must run daily against the UN Security Council Consolidated List and the UAE Local Terrorist List published by the Executive Office for Control and Non-Proliferation (EOCN).
Records must be kept for a minimum of five years after the end of the business relationship or the completion of the transaction — and the obligation survives company deregistration.
How high are the penalties under the 2025 law?
The 2025 law substantially increased the financial exposure for both individuals and corporate entities compared with the 2018 regime (Zigram, 2026).
| Violation | Individual Penalty | Legal Entity Penalty |
|---|---|---|
| Money laundering (standard) | AED 100,000 – 5 million + 1–10 years | AED 5 million – 100 million |
| Money laundering (aggravated) | AED 1 million – 10 million | Up to double the criminal proceeds |
| Proliferation financing | AED 1 million – 10 million | Or twice the value of the property |
| Anonymous virtual asset dealing | From AED 50,000 + 3+ months prison | Business licence revocation possible |
| Late or omitted STR filing | From AED 50,000 + FIU profile flag | Cumulative daily surcharge possible |
The FIU freezing power was extended from 7 days to 30 days, and transaction suspension may reach 10 working days without judicial approval — a materially wider operational risk than under the 2018 law.
What is the goAML system and how do you register?
The goAML portal is the mandatory reporting channel operated by the UAE Financial Intelligence Unit. Every DNFBP must complete registration within 30 days of trade licence issuance. The registration flow requires the company trade licence, Emirates ID of the Compliance Officer, MoA extract naming the ultimate beneficial owners, and confirmation of the sector code that determines the risk category.
After onboarding, businesses submit two report types: Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). STRs are mandatory “without delay” whenever there are reasonable grounds to suspect money laundering, terrorism financing, or proliferation financing — the 2025 law adds proliferation financing as a distinct criminal offence, so an STR trigger no longer requires an underlying predicate crime to be identified.
How does the 2025 law treat crypto and virtual assets?
VASPs are now formally within scope. Any UAE-licensed exchange, custodian, broker, or token issuer must apply full AML/CFT obligations — including CDD on wallet holders and STR filing on suspicious on-chain movements. Fully anonymous coins that block transaction traceability are prohibited from being offered by UAE-licensed VASPs, and dealing in them attracts fines from AED 50,000 plus criminal exposure.
For Dubai-based VASPs, the Virtual Assets Regulatory Authority (VARA) coordinates supervisory oversight alongside the FIU. For ADGM entities, the FSRA handles the licence — but goAML reporting remains national.
What should a UAE business do this quarter to stay compliant?
The 2026 enforcement wave is real: MoET now conducts unannounced on-site inspections of mainland DNFBPs, and the standard first-audit findings letter carries a 30-day remediation window before financial penalties escalate. The practical checklist is compact: confirm goAML registration is active, appoint or reconfirm a Compliance Officer, refresh the enterprise-wide risk assessment against the 2025 typologies, run a sanctions screening audit for the past 12 months, and verify that CDD files exist for every active client relationship — not just new onboardings.
Sources: Al Tamimi & Company — Eyes on 2026 AML Framework; UAE Ministry of Economy & Tourism — DNFBP Forum; Zigram — Federal Decree-Law 10 of 2025 Guide.