UAE AML Compliance Guide 2026: What Every Business Must Do
Anti-money laundering rules in the UAE now reach far beyond banks. Real estate brokers, gold and jewellery dealers, accountants, company formation agents and gaming operators all carry legal duties. And every UAE company, whatever it does, must know and record who really owns it.
This guide explains the rules in plain English. It covers who must comply, the ten core duties, what the rules mean for private clients and family businesses, the penalties, and a 30-day plan to get compliant.
Key takeaways
The main law is Federal Decree-Law No. 10 of 2025, in force since 14 October 2025. The detail sits in Cabinet Resolution No. 134 of 2025, in force since 14 December 2025.
Covered businesses must assess risk, check customers, identify beneficial owners, appoint a compliance officer, report suspicions, apply sanctions immediately, keep records for five years and test their controls.
Every UAE company must keep accurate beneficial owner information and update it within 15 working days of any change.
Administrative fines reach AED 5,000,000 per violation, and criminal penalties go much higher.
Contents
1. What AML compliance means in the UAE
AML compliance means having the controls in place to stop your business being used to hide criminal money, fund terrorism or finance weapons of mass destruction. UAE law calls these three risks money laundering, terrorist financing and proliferation financing.
In practice, that means four things:
knowing who you deal with
understanding where their money comes from
spotting what looks wrong
telling the authorities when you have a suspicion
The law expects a risk-based approach. A small business with simple, low-risk customers needs lighter controls than a broker handling large cross-border deals. But every covered business needs controls that are written down, followed and tested.
2. The laws you need to know
Text | What it does | In force from |
|---|---|---|
Federal Decree-Law No. 10 of 2025 | The main AML, CFT and CPF law. It defines the crimes, sets duties and penalties, and repeals the 2018 law | 14 October 2025 |
Cabinet Resolution No. 134 of 2025 | The executive regulation. It lists covered businesses, thresholds, CDD and beneficial owner rules, and compliance officer duties | 14 December 2025 |
Federal Decree-Law No. 30 of 2024 and its 2026 executive regulation | Creates a national "Know Your Customer" digital platform | Regulation effective 21 April 2026 |
If your current policies were written under the 2018 law, read our summary of what the 2025 law changed.
3. Who must comply
The full set of duties applies to:
Financial institutions, such as banks, exchange houses, finance companies and insurers.
Virtual asset service providers (VASPs), such as crypto exchanges, custodians and transfer services.
Designated non-financial businesses and professions (DNFBPs), listed below.
Non-profit organisations are also supervised and have their own obligations.
Am I a DNFBP?
Cabinet Resolution No. 134 of 2025 (Article 3) lists the DNFBPs:
Business | Covered when |
|---|---|
Real estate brokers and agents | Concluding purchase or sale transactions for customers |
Dealers in precious metals and stones | Single or linked cash transactions of AED 55,000 or more |
Lawyers, notaries, other independent legal professionals and independent accountants | Preparing or carrying out transactions for clients involving real estate, managing client funds or bank and securities accounts, company contributions, or creating, running, buying or selling companies and legal arrangements |
Company and trust service providers | Forming companies, acting as or arranging directors, secretaries, nominee shareholders or trustees, or providing a registered office or business address |
Commercial gaming operators | Single or linked transactions of AED 11,000 or more |
Two practical notes:
Activity matters more than the job title. An accountant who only prepares tax returns may fall outside the list. An accountant who manages client funds or sets up companies for clients falls inside it.
The list can grow. Supervisors can add businesses by resolution.
Not on the list? You are still affected
Even if you are not a covered business, the law still reaches you in three ways:
You will be on the receiving end of AML checks from your bank, broker, auditor and corporate service provider.
Every company must keep beneficial owner records (section 6).
Dealing in funds where there are sufficient signs of an illegal source, or of a hidden owner, is itself an offence (Article 30 of the 2025 law).
4. Who supervises you
Your supervisor depends on your sector and where you are licensed.
Ministry of Economy and Tourism (MOET). For the mainland and commercial free zones, it supervises four DNFBP sectors: real estate agents and brokers, dealers in precious metals and stones, independent accountants and auditors, and trust and company service providers.
Financial regulators, such as the Central Bank of the UAE, supervise licensed financial institutions.
Financial free zones. The DIFC and ADGM have their own regulators for firms licensed there.
Other sectors. Lawyers and commercial gaming fall under their own competent authorities.
All covered businesses report suspicious transactions to one body: the Financial Intelligence Unit (FIU), which sits within the Central Bank. Reports go through the FIU's electronic reporting system, goAML.
5. The ten core AML duties
These come from Article 19 of Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
Duty 1: Assess your business risk
Identify, assess, document and keep updating your risks. Look at your customers, the countries you deal with, your products and services, transaction types and how you deliver services. Take the National Risk Assessment into account. Keep the written study and hand it to your supervisor on request.
Duty 2: Write policies approved by senior management
Your policies and controls must match your risks and the size of your business. They must cover customer due diligence, suspicious transaction reporting, compliance management, staff screening and training. They must apply across your branches and majority-owned subsidiaries, and you must review them on an ongoing basis.
Duty 3: Appoint a compliance officer at management level
The compliance officer needs independence in decision-making and suitable experience. Their job is to:
monitor transactions
assess possible suspicious transactions and decide whether to report them to the FIU, recording the reasons
review your AML systems and report to senior management
run staff training
work with your supervisor and the FIU
Duty 4: Carry out customer due diligence (CDD)
Before and during a business relationship, you must:
identify and verify the customer
identify the beneficial owner
understand the nature of the customer's business, the purpose of the relationship, and the ownership and control structure
keep monitoring the relationship
Never open accounts or deal under anonymous, fictitious or numbered names.
Duty 5: Apply enhanced due diligence (EDD) where risk is higher
Where risk is higher, do more. Two cases are set out in the regulation:
High-risk countries. Apply enhanced measures to customers from countries the National Committee identifies as high risk or as having weak AML systems.
Politically exposed persons (PEPs). For foreign PEPs, get senior management approval, take reasonable measures to establish the source of funds and source of wealth, and monitor the relationship more closely. For domestic PEPs and senior figures at international organisations, apply the same steps where the relationship is high risk.
Duty 6: Identify beneficial owners
For a company customer:
Start with any natural person who owns 25% or more, alone or jointly.
If that is unclear, identify whoever controls the company by other means.
If nobody qualifies, record the person in senior management.
Nominee shareholders and nominee directors do not count as beneficial owners. Look through them to the person who instructs them.
Duty 7: Apply targeted financial sanctions immediately
Screen customers and transactions against sanctions lists. Act on instructions from the Executive Office for Control and Non-Proliferation without delay, which means freezing funds and not making them available to listed persons.
Duty 8: Report suspicious transactions to the FIU
If you suspect, or have reasonable grounds to suspect, that funds or a transaction are linked to crime, report to the FIU without delay. This applies whatever the amount, and attempted transactions count too. Answer any follow-up request from the FIU promptly. Build red-flag indicators for your business and keep them updated.
Never tip off the customer. Warning someone that a report has been filed, or that they are under investigation, is a crime.
Duty 9: Keep records for at least five years
Keep transaction records, CDD files, correspondence, ID copies, suspicious transaction reports and any analysis for at least five years. The period runs from the end of the business relationship or the latest relevant event, such as an inspection, an investigation or a final court judgment. Records must be available to the authorities promptly.
Duty 10: Train your staff and test your controls
Run regular AML training for your compliance function and relevant staff. Have an independent audit function test whether your policies and controls actually work. Screen new employees for fitness and propriety.
Behind all ten duties sits a basic rule: you must hold the right licence or registration for any covered activity (Article 20 of the law).
6. Beneficial ownership: a duty for every company
This part applies to all UAE companies, not only covered businesses. Under Articles 38 to 40 of Cabinet Resolution No. 134 of 2025:
Keep basic information and beneficial owner information accurate and up to date, and check it on an ongoing basis.
Update within 15 working days of any change to your basic information, nominee details or beneficial owners.
Keep the shareholders' register in the UAE, at your office, registered place of business or another location notified to the registrar. The exception is where you keep beneficial owner information in the UAE and provide it to the registrar on request.
Nominees must disclose. A nominee director or nominee shareholder must tell the company who they act for, and report any change within 15 working days.
No bearer shares. UAE companies cannot issue bearer shares or similar untraceable instruments. Existing ones had to be converted.
Cooperate with banks and service providers asking for beneficial owner information.
Keep records for five years after the company is dissolved or stops being a customer.
Giving false or misleading beneficial owner information is a criminal offence under Article 35 of the 2025 law.
7. What AML means for private clients and family businesses
Most AML guides are written for brokers and dealers. If you are a high-net-worth individual, a family office or a family-owned group, the rules reach you through the institutions you work with.
You will be asked for more, and asked more often. Banks, private banks, insurers, brokers and corporate service providers must all identify your beneficial owners and understand your business. Where the risk is higher, they must also establish your source of funds and source of wealth.
The two terms mean different things:
Source of funds is where the money for a particular transaction came from, for example a property sale or a dividend.
Source of wealth is how you built your overall wealth, for example a business you founded, an inheritance or a career.
Holding structures need clear paperwork. With holding companies, trusts, foundations or nominee arrangements, the institution must look through each layer to the real owner and controller. A clear structure chart, current registers and supporting documents make onboarding faster. They also reduce the risk of delays, extra questions or a declined application.
Good records protect you. The FIU can freeze funds for up to 30 days without prior notice, extendable by the Attorney General, when its analysis gives grounds to act. A well-documented history of where your money came from is your best defence against long reviews.
Practical steps for families:
Keep an up-to-date structure chart showing every entity and its owners.
Hold certified copies of constitutional documents, registers and beneficial owner filings for each entity.
Prepare a short source-of-wealth summary with supporting evidence, and update it after major events such as a business sale or an inheritance.
Use one coordinated adviser so banks and regulators get consistent answers.
GTAG works with family offices and private clients on structuring, tax and wealth matters. Read more about our family office services and asset management.
8. Penalties
Administrative penalties (Article 17 of the 2025 law)
Your supervisor can:
issue a warning
impose a fine of AED 10,000 to AED 5,000,000 for each violation
ban you from the sector, or suspend or restrict your activity
restrict or suspend responsible managers, or appoint a temporary supervisor
revoke your licence
Repeat violations within a year can lead to increasing fines. Supervisors may publish the penalties they impose, so the reputational cost can be as serious as the fine.
Criminal penalties (selected)
Offence | Penalty |
|---|---|
Money laundering by an individual (Art. 26) | 1 to 10 years' imprisonment and a fine of AED 100,000 to AED 5,000,000, or the value of the criminal property if higher |
Money laundering committed on behalf of a company (Art. 27) | A fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property if higher. The court may also dissolve the company |
Failing to report a suspicious transaction, deliberately or through gross negligence (Art. 28) | Imprisonment and/or a fine of AED 100,000 to AED 1,000,000 |
Tipping off (Art. 29) | Imprisonment and/or a fine of at least AED 50,000 |
Unlicensed covered activity (Art. 32) | Imprisonment and/or a fine of AED 200,000 to AED 10,000,000 |
Breaching sanctions instructions (Art. 33) | Imprisonment and/or a fine of at least AED 20,000 |
False beneficial owner information (Art. 35) | Imprisonment and/or a fine of at least AED 20,000 |
Managers can be personally liable where they knew of an offence and it happened because they breached their duties. Money laundering, terrorist financing and proliferation financing cases do not lapse with time.
9. Your 30-day AML action plan
Week 1: Scope
Confirm whether any of your activities fall under the DNFBP list, including the thresholds.
Identify your supervisor.
Check your FIU reporting (goAML) access is active.
Check that your beneficial owner records and shareholders' register are current.
Week 2: Assess and write
Complete and document your business risk assessment.
Update your AML policy to reference Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
Get the policy approved by senior management.
Week 3: Put people and processes in place
Appoint or confirm a compliance officer at management level.
Update CDD and onboarding forms, including the 25% beneficial owner test, PEP screening and source of funds questions.
Set up immediate sanctions screening.
Week 4: Train and test
Train relevant staff on red flags, escalation and the tipping-off rule.
Set your record-keeping rules to at least five years.
Book an independent review of your AML framework.
How GTAG can help
Gulf Tax Accounting Group supports UAE businesses, family offices and private clients with tax, accounting and wealth matters. We can review your AML position against the 2025 law and help you put clear, documented controls in place. We can also prepare the beneficial ownership and source-of-wealth paperwork your bank will ask for.
10. Frequently asked questions
Is AML compliance mandatory for all UAE businesses?
The full programme is mandatory for financial institutions, virtual asset service providers and DNFBPs. Every UAE company must still keep accurate beneficial owner information. And no business may deal in funds where there are sufficient signs of an illegal source.
What is a DNFBP in the UAE?
A designated non-financial business or profession, listed in Article 3 of Cabinet Resolution No. 134 of 2025. The list covers real estate brokers and agents, dealers in precious metals and stones, lawyers, notaries and independent accountants (for certain activities), company and trust service providers, and commercial gaming operators.
What is the AML threshold for gold and jewellery dealers?
Dealers in precious metals and stones are covered for single or linked cash transactions of AED 55,000 or more. Suspicious transactions must be reported whatever the amount.
How quickly must a company update beneficial owner information?
Within 15 working days of any change.
Who is a beneficial owner in the UAE?
The natural person who ultimately owns or controls a company. Start with anyone owning 25% or more. If that is unclear, identify who controls it by other means. Failing that, record the senior manager.
Do I need a compliance officer?
Yes, if you are a financial institution, VASP or DNFBP. The compliance officer must sit at management level, have independence and suitable experience.
How long do I keep AML records?
At least five years from the end of the relationship or the latest relevant event.
What happens if I do not comply?
Supervisors can issue warnings, impose fines of up to AED 5,000,000 per violation, suspend your activity or revoke your licence. Criminal penalties apply to offences such as failing to report, tipping off and money laundering itself.
Official sources
Federal Decree-Law No. 10 of 2025 on AML, CFT and CPF, UAE Legislation portal
Cabinet Resolution No. 134 of 2025, executive regulation, UAE Legislation portal
Executive regulation of the "Know Your Customer" Digital Platform law, UAE Legislation portal
AML/CFT/CPF supervision of DNFBPs, Ministry of Economy and Tourism
This guide is general information, not legal advice. The English texts on the UAE Legislation portal are translations; the Arabic text prevails. Last reviewed 2 November 2026.
Comments