Is Your UAE Business Covered by AML Rules Without Knowing It?

The short answer

If your business brokers property, deals in gold or precious stones, keeps books or audits accounts, gives certain legal services, forms companies for clients, or provides them a registered address, you are already covered by UAE anti money laundering rules. You are covered because of what you do, not because of what your trade licence is called, and there is no small business exemption.

Anti money laundering, usually shortened to AML, is the set of rules that stops criminal money moving through legitimate businesses. Most owners file it under banking. The law does not. It creates a second group called Designated Non-Financial Businesses and Professions, or DNFBPs, and that group is where most of the surprise sits.

The rulebook is also new. Federal Decree-Law 10 of 2025 came into force on 14 October 2025 and, by its Article (41), repealed Federal Decree-Law 20 of 2018. Cabinet Resolution 134 of 2025 came into force on 14 December 2025 and, by its Article (70), repealed Cabinet Decision 10 of 2019. If your AML policy still cites the 2018 law, it is citing a repealed instrument.

This is general information, not tax or legal advice. Your obligations depend on the specific activities of your business. Confirm your own position with the Ministry of Economy and Tourism or a qualified adviser before acting. Every rule, figure and date on this page was checked on 31 July 2026.

Who is covered

Article (3) of Cabinet Resolution 134 of 2025 defines the DNFBP categories. Read the table by activity, not by industry label.

Three points that decide most cases.

• The professional category now names the individual. The 2025 wording covers those practising individually, as partners, or as professionals inside a firm. The old wording in Cabinet Decision 10 of 2019 left room to argue that only the firm was caught. That room is gone.
• Providing an address is enough. Under the company and trust service provider category, giving a client a registered office or a correspondence address brings you inside the regime on its own.
• Commercial gaming operators are new. That category did not exist in the 2019 list. The public Ministry of Economy and Tourism page that explains which companies fall under the DNFBP definition still names four categories in plain language, being real estate firms, auditing or accounting firms, dealers in precious metals or stones, and trust or company service providers. It had not been updated for the gaming category when this article was checked on 31 July 2026, so read Article (3) itself rather than the summary page.

The supervisor for this sector is the Ministry of Economy and Tourism, which states on its own AML page that it supervises the DNFBP sector at state level and in the commercial free zones. DIFC and ADGM run their own AML regimes under their own regulators, and this article does not cover those.

Why the rules changed in October 2025

Two instruments replaced the framework almost everyone in this market wrote their policies against.

Four substantive changes matter to a small firm.

1. The commercial gaming category was added, at an AED 11,000 threshold.
2. The compliance officer must now be at management level and must have independence in decision making, under Article (22) of Cabinet Resolution 134 of 2025. Neither phrase appeared in the 2019 text.
3. Record retention now expressly covers closed-circuit television and automated teller machine recordings, under Article (25)(2). That was not in the 2019 rules.
4. The statutory fine floor fell from AED 50,000 under the 2018 law to AED 10,000 under Article (17)(1) of the 2025 law. That is not leniency. It widens the range downwards so that smaller failures can be fined rather than let go.

There is a second-order consequence worth stating plainly. Article (21) of Cabinet Resolution 134 of 2025 requires internal policies to be reviewed and updated on an ongoing basis. A policy manual that still cites the 2018 law and the 2019 regulations is itself evidence that the review did not happen.

One thing this article will not give you is a compliance deadline. There is no AML filing date in the UAE. The obligations are continuous and trigger based, and no transitional or grace period appears in either the 2025 Decree-Law or the 2025 Cabinet Resolution. The only dates that matter are the two commencement dates in the table above.

The goAML registration you cannot skip

goAML is the electronic system of the UAE Financial Intelligence Unit, the government body that receives reports about suspicious money. It is how a DNFBP files a report, and it is the first thing an inspector checks, because it is a yes or no fact that takes seconds to verify.

The Ministry of Economy and Tourism guidelines for DNFBPs, dated September 2025, state that DNFBPs are mandated to register on the goAML system, that the registration must be maintained in an active status, and that the compliance officer of the company is required to register as the user of the system. The guidelines add that all DNFBPs must register immediately to confirm readiness for filing reports.

On timing, the original registration deadline of 31 March 2021 was extended to 30 April 2021, as reported by WAM, the official UAE state news agency. That deadline is history. For a business licensed after it, the trigger is the moment you begin carrying out a DNFBP activity, and the Ministry wording is to register immediately. There is no rolling annual deadline in the primary sources, and no annual renewal requirement was found in them either. What the guidelines require is that the registration stays active.

Two legal hooks sit underneath the obligation. Article (18)(1)(a) of Cabinet Resolution 134 of 2025 requires reports to go through the electronic system of the Financial Intelligence Unit, and Article (20) of Federal Decree-Law 10 of 2025 prohibits carrying on a DNFBP activity without a licence, registration or enrolment from the competent authority or the relevant supervisory authority.

The practical reason to treat this as urgent is not the fine. In a published Q3 2023 announcement, the Ministry of Economy suspended 50 DNFBP establishments for three months purely for failing to register on goAML, with the suspension staying in force until they registered. For most small firms, three months of suspended trading costs more than any fine on the schedule.

The six duties you have to carry out

All article references below are to Cabinet Resolution 134 of 2025 unless another instrument is named.

1. Assess your own risk, Article (5)

You must identify, understand, manage and assess the crime risks your business faces, proportionate to its nature and size. Article (5)(1)(a) requires you to consider customer risk, country and geographic risk, and product, service, transaction and delivery channel risk before you settle on an overall risk level. Article (5)(1)(b) requires the process to be documented, the study retained, the assessment updated on an ongoing basis, and the whole thing handed to the Supervisory Authority on request. The same duty sits at statute level in Article (19)(1)(a) of Federal Decree-Law 10 of 2025.

2. Know your customer, Articles (7) and (8)

Customer due diligence, usually shortened to CDD, means verifying who your customer is and understanding what they are doing with you. Article (7)(1) requires it on the commencement of a business relationship, where there is suspicion of a crime, and where there are doubts about the accuracy or adequacy of identification data you obtained earlier. Article (8) requires ongoing monitoring, meaning you scrutinise transactions throughout the relationship and keep the customer information current rather than filing it once and forgetting it.

One precision point, because it is widely misreported. The occasional transaction thresholds of AED 55,000, and AED 3,500 for wire transfers, are written in Article (7)(2) for financial institutions, and a separate AED 3,500 threshold is written in Article (7)(3) for virtual asset service providers. For DNFBPs the money figures live in the definitions in Article (3), being AED 11,000 for commercial gaming and AED 55,000 for dealers in precious metals and stones. Do not run your business on a general rule that DNFBPs only do CDD above AED 55,000. That is not what the text says.

3. Go further on higher risk, Articles (16), (23) and (24)

Enhanced due diligence, or EDD, is the deeper version of the same work, and three situations call for it. Article (23) requires enhanced measures, proportionate to risk, for persons from countries the National Committee identifies as high risk or as having deficiencies in this area, plus any countermeasures the Supervisory Authority requires. Article (16) covers politically exposed persons, meaning people who hold or have held prominent public functions, and for foreign ones it requires systems to identify them, senior management approval before you start or continue the relationship, reasonable measures to establish source of funds and wealth, and enhanced ongoing monitoring. Article (24) requires you to assess the risk before you launch a new product, practice or technology.

4. Appoint a compliance officer, Articles (21) and (22)

Article (21) requires internal policies, controls and procedures approved by senior management and proportionate to your risks and to the nature and size of the business, covering six things: CDD measures, procedures for reporting suspicious transactions, compliance management arrangements including the appointment of a compliance officer at management level, employee screening for fitness and propriety, periodic training, and an independent audit function that tests whether the controls actually work.

Article (22) then sets the role. The officer must be at management level, must have independence in decision making, and must have appropriate competence and experience. Five duties are listed: monitoring transactions, reviewing suspicious transaction data and deciding whether to notify the Financial Intelligence Unit or keep the matter internally with the reasons recorded, reviewing internal systems and reporting periodically to senior management with a copy to the Supervisory Authority on request, running and documenting training, and cooperating with the Supervisory Authority and the Unit.

5. Report suspicion, Articles (17), (18) and (19)

A suspicious transaction report, or STR, is the notification you file when something does not add up. Article (17) requires you to set indicators that identify suspicion and to keep them updated as methods change. Article (18)(1) requires you to notify the Financial Intelligence Unit immediately and without delay, through the electronic system of the Unit, where there is suspicion or reasonable grounds to suspect that a transaction, an attempted transaction or funds are proceeds of crime or connected to it, and it applies regardless of their value. Banking secrecy, professional secrecy and contractual liability are not a defence, and you must respond promptly to any request from the Unit for more information.

Two qualifications. Article (18)(2) exempts lawyers, notaries, other independent legal professionals and independent statutory auditors where the information came to them while assessing a customer legal position, defending or representing the customer, or giving a legal opinion on judicial proceedings. And Article (19)(1) bans tipping off, meaning you may not tell the customer or anyone else, directly or indirectly, that a report has been or is about to be made, or that an investigation is under way.

6. Keep the records, Article (25)

Article (25)(1) requires records, documents, instruments and data on all domestic and international financial and cash transactions and commercial dealings to be kept for at least five years from completion of the transaction or termination of the business relationship, and to be produced to the authorities promptly on request.

Article (25)(2) extends the same five year minimum to CDD records, ongoing monitoring records, account files, business correspondence, copies of identification documents, suspicious transaction reports, the results of any analysis, and, new in 2025, closed-circuit television and related automated teller machine recordings. The clock runs from the most recent of several events: termination of the relationship, account closure, completion of an occasional transaction, completion of a Supervisory Authority inspection, completion of an investigation, or a final court judgment. Article (25)(3) requires records to be organised so individual transactions can be reconstructed, which is a filing standard, not a storage volume.

What it costs if you do not

There are two layers. The statute sets the range. A Cabinet resolution sets the actual numbers the Ministry applies.

The statutory range

Article (17)(1) of Federal Decree-Law 10 of 2025 lets the Supervisory Authority issue a warning, impose an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation, prohibit the violator from the relevant sector, restrict the powers of board members and executives and owners responsible, suspend or replace those individuals, suspend or restrict the activity or profession, and revoke the licence. Article (17)(3) allows an incremental fine where the same violation recurs within a year. Article (17)(4) allows the Authority to publish the penalties through media outlets, so reputational exposure is written into the statute rather than being a side effect.

The schedule the Ministry applies to DNFBPs

Cabinet Resolution 71 of 2024, issued on 8 July 2024, carries the list of violations and administrative fines for businesses supervised by the Ministry of Justice and the Ministry of Economy. Article (3)(1) allows the Ministry to impose an administrative penalty, or a fine from the annexed list, or both. Article (5)(2) allows the Ministry to double the fine when the violation is repeated. These rows are the ones a desk review finds.

One status note, stated as a live issue rather than as fact. Cabinet Resolution 71 of 2024 was made under the repealed 2018 law, and Article (39) of Federal Decree-Law 10 of 2025 directs the Cabinet to issue a new violations and penalties resolution. Under Article (41)(3) of the 2025 Decree-Law, resolutions issued under the old law stay effective so far as they do not conflict with it, until superseding instruments are issued. No replacement resolution was located as at 31 July 2026. So the schedule above is what applies today, its amounts sit inside the new statutory range, and a replacement is expected.

Where it stops being administrative

Three provisions of Federal Decree-Law 10 of 2025 take this out of the fine column.

• Article (28). Failing to report a suspicious transaction, deliberately or through gross negligence, is punishable by imprisonment plus a fine of AED 100,000 to AED 1,000,000, or either penalty. Gross negligence means you did not have to know. Having no compliance officer, no indicators and no monitoring is how gross negligence gets established.
• Article (32). Carrying on a DNFBP activity without the required licence or registration is punishable by imprisonment plus a fine of AED 200,000 to AED 10,000,000, or either.
• Article (37)(2). Criminal proceedings for money laundering, terrorism financing and proliferation financing do not lapse by prescription, and the penalties do not extinguish by lapse of time. There is no year in which the file closes.

For completeness, where a legal person is convicted of money laundering, terrorism financing or proliferation financing committed on its behalf, Article (27)(1) sets a fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property, whichever is greater. Article (27)(3) and (4) require the court to order dissolution and closure of the premises on a terrorism financing or proliferation financing conviction, and allow it on a money laundering conviction.

Why enforcement got tougher

The Financial Action Task Force, known as FATF, is the global body that sets standards on money laundering and reviews countries against them. Its list of jurisdictions under increased monitoring is what the market calls the grey list.

The UAE was on it, and came off it on 23 February 2024. The FATF statement records that the deficiencies had been identified in February 2022 and welcomes the UAE progress, and it is the reasons given for the removal that explain the enforcement climate. One of the six commitments FATF listed was improving how DNFBP supervisors understand risk, applying effective and proportionate sanctions for non-compliance involving financial institutions and DNFBPs, and increasing suspicious transaction reporting in those sectors.

Read that as a causal chain rather than as background. Delisting was conditional on the UAE demonstrating it was actually sanctioning DNFBPs and getting them to file reports. The Ministry of Economy inspection and fining programme is how that commitment is delivered. And FATF closed by saying the UAE should continue working with MENAFATF, the regional body for the Middle East and North Africa, to sustain the improvements. The pressure did not end at delisting, because sustaining the result requires visible enforcement to continue.

What the Ministry has actually published

These are figures the Ministry of Economy and Tourism announced itself.

Two honest caveats. Full year 2025 enforcement totals circulate in commentary, and no Ministry publication confirming them could be located, so they are not used here. The composition of the first half of 2025 figures is the Ministry breakdown as announced, and any average per violation you see quoted is arithmetic on those two published numbers rather than a Ministry figure.

What the table does show is that the two largest fine pools sat with gold and gemstone traders and with real estate brokerages, and that the Ministry uses suspension of the activity and not only money.

What to do this month

If the categories above describe your business, work down this list in order. The first three are the ones an inspector can check without alleging that a single dirham was laundered.

1. Check your goAML registration exists and is active. If it does not exist, that is row 23, and it is also what triggered the three month suspensions.
2. Name a compliance officer at management level with independence in decision making, and register that person as the goAML user.
3. Fix the records. Five years minimum, organised so an individual transaction can be reconstructed, and check whether the closed-circuit television requirement in Article (25)(2) touches your premises.
4. Write and approve the internal policies covering the six items in Article (21), and have senior management approve them in writing.
5. Document your risk assessment across customer, country, product, service, transaction and delivery channel risk, and keep the study.
6. Re-date any AML manual that cites the 2018 law or the 2019 regulations. Those citations are now wrong, and the manual is missing the new gaming category, the management level and independence requirements for the compliance officer, and the recording retention duty.

If your business is not formed yet, the cleanest moment to get this right is at licensing, because the activity you choose decides whether you land inside the DNFBP definition at all. Entityz forms companies across the UAE free zones and mainland, has established more than 500 businesses, and stays with clients for 12 months after setup. Look at the licence activities and free zones we work with, or talk to Entityz and we will tell you plainly whether the activity you have in mind carries AML obligations before you commit to it.

The reporting side of compliance is a separate obligation with its own dates. Does your UAE company need an audit, and by when covers who must have audited accounts, and UAE corporate tax, what businesses need to know covers the tax side.