Anti Money Laundering Duties for Dubai Businesses: Key Requirements

The UAE remains on the Financial Action Task Force (FATF) regular follow-up list as of 2026, and domestic enforcement has intensified sharply. The Ministry of Economy supervises over 10,000 Designated Non-Financial Businesses and Professions (DNFBPs) for AML compliance (Ministry of Economy UAE, 2024). Administrative fines under Federal Decree-Law No. 20 of 2018 can reach AED 1,000,000 per violation (UNVERIFIED: confirm current maximum before publishing). The goAML portal, operated by the UAE Financial Intelligence Unit, is mandatory for all covered businesses. Corporate tax late registration carries a one-time flat AED 10,000 penalty, separate from any AML fine. For first-time founders setting up a company in Dubai, these are not background statistics, they are direct liabilities that attach to your trade license from day one.

This guide explains exactly what anti money laundering Dubai obligations apply to your business, what compliance costs look like, and the step-by-step process you need to follow to stay on the right side of UAE law.

What Is Anti Money Laundering in Dubai and Who It Applies To

Anti money laundering in Dubai refers to the legal framework under UAE Federal Decree-Law No. 20 of 2018 that requires businesses to detect, prevent, and report financial crime. It applies to banks, financial institutions, and a broad category of Designated Non-Financial Businesses and Professions including real estate agents, auditors, lawyers, and dealers in precious metals.

The Legal Framework Underpinning UAE AML Obligations

The primary statute is Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (UAE Cabinet, 2018). Cabinet Decision No. 10 of 2019 provides the implementing regulations that define which business categories are covered, what procedures must be followed, and what records must be kept (UAE Cabinet, 2019).

The UAE National Risk Assessment identifies high-risk sectors and informs which businesses face heightened scrutiny. The Ministry of Economy acts as the supervisory body for DNFBPs on both mainland and free zone licenses, meaning your free zone registration does not shift that responsibility to the free zone authority alone (Ministry of Economy UAE, 2024).

A newly licensed real estate brokerage in Dubai falls under DNFBP classification from its first day of operation, regardless of transaction volume. That is not a common misconception, it is a point the Ministry of Economy has enforced repeatedly in its audit programme.

Which Business Types Are Covered Under Dubai AML Rules

AML compliance UAE obligations cover two broad categories. Check your business activities in Dubai against both lists before you launch:

• Financial institutions: banks, exchange houses, insurance firms, investment advisors, money service businesses

• DNFBPs (per Cabinet Decision No. 10 of 2019): real estate agents and brokers, auditors, accountants, lawyers, notaries, dealers in precious metals and stones, company formation agents

• Virtual asset service providers (VASPs): added under 2022 regulatory amendments, now fully within the AML perimeter

• Free zone companies: not exempt, AML obligations follow the activity, not the jurisdiction

A free zone consultancy that advises clients on corporate structuring is classified as a DNFBP under company formation agent rules and must register on goAML. The free zone authority may also conduct its own compliance audits, layering on top of Ministry of Economy supervision.

AML Obligations by Business Type in Dubai

AML Compliance Requirements for Dubai Businesses

Dubai businesses subject to AML rules must appoint a compliance officer, conduct customer due diligence, maintain transaction records for at least five years, register on the goAML portal, and file suspicious transaction reports. DNFBPs supervised by the Ministry of Economy must also complete an annual AML risk assessment and implement a written internal policy.

Customer Due Diligence and Know Your Customer Checks

You must verify the identity of every customer before establishing a business relationship, not after the first invoice. Standard Customer Due Diligence (CDD) applies to most clients. Enhanced Due Diligence (EDD) is triggered for:

• Politically exposed persons (PEPs) and their close associates

• Clients from jurisdictions on the FATF grey or black list

• Complex ownership structures where the beneficial owner is obscured

• Any transaction that is disproportionate to the client's known business profile

The beneficial ownership threshold is 25%: you must identify anyone holding 25% or more of the client entity, not just the person signing the contract. A Dubai-based accounting firm onboarding a new corporate client must verify the ultimate beneficial owner before accepting the engagement, not just the signatory director. KYC records must be updated whenever the client's risk profile changes, not only at onboarding.

Internal AML Policies, Controls, and the Compliance Officer Role

Every covered business must have a written AML/CFT policy approved by senior management. This is a hard requirement under Cabinet Decision No. 10 of 2019, not a best-practice recommendation. The policy must cover customer acceptance criteria, risk rating methodology, transaction monitoring, and escalation procedures.

A named compliance officer must be appointed in writing. For small businesses, the owner can hold this role, but the appointment still needs to be documented. A sole-owner consultancy with two staff can designate the owner as compliance officer, but must still produce a written policy document and a staff training record. Annual AML training is best practice; the law does not specify frequency, but the Ministry of Economy looks for evidence of regular training during audits. You can find business support services to help structure your compliance programme if this is outside your expertise.

Record-Keeping Obligations Every Dubai Business Must Meet

• Retain all customer identification documents, transaction records, and correspondence for a minimum of five years from the end of the business relationship

• Records must be retrievable quickly if requested by the Ministry of Economy or law enforcement

• Digital storage is acceptable, provided records are complete, unaltered, and accessible

• Failure to maintain records is a standalone violation, separate from any underlying transaction offence

Consider this: a UK-based founder who sets up a Dubai consultancy and then relocates back to the UK two years later still carries the record-keeping obligation for those five years. The records must remain accessible in the UAE, not just on a personal hard drive overseas.

What Anti Money Laundering Compliance Costs in Dubai

AML compliance costs for a Dubai business vary by size and activity. Core costs include goAML registration (no fee), a compliance officer salary or outsourced retainer, staff training, and any external audit. Penalties for non-compliance are severe: the corporate tax late registration penalty is a one-time flat AED 10,000, and AML violations can reach AED 1,000,000 or more per breach.

Direct Compliance Costs to Budget For

A two-person real estate brokerage in Dubai typically outsources its compliance officer function rather than hiring in-house, keeping the monthly cost to a fixed retainer. Here's what to budget for:

• goAML portal registration: no government fee

• Outsourced AML compliance officer retainer: UNVERIFIED: confirm current market rate before publishing per month for SMEs

• AML policy drafting (external consultant): UNVERIFIED: confirm current market rate before publishing, one-off cost

• Staff AML training programme: UNVERIFIED: confirm current market rate before publishing per session

• Annual independent AML audit (higher-risk entities): UNVERIFIED: confirm current market rate before publishing

Use the business setup cost calculator to factor compliance costs into your overall launch budget from the start.

Penalties for AML Non-Compliance in the UAE

Administrative fines under Federal Decree-Law No. 20 of 2018 can reach AED 1,000,000 per violation (UNVERIFIED: confirm exact current range before publishing). That is per violation, meaning multiple failures across customer files, record-keeping, and goAML registration can compound quickly.

Beyond fines, the consequences include license suspension or revocation for repeated or serious breaches, and criminal prosecution for individuals in cases of willful facilitation. The Ministry of Economy also publishes the names of penalised entities, so reputational damage is a real and immediate consequence. In 2023, the Ministry sanctioned multiple real estate brokers for failing to register on goAML, confirming that enforcement targets free zone and mainland businesses equally (Ministry of Economy UAE, 2023).

Step-by-Step Guide to Anti Money Laundering Compliance for Dubai Businesses

To meet anti money laundering Dubai obligations, a business must: confirm whether it is a covered entity, register on goAML, appoint a compliance officer, draft an AML policy, implement KYC procedures, train staff, and file suspicious transaction reports when required. This process applies from the date of license issuance, not from first revenue.

Step 1: Confirm Your Classification and Supervisory Authority

Start by identifying whether your activity falls under financial institution or DNFBP categories. Financial institutions are supervised by the Central Bank of the UAE (CBUAE). DNFBPs are supervised by the Ministry of Economy for both mainland and free zone entities.

Check the specific DNFBP list in Cabinet Decision No. 10 of 2019. If your activity is regulated (financial services, for example), the named regulator approves it separately from your trade license, your free zone license and the regulator's approval are two distinct steps. A UK-based founder setting up a financial consultancy in Dubai needs both the free zone license and the relevant regulatory approval before taking on clients.

Step 2: Register on the goAML Portal

The goAML portal is operated by the UAE Financial Intelligence Unit. Registration is free and must be completed before conducting any regulated transaction, not at license renewal time. Here's the process:

1. Go to the UAE Financial Intelligence Unit goAML portal

2. Create an institutional account using your trade license number

3. Enter the Emirates ID of the appointed compliance officer

4. Submit the registration and save the reference number generated by the system

A newly licensed financial consultancy that receives its trade license in one day at a free zone should complete goAML registration within the same week, before taking on any client work. That reference number is what banks and auditors will ask for later.

Step 3: Build Your AML Program and File Reports

• Draft a written AML/CFT policy covering customer acceptance, risk rating, monitoring, and escalation

• Appoint your compliance officer in writing and keep the appointment on file

• Implement KYC procedures for all new clients; apply EDD for high-risk profiles

• File a Suspicious Transaction Report (STR) on goAML whenever a red flag is identified, filing does not require certainty of wrongdoing, only reasonable suspicion

• Retain all records for a minimum of five years from the end of the business relationship

For help structuring your banking and taxation arrangements alongside your AML programme, specialist support is available from day one of your setup.

GoAML Registration and Suspicious Transaction Reporting

The goAML portal is the UAE Financial Intelligence Unit's mandatory reporting platform. All covered businesses must register before conducting regulated transactions and use the portal to file Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). Failure to register or file is a standalone violation that can trigger Ministry of Economy fines independent of any underlying transaction.

What Triggers a Suspicious Transaction Report

You do not need proof of wrongdoing to file an STR. Suspicion alone is sufficient, and in some cases, the obligation to file exists even if you decline the transaction. Watch for:

• Unusual cash transactions or requests to split payments across multiple accounts

• Clients unwilling to provide beneficial ownership information or giving inconsistent identification

• Transactions with no apparent commercial rationale, or disproportionate to the client's known business profile

• Requests involving jurisdictions on the FATF grey or black list

• Clients who seem unusually eager to complete a transaction quickly without standard documentation

A Dubai-based accounting firm asked to process a large cash payment from a client who refuses to identify the source of funds must file an STR on goAML, regardless of whether it accepts the engagement. This is one of the clearest anti money laundering Dubai obligations in practice, and it catches many first-time founders off guard.

How the UAE Financial Intelligence Unit Uses Your Reports

The UAEFIU analyses STR data to identify patterns and refer cases to law enforcement. Businesses that file in good faith are protected from civil liability under Federal Decree-Law No. 20 of 2018, so filing protects you, not just the financial system.

One critical rule: tipping off the subject of an STR is a criminal offence. Never inform a client that a report has been filed about them. The UAEFIU also publishes annual typologies and red-flag guidance to help businesses in sectors like financial services identify emerging patterns.

Is AML registration required for all free zone companies?

Yes. Free zone companies whose activities fall within the DNFBP or financial institution categories must register on goAML and comply with all AML obligations under Federal Decree-Law No. 20 of 2018. The free zone jurisdiction does not create an exemption. The Ministry of Economy retains supervisory authority over DNFBPs regardless of where the license is issued.

How Anti Money Laundering Rules Affect Your Dubai Business License and Banking

AML compliance directly affects your ability to open a UAE corporate bank account and maintain your trade license. Banks conduct their own AML checks before approving any account, and a missing or incomplete goAML registration will typically result in rejection. Ongoing compliance failures can trigger license suspension by the free zone authority or Ministry of Economy.

Why Banks Require AML Compliance Evidence Before Opening Accounts

UAE banks conduct their own KYC and AML risk assessment on every new corporate applicant, under CBUAE regulations (Central Bank of the UAE, 2024). Your goAML registration reference demonstrates institutional compliance and typically accelerates the approval process. Banks may also request your written AML policy, the compliance officer appointment letter, and your beneficial ownership register.

A newly formed free zone company that completes goAML registration before approaching banks typically progresses through the account-opening process faster than one that treats compliance as an afterthought. A business that cannot demonstrate AML controls is routinely declined, regardless of license status. Getting this right before your first bank meeting is not optional, it is practical preparation.

AML Compliance at License Renewal and During Regulatory Audits

• The Ministry of Economy conducts both desk-based and on-site AML audits of DNFBPs

• Free zone authorities may request evidence of ongoing AML compliance at license renewal

• Non-compliant entities face renewal refusal in addition to financial penalties

• Keeping your AML policy, training records, and goAML filing history in one accessible folder makes audits straight

  References

  1. Ministry of Economy UAE

  2. UAE Cabinet

  3. CBUAE