If your UAE business is a real estate brokerage, a gold or jewellery dealer, a law or accounting firm, or a corporate service provider, you are a Designated Non-Financial Business or Profession and you must register on the goAML platform, appoint a compliance officer, run customer due diligence, keep records for five years and report suspicious transactions with no minimum value. Administrative fines run from AED 10,000 to AED 5,000,000 for each violation under Article 17 of Federal Decree-Law No. 10 of 2025.

That decree-law is the reason this guide exists. Almost every AML explainer aimed at UAE businesses still cites Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, and both were repealed in late 2025. The government’s own summary page has not caught up either. This guide works from the current instruments: the new decree-law, its new Executive Regulations, and what actually changed in the perimeter of who is caught.

The Law Changed in Late 2025 and Most Guidance Has Not Caught Up

Federal Decree-Law No. 10 of 2025 replaced Federal Decree-Law No. 20 of 2018 outright, and Cabinet Resolution No. 134 of 2025 replaced Cabinet Decision No. 10 of 2019. Anything that tells you your obligations come from the 2018 law or the 2019 regulation is describing a repealed framework.

The repeals are express, not implied. Article 41(1) of the decree-law states that Federal Decree-Law No. 20 of 2018 “shall hereby be repealed,” and Article 70 of Cabinet Resolution No. 134 of 2025 does the same for Cabinet Decision No. 10 of 2019.

Instrument Issued Entry into force Status
Federal Decree-Law No. 10 of 2025 (AML/CFT/CPF) 30 September 2025 Two weeks after publication in the Official Gazette (Art. 42) Current
Cabinet Resolution No. 134 of 2025 (Executive Regulations) 29 October 2025 Thirty days after publication in the Official Gazette (Art. 71) Current
Federal Decree-Law No. 20 of 2018 2018 – Repealed by Art. 41(1)
Cabinet Decision No. 10 of 2019 2019 – Repealed by Art. 70

One transitional rule matters in practice. Article 41(3) keeps the regulations, resolutions and circulars issued under the 2018 law alive, but only “insofar as they do not conflict” with the new decree-law, and only until replacement instruments are issued. So a supervisory circular you were given in 2023 may still bind you, and may also have been silently overridden. Where the old guidance and the new text disagree, the new text wins.

The government’s own consumer-facing summary of the AML framework, on the official UAE portal, still presents the 2018 decree-law and the 2019 Cabinet Decision as the governing instruments and links to both. It is the clearest illustration of how far behind the secondary material sits, and a reason to work from the legislation rather than from summaries.

Who Counts as a DNFBP Under the 2025 Rules

Article 3 of Cabinet Resolution No. 134 of 2025 lists five categories of Designated Non-Financial Businesses and Professions: commercial gaming operators, real estate brokers and agents, dealers in valuable metals and precious stones, certain legal and accounting professionals, and company and trust service providers. Supervisory authorities can add more.

Two of those categories carry a monetary trigger, and the rest do not.

DNFBP category When the obligations bite
Commercial gaming operators, including gaming on board vessels A single financial transaction, or linked transactions, of AED 11,000 or more. Transactions involving only gaming chips or instruments do not count
Real estate brokers and agents When concluding transactions or settlements for a customer on the purchase or sale of real estate. No value threshold
Dealers in valuable metals and precious stones A single cash transaction, or linked cash transactions, of AED 55,000 or more
Lawyers, notaries, other independent legal professionals and independent accountants When they prepare, conduct or execute transactions for a client involving real estate, client funds, accounts, company formation contributions, or the establishment, operation, management, sale or purchase of legal persons or businesses
Company and trust service providers When acting as incorporation agent, director or secretary, providing a registered office or correspondence address, acting as trustee, or acting as a nominee shareholder

What actually changed in the perimeter

Compare that list with Article 3 of the repealed Cabinet Decision No. 10 of 2019 and one addition stands out. The 2019 list ran to four categories: real estate brokers and agents, dealers in precious metals and stones, legal and accounting professionals, and what it called “credit companies and funds service providers” performing corporate services. Commercial gaming operators were not in it. They are now first on the list, with their own AED 11,000 trigger, which is the lowest monetary threshold anywhere in the DNFBP definition.

The corporate services category was also rewritten. The 2019 text described it awkwardly as “credit companies and funds service providers”; the 2025 text names them “Company and Trust Service Providers,” which is what the sector has always been called in practice and removes an argument that a pure corporate services firm sat outside the definition. If you run a company formation or PRO services business in the UAE, that category is now unambiguous.

The real estate wording tightened too. The 2019 version applied “in case they conclude transactions pertaining to the sale and purchase of real estate property”; the 2025 version reads “when concluding transactions or settlements on behalf of their customers in relation to the purchase or sale of real estate.” The addition of “settlements” widens it. Note what neither version covers: pure leasing. A brokerage that only does residential lettings and never handles a sale is, on the face of Article 3, outside the DNFBP definition, though your supervisory authority can still bring you in under Article 3(6).

Registration on goAML Is the Entry Ticket

goAML is the reporting platform operated by the Financial Intelligence Unit at the Central Bank of the UAE. Every financial institution and every DNFBP has to register on it. Registration is not the compliance program, but nothing else works without it, because the platform is how suspicious transaction reports are actually filed.

The obligation has two legs. Article 18(1)(a) of the Executive Regulations requires reports to be submitted “through the Unit’s electronic system or any other means approved thereby,” which in practice is goAML. Separately, Article 20 of the decree-law prohibits anyone from carrying on a DNFBP activity “without obtaining a license, registration, or enrolment from the Competent Authority or from the relevant Supervisory Authority.”

Article 32 of the decree-law puts a penalty behind Article 20 that most operators underestimate: imprisonment and a fine of AED 200,000 to AED 10,000,000, or either penalty. That is a criminal exposure, separate from the administrative fines a supervisor can impose.

What actually happens when you register

Registration is by legal entity, not by branch, and it requires you to nominate a compliance officer as the entity’s reporting person before the account becomes usable. You will be asked for the trade licence, the establishment’s details and identification for the nominated officer, and the account has to be activated by the FIU before you can submit anything. Businesses that leave registration until a suspicious transaction has already arisen discover the problem the hard way, because the reporting duty in Article 18 is immediate and the platform onboarding is not.

The Six Obligations Every DNFBP Has to Meet

Article 19 of the decree-law and Chapter Two of the Executive Regulations set out the compliance program: a documented risk assessment, customer due diligence, internal policies approved by senior management, immediate implementation of targeted financial sanctions, five-year record-keeping, and suspicious transaction reporting.

1. A documented, updated risk assessment

Article 19(1)(a) requires you to identify, understand, manage, assess, document and continuously update your crime risks using a risk-based approach, to retain the assessment, and to hand it to your supervisor on request. The document itself is the obligation. An undocumented view of your own risk fails the article even if the view is correct.

2. Customer due diligence, and when it is triggered

Article 7 of the Executive Regulations requires CDD from every reporting entity on commencing a business relationship, where a crime is suspected, and where there are doubts about the accuracy or adequacy of identification data already held. Occasional-transaction triggers are set separately, and only for financial institutions and virtual asset service providers.

Trigger Threshold Applies to
Start of a business relationship No threshold All reporting entities
Suspicion of a crime, or doubt about existing customer data No threshold All reporting entities
Occasional transaction, single or linked AED 55,000 Financial institutions
Occasional transaction in the form of a wire transfer AED 3,500 Financial institutions
Occasional transaction, single or linked AED 3,500 Virtual asset service providers

For a natural person, Article 9 requires the name as it appears on the identity document, nationality, address, date and place of birth, employer name and address where applicable, and a true copy of a valid identity card or travel document. For a company, it requires the name and legal form, memorandum of association, the tax registration number where the entity is subject to corporate tax, registered address, articles of association and the names of senior management. That corporate tax reference is new drafting and ties AML files directly to the corporate tax registration record on EmaraTax.

Article 10 then requires you to identify the beneficial owner behind any legal person and take reasonable measures to verify that identity from a reliable, independent source. This is the same underlying person your company already declares in its UBO register filing, and inconsistency between the two records is an obvious audit finding.

3. Internal policies approved by senior management

Article 21 of the Executive Regulations lists six mandatory components: CDD procedures including risk management before verification completes, suspicious transaction reporting procedures, compliance management arrangements including the appointment of a compliance officer at management level, employee screening for fitness and propriety, periodic training programs, and an independent audit function to test the effectiveness of the policies. That last one catches small firms out. The audit has to be independent of the people who run the controls. Charitable collections carry their own licensing and account restrictions, covered in our guide to fundraising and donations in the UAE.

4. A compliance officer with real independence

Article 22 requires the compliance officer to be at management level, to have independence in decision-making, and to hold appropriate competence and experience. Five duties are assigned: monitoring transactions, reviewing and deciding on suspicious transaction data in full confidentiality, reviewing and reporting on the internal systems directly to senior management, developing and documenting training programs, and cooperating with the supervisor and the FIU.

The wording of duty two is worth reading closely. The compliance officer decides “whether to notify the Unit or to retain the matter stating the reasons therefor.” A documented decision not to report is a legitimate outcome. An undocumented one is not.

5. Five-year record retention, measured from the latest event

Article 25 requires transaction records to be kept for at least five years from completion of the transaction or the end of the business relationship. For CDD records the clock is more complex, and it runs from whichever of these is most recent: the end of the business relationship, account closure, completion of an occasional transaction, completion of a supervisory inspection, completion of an investigation, or the issuance of a final court judgment. An inspection therefore restarts a retention period that you may have thought had nearly expired.

The records in scope are broader than most firms assume: account files, business correspondence, copies of identification documents, the suspicious transaction reports themselves, the analysis behind them, and CCTV and ATM recordings.

6. Suspicious transaction reporting with no de minimis

Article 18(1) of the decree-law applies “regardless of their value.” There is no floor. Reporting must be immediate, direct and detailed, and banking or professional secrecy cannot be raised against it.

Lawyers, notaries, other independent legal professionals and independent auditors are exempt from the reporting duty, but only for information obtained in circumstances covered by professional secrecy. The exemption attaches to the circumstances, not to the profession.

Article 18(2) of the Executive Regulations defines those circumstances precisely: assessing a client’s legal position, defending or representing the client before courts or in arbitration or mediation, or giving a legal opinion relating to judicial proceedings, including advice on whether to start or avoid them, whether obtained before, during or after the proceedings.

Nothing there covers transactional work. A lawyer executing a property purchase or incorporating a company for a client is doing precisely what Article 3(4) lists as a DNFBP activity, and no privilege exemption applies to it. If you are instructing a UAE lawyer on a transaction, expect full identification and source-of-funds questions.

Article 19(2) adds a narrow protection in the other direction: an attempt by a lawyer, notary or auditor to dissuade a client from an unlawful act does not count as tipping off.

Penalties: Administrative and Criminal, Running in Parallel

Supervisors can impose administrative penalties ranging from a warning to licence revocation, with fines of AED 10,000 to AED 5,000,000 per violation. Separately, the decree-law creates criminal offences for failing to report, for tipping off, and for operating without registration.

Conduct Exposure Source
Any violation of the decree-law, its regulations or decisions issued under them Warning; administrative fine AED 10,000 to AED 5,000,000 per violation; sector ban; restriction or suspension of directors; suspension of the activity; licence revocation Art. 17(1)
Repeating the same violation within a year of the previous fine Incremental fine Art. 17(3)
Failing to report a suspicious transaction, deliberately or by gross negligence Imprisonment and a fine of AED 100,000 to AED 1,000,000, or either Art. 28
Tipping off a customer about a report or an investigation Imprisonment and a fine of not less than AED 50,000, or either Art. 29(1)
Carrying on a DNFBP activity without licence, registration or enrolment Imprisonment and a fine of AED 200,000 to AED 10,000,000, or either Arts. 20 and 32
Breaching CDD, policies or record-keeping duties under Art. 19 Imprisonment and a fine of not less than AED 10,000, or either Art. 35(3)
Giving false or misleading beneficial ownership information Imprisonment and a fine of not less than AED 20,000, or either Art. 35(1)
Money laundering by the company itself, through its representatives Fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property, whichever is greater Art. 27(1)

Two features of the penalty regime deserve attention. Article 17(4) allows the supervisor to publish the administrative penalties it imposes through the media, which turns a fine into a reputational event. And Article 27(5) reaches the individual: where the company commits one of these offences, the person responsible for its actual management is personally punishable by imprisonment and a fine if it is proven they knew and the offence resulted from a breach of the duties of their position.

Article 37(1) provides the counterweight. No criminal, civil or administrative liability attaches to a business or its staff for making a report, even where they were not fully aware of the nature or actual occurrence of the crime, unless the report was made in bad faith to harm someone. Over-reporting in good faith is protected. Under-reporting is not.

Corrupt payments are a frequent predicate for the reporting duties above. The underlying offences, including private-sector commercial bribery and the fact that there is no limitation period, are covered in our guide to bribery and corruption law in the UAE.

What This Means Sector by Sector

Real estate brokers and agents

You are caught on sales and purchases, with no value threshold at all, and the widening of the wording to “transactions or settlements” makes it harder to argue you merely introduced the parties. Practically this means a compliance file on both sides of every sale, beneficial ownership identification where a buyer is a company, and a documented view on source of funds. Brokerages already carry a RERA broker licence and its renewal obligations, and the AML file sits alongside it as a separate supervisory exposure.

Gold, jewellery and precious stone dealers

The AED 55,000 cash trigger has not changed, and it applies to a single cash transaction or several that appear to be linked. Structuring a sale into instalments below the threshold is the classic failure pattern, and the “appear to be linked” wording exists precisely to defeat it. Anyone buying gold in the UAE in significant quantities should expect identification requests as a matter of routine.

Company and trust service providers

The category now expressly covers providing a registered office, business address or correspondence address. That sweeps in a large number of free zone and virtual-office arrangements sold as a low-cost setup product. If you provide that service commercially, you are a DNFBP. If you are buying it, this is one more reason to verify a company setup provider before you pay.

Virtual asset businesses

Virtual asset service providers are treated as their own category throughout the new instruments rather than as a DNFBP, with the lowest CDD threshold in the regime at AED 3,500. Article 30(2) of the decree-law also creates a standalone offence of dealing in virtual assets characterized by total anonymity, or in unlicensed accounts or technologies that obstruct tracing, punishable by imprisonment of at least three months and a fine of at least AED 50,000. That sits on top of the VARA licensing regime for crypto activity in Dubai.

Frequently Asked Questions

Is my business a DNFBP in the UAE?

You are a DNFBP if you fall into one of the five categories in Article 3 of Cabinet Resolution No. 134 of 2025: commercial gaming operators at AED 11,000 or more, real estate brokers and agents concluding sales or purchases, dealers in valuable metals and precious stones at AED 55,000 or more in cash, lawyers, notaries, independent legal professionals and independent accountants performing listed transactional work, and company and trust service providers. Supervisory authorities can add further activities under Article 3(6).

Do I have to register on goAML even if I never file a report?

Yes. Registration is a standing requirement, not a consequence of having something to report. Article 20 of Federal Decree-Law No. 10 of 2025 prohibits carrying on a DNFBP activity without licence, registration or enrolment from the competent or supervisory authority, and Article 32 backs that with imprisonment and a fine of AED 200,000 to AED 10,000,000. The platform is also the only practical route to file when a report does become necessary.

What is the minimum transaction value that triggers a suspicious transaction report?

There is none. Article 18(1) of the decree-law applies to a suspicious transaction or funds “regardless of their value.” The AED 55,000 and AED 3,500 figures elsewhere in the framework are customer due diligence triggers, not reporting thresholds, and confusing the two is the most common error in UAE AML compliance.

Can I tell my client that I filed a report about them?

No. Article 19(1) of the Executive Regulations prohibits the business, its directors, officers and employees from disclosing directly or indirectly that a report has been or is about to be submitted, or that an investigation is under way. Article 29(1) of the decree-law makes tipping off punishable by imprisonment and a fine of not less than AED 50,000. The only carve-out is sharing within branches and subsidiaries at financial group level.

Are lawyers exempt from reporting suspicious transactions?

Only partly. The exemption in Article 18(2) covers information obtained while assessing a client’s legal position, defending or representing them in court, arbitration or mediation, or advising on judicial proceedings. It does not cover transactional work such as buying and selling real estate, managing client funds or incorporating companies, which is exactly the activity that makes a lawyer a DNFBP in the first place.

How long do I have to keep AML records?

At least five years. For transactions the clock runs from completion of the transaction or the end of the business relationship. For customer due diligence records, Article 25(2) measures five years from the most recent of: end of the relationship, account closure, completion of an occasional transaction, completion of a supervisory inspection, completion of an investigation, or a final court judgment. An inspection therefore extends the retention period.

What is the maximum AML fine for a UAE business?

Administrative fines run to AED 5,000,000 for each violation under Article 17(1)(b), and repeat violations within a year attract an incremental fine. Criminally, a legal person whose representatives commit money laundering on its behalf faces a fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property if greater, under Article 27(1), and the court may order dissolution and closure of the premises.

Does a real estate agency that only handles rentals need an AML program?

On the face of Article 3(2), the DNFBP trigger is concluding transactions or settlements on the purchase or sale of real estate, so a pure leasing brokerage is not caught by that limb. This is a narrow reading of a definition that supervisory authorities can extend under Article 3(6), and many agencies do both. Confirm your position with your supervisory authority rather than assuming the exemption holds.

Who supervises DNFBPs in the UAE?

Supervision is split by sector rather than centralized. Article 16 of the decree-law gives supervisory authorities the duties of risk assessment, desk-based and field inspection, and maintaining statistics on penalties, within their respective areas of competence. Financial institutions sit with the Central Bank, while DNFBPs sit with the ministry or free zone authority that licenses their activity, so your supervisor follows your licence.

Do free zone companies have to comply with UAE AML law?

Yes. The decree-law and its Executive Regulations are federal and apply to the activities they define wherever they are carried on in the State. What changes in a free zone is the identity of your supervisory authority and the inspection process, not whether the obligations apply. Financial free zones with their own regulators layer their own rulebooks on top rather than displacing the federal framework.

Official Sources

Information is current as of August 2026. Every article number, threshold, penalty and date above was read from the English texts of Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 as published on the UAE Legislation portal, and the previous DNFBP definition was read from the repealed Cabinet Decision No. 10 of 2019 on the same portal. Three limitations are stated rather than smoothed over. The exact Official Gazette publication dates were not retrievable, so both entry-into-force dates are given as the decree-law and resolution themselves express them, counted from publication rather than as fixed calendar dates. The goAML registration steps and document list described here reflect the platform’s standard onboarding rather than a published procedural regulation, because the Financial Intelligence Unit does not publish that procedure as legislation; confirm the current requirements on the platform itself. And no registration fee is quoted anywhere, because none is published by any official source. The UAE Legislation portal carries its own notice that the Arabic text prevails in case of conflict. This is general information, not legal advice. Confirm your own classification and obligations with your supervisory authority or a licensed UAE legal adviser.