The UAE has one of the most closely watched anti-money laundering (AML) regimes in the region — and in 2025 it was substantially rebuilt. If your business is an auditor, accountant, real-estate broker, corporate service provider or dealer in precious metals, AML compliance is not optional, and enforcement has only sharpened since the country’s exit from the FATF grey list.
A refreshed legal framework
The UAE overhauled its AML framework in 2025. A new federal decree-law (Federal Decree-Law No. 10 of 2025 on Combating Money Laundering, the Financing of Terrorism and the Financing of Illegal Organisations) replaced the earlier 2018 law, and new executive regulations (Cabinet Resolution No. 134 of 2025) replaced the 2019 implementing regulation. The regime now expressly covers the financing of proliferation alongside money laundering and terrorism financing, and it sits under a strengthened national coordination structure.
The practical obligations for businesses have not been relaxed by the new law — if anything, the framework has been tightened and modernised.
Who must comply
The rules bind two broad groups: Financial Institutions and Designated Non-Financial Businesses and Professions (DNFBPs). The Ministry of Economy supervises four core DNFBP categories:
- Auditors and accountants providing professional services to third parties;
- Trust and company service providers;
- Real-estate brokers and agents;
- Dealers in precious metals and precious stones.
Depending on the entity, the supervisor may be the Central Bank of the UAE, the Ministry of Economy, the DFSA (DIFC), the FSRA (ADGM) or the Securities and Commodities Authority.
Your core obligations
- Customer due diligence (CDD): identify and verify every customer and beneficial owner using reliable, independent sources before the relationship begins. Anonymous or fictitious accounts are prohibited.
- Enhanced due diligence (EDD): apply deeper scrutiny to higher-risk relationships — politically exposed persons, customers connected to high-risk jurisdictions, and unusual or complex transactions.
- Risk-based assessment: maintain a documented, business-wide assessment of your money-laundering and terrorism-financing risk across clients, services, geographies and channels.
- Compliance officer: appoint a qualified, sufficiently senior AML compliance officer with direct access to senior management.
- Record-keeping: retain customer, transaction and reporting records for at least five years.
- Sanctions screening: screen customers and transactions against the UAE’s local terrorist lists and United Nations Security Council sanctions lists, both at onboarding and on an ongoing basis.
goAML: the reporting backbone
goAML is the online platform through which businesses file reports to the UAE’s Financial Intelligence Unit. Built by the UN Office on Drugs and Crime and used by financial intelligence units worldwide, it is administered locally under the Central Bank.
- Registration is mandatory for every Financial Institution and DNFBP — failing to register is itself treated as a compliance failure.
- Suspicious Transaction and Activity Reports must be filed without delay whenever there are reasonable grounds to suspect proceeds of crime. Suspicion — not proof — is the trigger, and there is no minimum monetary threshold.
- Tipping off a customer that a report has been or may be filed is prohibited.
Penalties
The regime carries both criminal and administrative consequences. These range from substantial fines and, for money-laundering offences, imprisonment, through to the suspension or cancellation of licences, restrictions on responsible individuals, and public disclosure of penalties. Supervisors carry out regular inspections of DNFBPs, and enforcement action in this area is active and well publicised. Because the precise figures are set out in the law and its executive regulations and are periodically updated, businesses should confirm the current penalty schedule with their supervisor rather than rely on older summaries.
Why this matters now
In February 2024 the Financial Action Task Force removed the UAE from its list of jurisdictions under increased monitoring — the “grey list” — and the European Union subsequently removed the UAE from its own high-risk list. That progress was built on exactly the kind of compliance the rules require, and it has been accompanied by continued, rigorous enforcement rather than a lighter touch. The 2025 legal overhaul confirms the direction of travel: robust, internationally aligned, and here to stay.
How Active Auditors can help
As a UAE audit and advisory firm, we help businesses register on goAML, build risk-based AML policies and procedures, run customer due diligence and screening, appoint and support compliance officers, and stay ready for supervisory inspection. If you are unsure whether the rules apply to you — or whether your current programme is adequate — we can review your position.