Quick Summary

A comprehensive, step-by-step UAE AML regulations compliance checklist designed for businesses, DNFBPs, and financial institutions operating in Dubai and the broader UAE. This guide breaks down legal obligations, risk assessments, customer due diligence, beneficial ownership identification, sanctions screening, goAML reporting, and practical execution steps required under federal legislation.

Operating a business in Dubai or across the wider United Arab Emirates (UAE) requires strict, proactive adherence to federal Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and Counter Proliferation Financing (CPF) regulatory frameworks. Guided by the Central Bank of the UAE (CBUAE), the Ministry of Economy (MoE), the Ministry of Justice (MoJ), and financial services regulatory bodies across specialized free zones like the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), the UAE has instituted a robust financial crime compliance architecture.

For operating commercial entities, maintaining strict alignment with these federal obligations is not merely an administrative exercise. It represents a fundamental operational necessity to preserve commercial banking relationships, safeguard corporate reputation, avoid severe administrative fines, and prevent executive criminal liability. To help compliance officers, legal counsel, board directors, and Designated Non-Financial Businesses and Professions (DNFBPs) systematically evaluate and strengthen their internal controls, this operational UAE AML regulations compliance checklist provides a detailed breakdown of legal, technical, and procedural mandates.

Understanding the UAE AML Legal Architecture

The legal foundation of the UAE’s AML/CFT regulatory framework is governed primarily by Federal Decree-Law No. (20) of 2018 on Anti-Money Laundering and Combatting the Financing of Terrorism and Financing of Illegal Organisations, as amended by Federal Decree-Law No. (26) of 2021, and supported by its Executive Regulations under Cabinet Decision No. (10) of 2019. Further legislative enhancements, including Cabinet Decision No. (109) of 2023 regarding the Regulation of Beneficial Owner Procedures, as well as updated federal decrees such as Federal Decree-Law No. (10) of 2025, have solidified regulatory expectations across every jurisdiction within the seven emirates.

Regulatory obligations apply to all commercial entities operating within the UAE onshore jurisdiction, commercial free zones (such as DMCC, JAFZA, and KIZAD), and financial free zones (DIFC and ADGM). Regulated entities fall into two principal categories:

• Financial Institutions (FIs): Commercial banks, investment firms, exchange houses, money services businesses (MSBs), payment service providers (PSPs), digital asset service providers (VASPs), insurance companies, and finance companies. Primary supervision rests with the CBUAE, the Securities and Commodities Authority (SCA), the Dubai Financial Services Authority (DFSA), or the Financial Services Regulatory Authority (FSRA).
• Designated Non-Financial Businesses and Professions (DNFBPs): Real estate brokers and developers, dealers in precious metals and stones (DPMS), trust and company service providers (TCSPs), corporate service providers (CSPs), independent legal practitioners and auditors, and accounting firms. Supervision for DNFBPs is managed by the Ministry of Economy, the Ministry of Justice, or specific free zone authorities.

Key Differences in Supervisory Oversight

While federal legislation mandates uniform baseline obligations—such as Ultimate Beneficial Ownership (UBO) disclosure, sanctions screening, and goAML reporting—supervisory authorities enforce distinct guidelines tailored to sector-specific risks. For example, CBUAE-regulated entities face stringent rules regarding transaction monitoring software and capital requirements, whereas DNFBPs regulated by the Ministry of Economy must submit specialized operational reports based on sector risks, such as Real Estate Activity Reports (REARs) for high-value property transactions.

The Core UAE AML Regulations Compliance Checklist

Establishing a fully compliant AML/CFT ecosystem requires a structured, multi-layered approach. The following compliance checklist details the seven foundational pillars that every regulated business in the UAE must construct, execute, and continuously evaluate.

1. Enterprise-Wide Risk Assessment (EWRA)

A compliant framework begins with a formal, documented Enterprise-Wide Risk Assessment (EWRA). Organizations must systematically identify, analyze, and quantify their exposure to money laundering, terrorist financing, and proliferation financing risks across their operational footprint.

• Four Risk Categories: Assess inherent risk across four key vectors:
  • Customer Risk: High-net-worth individuals, Politically Exposed Persons (PEPs), cash-intensive businesses, complex ownership structures, and non-resident entities.
  • Geographic Risk: High-risk jurisdictions identified by the Financial Action Task Force (FATF), sanctioned nations, tax havens, or countries with high perceived corruption.
  • Product and Service Risk: Trade finance, private banking, anonymous transfers, high-value bullion trading, corporate structuring, and cross-border wire transfers.
  • Delivery Channel Risk: Non-face-to-face customer onboarding, reliance on third-party intermediaries, and automated fintech channels.
• Documented Scoring Methodology: Formulate a structured risk scoring methodology that assigns objective weightings to inherent risks, evaluates internal mitigation controls, and determines the residual risk score.
• Periodic Review and Escalation: Review and update the EWRA at least annually. Immediate updates are required following major operational changes, launch of new products, entry into new geographic markets, or significant updates to national risk assessments (NRA).

2. Governance, Policies, and Compliance Officer Appointment

Robust AML policies must be supported by an empowered compliance governance structure and senior management accountability.

• Appointment of a Qualified MLRO / Compliance Officer: Appoint a dedicated, UAE-resourced Anti-Money Laundering Compliance Officer and Money Laundering Reporting Officer (MLRO). The individual must possess adequate experience, hold proper regulatory clearance where required, and enjoy operational independence with direct access to the Board of Directors or executive leadership.
• Internal Compliance Manual: Develop, publish, and maintain an updated AML/CFT/CPF Policy and Procedures Manual tailored specifically to the company’s EWRA. Generic, off-the-shelf templates fail regulatory inspections and create severe legal vulnerabilities.
• Senior Management Governance: Ensure the Board of Directors or senior executive committee reviews and formally approves all compliance policies, risk appetites, and annual audit reports. Board minutes must reflect substantive discussions on financial crime risk.

3. Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), and UBO Protocols

Knowing your customer (KYC) and uncovering the ultimate natural person behind legal structures form the core of federal compliance under Cabinet Decision No. (109) of 2023.

• Standard Customer Due Diligence (CDD): Obtain and verify baseline identity records prior to establishing a business relationship or executing an occasional transaction:
  • For natural persons: Valid Emirates ID or passport, proof of address, and nationality.
  • For legal entities: Valid trade license or commercial registration, Certificate of Incorporation, Memorandum and Articles of Association, register of directors, and incumbency certificate.
• Ultimate Beneficial Ownership (UBO) Verification: Identify and verify any natural person who ultimately owns or controls, directly or indirectly, 25% or more of the legal entity’s equity or voting rights. If no individual meets this threshold, identify the natural person exercising control through other means, or verify the senior managing official. Maintain an updated internal UBO Register at all times.
• Enhanced Due Diligence (EDD): Apply enhanced controls for high-risk customers, including:
  • Obtaining explicit Senior Management approval prior to onboarding.
  • Establishing verifiable Source of Funds (SOF) and Source of Wealth (SOW).
  • Conducting deep-dive adverse media and public record background checks.
  • Applying continuous operational monitoring to business activities.
• Simplified Due Diligence (SDD): Apply reduced due diligence measures only when lower risk is objectively proven and permitted under supervisory guidance (e.g., state-owned entities or entities listed on regulated stock exchanges).

4. Targeted Financial Sanctions (TFS) & Real-Time Screening

The UAE enforces strict zero-tolerance policies regarding domestic and international sanctions lists administered by the Executive Office for Control and Non-Proliferation (EOCN).

• Sanctions Screening Scope: Screen all prospective and existing clients, UBOs, legal representatives, directors, operational counterparties, and payment details against:
  • The UAE Local Terrorist List (issued by the Cabinet).
  • The UN Security Council Consolidated List.
  • Relevant international lists (such as OFAC, EU, UK HMT) where operational exposure exists.
• Screening Frequency: Implement automated, real-time screening tools capable of scanning customer databases and incoming/outgoing operational transactions instantly upon updates to sanction lists. Updates published by the EOCN must reflect in screening engines within 24 hours.
• Freezing and Unilateral Asset Blocking: Establish formal, written operational procedures to freeze funds, assets, or accounts within 24 hours without prior notice upon confirming a true sanction match. Submitting a Fund Freeze Report (FFR) via the goAML portal is mandatory.

5. Transaction Monitoring & goAML Reporting Obligations

Monitoring business relationships allows firms to identify unusual patterns and meet mandatory legal reporting thresholds.

• Transaction Monitoring System: Establish automated or semi-automated transaction monitoring processes calibrated against baseline customer behavior, source of funds declarations, and risk scores. Flags must be raised for structured payments, unexpected high-value transfers, and uncharacteristic geographic flows.
• goAML Platform Registration: Secure active, verified registration on the UAE Ministry of Interior’s goAML portal, managed by the Financial Intelligence Unit (FIU). Maintain valid system credentials and operational readiness.
• Submitting STRs and SARs: Promptly analyze flagged activities. If reasonable grounds exist to suspect that funds involve illicit activity, money laundering, or terrorist financing, file a Suspicious Transaction Report (STR) or Suspicious Activity Report (SAR) via goAML within statutory timeframes.
• Sector-Specific Regulatory Reports: DNFBPs must file specialized sector reports as mandated by supervisory bodies, such as:
  • Real Estate Activity Reports (REARs): Mandatory for real estate professionals handling cash payments above AED 55,000 or virtual asset transactions.
  • High-Value Payment Reports (HVPRs): Required for dealers in precious metals and stones handling cash transactions above AED 55,000.

6. Record-Keeping & Retention Standards

Retaining detailed records ensures that law enforcement agencies and supervisory authorities can rebuild transaction histories during official inquiries.

• Five-Year Retention Mandate: Store all CDD documentation, UBO registers, transaction ledgers, account files, internal review logs, and goAML filings for a minimum of five (5) years following the termination of the business relationship or the completion of an occasional transaction.
• Data Accessibility and Protection: Store electronic and physical records securely. Records must be organized to allow swift retrieval and presentation to the CBUAE, Ministry of Economy, or law enforcement bodies upon official request.

7. Employee Training and Culture of Compliance

Human oversight remains a primary defense against financial crime risks.

• Mandatory Annual Training: Deliver comprehensive AML/CFT/CPF training to all operational, front-line, management, and compliance staff at least annually. Tailor modules to reflect specific job duties and operational exposures.
• Red-Flag Typologies: Train staff to recognize industry-specific red flags, such as customer reluctance to provide UBO documentation, third-party payments from unrelated offshore entities, and economic transactions lacking clear business logic.
• Audit Trails of Training: Maintain full documentation of training sessions, attendance registers, course content, and employee post-training evaluation results.

Sector-Specific Compliance Requirements Comparison

The operational application of UAE AML requirements varies depending on corporate authorization and regulatory classification. The following matrix illustrates key compliance benchmarks across primary sectors:

Compliance Domain	Financial Institutions (FIs)	Real Estate Brokers & Developers	Trust & Company Service Providers (TCSPs)	Dealers in Precious Metals & Stones
Primary Regulator	CBUAE / SCA / DFSA / FSRA	Ministry of Economy / Municipalities	Ministry of Economy / Free Zone Authorities	Ministry of Economy
goAML Registration	Mandatory	Mandatory	Mandatory	Mandatory
UBO Threshold	25% or ultimate control	25% or ultimate control	25% or ultimate control	25% or ultimate control
Screening Frequency	Real-time / Automated daily batch	Onboarding & prior to contract signing	Onboarding & structural changes	At point of transaction / cash trade
Specialized Reporting	STR / SAR / FFR / PTR	REAR (Cash/Crypto ≥ AED 55k)	STR / SAR / Complex Structure Alerts	HVPR (Cash trades ≥ AED 55k)
Record Retention	Minimum 5 years	Minimum 5 years	Minimum 5 years	Minimum 5 years

Step-by-Step Implementation Guide for Businesses

To move from conceptual understanding to operational compliance, organizations should execute a structured four-phase implementation framework:

Phase 1: Perform a Comprehensive Gap Analysis

Begin by comparing existing corporate policies, customer files, screening tools, and onboarding workflows against current CBUAE and Ministry of Economy guidelines. Document operational deficiencies, unverified customer files, missing UBO declarations, and outdated risk assessments in a structured Remediation Action Plan.

Phase 2: Remediate High-Risk Client Portfolios

Prioritize existing customer portfolios based on risk exposure. Request missing KYC documents, verify updated trade licenses, identify 25% UBO thresholds, and re-screen client databases against official lists. Flag high-risk accounts, such as Politically Exposed Persons (PEPs) or entities from high-risk jurisdictions, for formal executive review and Source of Wealth verification.

Phase 3: Upgrade Technical Systems and Reporting Channels

Test the technical performance of sanctions screening engines and transaction monitoring tools using synthetic test profiles and true-match scenario data. Confirm that match alerts route correctly to compliance officers and verify that goAML system access and reporting profiles function without technical disruption.

Phase 4: Conduct Independent Compliance Audits

Validate the operational efficiency of internal controls by scheduling independent internal or external AML audits. External advisory reviews simulate regulatory inspections, helping board members and MLROs resolve structural weaknesses prior to official supervisory reviews.

Risk Considerations and Regulatory Sanctions

Supervisory authorities in the UAE maintain an active, enforcement-focused stance against non-compliant entities. The Cabinet Decision No. (16) of 2021 regarding Administrative Penalties lists explicit fines and non-financial sanctions for regulatory violations.

Common Administrative Violations and Fines

• Failure to register on goAML: Administrative fines ranging from AED 50,000 to AED 100,000.
• Failure to perform risk assessments (EWRA): Fines ranging from AED 50,000 to AED 100,000.
• Failure to conduct CDD/EDD prior to onboarding: Penalties up to AED 500,000.
• Failure to implement targeted financial sanctions protocols: Fines reaching up to AED 1,000,000 per instance.
• Failure to report suspicious transactions (STR/SAR): Substantial financial penalties up to AED 5,000,000 alongside executive referral for potential criminal prosecution under federal anti-money laundering laws.

In addition to financial penalties, supervisory authorities possess statutory powers to suspend operational commercial licenses, restrict business operations, mandate the removal of compliance officers or board members, and publicly publish administrative fines against non-compliant firms.

How Professional Compliance Advisory Protects Your Enterprise

Navigating the changing legal environment of UAE anti-money laundering regulations requires specialized technical insight, ongoing regulatory monitoring, and structured internal workflows. Operating in association with Farahat & Co., Tareq Badarin offers tailored AML compliance consultancy services designed specifically for DNFBPs, financial service providers, and commercial firms in Dubai and across the UAE.

Services include designing customized Enterprise-Wide Risk Assessments, drafting institutional AML/CFT policy manuals, conducting goAML operational audits, performing KYC/UBO remediation, and managing regulatory supervisory inspections. Professional advisory helps ensure your business remains compliant, structurally secure, and fully aligned with federal requirements.

Contact Tareq Badarin today to schedule an executive compliance consultation and ensure your organization’s financial crime prevention architecture meets every federal benchmark.

Frequently Asked Questions

What businesses are required to follow UAE AML regulations?

UAE AML regulations apply to all Financial Institutions (FIs) regulated by CBUAE, DFSA, or FSRA, as well as Designated Non-Financial Businesses and Professions (DNFBPs). DNFBPs include real estate agents and brokers, dealers in precious metals and stones, corporate service providers, trust providers, independent auditors, and lawyers.

What is the mandatory threshold for Ultimate Beneficial Ownership (UBO) in the UAE?

Under UAE federal regulations, an Ultimate Beneficial Owner (UBO) is generally defined as any natural person who ultimately owns or controls 25% or more of an entity's capital or voting rights, or who exercises ultimate control over the management of the legal entity.

How often should an Enterprise-Wide Risk Assessment (EWRA) be updated?

An Enterprise-Wide Risk Assessment should be reviewed and updated at least annually. Additionally, it must be re-evaluated whenever there are significant changes to your business model, customer base, geographic reach, or relevant federal laws.

What is the goAML system and who needs to register?

goAML is an online portal operated by the UAE Financial Intelligence Unit (FIU) for reporting suspicious transactions and activities. Registration on goAML is mandatory for all regulated Financial Institutions and DNFBPs operating in the UAE.