Tax & Compliance · AML Compliance

AML compliance for UAE businesses

Anti-money-laundering obligations do not stop at banks. A category of businesses known as DNFBPs — designated non-financial businesses and professions — carries its own duties, and most owners in scope do not know they are in it until an inspection.

Federal Decree-Law 10 of 2025Cabinet Resolution 134 of 2025Six categories, read off Article 3

Get a setup plan Talk to an advisor

Who is in scope

Six categories now, not four

Article 3 of Cabinet Resolution 134 of 2025 sets out the designated non-financial businesses and professions. The familiar "four DNFBP categories" list that most published material still runs is out of date. If your business touches high-value assets, gaming, or helping other people form companies, assume you are in scope until you have confirmed otherwise.

Commercial gaming operators Including on board vessels. Triggered by a single or linked transaction of AED 11,000 or more — a category that did not exist before.

Real estate brokers and agents Concluding purchase or sale transactions on behalf of customers.

Dealers in valuable metals and precious stones Triggered by a single or linked cash transaction of AED 55,000 or more.

Lawyers, notaries and independent accountants Also other independent legal professionals. Five listed activities, including managing client funds, forming or managing legal persons, and buying or selling commercial entities.

Company and trust service providers Five listed activities.

Anything else the supervisory authority designates In coordination with the National Committee.

It is a programme, not a formCabinet Resolution 134 of 2025 requires a written risk assessment proportionate to the nature and size of your business, applying a risk-based approach and the results of the National Risk Assessment (Art. 5); customer due diligence before you act, with enhanced checks on higher-risk clients (Arts. 6–15); and staff training.
A compliance officer at management levelWith independence in decision-making and appropriate competence and experience (Art. 22). The role is real, not a name on a form.
Records kept for not less than five yearsFrom completion of the transaction or the end of the business relationship. The same floor applies to CDD records, account files, correspondence, ID copies, reports and CCTV (Art. 25).
Report suspicion immediately and without delayTo the Financial Intelligence Unit, through its electronic system (Art. 18). Under the new law the FIU sits within the Central Bank (Federal Decree-Law 10 of 2025, Art. 11).
Two registrations sit underneath all of itgoAML, the FIU's reporting portal, which DNFBPs were required to enrol in; and registration with the Executive Office for Control and Non-Proliferation to receive automatic updates to the UN and local sanctions lists, with screening against them and a funds-freeze report through goAML within 5 days.
The commonest failure is a policy with no evidence behind itInspections look for the file on the client, not the manual on the shelf.
This page does not tell you who supervises youFederal Decree-Law 10 of 2025 defines "supervisory authority" generically — the federal and local authorities entrusted under the legislation — and does not name a ministry. That remains unverified, so nothing here asserts it. Confirm your supervisor for your own activity before registering with a named body.

At a glance

The essentials

Governing law: Federal Decree-Law No. 10 of 2025, in force 14 October 2025
Implementing regulation: Cabinet Resolution No. 134 of 2025, in force 14 December 2025
What was repealed: FDL 20 of 2018 (Art. 41) and Cabinet Resolution 10 of 2019 (Art. 70)
DNFBP categories: Six under Article 3 — not the four most published material still lists
Record retention: Not less than five years from the transaction or the end of the relationship
Fine per violation: Not less than AED 10,000 and not more than AED 5,000,000
Where reports go: The Financial Intelligence Unit, which now sits within the Central Bank
Who supervises you: Not named in the law — confirm for your activity before registering

Does this apply to you

Should you act?

Being unregistered is itself the breach, so the question is worth settling once rather than assuming.

✓

This applies to you if

You are a real estate broker, precious metals dealer, auditor or corporate services providerNow. These are named categories, and being unregistered is the breach.
You run a commercial gaming operationA category that did not exist under the old law, triggered at AED 11,000 in a single or linked transaction.
You are adjacent to a listed categoryA law firm doing company formation, a consultancy holding client funds, a car dealer taking large cash payments. Check carefully.

It may not apply if

You are a straightforward trading or services companyWith no activity in any listed category. "Probably not" is worth converting to "confirmed" once.

FAQ

Common questions

Ask AgentBiz

My manual was written in 2024. Is it still valid?

It cites a repealed law. Federal Decree-Law 20 of 2018 was repealed on 14 October 2025, and Cabinet Resolution 10 of 2019 on 14 December 2025.

How often does the risk assessment need redoing?

When your business changes materially, and periodically regardless. A three-year-old assessment describing a business you no longer run is not a defence.

Can the compliance officer be the owner?

Often yes in a small firm, provided they have the authority and the time. Article 22 requires independence in decision-making and appropriate competence and experience — the role is real, not a name on a form.

What actually triggers a report?

Suspicion, not proof. The threshold is lower than most people assume, and not reporting is the offence. Lawyers, notaries, other independent legal professionals and independent statutory auditors have a narrow exemption where the information is covered by professional secrecy (Art. 18(2)) — narrow, and not a general shield.

What does a breach cost?

Federal Decree-Law 10 of 2025, Article 17, sets an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation, alongside warnings, restriction of officers' powers, suspension of the activity, publication of the penalty and revocation of the licence. Repeat violations within a year can be escalated.