By StartZone UAE Editorial Team | September 2026
AML compliance for DNFBP UAE 2026 is no longer a paperwork formality that businesses can defer until a bank or regulator asks questions. Under Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism, and the enforcement schedule set out in Cabinet Resolution No. 71 of 2024, Designated Non-Financial Businesses and Professions across the UAE now face administrative fines of up to AED 5,000,000 per violation for gaps that were routinely overlooked just two years ago. Real estate brokers, auditors and accountants, precious metals and stones dealers, and corporate and trust service providers are all squarely inside the Ministry of Economy‘s supervisory net, and enforcement data shows the Ministry is using it. This guide walks through what AML compliance for DNFBP UAE 2026 actually requires: goAML registration, a documented risk-based program, suspicious transaction reporting, record-keeping, and the penalty framework that makes ignoring any of it an expensive mistake.
What Is a DNFBP Under UAE AML Law
A Designated Non-Financial Business or Profession, or DNFBP, is any business that falls outside the traditional banking and insurance sector but still handles transactions, funds, or client assets in ways that carry money laundering risk. The UAE adopted the DNFBP classification directly from the Financial Action Task Force (FATF) recommendations, and Federal Decree-Law No. 20 of 2018 — now succeeded by Federal Decree-Law No. 10 of 2025 — built the domestic legal foundation around it. The size of the business is irrelevant to the obligation: a sole-practitioner corporate service provider carries the same AML compliance for DNFBP UAE 2026 duties as a fifty-branch audit firm.
The Four DNFBP Categories Supervised by the Ministry of Economy
The Ministry of Economy and Tourism publishes a clear scope for who must comply. The four core categories are:
- Real estate firms — brokers and agents facilitating property sale, purchase, or lease transactions on behalf of clients.
- Auditing and accounting firms — practices providing independent assurance, bookkeeping, or advisory services on financial matters.
- Dealers in precious metals and stones (DPMS) — jewellers, refiners, cutters, and traders handling gold, diamonds, and gemstones.
- Trust and company service providers (TCSPs) — firms offering company formation, registered agent, nominee director, or corporate administration services.
Independent legal consultants and law firms performing specified financial or property-related activities for clients are also brought within scope under the Ministry of Justice’s parallel supervisory track, and commercial gaming operators were added as a fifth category following recent legislative updates. If your business touches any of these activities, AML compliance for DNFBP UAE 2026 obligations apply from the day you start operating, not from the day a regulator sends a notice.
Why AML Compliance for DNFBP UAE 2026 Enforcement Has Intensified
The shift from a light-touch registration regime to active, well-publicised enforcement is the single biggest change DNFBPs need to understand this year. The Ministry of Economy has moved from issuing circulars to issuing fines. In one recent action, the Ministry imposed fines exceeding AED 22.6 million on 29 DNFBP companies — 17 precious metals and gems dealers, four corporate service providers, and two auditing firms — for a combined 225 violations, the majority tied to a failure to screen customers and transactions against the UAE’s terrorism list. A separate enforcement round levied AED 3.55 million in fines across 69 violations against eight DNFBP companies.
Two structural changes explain the intensity. First, Federal Decree-Law No. 10 of 2025 replaced the 2018 law with a modernised framework that widens supervisory powers and raises the penalty ceiling. Second, Cabinet Resolution No. 71 of 2024 introduced a unified tariff of administrative penalties spanning 41 distinct violation types, which gives inspectors a fixed schedule to apply rather than case-by-case discretion. For any business still treating AML compliance for DNFBP UAE 2026 as optional or low-priority, that combination of a wider net and a fixed fine schedule is the reason to move it to the top of the compliance calendar. Businesses that ignore annual free zone compliance filings tend to be the same businesses that fall behind on AML obligations, since both rely on the same internal governance discipline.
How the 2026 Rules Differ From the Pre-2025 Regime
Businesses that registered for AML purposes several years ago and assumed the job was done are the ones most exposed under the current framework. The old regime, built around Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, treated goAML registration and a written policy as largely sufficient evidence of compliance. AML compliance for DNFBP UAE 2026 is a materially different standard: it is outcome-tested. Inspectors now ask for proof that customer screening actually ran, that the MLRO actually reviewed flagged files, and that reports were actually filed within a reasonable window of suspicion arising — not just that a policy document describing those steps exists in a folder.
The practical effect is that a DNFBP can hold a valid trade licence, an active goAML account, and a written AML policy, and still be fined if the underlying activity doesn’t match the paperwork. This is why recent Ministry enforcement rounds have concentrated on sanctions-list screening failures rather than registration gaps — registration is now assumed as a baseline, and the scrutiny has moved one level deeper into whether the program actually functions day to day.
GoAML Registration Is the Mandatory First Step
Registration on goAML — the UAE Financial Intelligence Unit’s reporting platform, operated under the Central Bank — is the non-negotiable starting point for AML compliance for DNFBP UAE 2026. A business that has not registered is considered non-compliant from day one, regardless of whether it has ever handled a suspicious transaction. Increasingly, banks are checking goAML registration status before opening or maintaining corporate accounts for real estate firms, precious metals traders, and company service providers, which means unregistered DNFBPs risk frozen accounts and blocked remittances in addition to regulatory fines — a gap that shows up in the same due-diligence checks banks run when a corporate bank account application gets rejected.
Documents Required for goAML Registration
- A valid commercial trade licence listing the current partners or owners
- Passport copy, Emirates ID, and residency visa of the appointed Money Laundering Reporting Officer (MLRO)
- An authorisation letter confirming the MLRO’s appointment
- A working email address and a Google Authenticator-compatible device for two-factor authentication on the portal
Step-by-Step GoAML Enrollment Process
- Create an organisation profile on the goAML portal using the registered trade licence details.
- Upload the MLRO’s identification documents and the signed authorisation letter.
- Configure two-factor authentication and confirm the organisation’s registered email.
- Await activation confirmation from the Financial Intelligence Unit before submitting any reports.
- Test the reporting interface with a nil return to confirm the account is fully operational.
Firms that delay goAML registration until a client transaction looks suspicious are already too late — the portal access itself, not just the report, is the compliance requirement.
Building a Risk-Based AML/CFT Compliance Program
Registration alone does not satisfy AML compliance for DNFBP UAE 2026 requirements. Regulators expect a documented, risk-based program that is actually followed, not a policy binder that sits unopened. Three components anchor that program.
Appointing a Money Laundering Reporting Officer (MLRO)
Every DNFBP must designate a compliance officer — commonly called the MLRO — responsible for monitoring transactions, filing reports, and acting as the point of contact for the Financial Intelligence Unit and Ministry inspectors. The MLRO should sit senior enough in the organisation to have real authority to halt a transaction or escalate a concern without commercial pressure overriding the decision.
Conducting Customer Risk Assessment (CRA)
The Ministry of Economy’s Customer Risk Assessment guidance requires DNFBPs to score each client relationship against factors drawn from the UAE’s National Risk Assessment — geography, transaction type, source of funds, and beneficial ownership complexity among them. A real estate firm selling to a walk-in local buyer carries a different risk profile than one facilitating a high-value purchase for an offshore corporate structure, and the compliance program must reflect that difference in practice, not just on paper.
Customer Due Diligence and Enhanced Due Diligence
Standard customer due diligence (CDD) — verifying identity, ownership, and the purpose of the business relationship — applies to every client. Enhanced due diligence (EDD) kicks in for higher-risk categories: politically exposed persons, clients from higher-risk jurisdictions, and transactions that don’t have an obvious commercial rationale. Skipping EDD on a flagged client is one of the most common findings in Ministry inspections.
Ongoing monitoring closes the loop on all three components. A CDD file completed at onboarding and never revisited is a snapshot, not a control — client circumstances, ownership structures, and risk profiles change, and a program built for genuine AML compliance for DNFBP UAE 2026 standards revisits higher-risk files periodically rather than treating onboarding as the only checkpoint that matters.
Suspicious Transaction and Activity Reporting Obligations
Once a DNFBP suspects, or has reasonable grounds to suspect, that a transaction or client relationship involves money laundering, terrorism financing, or proceeds of crime, Article 18 of Federal Decree-Law No. 10 of 2025 requires the business to file a report through goAML without delay. There is no minimum transaction value that exempts a business from this duty — a suspicious AED 5,000 transaction is reportable just as much as a suspicious AED 5,000,000 one.
DNFBPs typically file several report types depending on the sector and trigger: Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and, for sectors like real estate and precious metals, additional sector-specific notifications. Filing internally to a manager and stopping there does not satisfy the obligation — the report has to reach the Financial Intelligence Unit through the goAML system.
Record-Keeping Requirements Under the Five-Year Rule
UAE AML regulations require DNFBPs to retain transaction records, customer due diligence documentation, and supporting correspondence for a minimum of five years from the date the transaction was completed or the business relationship ended. This isn’t a suggestion — inspectors routinely request historical CDD files during on-site visits, and an inability to produce them is treated as a standalone violation separate from any underlying AML failure. Digital record-keeping systems that timestamp and lock documents once filed are becoming the practical standard, since paper files are far easier for inspectors to find incomplete.
In practice, inspectors tend to sample rather than review every file, which means gaps are found fastest in whichever records are hardest to retrieve. A DNFBP that can produce a complete CDD file, correspondence trail, and transaction log for any client within minutes of being asked is demonstrating exactly the operational maturity the five-year rule is designed to test — and doing so consistently is one of the clearest signals an inspector uses to judge the rest of the program favourably.
Sector-Specific Transaction Thresholds to Monitor
Certain DNFBP categories carry specific cash transaction thresholds above which enhanced monitoring and reporting duties are automatically triggered, separate from the general suspicion-based reporting duty:
- Dealers in precious metals and stones: AED 55,000 for a single transaction or a series of linked transactions.
- Commercial gaming operators: AED 11,000 for a single or linked financial transaction, excluding gaming chips.
- Real estate transactions: reporting obligations attach regardless of value where the transaction pattern itself is unusual for the client or property type.
Businesses that only monitor for suspicion and ignore these fixed thresholds are missing an entire category of AML compliance for DNFBP UAE 2026 obligations that apply automatically, with no judgment call required.
Penalties for Non-Compliance With DNFBP AML Rules
The penalty structure has two layers. Federal Decree-Law No. 10 of 2025, Article 17, sets the outer boundary: administrative fines of not less than AED 10,000 and not exceeding AED 5,000,000 for each violation. Cabinet Resolution No. 71 of 2024 then applies a unified tariff across 41 specific violation types — covering failures such as not registering on goAML, not appointing an MLRO, not conducting CDD, and not filing required reports — with fines commonly falling in the AED 50,000 to AED 1,000,000 range depending on severity and repetition.
Beyond the direct fine, non-compliant DNFBPs face secondary consequences that are often more disruptive to daily operations: banks freezing corporate accounts pending evidence of goAML registration, correspondent banks declining transfers, and — in serious or repeated cases — licence suspension by the Ministry of Economy. A frozen operating account, triggered by an AML gap rather than a criminal finding, has shut down cash flow for more than one UAE business that assumed compliance was a low priority.
Common Compliance Failures That Trigger Ministry Enforcement
Enforcement patterns from recent Ministry actions point to a recurring set of failures:
- No goAML registration, or a registration that was never activated after initial sign-up
- No MLRO appointed, or an MLRO appointed on paper with no real operational authority
- No screening of customers and beneficial owners against the UAE’s terrorism and sanctions lists
- CDD files that are incomplete, expired, or missing beneficial ownership documentation
- Internal AML policies that exist as a document but were never trained on or followed
- Missed or late suspicious transaction reports, particularly where staff assumed a transaction was “too small” to matter
Every one of these is preventable with a functioning, reviewed compliance program rather than a one-time policy purchase. None of them require sophisticated technology to fix — they require someone with real accountability checking that the program is being followed, on a fixed schedule, and documenting that the check happened.
A Practical AML Compliance Checklist for 2026
For a DNFBP assessing where it stands on AML compliance for DNFBP UAE 2026, the following checklist covers the baseline the Ministry of Economy expects:
- Confirm goAML registration is complete and active, not just submitted
- Appoint and document an MLRO with real authority to escalate concerns
- Adopt a written, risk-based AML/CFT policy covering CDD, EDD, and ongoing monitoring
- Screen every client and beneficial owner against the UAE terrorism and sanctions lists at onboarding and periodically thereafter
- Maintain CDD and transaction records for a minimum of five years in a retrievable format
- Train staff annually on recognising and escalating suspicious activity
- Monitor sector-specific cash thresholds and file the correct report type without delay
- Review the compliance program at least annually against updated Ministry guidance
Businesses that also keep their broader regulatory position current — including registered address and correspondence requirements and pending obligations like e-invoicing readiness ahead of the 2027 mandate, tend to find AML compliance easier to sustain, since the underlying discipline of accurate, timely record-keeping is the same across all three.
Start Your DNFBP Compliance Journey With StartZone UAE
AML compliance for DNFBP UAE 2026 is now an operating cost of doing business in the sectors the Ministry of Economy supervises, and the gap between a compliant business and a fined one is usually a missing MLRO appointment, an inactive goAML account, or a CDD file nobody kept up to date. StartZone UAE works with real estate firms, auditors, precious metals dealers, and corporate service providers to build AML programs that hold up under inspection — from goAML registration through to ongoing monitoring and staff training.
Start your UAE business journey today →
Frequently Asked Questions
What is a DNFBP under UAE AML law?
A DNFBP, or Designated Non-Financial Business or Profession, is a business outside traditional banking that still carries money laundering risk — including real estate brokers, auditors and accountants, precious metals and stones dealers, and trust and company service providers, all supervised by the Ministry of Economy under Federal Decree-Law No. 10 of 2025.
Is goAML registration mandatory for every DNFBP in the UAE?
Yes. Every DNFBP operating in the UAE must register on the goAML platform regardless of size or transaction volume. A business that has not registered is considered non-compliant with AML compliance for DNFBP UAE 2026 requirements from the outset, and banks increasingly check registration status before servicing corporate accounts.
How long must DNFBPs keep AML and CDD records?
UAE regulations require a minimum five-year retention period for transaction records, customer due diligence documentation, and related correspondence, counted from the date the transaction or business relationship ended.
What are the fines for AML non-compliance for DNFBPs in 2026?
Federal Decree-Law No. 10 of 2025 sets fines from AED 10,000 to AED 5,000,000 per violation. Cabinet Resolution No. 71 of 2024 applies a unified tariff across 41 violation types, with typical fines in the AED 50,000 to AED 1,000,000 range depending on the specific failure and whether it is repeated.
Who needs to be appointed as the Money Laundering Reporting Officer?
The MLRO should be a senior individual within the DNFBP with genuine authority to review transactions, halt suspicious activity, and file reports through goAML. The role cannot be nominal — Ministry inspections specifically test whether the appointed MLRO has real operational involvement.
Do small or single-owner DNFBPs get any exemption from AML compliance?
No. AML compliance for DNFBP UAE 2026 obligations apply regardless of business size. A solo corporate service provider or independent real estate broker carries the same registration, reporting, and record-keeping duties as a large multi-branch firm.
How is AML compliance for DNFBP UAE 2026 different from the 2018 rules?
The current framework under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 71 of 2024 raises the fine ceiling and shifts inspection focus from whether registration paperwork exists to whether the AML program is actually operating — screening, reporting, and record-keeping in practice, not just on paper.
Image: Scales of Justice by North Charleston, licensed under CC BY-SA 2.0.
