DNFBP AML Compliance in the UAE 2026: Who Is Covered, What’s Required, and Who Supervises

DNFBP (Designated Non-Financial Businesses and Professions) is a category of businesses that are not financial institutions but must comply with AML/CFT requirements on par with banks: real estate agents, dealers in precious metals and stones, trust and company service providers, accountants, auditors, lawyers, notaries, and commercial gaming operators.

The current base statute is Federal Decree-Law No. (10) of 2025 on Combating Money Laundering, the Financing of Terrorism, and the Financing of Proliferation, effective 14 October 2025, replacing Federal Decree-Law No. 20 of 2018.

DNFBP categories are supervised not by a single body but by three different regulators depending on the activity — the Ministry of Economy and Tourism, the Ministry of Justice, and the General Commercial Gaming Regulatory Authority.

All DNFBPs must register on the goAML platform — the operational reporting system administered by the UAE’s Financial Intelligence Unit (FIU) — to file a Suspicious Transaction Report upon detecting suspicious activity.

⚠ Federal Decree-Law No. 10 of 2025 lowered the evidentiary threshold for establishing money laundering, expanded the “tipping off” offence (disclosing an ongoing review to a client), criminalised providing false beneficial ownership information, and substantially expanded the penalty structure (from AED 10,000 for administrative breaches up to AED 100,000,000 for the act of money laundering itself, depending on the article).

1. Who Falls Under the DNFBP Category

DNFBP category	Supervisory body
Real estate brokers and agents	Ministry of Economy and Tourism (MoET)
Dealers in precious metals and stones (DPMS)	Ministry of Economy and Tourism (MoET)
Trust and company service providers (TCSP)	Ministry of Economy and Tourism (MoET)
Accountants and auditors	Ministry of Economy and Tourism (MoET)
Lawyers, notaries, and other independent legal professionals	Ministry of Justice (MoJ)
Commercial gaming operators	General Commercial Gaming Regulatory Authority (GCGRA)

The six categories are defined by Article 3 of Cabinet Resolution No. (134) of 2025 — the executive regulation to the base statute.

ℹ Dealers in precious metals and stones fall under AML requirements specifically when conducting cash transactions (or a series of linked transactions) exceeding AED 55,000 — a threshold specific to this category, not universal across all DNFBPs.

2. A Two-Stage Process: Regulator Approval First, Then goAML

Registering on the goAML platform is not the first step but the second: access to the system opens only after approval from the relevant supervisory body.

Per the official Ministry of Economy and Tourism page, all DNFBPs must register on the goAML platform — an integrated system for filing Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs), established pursuant to Federal Decree-Law No. 20 of 2018 (now replaced by Federal Decree-Law No. 10 of 2025) and Article 20(2) of Cabinet Decision No. 10 of 2019.

⚠ Failure to register on goAML carries serious sanctions from the Ministry of Economy — per the regulator’s own wording, the consequences can be substantial for the business.

⚠ The SACM portal (Supervisory Self-Assessment platform) is a system separate from goAML: SACM is used for supervisory self-assessment, goAML for operational suspicious-activity reporting. Both systems are mandatory and should not be confused with one another.

3. Mandatory Elements of an AML Programme

Obligation	Summary
Business-wide ML/TF/PF risk assessment	Assessing money laundering, terrorist financing, and proliferation financing risk across the entire business
CDD / SDD / EDD	Standard, simplified, and enhanced customer due diligence depending on the risk level
Beneficial owner identification	Maintaining and regularly updating the UBO register
Sanctions screening	Checking counterparties against the Executive Office for Control and Non-Proliferation (EOCN) lists
Reporting via goAML	Filing a Suspicious Transaction Report (STR) with the Financial Intelligence Unit (FIU)
Internal policy and controls	Board-approved AML policies, an appointed MLRO, and staff training

These eight to nine core obligations are set by Articles 18–20 of Federal Decree-Law No. 10 of 2025, supplemented by Cabinet Resolution No. 134 of 2025, Cabinet Resolution No. 109 of 2023 on Beneficial Owner Procedures, and sector-specific DNFBP guidance.

4. MLRO Requirements

The Money Laundering Reporting Officer is the central figure of a DNFBP’s compliance programme, not a box-ticking title.

The MLRO must be a UAE resident, hold sufficient seniority to act independently, and have direct access to the company’s senior management.

⚠ Under the 2025 law, personal accountability extends not only to the company but personally to the MLRO — appointing someone to this role without a real understanding of the personal liability involved creates risk for both the company and the individual.

5. Record-Keeping Requirements

The minimum record-retention period is 5 years: customer files, transaction records, filed STRs, risk assessments, and training logs must be produced on demand during an inspection.

6. Staff Training

An AML programme is not limited to documentation — it requires regular staff training, differentiated by role.

✅ Recommended practice is annual training for all staff, with separate modules for client-facing employees, compliance staff, and senior management; training records form part of the inspection pack.

7. What Changed With the 2025 Law

⚠ Federal Decree-Law No. 10 of 2025 introduced several substantive changes compared to the previous regime: the evidentiary threshold for establishing money laundering was lowered, the “tipping off” offence was expanded, providing knowingly false beneficial ownership information was criminalised, and the penalty structure was substantially raised.

Article	Violation	Sanction
Art. 17	Administrative compliance failures identified by the supervisory authority	AED 10,000–5,000,000
Art. 27	ML/TF/PF committed by a legal person’s representatives/directors/agents	AED 5,000,000–100,000,000, or the value of the criminal property if greater
Art. 28	Breach of the STR filing obligation	Imprisonment + AED 100,000–1,000,000
Art. 29	Tipping off — disclosing an ongoing review	From AED 50,000
Art. 32	DNFBP activity without proper licensing/registration	Imprisonment + AED 200,000–10,000,000

ℹ The AED 100,000,000 figure is not a single, general ceiling for any violation — it is the top of the Article 27 range, applicable specifically to money laundering itself committed by a legal person’s representatives. For a typical DNFBP facing a compliance shortfall during an inspection, the more likely regime is Article 17 (administrative sanctions up to AED 5,000,000), not the criminal liability of Article 27.

8. Step-by-Step Process for a DNFBP Company

1.     Determine whether the company’s activity falls under one of the six DNFBP categories per Article 3 of Cabinet Resolution No. 134 of 2025.

2.     Identify the applicable supervisory body: the Ministry of Economy and Tourism, the Ministry of Justice, or the GCGRA, depending on the activity.

3.     Appoint an MLRO — a UAE resident with sufficient authority and direct access to management.

4.     Draft and obtain board approval for an internal AML policy covering risk assessment, CDD/EDD, sanctions screening, and internal escalation procedures.

5.     Register with the relevant supervisory body, then register on the goAML platform.

6.     Set up a record-keeping system for at least 5 years and regular staff training.

7.     Implement a procedure for filing an STR through the goAML portal upon detecting signs of a suspicious transaction.

9. Common Mistakes

•       Assuming all DNFBPs are supervised by the same body. Lawyers and notaries fall under the Ministry of Justice, not the Ministry of Economy — approaching the wrong body delays registration.

•       Confusing the SACM portal with goAML. These are two separate mandatory systems with different functions — supervisory self-assessment and operational reporting, respectively.

•       Appointing an MLRO as a formality, without a real understanding of personal accountability. The 2025 law directly places liability on the individual, not only the company.

•       Delaying an STR filing until full certainty about a violation. The standard is reasonable suspicion, not proven fact; delaying a report can itself be treated as a violation.

10. Who Benefits From Getting AML Right From the Start

•       Real estate agencies handling property transactions on behalf of clients. This is an explicitly named DNFBP category with mandatory compliance.

•       Dealers in precious metals and stones conducting large cash transactions. The AED 55,000 threshold is reached faster than it might seem when dealing in jewellery and bullion.

•       Accounting and legal firms managing client funds or accounts. These specific activities are expressly cited as grounds for DNFBP classification.

11. When Professional Verification Is Essential

Self-assessment is worth supplementing with specialist advice when: uncertain whether a specific activity falls within the DNFBP definition; determining the supervisory body for a mixed activity profile; and building an AML programme from scratch for a company facing these requirements for the first time.

FAQ

Which law governs AML for DNFBPs in the UAE?

Federal Decree-Law No. (10) of 2025 on Combating Money Laundering, the Financing of Terrorism, and the Financing of Proliferation, effective 14 October 2025.

Who supervises real estate agents and accountants as DNFBPs?

The Ministry of Economy and Tourism — lawyers and notaries are supervised separately by the Ministry of Justice.

What is goAML?

The UAE Financial Intelligence Unit’s integrated platform for filing Suspicious Transaction Reports — registration is mandatory for all DNFBPs.

What is the maximum fine for legal persons under the 2025 law?

AED 100,000,000 — the top of the Article 27 range for money laundering itself committed by a legal person; administrative compliance breaches under Article 17 are capped far lower, at AED 5,000,000.

Key Takeaways

•       The current statute is Federal Decree-Law No. 10 of 2025, effective 14 October 2025.

•       Six DNFBP categories are supervised by three different bodies: MoET, MoJ, and GCGRA.

•       goAML registration is mandatory for all DNFBPs and follows approval from the relevant regulator.

•       The MLRO must be a UAE resident with direct access to management; personal accountability attaches to the individual.

•       The minimum record-retention period is 5 years.

•       Penalties range from AED 10,000 (administrative breaches, Art. 17) to AED 100,000,000 (money laundering itself, Art. 27), depending on the article.

Summary

AML compliance for DNFBPs (Designated Non-Financial Businesses and Professions) in the UAE is governed by Federal Decree-Law No. (10) of 2025 on Combating Money Laundering, the Financing of Terrorism, and the Financing of Proliferation, effective 14 October 2025. Six DNFBP categories — real estate agents, dealers in precious metals and stones, trust and company service providers, accountants and auditors, lawyers and notaries, and commercial gaming operators — are supervised by three different bodies: the Ministry of Economy and Tourism (most categories), the Ministry of Justice (lawyers, notaries), and the General Commercial Gaming Regulatory Authority (gaming). All DNFBPs must register on the goAML platform, administered by the UAE Financial Intelligence Unit, to file a Suspicious Transaction Report. The Money Laundering Reporting Officer must be a UAE resident with direct access to management; the 2025 law places personal accountability on the MLRO. The minimum record-retention period is 5 years. Penalties range from AED 10,000 for administrative compliance breaches up to AED 100,000,000 for money laundering itself committed by a legal person.

Sources

• Ministry of Economy and Tourism UAE — Register in goAML, official section (moet.gov.ae)

• UAE Legislation — Federal Decree-Law No. 10 of 2025 on Combating Money Laundering, the Financing of Terrorism, and the Financing of Proliferation (uaelegislation.gov.ae)

• DLA Piper — UAE Issues New AML Law to Strengthen Anti-Money Laundering Framework (dlapiper.com)

Disclaimer

This material is for informational purposes only and does not constitute legal advice. Compliance requirements for a specific business require individual legal assessment — obtain consultation with a qualified UAE AML/CFT specialist. Information is accurate as of July 2026.