UAE Federal Decree-Law 20/2018
AML/CFT: Know your customer
Anti-money-laundering and counter-financing-of-terrorism rules apply to designated non-financial businesses (DNFBPs) in the UAE — lawyers, accountants, real estate agents, precious metals dealers, and more. Understand KYC, suspicious reporting, and your obligations.
Who must comply (DNFBPs)
- Lawyers & legal professionals
- Accountants & auditors
- Auditors & tax advisors
- Real estate agents & property dealers
- Precious metals & jewellery dealers
- Trust & company service providers
- Dealers in high-value goods (art, vehicles)
Core obligations
KYC, CDD, and suspicious reporting
KYC (Know Your Customer): What information must I collect?
Name, nationality, date of birth, address, source of funds/wealth, business nature. For companies: ownership structure, beneficial owners, registered address. Update KYC every 3–5 years or when material changes occur. Keep records for at least 7 years.
CDD (Customer Due Diligence): When do I need to verify ID?
Before entering into a business relationship or conducting a transaction above AED 50,000 (or equivalent). Verify identity using official documents (passport, UAE ID, driving licence). Obtain evidence of address (utility bill, bank statement <3 months old). For high-risk customers (PEPs, sanctioned individuals), enhanced due diligence applies.
What is a "suspicious transaction" and when must I report it?
Any transaction that appears inconsistent with the customer's profile, is unusually large, involves multiple rapid transfers, uses cash to avoid reporting thresholds, or involves high-risk jurisdictions. Report within 10 days to the Financial Intelligence Unit (FIU) at fiu.gov.ae; you can also call their hotline (04-309-1111) for confidential guidance.
Do I need an AML compliance officer?
Larger DNFBPs or those handling significant volumes should appoint one. The FIU recommends designating someone responsible for AML/CFT compliance and reporting suspicious activity. Keep documentation of your AML policies and staff training.
Penalties & enforcement
Consequences of non-compliance
- Fine: Up to AED 5,000,000 for serious violations (failure to report, weak KYC, facilitating suspect transactions).
- Licence suspension: Business licence can be suspended or revoked.
- Criminal liability: Directors/responsible persons can face personal prosecution if gross negligence or deliberate evasion proven.
- Reputational damage: Listing on sanctions/watch lists affects banking relationships and business credibility.
Quick compliance checklist
Steps to implement AML/CFT
- ☐ Identify if you're a DNFBP under UAE law (ask your sector regulator if unsure).
- ☐ Draft an AML/CFT policy (KYC requirements, transaction monitoring, reporting procedures).
- ☐ Create a customer onboarding checklist (ID, address, source of funds, beneficial owners).
- ☐ Implement record-keeping (7-year retention minimum).
- ☐ Train staff on AML/CFT obligations (at least annually).
- ☐ Establish a process to monitor transactions and flag suspicious activity.
- ☐ Designate an AML compliance contact and report suspicious transactions to the FIU promptly.
- ☐ Review your procedures annually and update as FIU guidance evolves.
Who this reaches
Whether AML obligations apply to you
Anti-money-laundering obligations in the UAE do not fall on every business. They fall on financial institutions and on Designated Non-Financial Businesses and Professions, a defined list that catches several sectors whose operators often do not think of themselves as regulated.
The designated categories
| Real estate agents and brokers | Where involved in buying and selling property for clients. |
|---|---|
| Dealers in precious metals and stones | Where single transactions reach the prescribed cash threshold. |
| Auditors and accountants | In independent practice. |
| Corporate service providers | Company formation agents, and those providing registered offices, nominee or trustee arrangements. |
| Lawyers and notaries | When carrying out specified transactions on behalf of clients. |
What being in scope requires
Registration on the goAML platform. A written risk assessment for the business. Customer due diligence proportionate to risk, with enhanced measures for higher-risk relationships and politically exposed persons. Ongoing monitoring rather than a check performed once at onboarding. Reporting of suspicious transactions through goAML. A named compliance officer. Staff training. Record retention for the prescribed period.
None of this is optional for a designated business, and the penalty regime for AML breaches is materially heavier than the administrative penalties attached to tax filing.
Where it overlaps with tax
Ultimate beneficial ownership sits at the intersection. UBO filing is a company law obligation applying much more widely than the AML rules, but the underlying question, who ultimately owns and controls this company, is the same one AML due diligence asks. Keep the two records consistent, because inconsistency between them is exactly the sort of thing that surfaces in an inspection. See the UBO guide.
If you are not sure
The test is what your business actually does, not the wording on the licence. A trading company that occasionally brokers property for a client may be in scope for that activity. Where the answer is genuinely unclear, this is worth confirming with a compliance professional rather than assuming, because the cost of being wrong is not proportionate to the cost of asking.
Common questions
Do AML rules apply to every UAE business?
No. They apply to financial institutions and to Designated Non-Financial Businesses and Professions, which includes real estate brokers, dealers in precious metals and stones, auditors and accountants, corporate service providers, and lawyers and notaries carrying out specified transactions.
What is goAML?
The UAE platform on which designated businesses register and submit suspicious transaction reports.
What does a designated business have to do?
Register on goAML, carry out a business risk assessment, apply customer due diligence with enhanced measures for higher risk, monitor on an ongoing basis, report suspicious transactions, appoint a compliance officer, train staff and retain records.
General information about UAE rules, not tax or legal advice. Verify anything that affects a decision with the relevant authority or a licensed adviser. About · Contact · Terms · Privacy