UAE Federal Decree-Law 20/2018
AML/CFT: Know your customer
Anti-money-laundering and counter-financing-of-terrorism rules apply to designated non-financial businesses (DNFBPs) in the UAE โ lawyers, accountants, real estate agents, precious metals dealers, and more. Understand KYC, suspicious reporting, and your obligations.
Who must comply (DNFBPs)
- Lawyers & legal professionals
- Accountants & auditors
- Auditors & tax advisors
- Real estate agents & property dealers
- Precious metals & jewellery dealers
- Trust & company service providers
- Dealers in high-value goods (art, vehicles)
Core obligations
KYC, CDD, and suspicious reporting
KYC (Know Your Customer): What information must I collect?
Name, nationality, date of birth, address, source of funds/wealth, business nature. For companies: ownership structure, beneficial owners, registered address. Update KYC every 3โ5 years or when material changes occur. Keep records for at least 7 years.
CDD (Customer Due Diligence): When do I need to verify ID?
Before entering into a business relationship or conducting a transaction above AED 50,000 (or equivalent). Verify identity using official documents (passport, UAE ID, driving licence). Obtain evidence of address (utility bill, bank statement <3 months old). For high-risk customers (PEPs, sanctioned individuals), enhanced due diligence applies.
What is a "suspicious transaction" and when must I report it?
Any transaction that appears inconsistent with the customer's profile, is unusually large, involves multiple rapid transfers, uses cash to avoid reporting thresholds, or involves high-risk jurisdictions. Report within 10 days to the Financial Intelligence Unit (FIU) at fiu.gov.ae; you can also call their hotline (04-309-1111) for confidential guidance.
Do I need an AML compliance officer?
Larger DNFBPs or those handling significant volumes should appoint one. The FIU recommends designating someone responsible for AML/CFT compliance and reporting suspicious activity. Keep documentation of your AML policies and staff training.
Penalties & enforcement
Consequences of non-compliance
- Fine: Up to AED 5,000,000 for serious violations (failure to report, weak KYC, facilitating suspect transactions).
- Licence suspension: Business licence can be suspended or revoked.
- Criminal liability: Directors/responsible persons can face personal prosecution if gross negligence or deliberate evasion proven.
- Reputational damage: Listing on sanctions/watch lists affects banking relationships and business credibility.
Quick compliance checklist
Steps to implement AML/CFT
- โ Identify if you're a DNFBP under UAE law (ask your sector regulator if unsure).
- โ Draft an AML/CFT policy (KYC requirements, transaction monitoring, reporting procedures).
- โ Create a customer onboarding checklist (ID, address, source of funds, beneficial owners).
- โ Implement record-keeping (7-year retention minimum).
- โ Train staff on AML/CFT obligations (at least annually).
- โ Establish a process to monitor transactions and flag suspicious activity.
- โ Designate an AML compliance contact and report suspicious transactions to the FIU promptly.
- โ Review your procedures annually and update as FIU guidance evolves.