Know All about Anti-Money Laundering Compliance in UAE

You probably did not start your business thinking you would need to worry about money laundering. Yet depending on what your company does, AML compliance may already be part of your responsibilities in the UAE.

And the tricky part is figuring out where you stand. The rules cover more than banks and financial institutions. Real estate businesses, auditing and taxation firms, dealers in precious metals and stones, and corporate service providers can also have AML obligations.

That matters because getting it wrong is not just a paperwork problem. In 2025, money laundering cases rose 45.8%, from 646 to 942, while Suspicious Transaction Reports increased to 66,000. So, what does AML compliance in the UAE actually require from your business?

Let’s break down the rules, the reporting requirements, and the penalties in plain English.

What AML compliance means in the UAE

AML compliance means taking steps to prevent your business from being used to move, hide, or legitimise money linked to crime. In the UAE, the framework is set out under Federal Decree-Law No. 10 of 2025, along with its implementing regulation, Cabinet Resolution No. 134 of 2025.

The rules do not apply only to banks. They cover financial institutions (FIs), such as banks, exchange houses, finance companies, payment service providers, and insurance businesses, which are supervised by the relevant financial regulator. The UAE Central Bank’s AML/CFT guidance sets out the expectations for financial institutions under its supervision.

The UAE Ministry of Economy and Tourism’s AML guidance explains which activities fall within the DNFBP framework and provides guidance for businesses under its supervision.

Your obligations depend on your business type and regulator. So, before building an AML programme, first establish whether your business is an FI, DNFBP, or outside these categories. This determines which AML requirements and regulatory guidance apply to you.

Does AML compliance apply to you?

On the matter of AML compliance, the UAE Ministry of Economy identifies these four categories:

What you need for AML compliance in the UAE

Once you know your business falls within the AML framework, the next question is what you actually need to put in place. The requirements cover how you assess risk, check customers, keep records, train your team, and spot potentially suspicious activity.

1. Conduct an AML risk assessment

An AML risk assessment helps you identify where your business may face money laundering, terrorism financing, or proliferation financing risks. Assess your customers, products and services, countries, delivery channels, and transaction types. Then tailor your controls to those risks and reassess your risk profile periodically.

2. Carry out customer due diligence

Customer due diligence (CDD) means knowing who your customers are and understanding the relationships you enter into. Identify and verify customers and, where relevant, their beneficial owners. Understand the purpose and nature of the relationship, then monitor it on an ongoing, risk-based basis.

Good record-keeping matters here too. Your audit of purchases can help you think through how supporting records are maintained and reviewed.

3. Apply enhanced due diligence to higher-risk customers

Enhanced due diligence (EDD) means taking extra steps when a customer or transaction carries a higher financial crime risk. This may include gathering more information about the customer, their source of funds or wealth, and specific transactions. Higher-risk cases can include PEPs, large cash payments, and certain cross-border transactions.

4. Appoint a compliance officer

A compliance officer, also referred to as a CO or MLRO, is responsible for overseeing your AML controls and helping ensure the business meets its obligations.

For DNFBPs, the Ministry says the compliance officer should have appropriate seniority, independence, authority, and access to the information and resources needed to carry out the role. The CBUAE Rulebook also sets out specific requirements around the appointment and responsibilities of compliance officers for licensed financial institutions.

5. Keep your AML records

Record keeping means keeping enough information to show what checks you carried out, what you found, and how you handled the resulting risks.

Your records can include customer information, audit of purchases, CDD and EDD documents, risk assessments, transaction records, screening results, and suspicious transaction reporting records. The CBUAE says covered financial institutions must retain relevant records for at least five years, subject to the applicable legal requirements.

For businesses managing large volumes of purchases and payments, a clear audit procedure for accounts payable can also make supporting documentation easier to track.

6. Train your employees

AML training helps employees handling customers, transactions, and compliance processes recognise risks and know how to respond. Cover your AML policies, CDD, transaction monitoring, sanctions and PEP screening, suspicious activity indicators, reporting procedures, and employee responsibilities. Keep records of training as required by your regulator.

7. Screen customers against sanctions and PEP lists

Sanctions and PEP screening helps identify customers or related parties who may pose higher financial crime risks. You should have processes to screen relevant customers and transactions against applicable UAE and UN sanctions lists. PEP screening is also part of the wider procurement risk management process.

Registering and reporting on goAML

If your business is a DNFBP, goAML registration is mandatory. It is the UAE Financial Intelligence Unit’s system for receiving suspicious transaction and activity reports.

1. Pre-register through SACM: Submit your organisation and authorised user details through the UAE FIU registration portal.
2. Complete goAML registration: Use the credentials provided after pre-registration, select your supervisory body, add your company details, and upload the required documents.
3. Submit suspicious reports: Your compliance officer uses goAML to file an STR or SAR when there are reasonable grounds to suspect suspicious activity.

What are the penalties for AML non-compliance in the UAE?

AML penalties in the UAE depend on the type and seriousness of the violation. Under Federal Decree-Law No. 10 of 2025, supervisory authorities can impose the following administrative penalties:

The law also allows supervisory authorities to publish administrative penalties and require businesses to report on how they have corrected the violation.

What are the three stages of money laundering?

The three stages of money laundering explain how criminals try to turn illegal funds into money that appears legitimate. Understanding them also explains why AML compliance focuses so heavily on customer checks, transaction monitoring, and record keeping.

1. Placement

Placement is when illicit money first enters the financial system or legitimate economy. This could involve depositing cash into a bank account, buying assets, or using a business to introduce the funds into normal transactions.

2. Layering

Layering involves moving the money through multiple transactions to make its origin harder to trace. Criminals may transfer funds between accounts, businesses, countries, or assets, creating a complicated trail that can obscure where the money came from.

3. Integration

Integration is when the money returns to the legitimate economy and appears to come from a lawful source. It could be presented as business revenue, investment returns, or proceeds from selling an asset.

AML compliance checklist for UAE businesses

Use this checklist to see whether your business has the main pieces of its AML compliance framework in place:

• Confirm whether your business is an FI or a DNFBP and identify your supervisory authority.
• Complete a documented AML risk assessment and update it when your business, customers, or risks change.
• Create written AML/CFT policies, controls, and procedures based on your risk assessment. An expense policy builder can also help formalise your internal spend management.
• Carry out customer due diligence (CDD) and verify customers and beneficial owners.
• Apply enhanced due diligence (EDD) where a customer or transaction presents higher risk.
• Appoint a suitably qualified compliance officer or MLRO where required.
• Register your business and authorised users on goAML where required.
• Screen customers and relevant parties against UAE and UN sanctions lists and identify PEPs.
• Keep customer, transaction, CDD, EDD, and reporting records for the required retention period.
• Train employees on AML controls, suspicious activity, and their reporting responsibilities.
• Have a process for identifying and reporting suspicious transactions without delay.

If you cannot tick several of these boxes, your AML framework probably needs some attention. The UAE Ministry of Economy and Tourism’s AML guidance is a useful place to check the particular requirements that apply to your business.

Final thoughts

AML compliance in the UAE comes down to a few basics: understand your risks, know your customers, keep proper records, train your team, and report suspicious activity when required. Your controls should also evolve as your business and risk profile change.

Good financial processes can make compliance easier to manage. Alaan helps UAE businesses organise spending with clear controls, records, and approval trails.

Explore Alaan’s spend management solutions and make keeping track of company spending a little less painful.

FAQs

1. What is AML compliance?

AML compliance means having the policies and controls needed to prevent money laundering, terrorism financing, and related financial crime.

2. What are the five pillars of AML compliance?

The five pillars are risk assessment, customer due diligence, transaction monitoring, reporting and record keeping, and governance and training.

3. What are the three stages of money laundering?

The three stages are placement, where illicit funds enter the financial system, layering, where transactions obscure their origin, and integration, where the funds appear legitimate.

4. Is AML compliance mandatory in the UAE?

Yes, AML compliance is mandatory for businesses that fall within the UAE’s AML framework, with specific requirements depending on their activities and supervisory authority.

5. Who has to comply with AML regulations in the UAE?

AML obligations apply to financial institutions and designated non-financial businesses and professions, including real estate businesses, precious metals and stones dealers, auditors, and corporate service providers.