AML Compliance in the UAE (2026): The New Law Every Business Must Know

First, the good news: the UAE is off the FATF grey list

In February 2024 the Financial Action Task Force removed the UAE from its list of jurisdictions under increased monitoring — the "grey list" — where it had been placed in March 2022. That exit followed two years of intense reform: new laws, a restructured national committee, and a sharp increase in enforcement and inspections.

The practical message for businesses is the opposite of "relax". The UAE earned its removal by demonstrating real, sustained enforcement, and it intends to keep it. Inspection activity and penalties have not eased — the regime is now embedded, not experimental.

The 2025 rewrite — the law changed underneath you

This is the single most important point, and where most existing guidance is now wrong: the UAE replaced its core AML statute in late 2025.

The governing law is now Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism and the Financing of Proliferation, in force from 14 October 2025. Its executive regulations are Cabinet Decision No. 134 of 2025, in force from 14 December 2025. Together they repealed the previous Federal Decree-Law No. 20 of 2018 and its Cabinet Decision No. 10 of 2019.

If your risk assessment, policies, or staff training still reference the 2018 law or the 2019 regulations, they cite repealed legislation — a finding an inspector will notice immediately.

Are you a DNFBP? The list is now six categories

Designated Non-Financial Businesses and Professions (DNFBPs) are the non-bank categories that carry full AML obligations. Under the 2025 executive regulations the list expanded to six:

real estate brokers and agents (when concluding a property purchase or sale for a client); dealers in precious metals and stones; independent accountants and auditors; lawyers, notaries and other independent legal professionals (for specified transactions); corporate service providers and trust and company service providers; and — new — commercial gaming operators. Virtual asset service providers are also now deeply integrated into the regime.

If your business is in any of these categories, AML compliance is mandatory, not optional. Many owners — particularly in real estate and corporate services — still assume it does not apply to them.

goAML registration and reporting

goAML is the reporting platform of the UAE Financial Intelligence Unit, and registration on it is mandatory for every DNFBP. A business that has not registered is non-compliant from day one and exposed the moment it is inspected.

Through goAML you file Suspicious Transaction Reports and Suspicious Activity Reports, and sector-specific reports — the Real Estate Activity Report and the Dealers in Precious Metals and Stones Report — where applicable. Reports must be filed without delay, and you must never "tip off" the customer that a report has been made.

What a compliant AML programme must contain

A UAE-compliant programme rests on five pillars: a documented, business-wide risk assessment — which must now expressly include proliferation-financing risk; written policies and procedures covering customer due diligence and enhanced due diligence; a nominated Compliance Officer (MLRO) with genuine authority; ongoing staff training; and an independent audit or review of the programme's effectiveness.

Underneath these sit ongoing transaction monitoring, record-keeping, and sanctions and targeted-financial-sanctions screening against the UN and local lists. The risk assessment is not a one-off document — it must be refreshed whenever the business or the regulatory environment changes materially.

Who inspects you — and what an inspection looks like

For the main DNFBP sectors — real estate, precious metals, accountants and auditors, and corporate service providers — the federal supervisor is the Ministry of Economy and Tourism (the Ministry of Economy was renamed in June 2025). Lawyers and notaries fall under the Ministry of Justice; regulated firms in the DIFC and ADGM answer to the DFSA and FSRA respectively.

An inspection reviews your risk assessment, customer files, policies, training records, reporting history, and your Compliance Officer's standing. A first finding of non-compliance usually brings a remediation plan and a follow-up visit; serious or repeat failures escalate quickly to fines, suspension, or referral for prosecution.

The penalties — and how they changed

The administrative penalty range under the new regime runs from AED 10,000 to AED 5,000,000 per violation. The important change is the floor: the minimum dropped from AED 50,000 under the old law to AED 10,000 — while the AED 5,000,000 ceiling is unchanged. Supervisors can also issue warnings, restrict activity, or suspend and revoke a licence.

Criminal penalties sit far higher and separate — for legal persons they run into the tens of millions of dirhams, alongside imprisonment for the individuals involved and asset confiscation. Failing to maintain an accurate beneficial-ownership register is itself penalised. The gap between the modest cost of compliance and the cost of a serious breach is enormous.

What else changed for 2026

Several substantive additions matter. Proliferation financing — funding the spread of weapons — now sits squarely in scope, and every regulated business must assess and screen for it. The commercial gaming sector was brought in as a DNFBP category, tied to the UAE's new gaming regulator. Virtual asset service providers are integrated throughout, and reporting thresholds now capture settlement in virtual assets, not just cash.

The list of predicate offences that can underlie money laundering was widened — tax evasion is expressly included — and the national framework was restructured, with a supreme committee and a National Strategy running to 2027. The direction of travel is clear: broader scope, higher expectations, sustained enforcement.

What to do if you are not yet compliant

If you fall within the DNFBP definition and do not yet have a current programme, the priority order is straightforward. Register on goAML immediately. Carry out a documented risk assessment, including proliferation-financing risk. Put written policies and customer-due-diligence procedures in place. Appoint a Compliance Officer. Train your team. And crucially, make sure every reference in your documents is to the 2025 law and regulations, not the repealed 2018 framework.

A well-run remediation can be completed in a matter of weeks. Weighed against a five- or six-figure penalty and the reputational damage of a public enforcement action, it is one of the cheapest risk investments a regulated business can make.

Getting AML right, once

AML is not a form-filling exercise you complete and forget. It is an ongoing obligation that has to keep pace with a framework the UAE deliberately keeps current. The businesses that struggle are the ones treating a one-time policy pack as compliance; the ones that do well build a living programme and refresh it.

If you are unsure whether you are a DNFBP, whether your programme reflects the 2025 law, or whether your goAML registration and reporting are in order, an AML inspection-readiness review will tell you exactly where the gaps are. Book a consultation and we will assess your obligations against the current regime.