AML/CFT Compliance for UAE Designated Non-Financial Businesses & Professions
The UAE’s Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) framework, governed by Federal Decree-Law No. 20 of 2018 and its implementing regulations, imposes significant compliance obligations on a broad category of businesses beyond banks and financial institutions. Designated Non-Financial Businesses and Professions (DNFBPs), including accounting firms, auditors, real estate brokers and developers, dealers in precious metals and stones, and legal professionals, are subject to a comprehensive set of AML/CFT obligations that must be actively managed.
The UAE has invested heavily in strengthening its AML/CFT framework following its FATF greylisting in 2022 and subsequent removal from the greylist in 2024. Regulatory enforcement in this area is active, and the consequences of non-compliance (fines, licence suspension, and reputational damage) are severe. ZAMA advises DNFBP clients on building and maintaining AML/CFT compliance frameworks that are proportionate, effective, and demonstrably in place.
Which Businesses Are DNFBPs Under UAE Law?
The following categories of business are designated as DNFBPs and subject to UAE AML/CFT obligations:
- Accountants and accounting firms providing accounting, bookkeeping, auditing, or tax advisory services.
- Auditors conducting statutory or external audit engagements.
- Real estate brokers, developers, and agents involved in property transactions.
- Dealers in precious metals and precious stones.
- Lawyers, notaries, and other independent legal professionals.
- Company formation agents and corporate service providers.
- Trust and company service providers.
If your business falls into one of these categories and you operate in the UAE, AML/CFT compliance obligations apply to you, regardless of whether you are a Free Zone or mainland entity.
What AML/CFT Compliance Requires for DNFBPs
goAML Registration
All UAE DNFBPs must register on the UAE Financial Intelligence Unit’s (FIU) goAML portal, the UAE’s designated platform for filing Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). Failure to register is itself a compliance violation. ZAMA manages goAML registration for eligible DNFBP clients and provides guidance on using the platform.
Business Risk Assessment (BRA)
DNFBPs must conduct and document a formal Business Risk Assessment, identifying the money laundering and terrorism financing risks specific to their business, client base, products, services, and geographic exposure. The BRA is the foundation of the compliance framework; it determines the level of controls and due diligence required. ZAMA prepares and reviews Business Risk Assessments for DNFBP clients.
Policies, Procedures & Controls
DNFBPs must implement written AML/CFT policies that address customer due diligence, record-keeping, transaction monitoring, suspicious activity identification and reporting, sanctions screening, employee training, and internal compliance oversight. ZAMA develops AML/CFT policy documentation tailored to the risk profile and business model of each DNFBP client.
Customer Due Diligence (CDD)
DNFBPs must conduct Customer Due Diligence on all clients, verifying identity, understanding the nature and purpose of the relationship, and assessing ML/TF risk. CDD is applied on an ongoing basis, with enhanced due diligence for higher-risk customers, Politically Exposed Persons (PEPs), and high-risk jurisdictions. ZAMA advises on CDD frameworks and EDD triggers appropriate to your business.
Suspicious Transaction Reporting
DNFBPs are legally required to file a Suspicious Transaction Report or Suspicious Activity Report through goAML when they know, suspect, or have reasonable grounds to suspect that a transaction involves the proceeds of crime or is connected to terrorism financing. ZAMA advises on identifying reportable suspicions, the tipping-off prohibition, and the STR/SAR filing process.
Record-Keeping
All CDD records, transaction records, and AML/CFT documentation must be retained for a minimum of five years from the date the business relationship ends or the transaction is completed. Records must allow reconstruction of individual transactions and be available to regulators on request. ZAMA advises on AML record-keeping systems and retention policies.
AML Compliance Officer
DNFBPs are required to appoint a senior individual as AML Compliance Officer, responsible for overseeing the AML/CFT programme, handling STR filings, conducting employee training, and reporting to senior management. For smaller DNFBPs where a dedicated internal resource is not proportionate, ZAMA can provide outsourced AML Compliance Officer support.
Frequently Asked Questions
Yes. Accounting firms, bookkeeping services, auditors, and tax advisors that operate in the UAE are categorised as DNFBPs and are subject to the full suite of UAE AML/CFT obligations. This applies regardless of whether the firm operates on the mainland or in a Free Zone. ZAMA’s own AML compliance programme covers its obligations as a DNFBP and serves as a practical model for advising DNFBP clients.
The UAE AML/CFT penalty framework is extensive. Administrative penalties for DNFBPs include fines ranging from AED 50,000 to AED 5,000,000 per violation, depending on the nature and severity of the breach. The supervising authority also has the power to suspend or cancel the business licence of a non-compliant DNFBP. In cases involving wilful facilitation of money laundering or terrorism financing, criminal liability applies.
Yes. UAE DNFBPs are required to screen clients, beneficial owners, and counterparties against relevant sanctions lists, including the UN Consolidated Sanctions List, the UAE Local Terrorist List, and other applicable lists, before entering into a business relationship and on an ongoing basis. Transacting with a sanctioned person or entity is a serious criminal offence. ZAMA advises on sanctions screening processes and tools appropriate to the size and risk profile of your business.
AML/CFT policies and procedures should be reviewed at least annually and updated whenever there is a material change in the business, such as new service lines, new client categories, new geographic exposure, or changes in the regulatory framework. The UAE’s AML/CFT requirements have evolved frequently in recent years, and policies that were compliant two years ago may have gaps against current requirements. ZAMA provides annual AML/CFT programme reviews for its DNFBP clients.
Build an AML Programme That Protects Your Business and Your Licence.
ZAMA advises UAE DNFBPs on every aspect of AML/CFT compliance, from goAML registration and business risk assessments through to CDD frameworks, STR filing, and staff training. Book a free consultation to discuss your AML obligations and where your current programme may have gaps.