AML Compliance in the UAE: Building and Running the Programme

Most UAE material answering "what is AML compliance" defines money laundering and stops. That is not what an inspection looks at. Anti-money-laundering compliance is a programme with named components, each traceable to an article of the executive regulation, and each producing a document, a record or a decision that can be put on a table.

Two instruments govern it and both are recent. Federal Decree-Law No. 10 of 2025, issued 30 September 2025, repeals Federal Decree-Law No. 20 of 2018 outright (Article 41(1)). Cabinet Decision No. 134 of 2025, issued 29 October 2025, is its executive regulation and repeals Cabinet Decision No. 10 of 2019 (Article 70). Checked 17 August 2026: a great deal of AML material in circulation here — including policy templates sold as part of a compliance package — is still written against the 2018 and 2019 pair, which means its article numbers point at regulations that no longer exist.

The programme below is what those two instruments require. Registering on goAML is one line in it, not the whole of it.

Everything else is calibrated from this document, which is why it is the first thing a supervisor asks for and the most common thing missing.

Article 19(1)(a) of the Decree-Law requires a supervised business to identify, understand, manage, assess, document and continuously update its crime risks, retain the assessment and provide it to the supervisory authority on request. Article 5(1) of the executive regulation adds the method: consider all relevant risk factors — customer risk, country and geographic risk, product, service, transaction and delivery-channel risk — before determining the overall level of risk and the level of mitigation to apply, take the National Risk Assessment into account, and document the process itself, not only the conclusion.

Article 5(2) then requires you to act on the result: internal policies, controls and procedures approved by senior management, proportionate to the nature and size of the business, with implementation monitored and effectiveness assessed. Article 5(4) singles out proliferation financing — where those risks are high, enhanced internal controls, documented records of the measures taken, and periodic review of the controls as the risk level changes.

The Ministry of Economy and Tourism's Guidelines for Designated Non-Financial Businesses and Professions of March 2026 add the operating detail. In most cases the business-wide assessment should be performed at least annually. Senior management must formally certify that it accurately reflects the entity's risk exposure. And where the exercise is bought in, the Guidelines are explicit that it must not be a "black box": the business has to understand the vendor's methodology, data sources and assumptions, review the output critically, and remains accountable for the adequacy of an assessment it outsourced.

"KYC" and "AML compliance" are used interchangeably in the market and they are not the same thing. Know-your-customer is the identification and verification step. Customer due diligence, as the Regulation defines it operationally, is wider: identify and verify the customer, verify anyone acting on their behalf, understand the purpose and intended nature of the relationship, understand the customer's business and its ownership and control structure, identify the beneficial owner, and then monitor the relationship for as long as it lasts.

Article 6 sets the timing — identity is verified before or during the establishment of a business relationship, or before carrying out a transaction for someone with whom no relationship exists. Deferral is allowed only in low-risk cases, only if it is necessary so as not to disrupt normal business, only with measures to control the risk in the meantime, and it must be completed as soon as possible. Article 7 sets the trigger points: on commencement of a relationship, where there is suspicion of a crime, and where there is doubt about the accuracy or adequacy of identification data already held.

Article 9 prescribes the data. For a natural person: name as stated in the identity card or travel document, nationality, address, date and place of birth, employer name and address where applicable, and a true copy of a valid identity document. For a legal person or legal arrangement: name, legal form, memorandum of association, the tax registration number of legal persons subject to corporate tax, any unique reference number, the registered address and the local representative of a foreign person, the articles of association, and the names of the people in senior management positions. That corporate tax reference is new in the 2025 regulation and does not appear in the older templates.

Article 10 is the beneficial ownership test, and it runs as a cascade. First, the natural person who ultimately owns — individually or jointly — an actual controlling ownership interest or shares of 25% or more. Where there is doubt about that person, or where nobody controls through ownership at all, the natural person who exercises legal or actual control by any other means, directly or indirectly. Where neither identifies anyone, the relevant natural person holding a senior management position. There is no honest outcome in which a corporate customer has no identified beneficial owner; there is only a record of which limb you fell to and why.

Enhanced due diligence is not a vague instruction to be careful. Article 5(2)(c) lists seven measures by way of example, and a supervisor will look for the ones that fit the risk: obtaining and verifying additional information on the customer's identity and occupation and on the beneficial owner, including from public databases and open sources; obtaining more on the purpose of the relationship or the reasons for the transactions; updating due diligence information more regularly; taking reasonable measures to identify the source of funds and the source of wealth; increasing the degree and level of ongoing monitoring and selecting transaction patterns for further scrutiny; requiring the first payment to come through an account in the customer's name at an institution subject to equivalent standards; and obtaining senior-management approval to start or continue the relationship.

Article 23 attaches enhanced measures to business with natural or legal persons from countries the National Committee identifies as high risk, or from countries with deficiencies in their anti-money-laundering systems, together with any countermeasures the supervisory authority requires.

This is the part of the programme most often missing from UAE advisory pages, and it is the part with the fastest clock.

Targeted financial sanctions are implemented through Cabinet Decision No. 74 of 2020, which the Executive Office for Control and Non-Proliferation administers. Two lists matter, and the Executive Office refers to them together as the Sanctions List: the UAE Local Terrorist List, issued by the Cabinet under UN Security Council Resolution 1373 (2001), and the UN Consolidated List issued by the Security Council. Article 21 of that Decision sets the obligations for financial institutions and DNFBPs, and Federal Decree-Law No. 10 of 2025 carries the definition through: targeted financial sanctions are the freezing of funds, and the prohibition on making them available, for anyone designated by Cabinet resolutions on terrorist lists or by the Security Council under Chapter VII.

Article 21(2) defines the scope of a screening run, and it is broader than a customer list: the customer database, the names of parties to any transaction, the names of potential clients, the names of beneficial owners, and the names of persons and organisations with a direct or indirect relationship — with a continuous search before any operation or serious business relationship begins.

Article 21(3) requires appropriate compliance management arrangements including the appointment of a compliance officer at management level. Article 22 sets the standard for the person: appointed at management level and under the entity's responsibility, with independence in decision-making and appropriate competence and experience. Five duties follow — monitoring transactions related to the crime; reviewing records and receiving, examining and assessing suspicious transaction data and deciding whether to notify the Unit or to retain the matter with the reasons stated, in full confidentiality; reviewing internal systems against the Decree-Law and the Regulation and reporting periodically and directly to senior management, copied to the supervisory authority on request; developing, implementing and documenting training; and cooperating with the supervisory authority and the Unit.

The second duty is the load-bearing one. The decision whether a report is filed belongs to the officer, and the March 2026 Guidelines state that no individual, including senior management, may interfere with or influence it. That is what "independence in decision-making" is protecting, and it is why the reporting decision cannot be contracted out to an adviser whatever else is.

On the role itself the Guidelines are more flexible than the market assumes. Where a business cannot appoint a suitably qualified and independent officer internally, a third-party compliance officer may be permitted — subject to the person having the necessary qualifications, experience and understanding of the business model, a documented fit-and-proper evaluation, independence from operational and revenue-generating roles, unrestricted access to records, systems and staff, and a written contract. Ultimate accountability does not move: it stays with the entity's senior management and board, and the officer remains accountable for validating and supervising any third-party system or consultant used in the programme.

Article 17 of the Regulation comes before the reporting duty for a reason: a business must establish indicators through which it can identify suspicion of a crime, and update them on an ongoing basis as methods change, in line with its supervisor's instructions. A programme with no indicators has no mechanism for a report to arise from.

Article 18(1) is the duty itself. Where a business suspects, or has reasonable grounds to suspect, that a transaction, an attempted transaction, or funds in whole or in part constitute proceeds, are related to the crime, or are intended to be used in it — regardless of value — it must, without invoking banking secrecy, professional secrecy or contractual liability, immediately and without delay notify the Unit with all available data through the Unit's electronic system, and respond promptly to requests for more. Article 19(1) then prohibits the business, its directors, officers and employees from disclosing to the customer or anyone else that a report has been or is about to be made, that any data relates to one, or that an investigation is under way. The only carve-out in Article 19(2) is that an attempt to dissuade a customer from committing an unlawful act is not a disclosure.

The mechanics of registering for and filing on goAML — the report types, the submission route, and what registration produces — sit on our goAML page rather than here.

Article 25 requires all records, documents, instruments and data relating to domestic and international financial and cash transactions and commercial dealings to be kept for not less than five years from completion of the transaction or the end of the relationship. Clause 2 extends the same period to due diligence records, ongoing monitoring, account files, business correspondence, copies of identification documents, suspicious transaction reports, the results of any analysis, and CCTV and ATM recordings — with the clock running from the most recent of: the end of the relationship, account closure, completion of an occasional transaction, completion of a supervisory inspection, completion of an investigation, or a final court judgment. Clause 3 adds a quality standard: the records must be organised so that individual transactions can be reconstructed, data analysed and financial flows traced, well enough to serve as evidence in a prosecution.

Article 21(4) requires screening procedures ensuring high standards of fitness and propriety when employees are appointed, and Article 21(5) requires periodic anti-crime programmes and workshops to build the capability of the compliance function and other relevant staff. Article 22(4) puts the design, delivery and documentation of that training on the compliance officer.

Article 21(6) requires an independent audit function to test the effectiveness and adequacy of the internal policies, controls and procedures. The March 2026 Guidelines set out how it is expected to work: internal or external, but genuinely independent of the compliance and operational functions and free of conflicts; smaller firms may engage qualified external auditors, in which case the firm must verify their competence and regulatory standing and formalise scope, confidentiality and data protection in a written contract. Frequency and depth are set on a risk basis, informed by the National Risk Assessment, the firm's own risk assessment, its size and geography, and supervisory findings. The minimum scope named is the design and operating effectiveness of policies and systems, the adequacy of training, outsourcing arrangements, transaction monitoring and case management, remediation of earlier findings, and record-keeping. Findings go to senior management and the board — the function must report above the compliance officer, not to them — and where significant deficiencies cannot be mitigated within an acceptable time, the supervisory authority must be told.

Supervision is split by sector. The Ministry of Economy and Tourism supervises independent accountants and auditors, company and trust service providers, dealers in precious metals and stones, and real estate brokers and agents, in the mainland and in the commercial free zones. The Ministry of Justice supervises legal professionals. Financial institutions answer to their own prudential regulator rather than to the Ministry, and businesses licensed in the financial free zones to the Dubai Financial Services Authority or to the Financial Services Regulatory Authority of Abu Dhabi Global Market. The Decree-Law itself defines a supervisory authority generically, as the federal or local authority entrusted under the legislation with supervising the sector — so the practical first question is which authority issued your licence.

Article 17(1) of the Decree-Law gives a supervisory authority seven administrative responses to a violation of the law, the regulation or any decision issued under them: a warning; an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation; a ban on operating in the relevant sector; restrictions on the powers of responsible board members, executives, supervisors or owners, including the appointment of a temporary supervisor; suspension or replacement of responsible directors and officers; suspension or restriction of the activity or profession; and revocation of the licence. Article 17(2) allows an order to report periodically on the remedy; Article 17(3) allows an incremental fine where the same violation recurs within a year; Article 17(4) allows the authority to publish the penalties it imposes.

The per-violation amounts for the sectors supervised by the Ministry of Economy and the Ministry of Justice come from the list annexed to Cabinet Resolution No. 71 of 2024, issued 8 July 2024, whose Article 8 repeals Cabinet Resolution No. 16 of 2021 — an instrument several competitor pages still quote. Under Article 5(2) the Ministry may double a fine on repetition. Under Article 4, a grievance is filed within 30 working days, no reply within 40 working days counts as a rejection, and an appeal is not admissible before the grievance route has been used.

Two of the searches this page answers are commercial, so here is the honest position on both.

Software. No instrument we read requires a product. The Ministry's March 2026 Guidelines state that monitoring systems may be automated, semi-automated or manual, provided the systems and procedures are documented, reviewed periodically for effectiveness, and approved by senior management with oversight responsibilities assigned. On politically exposed persons the same document says identification systems "may include" automated screening tools, or manual and digital background checks using internet and media searches, subscription or publicly available databases, and background investigation services — proportionate to the nature and size of the business. What the law fixes is the outcome: screening that catches an update to the Sanctions List quickly enough to freeze within 24 hours, monitoring that can flag a transaction inconsistent with what you know of a customer, and records that can reconstruct a transaction years later. A small firm can meet that on a documented manual process; a large book cannot.

We name no vendor. We found no approved, accredited or endorsed software list published by the Ministry of Economy and Tourism, the Financial Intelligence Unit or the Executive Office, so treat "FIU-approved" or "Ministry-approved" as a marketing claim to be checked, not a certification. Where a tool or a consultant is used, the Guidelines keep the compliance officer accountable for understanding, validating and supervising it.

Services. A provider can genuinely help with the parts of the programme that are drafting, design and capability: facilitating the business risk assessment while leaving you able to explain its methodology, drafting policies, controls and procedures for senior management to approve, designing the due diligence file and the customer risk model, building the indicator set, running training, and — if genuinely independent of your compliance function and free of conflicts — performing the independent audit. What does not move is accountability. The compliance officer's decision whether to report is theirs, the assessment remains yours to stand behind, and appointing anyone external does not relieve the business of its obligations.

What this site will not do: we make no claim to be licensed, registered, accredited or credentialled for AML work, and none should be read into anything above; we publish no fee, package or price for our own work; we publish no office address, location or telephone number; we cannot and do not file suspicious transaction reports, name-match reports or any other filing on a client's behalf; and we do not publish another country's AML regime — everything here is the UAE federal framework, checked on 17 August 2026, and nothing on this page is advice on your own facts.