AML Compliance Consultant in Dubai for Regulated Businesses

Who this is for

This page is for owners, general managers and compliance leads of Dubai businesses that fall under the UAE AML framework and want an AML compliance consultant in Dubai who can explain the obligation plainly and then do the work. It covers mainland companies licensed by Dubai Economy and Tourism and businesses in Dubai's non-financial free zones such as DMCC, JAFZA, DAFZA, Dubai South and Dubai Silicon Oasis. Firms licensed in the DIFC are supervised by the DFSA and are covered on our DFSA page. Typical situations we are asked to help with:

• A real estate brokerage in Business Bay or Dubai Marina registered on goAML but with no risk assessment, no written procedures and a compliance officer in name only.
• A gold and jewellery trader in Deira handling cash transactions that needs screening and record-keeping that will stand up to an MoET inspection.
• An accounting, audit or corporate services firm in JLT or DMCC that onboards companies with layered ownership and needs a defensible beneficial ownership process.
• A finance company or exchange house under the Central Bank that has outgrown spreadsheets and needs monitoring, screening and reporting formalised.
• A newly licensed firm, including a virtual asset business under VARA, that must have a complete AML programme before onboarding its first customer.

What Dubai businesses must have in place under UAE AML law

The obligations are federal. They sit in Federal Decree-Law No. 10 of 2025, which replaced the 2018 law, and in the guidance issued by each Supervisory Authority. Which authority supervises you is set by your licence, not your location within Dubai.

Whatever the supervisor, the core programme a Dubai business must be able to show is the same. In plain English, you need:

• goAML registration. The Financial Intelligence Unit's reporting platform. Registration is mandatory for every regulated entity, and it is the channel for suspicious transaction reports and other regulatory filings. See our goAML registration guide.
• An appointed compliance officer. A named individual, notified to the supervisor, with the authority, time and knowledge to run the programme. For DNFBPs the role is often combined with the MLRO function.
• A business risk assessment. A documented assessment of the money laundering, terrorist financing and proliferation financing risks of your customers, products, delivery channels and geographies, reviewed and updated as the business changes.
• Policies and procedures. Written controls that match what your staff actually do, approved by senior management and refreshed when the law or your business changes.
• Customer due diligence and screening. Identifying and verifying customers and beneficial owners, applying enhanced measures where risk is higher, and screening against UN and UAE sanctions lists and for politically exposed persons.
• Ongoing monitoring. Keeping customer information current and reviewing transactions against what you expect of that customer.
• Suspicious transaction reporting. Internal escalation to the compliance officer and filing on goAML where there are grounds to suspect, without tipping off the customer.
• Training. Staff who deal with customers and transactions must understand their role, and that understanding must be documented.
• Records. Customer, transaction and reporting records kept for the retention period in the law and retrievable when the supervisor asks.

Failures are dealt with administratively by the supervisor, without a court. The current law allows a written warning, an administrative fine of AED 10,000 to AED 5,000,000 per violation, a ban from working in the sector, and restriction, suspension or revocation of the licence. Our article on AML fines and penalties in the UAE sets out the figures in full. The UAE left the FATF grey list in February 2024 and its fifth-round mutual evaluation is scheduled for 2026, so supervisory attention on DNFBPs in Dubai is not expected to ease.

What Adventant does

We structure every engagement as a path with four stages: assess, build, run and review. Some clients need all four. Many need only one or two. The scope and fee for each stage are agreed in writing before we begin.

1. Scoping call and document request. We confirm your licence, activity, supervisor and current state, then send a short list of what we need to see: licence, goAML confirmation, compliance officer appointment, any existing risk assessment, policies, sample customer files and training records.
2. Assessment. Typically two to three weeks. We review the documents, interview the compliance officer and front-line staff on site, and test a sample of customer files and transactions. You receive a gap report rated by severity against the law and your supervisor's guidance, with a prioritised remediation plan. This stage can also be delivered as a formal independent AML compliance review.
3. Build: risk assessment. Typically two weeks. We draft or rebuild your business risk assessment using your actual customer, product, channel and geography data, with a methodology your compliance officer can repeat annually. Our guide to writing an AML business risk assessment describes the approach.
4. Build: policies, procedures and tools. Typically three to four weeks, running in parallel with the risk assessment. We write the AML policy, CDD and EDD procedures, screening and monitoring procedures, STR escalation process, record-keeping and training policy, each tailored to your business rather than copied from a template. See our AML policies and procedures service.
5. Build: goAML and registrations. Where you are not yet registered, or your registration is incomplete, we handle goAML and the supervisor's own portal registrations and confirm the compliance officer notification is correct.
6. Run. For businesses without a qualified compliance officer, we provide an outsourced compliance officer and MLRO on a monthly retainer: reviewing onboarding files, running screening, handling alerts, preparing and filing STRs, delivering training and keeping the register of regulatory correspondence.
7. Review. Twelve months after the build, or ahead of an inspection, we test the programme independently and report to senior management on what is working, what has drifted and what the supervisor would challenge.

What you receive

Why businesses choose us for this

• Former senior bank compliance leaders. Our team held senior AML and compliance roles at banks operating in the UAE, including Standard Chartered, RAKBANK and FAB.
• Direct experience of inspections and remediation. We have sat on the receiving end of regulatory examinations and led the remediation that followed. We know what inspectors look for and which answers do not hold.
• Practical, not template-driven. Every document we produce is written around your customers, your products and your staff. A manual that describes a process you do not follow is a finding waiting to happen.
• Fixed scope agreed up front. Each stage has a written scope, deliverables and fee before we start. No open-ended hourly billing.
• Dubai-based with UAE-wide coverage. We are headquartered in Dubai, work on site across the emirate, and support clients in every other emirate.

Common mistakes we see

• Registering on goAML and treating that as the end of the job, with nothing filed and no one trained to recognise a reportable transaction.
• Appointing the office manager or a junior accountant as compliance officer without the time, authority or knowledge to perform the role.
• A business risk assessment downloaded or adapted from another firm, with risk ratings that bear no relation to the actual customer base.
• Policies dated and signed each year but never read, so that the written process and the real process have drifted apart.
• Screening customers once at onboarding and never again, so sanctions and PEP changes go unnoticed for years.
• Collecting identity documents but never identifying the beneficial owner behind a company customer.
• Zero STRs over several years presented as proof of a clean customer base, which supervisors read very differently. See zero STRs does not mean zero risk.

Related reading

• MoET and the UAE AML law of 2025: a guide for DNFBPs
• AML inspection readiness checklist for UAE businesses
• Customer due diligence checklist
• Sanctions and PEP screening process in the UAE
• The UAE's FATF mutual evaluation in 2026

Next step

Tell us your licence type, your supervisor and where you are in Dubai. We will come back with a view on which stage of the path you need, what it covers and what it costs. If you already have an inspection notice, say so and we will prioritise the call.

General information, not legal advice. Check current requirements with your supervisory authority.