Your UAE AML questions, answered.

Depending on your activities, AML compliance includes checking customers and their ownership, assessing risks, monitoring transactions and reporting suspicious activity. Your business also needs appropriate procedures, employee training and records of the checks carried out.

The primary law is Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and illegal organisations, as published on the Ministry of Economy and Tourism's AML page. Each supervisor then issues its own rules and guidance for the firms it regulates, so the detailed requirements depend on your regulator. Check the current official texts, as they are updated.

Not in the same way. The rules apply to specific kinds of business, mainly financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers. Whether you are covered depends on your licence and what you actually do. If you are unsure, ask your licensing authority or take advice.

DNFBP stands for designated non-financial businesses and professions. It covers sectors such as real estate agents and developers, dealers in precious metals and stones, lawyers and notaries, accountants and auditors, corporate service providers and commercial gaming operators, and in ADGM some other businesses such as business centres. Whether a particular business is covered depends on its activities, so confirm with your supervisor.

Yes. The law applies across the UAE, including free zones. What changes is the supervisor: for example the DFSA in the DIFC, the ADGM FSRA for financial firms in ADGM and the ADGM Registration Authority for DNFBPs there. Free zones that are not financial centres are generally supervised by the same bodies as the mainland. Check your licence.

It means your controls match the risks your business actually carries, rather than one checklist applied the same way to everyone. You look at your customers, geography, products and delivery channels, rate the risk, and apply stronger checks where the risk is higher and lighter ones where it is lower, with the reasoning written down.

It depends on your licence and activities. Financial institutions are generally supervised by the CBUAE, DFSA, ADGM FSRA or the CMA, while many DNFBPs fall under the Ministry of Economy and Tourism or the Ministry of Justice. Gaming operators are supervised by the GCGRA. We can help confirm which framework applies to you.

goAML is the online reporting platform of the UAE Financial Intelligence Unit (FIU). Businesses with reporting duties use it to submit reports such as suspicious transaction reports. Registering gives your business, and the named people who file for it, access to the platform.

Businesses that have reporting obligations to the FIU need to register. That generally includes regulated financial institutions, DNFBPs and virtual asset service providers. Whether you must register depends on your activities and your supervisor, so confirm the position with them.

No. Registering on goAML gives your business access to the UAE Financial Intelligence Unit's reporting platform. You must still carry out the AML duties that apply to your activities, including customer checks, monitoring and recordkeeping.

Typically your licence details, the people who will act as users, including the compliance officer or MLRO, and supporting documents set by the FIU. The exact requirements change, so follow the FIU's current registration guidance. Adventant can help prepare the registration, including user and role set-up.

The roles should reflect who prepares reports and who approves them. The compliance officer or MLRO is usually central, because they decide whether a report is filed. Agree roles and responsibilities before you register so that nothing depends on one person being available.

Suspicious transaction and suspicious activity reports are the main ones. Depending on your sector and supervisor, other reports can apply as well, for example for certain high-value cash transactions in some DNFBP sectors. Check which reports apply to your business.

Yes, we support goAML registration and regulatory reporting. The decision whether to report stays with your appointed compliance officer or MLRO, and responsibilities are agreed before we start. External support does not remove your business's own responsibility.

The Money Laundering Reporting Officer (MLRO) oversees the AML programme, receives internal concerns, decides whether a report should go to the FIU and is the main contact for the supervisor. The exact duties depend on the rules that apply to your sector.

Regulated businesses are generally expected to appoint a compliance officer or MLRO with enough seniority, time and independence to do the job. The exact requirement differs by regulator and licence, so confirm it with yours.

Sometimes. Some firms may appoint an external officer, while others, such as certain firms regulated by the Central Bank, the DFSA, the ADGM FSRA or the CMA, may be required to keep the role in-house. Your regulator decides, so confirm before you outsource.

Yes. Adventant can assist with customer file reviews, policy updates and reporting preparation. Responsibilities are agreed before starting, including the decisions that remain with your appointed officer. External support does not remove your business's responsibility for meeting its AML obligations.

Possibly, but supervisors look at independence, available time and expertise. A person with heavy commercial targets or many other roles can create conflicts. If you combine roles, record how the conflicts are managed and check your supervisor's expectations.

Requirements on location differ by regulator and licence. Supervisors expect the MLRO to be reachable, able to act promptly and accountable. Check your own regulator's requirement before you make the appointment.

Your business and its senior management. Outsourcing a task or a role does not transfer responsibility for meeting your AML obligations. An outsourced officer supports your compliance but does not replace your own oversight.

Know your customer (KYC) and customer due diligence (CDD) mean identifying who your customer is, verifying it, understanding why they want the relationship and checking the risk they pose, both at the start and as the relationship continues.

Generally proof of identity, where they live, the purpose of the relationship and, for higher-risk customers, the source of funds and wealth. The exact documents depend on the rules that apply to you and on the customer's risk rating.

Generally its registration details, who owns and controls it, who is authorised to act for it, the nature of its business and the purpose of the relationship. You also need to identify the people who ultimately own or control the company.

For higher-risk situations, such as politically exposed persons, high-risk countries, complex structures or unusual activity. It means deeper checks, usually senior approval, and closer ongoing monitoring than you apply to standard-risk customers.

Only where the rules allow it and your risk assessment supports it, with the reasoning recorded. It never removes sanctions screening or the duty to report suspicion. If anything changes or looks unusual, move back to full checks.

Source of funds is where the money for a particular transaction or relationship comes from. Source of wealth is how the customer built their overall wealth. Higher-risk customers often need both explained and supported by evidence.

According to risk. Higher-risk customers are reviewed more often and standard-risk customers less often. You should also review when something changes, such as a new owner, a new country of activity or unusual behaviour. Set the schedule out in your policy and follow any period your regulator requires.

The rules generally expect you not to open or continue the relationship until due diligence is complete, and to consider whether the refusal itself is a reason to report. Take care not to tip off the customer. Record what you asked for and what happened.

A natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. A company is not the end of the trail. Your due diligence has to reach the people behind it.

The rules set an ownership level at which a person counts, and the level depends on the rules that apply to you. Check the current level and definitions with your supervisor, then apply them consistently across your customer files.

No. A person can control a customer without owning much of it, for example through voting rights, the power to appoint directors or influence exercised informally. Both ownership and control should be considered.

Keep going until you reach people. Where a company owns part of the customer, get the same information for that company and continue upward, multiplying the stakes along each path. For example, 60% of a holding company that owns 50% of the customer is an effective 30% stake.

A declaration is a starting point, not verification. Take reasonable steps to check it against documents or independent sources, and record what you relied on.

Look at control by other means first. If you still cannot identify an individual, record the steps you took and escalate. Depending on the rules that apply, you may need to treat a senior managing official as the beneficial owner, so confirm this with your supervisor.

A nominee holds shares for someone else, so the nominee is not the beneficial owner. You need to find out who the nominee acts for and treat the arrangement as a higher-risk feature of the customer.

Checking your customers, their beneficial owners and relevant counterparties against the sanctions lists your obligations require, at onboarding and on an ongoing basis, and acting properly on any match.

The lists your obligations and risk require. In the UAE these include the lists published through the Executive Office for Control and Non-Proliferation, and other lists may apply to your risk. Check current official guidance for the exact lists.

Someone who holds or has held a prominent public function, such as a senior role in government, the judiciary, the military or a state-owned company. Family members and close associates are usually covered too, because they can be used to hold assets.

Typically senior management approval, a clear understanding of the source of wealth and funds, and enhanced ongoing monitoring. A PEP is not automatically a refusal, but the extra checks and the decision should be recorded.

A confirmed match means freezing without delay, not tipping off, and reporting through the channels set out in current official guidance. Do not wait for the next routine review, and escalate to your compliance officer straight away.

At onboarding and then on an ongoing basis, including when sanctions lists change and when customer details change. A one-off check at the start of a relationship is not enough.

A hit that looks like a match because the names are similar but is not the same person. Compare other details such as date of birth, nationality and identification numbers, record why you cleared the hit, and escalate anything you cannot resolve.

Yes. Adventant provides outsourced screening and customer monitoring. As with any outsourcing, your business remains responsible for the outcome and for the decisions that are made.

Reviewing customer activity against what you know about the customer, so that unusual or inconsistent behaviour is noticed, looked into and, where needed, reported. It runs for as long as the relationship does.

Activity that does not fit what you know about the customer, has no clear economic purpose, or matches known red flags. The test is reasonable grounds to suspect, not proof. If you have grounds to suspect, you escalate.

When you have grounds to suspect that funds or activity are linked to money laundering, terrorist financing or a related offence. The report goes to the FIU through goAML. Check your sector rules for timing, and do not hold a report back while you gather more evidence.

Warning the customer, or anyone connected to them, that a report has been made or is being considered. The law prohibits it. Keep reports and the reasons for them confidential and limit who is told.

Your compliance officer or MLRO, after staff escalate their concern internally. The decision and the reasons should be recorded whether or not a report is filed.

Suspicion can arise after a transaction, and when it does you should escalate straight away and report promptly if the grounds exist. Record why and when the suspicion arose, and speak to your MLRO rather than waiting.

Examples include activity that does not match the customer's profile, payments split to stay under thresholds, funds moved quickly in and out, unexplained third-party payments, reluctance to explain a transaction and complex ownership with no clear purpose.

The rules do not name a tool. A small business with low volumes may use documented manual reviews, while higher volumes usually need a system. What matters is that monitoring is effective for your risk, is documented and is actually followed.

Regulated businesses are generally expected to have written policies, controls and procedures that suit their business and are approved by senior management. A generic template that does not reflect what you actually do is a common weakness.

A documented assessment of how your business could be misused for money laundering or terrorist financing, looking at your customers, products, countries and delivery channels. It drives the controls you put in place and should be kept up to date.

Review them regularly and whenever a relevant change occurs, such as new regulatory requirements, changes to your services or updated customer ownership information. Customer review schedules should reflect risk. Follow any specific review periods required by your regulator.

The rules set a minimum period. Five years is commonly cited, but confirm the period that applies to you with your supervisor. Keep customer due diligence records, transaction records, reports and training records so they can be produced on request.

Staff whose roles touch customers, transactions or compliance, when they join and then regularly. Training should be tailored to the role and attendance should be recorded. Follow any specific frequency set by your regulator.

Your own firm's risks and procedures, how to spot red flags, how and when to escalate, tipping off, sanctions and recent changes in the rules. Practical examples from your business work better than generic slides.

Many supervisors expect the AML programme to be tested periodically by someone independent of those who run the controls. How often depends on your size, risk and regulator, so confirm the requirement that applies to you.

A supervisor typically asks to see your policies, risk assessment, customer files, screening and monitoring records, training records and reports, and may interview staff. Findings can lead to required remediation and, in some cases, penalties.

The law provides for administrative penalties and supervisors can also require remediation. Penalty levels depend on the rules and the breach, so check the current official texts rather than relying on figures quoted online, which vary.

Supervisors expect senior management to own AML compliance. Whether and how individuals can be personally liable depends on the law and the facts, so take legal advice on personal exposure rather than relying on a general answer.

Keep your policies, risk assessment, customer files, screening and monitoring records, training records and reports organised and current. A mock review before the supervisor arrives shows you the gaps while there is still time to fix them.

A review by someone independent of the day-to-day controls that tests whether your AML programme is designed properly and works in practice, and reports findings and fixes. Adventant provides independent AML compliance reviews.

Your controls can be proportionate to your size and risk, but the obligations do not disappear. A small business should still assess its risks, know its customers, screen, keep records and report suspicion, and should write down its reasoning.

Yes, real estate is a DNFBP sector. High-value cash and similar transactions have had to be reported, with a threshold of AED 55,000, but always confirm the current figure with your supervisor or the FIU. Who supervises you depends on where you are registered and licensed.

Yes. They are DNFBPs and, on the mainland and in free zones that are not financial centres, are generally supervised for AML by the Ministry of Economy and Tourism. Reporting duties for certain transactions can apply, so confirm the current rules.

Yes, where they carry out the activities the rules cover. The supervisor depends on location: for example the Ministry of Justice for lawyers and notaries onshore, the Ministry of Economy and Tourism for accountants onshore, and the DFSA or the ADGM Registration Authority in the DIFC and ADGM.

The General Commercial Gaming Regulatory Authority (GCGRA) supervises commercial gaming operators. Confirm the rules that apply to your licence category with it.

VASPs are covered by the AML framework, and the supervisor depends on the licence: the CBUAE, the DFSA, the ADGM FSRA or the CMA, depending on where the firm is licensed and what it does. Check your licence to confirm which regulator applies.

Each financial centre has its own regulator and rulebook: the DFSA in the DIFC, and the ADGM FSRA and ADGM Registration Authority in ADGM. Onshore firms follow the Central Bank, the CMA, the Ministry of Economy and Tourism or the Ministry of Justice, depending on the sector. The UAE-wide law applies to all of them.

Start with your licence and a list of what your business actually does, then ask your licensing authority which supervisor applies. Adventant can help you confirm the framework that applies to your activities.

Eleven services: an outsourced MLRO service; governance support for in-house MLROs; operational outsourcing of screening, risk assessment and ongoing monitoring; independent AML reviews and audits; regulatory inspections, gap assessments and remediation; goAML registration and regulatory reporting, including EOCN subscription and semi-annual reports; grievance filing for fine waivers; enterprise-wide risk assessments (EWRA); AML/CFT/CPF policies and procedures; AML training and awareness programmes; and implementation of TruDiligent AML software.

UAE businesses supervised by the Central Bank, the DFSA, the CMA, the ADGM FSRA and Registration Authority, the Ministry of Economy and Tourism, the Ministry of Justice and the GCGRA, including DNFBPs and virtual asset businesses.

No. Adventant is a Dubai-based compliance advisory firm. The information on this site is general guidance and not legal advice. For a legal opinion on your position, take advice from a lawyer.

It depends on what you need, including your activities, regulator, number of customers and the level of support. Get in touch and we will discuss your situation before anything is agreed.

Use the contact page for our WhatsApp, telephone and email details. Tell us what your business does and which regulator supervises you, and we will talk through the support that fits.