Compliance
AML Compliance in the UAE: A Practical Guide
· 4 min read · By Aureus Worldwide
Anti-Money Laundering compliance is now a serious obligation for a wide range of UAE businesses, not just banks. If your business falls within scope, you must have proper customer due diligence, monitoring and reporting in place, and regulators have shown they will act on failures. This practical guide explains who must comply, what an AML programme involves and how to meet your obligations without drowning in paperwork.
Who must comply
UAE AML obligations apply to financial institutions and to Designated Non-Financial Businesses and Professions (DNFBPs). DNFBPs commonly include:
- Real estate agents and brokers
- Dealers in precious metals and stones
- Auditors and accountants providing certain services
- Corporate service providers and company formation agents
- Legal professionals in defined situations
If you are unsure whether you are in scope, confirm your category with the relevant supervisory authority, being out of scope is not something to assume.
The pillars of an AML programme
A compliant AML framework rests on several pillars:
| Pillar | What it involves |
|---|---|
| Risk assessment | Assess money-laundering risk across customers, products and geography |
| Policies and procedures | Documented AML and KYC policies kept up to date |
| Customer due diligence | Identify and verify customers and beneficial owners |
| Ongoing monitoring | Monitor transactions for unusual activity |
| Reporting | File suspicious reports via goAML |
| Compliance officer | Appoint a responsible AML compliance officer |
| Training and records | Train staff and retain records for the required period |
Customer due diligence and KYC
Customer due diligence (CDD) is the heart of AML. At onboarding and on an ongoing basis you should:
- Identify and verify the customer using reliable documents
- Identify the ultimate beneficial owner (UBO) behind the customer
- Understand the purpose and nature of the relationship
- Apply enhanced due diligence to higher-risk customers and politically exposed persons
- Keep CDD information current
UBO identification overlaps with separate UBO obligations many UAE entities already face.
The goAML portal and reporting
In-scope businesses must register on the goAML platform operated by the UAE Financial Intelligence Unit and use it to file:
- Suspicious Transaction Reports (STRs) when a transaction raises suspicion
- Suspicious Activity Reports (SARs) for suspicious conduct more broadly
Reporting must be timely and made in good faith. Failing to register or report is a common and serious compliance gap.
Common AML failures
Regulators frequently find businesses that have:
- No documented AML policy or risk assessment
- No appointed compliance officer
- Weak or missing UBO checks
- No registration on goAML
- Inadequate staff training and record-keeping
Each of these is fixable, and each is far cheaper to fix than to be penalised for. Closing a business cleanly also requires compliance to be in order, see our guide on company liquidation in the UAE.
A risk-based approach in practice
UAE AML rules are built on a risk-based approach, which means you apply more scrutiny where the risk is higher and lighter measures where it is lower. In practice, you assess each customer and relationship against factors such as:
- Customer type, individual, company, trust or complex structure
- Geography, exposure to higher-risk jurisdictions
- Products and services, those more vulnerable to misuse
- Delivery channels, face-to-face versus remote onboarding
- Politically exposed person (PEP) status
Higher-risk relationships trigger enhanced due diligence: more detailed verification, closer monitoring and senior sign-off. Lower-risk ones can be handled with standard checks. Documenting why you placed a customer in a given risk band is as important as the checks themselves.
The cost of getting AML wrong
AML is an area where regulators in the UAE have been notably active, and the consequences of failure extend beyond fines. Possible outcomes of non-compliance include:
| Consequence | Impact |
|---|---|
| Administrative fines | Can be substantial |
| Licence action | Suspension or restrictions |
| Reputational damage | Loss of banking and clients |
| Personal liability | For responsible individuals |
Because penalty amounts are set by the authorities and revised over time, confirm the current figures with your regulator. The broader point is clear: a documented, working AML programme is far cheaper than the alternative.
Building a workable programme
You do not need a large compliance department, you need a proportionate, documented programme:
- Confirm whether you are in scope.
- Complete a risk assessment.
- Put written AML and KYC policies in place.
- Appoint a compliance officer.
- Register on goAML.
- Train staff and keep records.
- Review the programme periodically.
Keeping the programme alive
The most common mistake is treating AML as a one-off setup. A programme that sits in a drawer offers no protection. Keep it alive by refreshing customer due diligence at sensible intervals, re-running your risk assessment when the business changes, training new staff as they join, and reviewing policies against current regulations. Regulators look not just for documents but for evidence that the programme is actually operating day to day.
How Aureus Worldwide helps
Aureus Worldwide helps in-scope businesses build and run practical AML programmes through our AML consulting and compliance officer services: risk assessments, policies, UBO and CDD processes, goAML registration support and training. We are Dubai-based, responsive and transparent on fees, and we direct you to confirm changeable requirements with the regulator. To get AML-ready, contact us.
Frequently asked questions
Who must comply with UAE AML rules?
Financial institutions and Designated Non-Financial Businesses and Professions, including real estate agents, dealers in precious metals and stones, and certain corporate service providers and auditors, must comply. Confirm your category with the regulator.
What is goAML?
goAML is the UAE Financial Intelligence Unit platform used to register and to file Suspicious Transaction Reports and Suspicious Activity Reports. Relevant businesses must register and report through it.
What are the penalties for AML non-compliance?
AML breaches can attract significant administrative fines and other measures. Amounts are set by the authorities and can be substantial, so a documented AML programme is essential. Confirm current penalties with the regulator.