AML Obligations for DNFBPs in the UAE

The short answer: DNFBP AML UAE obligations

DNFBP AML UAE obligations apply to real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate and trust service providers, lawyers and notaries carrying out specified transactions, and, since the 2025 regulation, commercial gaming operators. If your business falls into one of these categories, you must register with your AML supervisor and on goAML, run a documented risk-based compliance programme, screen against sanctions lists and report suspicious transactions to the Financial Intelligence Unit (FIU).

These duties come from Federal Decree-Law No. 10 of 2025, which took effect on 14 October 2025, and its executive regulation, Cabinet Resolution No. 134 of 2025, which replaced the 2019 regulation. As of October 2026, supervisors are inspecting DNFBPs against the new framework, and the gap between businesses with a working programme and those with a policy on a shelf is widening.

This guide explains who counts as a DNFBP, who supervises you, what each sector must do in practice and how the rules differ in the DIFC and ADGM.

Who is a DNFBP under UAE law

A designated non-financial business or profession is a business outside the financial sector whose services can be misused to move or hide criminal money. The categories follow the FATF Recommendations, adapted to the UAE market. Coverage is activity-based: a company is a DNFBP when it carries on the relevant activity, whatever its licence is called.

In the DIFC, DNFBPs register with and are supervised by the Dubai Financial Services Authority; in ADGM, DNFBPs are supervised under ADGM's own regime. Both are covered below.

Core DNFBP AML UAE obligations

Whatever the sector, the core DNFBP AML UAE obligations are the same eight building blocks that apply to banks, scaled to the size and risk of the business. Our guide to the 2025 UAE AML law sets out the framework in more detail.

1. Register. Register with your supervisor's systems and complete goAML registration with the FIU, naming a compliance officer as administrator. See our guide to goAML registration and suspicious transaction reporting.
2. Assess risk. Document a business-wide risk assessment covering money laundering, terrorist financing and proliferation financing across customers, products, payment methods and geographies, approved by senior management.
3. Know your customer. Identify and verify customers and beneficial owners, using a 25 per cent ownership threshold with control-based fall-backs, and apply enhanced due diligence to high-risk customers and politically exposed persons.
4. Screen for sanctions. Screen customers and counterparties against the UAE Local Terrorist List and UN Consolidated List, freeze without delay on a confirmed match and report through goAML.
5. Monitor and report. Monitor relationships continuously, file threshold reports where your sector requires them and report suspicious transactions to the FIU immediately, without tipping off.
6. Appoint a compliance officer. Appoint a suitably senior and independent compliance officer, with a deputy where the business size justifies it.
7. Train and keep records. Train staff and keep due diligence, transaction and reporting records for at least five years.
8. Test independently. Review the programme periodically and fix findings.

What each sector must do in practice

Real estate brokers and agents

Brokers are often the only regulated party who meets the buyer face to face. They must identify buyers and sellers and their beneficial owners, understand the source of funds, and file a real estate activity report through goAML where a purchase involves cash at or above AED 55,000, virtual assets or funds from a third party. Off-plan purchases, rapid resales, payments from unrelated parties and buyers who resist ownership disclosure are recurring red flags. Our real estate regulation page covers the wider brokerage rules.

Dealers in precious metals and stones

Gold, diamond and jewellery traders must apply due diligence to transactions at or above AED 55,000 in cash or by wire, and file a dealers in precious metals and stones report within two weeks of a qualifying transaction. Supply-chain due diligence on the origin of gold and stones, particularly from conflict-affected and high-risk areas, is a growing focus. Split transactions designed to stay under the threshold should be aggregated and treated as suspicious.

Corporate and trust service providers

Formation agents, registered agents, nominee director providers and trust companies sit at the front door of the corporate system. They must identify the real owners behind every structure they form or service, scrutinise nominee arrangements and refuse to act where ownership is obscured. Because supplying false beneficial ownership information is now a separate offence, a provider who accepts declarations without verification carries real risk. See our guide to free zone company formation for how ownership disclosure fits the licensing process.

Auditors and accountants

Accountants are DNFBPs when they prepare or carry out specified transactions for clients, such as handling client money or managing company formation and sales. Statutory audit work alone raises different questions, but auditors who identify suspicions in the course of an engagement should know the reporting route and avoid tipping off clients.

Lawyers and notaries

Lawyers and notaries fall within the regime when they prepare or carry out transactions such as property deals, management of client funds or accounts, and the creation, operation or sale of companies. Advice in litigation and legal professional privilege are treated differently, but the boundary needs careful policy drafting. Their AML supervisor is the Ministry of Justice.

Commercial gaming operators

Commercial gaming operators, including lotteries, land-based and online gaming, were formally added to the DNFBP list by the 2025 regulation, with a transaction threshold of AED 11,000 for single or linked transactions. They are supervised by the federal General Commercial Gaming Regulatory Authority.

DNFBP AML UAE rules in the DIFC and ADGM

Businesses in the financial free zones follow the same federal law and report through the same FIU, but their supervisor and rulebook differ. In the DIFC, DNFBPs such as real estate agents, law firms, accounting firms and corporate service providers must register with the DFSA and comply with the AML Module of the DFSA Rulebook. In ADGM, DNFBPs are supervised under ADGM's AML framework, and ADGM's financial crime team has issued reminders on goAML registration and reporting, including threshold reports for precious metals dealers and real estate transactions and a six-year retention period for report records.

A group with an onshore real estate brokerage and a DIFC holding company may therefore deal with the Ministry of Economy and the DFSA at the same time. Aligning on the stricter standard across the group usually saves effort. For the DIFC regime more broadly, see DIFC financial regulation.

Preparing for a DNFBP AML UAE inspection

Supervisors carry out both desk-based reviews and on-site inspections, and both can arrive with limited notice. The quality of your preparation shapes the outcome far more than the length of your policy manual. Treat DNFBP AML UAE compliance as something you must be able to demonstrate on any given day, not something you assemble when a letter arrives.

What inspectors typically ask for

Expect requests for the business-wide risk assessment and evidence of its approval, the AML policy and procedures, the compliance officer's appointment and job description, goAML registration details, a list of customers and transactions over a period, a sample of customer files, sanctions screening logs, internal suspicion reports with the decisions taken on them, training records and any independent review report. Inspectors may also interview staff to test whether procedures are understood in practice.

Build an evidence file now

Keep a single, indexed compliance file containing the documents above, updated as they change. Record management information, such as the number of customers rated high risk, alerts reviewed, reports filed and screening hits handled, so you can show how the programme performs. Where you identify a weakness yourself, record the remediation plan and progress: self-identified issues being fixed are viewed very differently from issues inspectors find unaddressed.

Responding to findings

Findings usually come with deadlines for remediation. Respond in writing, accept or explain each finding, set realistic actions with owners and dates, and report completion. Where a finding could lead to a sanction, or where facts suggest earlier suspicious activity that was not reported to the FIU, take advice before responding. Our regulatory investigations team supports businesses through this stage.

Illustrative scenario: a free zone gold trader

This scenario is illustrative only and does not describe any real client.

A gold trading company in a commercial free zone buys scrap and bullion from regional suppliers and sells to wholesale buyers, some paying in cash. It holds a trade licence but has never registered on goAML and has no compliance officer.

Under DNFBP AML UAE rules, the company is a dealer in precious metals supervised by the Ministry of Economy. Its cash sales above the threshold require due diligence and threshold reports. Supplier due diligence is weak: it cannot evidence the origin of several shipments from higher-risk corridors.

A sensible remediation plan would appoint a compliance officer and deputy, complete both stages of goAML registration, write a business-wide risk assessment covering supply-chain and proliferation financing risk, introduce sanctions screening for suppliers and buyers, file any overdue threshold reports after taking advice, and adopt a policy of refusing cash above a set level. The board would approve the programme and schedule an independent review.

Risks and common mistakes for DNFBPs

Cross-border angle

Many UAE DNFBPs serve buyers and investors from India, Bangladesh, Pakistan, the UK, Russia, China and the wider GCC. Each corridor brings its own risk indicators, from informal value transfer and gold smuggling routes in South Asia to sanctions exposure for certain nationalities and sectors. Source-of-funds evidence from overseas should be read in context: bank statements, tax filings and sale documents from the home jurisdiction usually carry more weight than letters. Where foreign-law questions arise, such as whether a funds transfer complied with home-country exchange controls, TRW & Co can draw on colleagues in our network. For sanctions questions, see our sanctions and export controls practice.

What to do next: a checklist

• Confirm whether any of your activities fall within a DNFBP category, and identify your supervisor.
• Complete supervisor registration and both stages of goAML registration.
• Appoint a compliance officer and deputy, with clear authority and time.
• Write or refresh the business-wide risk assessment under the 2025 framework.
• Set up sanctions screening and a freezing procedure.
• Document threshold reporting rules for your sector and train staff on them.
• Keep records for at least five years and test the programme independently.

TRW & Co helps DNFBPs build proportionate programmes, prepare for inspections and respond to findings through our AML compliance practice. To discuss your business, contact our Dubai team.

Frequently asked questions

Sources and official materials

1. Federal Decree-Law No. (10) of 2025 — The 2025 federal AML/CFT/CPF law
2. Ministry of Economy: goAML registration technical instructions — Registration steps for DNFBPs supervised by the Ministry
3. DFSA: DNFBP registration service — Registration of DNFBPs in the DIFC
4. ADGM FCCP Notice 84 of 2025 — goAML, threshold reports and sanctions duties for ADGM entities
5. UAE Financial Intelligence Unit — Receives reports from financial institutions and DNFBPs

General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.