Real-estate agents and brokers
Businesses involved in customer transactions for buying or selling property need to assess client, beneficial-owner, payment and transaction risks.
Risk-based controls · evidence · reporting readiness
AML Compliance Services in Dubai
For UAE businesses classified as Designated Non-Financial Businesses and Professions (DNFBPs), effective compliance is more than a policy file or a goAML login. SAIF helps turn risk assessment, customer checks, reporting and staff responsibilities into an operating programme.
The direct answer
What does AML compliance mean for a UAE DNFBP?
A DNFBP needs to understand how its services could be misused for money laundering, terrorist financing or proliferation financing; document that risk; apply proportionate customer due diligence and screening; monitor relationships; escalate and report suspicion; train staff; and retain a clear record of decisions. Senior management and the appointed compliance officer need an operating system they can demonstrate—not a generic policy left on a shelf.
The Ministry of Economy and Tourism’s AML guidance and its 2026 supplemental guidance for independent accountants and auditors describe these responsibilities. The applicable obligations depend on your activity and supervisor. We confirm that scope before proposing work.
First establish the category
Which UAE businesses need a DNFBP AML programme?
The Ministry identifies several non-financial sectors. A licence label is a starting point; the actual services and transactions determine the applicable category and supervisor.
Dealers in precious metals and stones
Gold, jewellery, gemstones and related dealing can create distinct customer, source-of-funds, sanctions and transaction-reporting questions.
Accountants and auditors
Independent professional services may expose a firm to ownership, financial-statement, transaction or cross-border risks. The Ministry issued sector-specific guidance in 2026.
Trust and company service providers
Formation, registered-address and administration services call for careful understanding of who owns, controls and uses a structure.
Different supervisor, different scope.
Financial institutions and firms in DIFC or ADGM can face additional sector or financial-free-zone requirements. Certain legal professionals have their own supervisory route. SAIF’s page focuses on DNFBP programme support; we would agree any specialist regulated work separately rather than suggest one checklist covers every entity.
Check the Ministry’s DNFBP categories ↗Current UAE framework
The law changed. Your AML documents should reflect that.
Federal Decree-Law No. 10 of 2025 is the current federal AML/CFT/CPF law. Cabinet Resolution No. 134 of 2025 sets out its executive regulations. The Ministry’s 2026 DNFBP and sector guidance translates that framework into practical expectations.
Older web pages and policy templates often still describe Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 as the current core framework. A policy referring only to the superseded instruments should be reviewed—not merely updated by replacing the title on its cover. The risk assessment, controls, roles and evidence must be tested against the current requirements.
Read the current federal law ↗ Ministry legislation directory ↗
What an engagement can include
AML compliance support built around your actual business
Choose a focused gap review or a wider programme build. The scope depends on your DNFBP activity, customer base, present controls and regulator.
Applicability and gap assessment
Identify the licensed activity, DNFBP category and supervisor. Review existing policies, goAML access, client files, screening, escalation and management oversight; deliver a prioritised gap register.
Business risk assessment
Document exposure by customers, beneficial ownership, services, countries, delivery channels and transactions. Link inherent risks, existing controls and residual risks to a practical action plan.
Policies and operating procedures
Tailor written AML/CFT/CPF controls to the business, its risk assessment and current requirements. Define who approves higher-risk relationships and how exceptions are evidenced.
CDD, EDD and UBO processes
Build client-onboarding and periodic-review files covering identity, beneficial ownership, purpose of relationship, risk rating, source of funds or wealth where relevant, and enhanced review.
Screening and escalation
Review sanctions, PEP and adverse-information screening responsibilities, match resolution, ongoing monitoring, internal reporting and confidential decision records.
goAML and reporting readiness
Support reporting-entity access, assigned user roles and the internal path from staff concern to compliance-officer decision and, where required, reporting to the UAE FIU.
Training and independent review
Develop role-specific training evidence and test whether the programme works in practice. An independent review or inspection-readiness exercise can identify gaps before a supervisory visit.
A firm remains responsible for its own compliance decisions and supervisory submissions. Any continuing adviser, compliance-officer or reporting role must be separately agreed with the appropriate authority, access and independence considered.
From policy to operating evidence
How do we turn AML requirements into daily controls?
These are connected decisions, not a set of forms completed once. Each step should leave evidence that a reviewer can follow.
- 01
Map the business and exposure
Start with licences, services, customer types, geographies, transactions, delivery channels and existing procedures. Decide what your risk assessment needs to cover.
- 02
Design and assign controls
Set CDD and EDD requirements, screening and monitoring triggers, approval levels, compliance-officer duties, training and escalation. Match written policy to how the team works.
- 03
Test real files and decisions
Sample onboarding records, beneficial ownership checks, risk ratings, alerts and internal reports. Record gaps, owners and remediation dates instead of assuming a policy is being followed.
- 04
Review, refresh and evidence
Update the programme as activities or risks change; retain management review, training, independent testing and reporting records in a form available for supervisory inspection.
A practical example
A corporate buyer with layered ownership
A real-estate brokerage receives instructions from an overseas company seeking a UAE property purchase. The apparent signatory is not the person funding the transaction, and the ownership chart includes several entities. The broker should not treat a trade licence and a copy of the signatory’s passport as the entire CDD file.
The compliance team would identify and verify the customer and beneficial owner, understand control and the transaction’s purpose, assess geography and source-of-funds indicators, screen relevant parties, decide whether enhanced checks are needed, and record the rationale for accepting or declining the relationship. If reasonable suspicion remains, the appointed reporting function must assess the FIU reporting obligation confidentially.
What the file should explain
- Who is the customer and who ultimately owns or controls it?
- Who will pay, and does the funding path make commercial sense?
- What are the relevant sanctions, PEP and geographic risks?
- Which questions were escalated and who approved the outcome?
- If a concern persists, how was a reporting decision reached?
One red flag is not proof of wrongdoing. It is a reason for proportionate investigation and a documented decision.
Portal and reporting
goAML registration is necessary for DNFBPs—but not sufficient.
The Ministry says DNFBPs must register on the UAE FIU’s goAML portal. Registration gives the entity a reporting route; it does not establish that the risk assessment, client files, sanctions controls, training or internal escalation are complete. Portal access and user permissions should match the firm’s appointed reporting responsibilities.
An STR or SAR is a confidential regulatory report, not an ordinary customer complaint or a routine monthly return. The Ministry’s guidance explains that reasonable suspicion can arise from a relationship or attempted transaction, regardless of value, and does not require proof of a crime. Staff should escalate concerns through the firm’s procedure without tipping off the customer. A reporting decision belongs with the authorised compliance function.
For portal steps, refer to the Ministry’s goAML registration instructions. Do not put sensitive suspicion details in a public web enquiry form; contact us to agree a secure channel and scope.
Evidence and scope
What should you prepare for an AML health check?
Start with records you already have. We can then agree a risk-based sample and deliverables instead of requesting every file at once.
Business and governance
- Trade licences, activities and branches
- Organisation chart, compliance-officer appointment and management oversight
- Current risk assessment, policies and procedure manuals
- Training plan, attendance and any independent-review reports
Client and operating evidence
- Sample customer files and beneficial-ownership records
- Risk ratings, EDD and ongoing-review evidence
- Sanctions and PEP screening logs and match decisions
- Internal escalations, goAML status and regulator correspondence
Fees and timing depend on the number of entities, sector and transaction complexity, condition of existing files, urgency and whether the assignment is a one-off review, implementation or ongoing support. We set out exclusions and responsibilities in a written proposal.
Frequently asked questions
UAE AML and goAML answers
These answers explain the main DNFBP issues. A financial institution, legal practice or financial-free-zone firm must consider its own supervisor’s rules.
01What is AML compliance for a UAE DNFBP?+
It is the risk-based programme a designated non-financial business or profession uses to assess money-laundering, terrorist-financing and proliferation-financing risks; identify and monitor customers; screen relevant parties; escalate suspicion; report when required; train staff; and retain evidence. A goAML account alone is not a complete programme.
02Which businesses are DNFBPs in the UAE?+
The Ministry of Economy and Tourism identifies categories including real-estate agents and brokers, dealers in precious metals and stones, independent accountants and auditors, and trust or company service providers. Certain legal professionals are also in scope for specified activities under their applicable supervisor. Classification depends on the actual licensed services and transactions, not merely the trade name.
03Do all UAE companies need a goAML account?+
No. goAML registration applies to reporting entities such as DNFBPs and financial institutions, not automatically to every UAE trading company. Confirm your category and supervisor first. The Ministry states that DNFBP registration on goAML is mandatory.
04Is UAE AML law still Federal Decree-Law No. 20 of 2018?+
No. The current federal AML/CFT/CPF framework is Federal Decree-Law No. 10 of 2025 and its executive regulations, Cabinet Resolution No. 134 of 2025. Older templates or articles citing the 2018 law as the current primary law need review and updating.
05What does an AML business risk assessment cover?+
A documented business risk assessment examines the nature of customers, beneficial owners, products and services, transactions, delivery channels, geography and relevant sectoral risk. It evaluates controls and residual risk, then informs the firm’s procedures, resource allocation and monitoring.
06Is an AML policy template enough?+
Usually not. The Ministry’s 2026 guidance expects policies and procedures tailored to the entity’s actual business model and risk assessment, implemented and kept up to date. Supervisors may examine client files and decision evidence, not only a signed policy document.
07What is the difference between KYC, CDD and EDD?+
KYC is often used for identifying a customer. Customer Due Diligence is broader: verifying identity and beneficial owners, understanding the relationship, assigning risk and monitoring it. Enhanced Due Diligence adds proportionate measures for higher-risk situations. The exact controls depend on the facts and the applicable supervisor.
08Do I need to identify the ultimate beneficial owner?+
For a legal-entity customer, beneficial ownership and control are part of risk-based CDD. Obtain and verify enough information to understand who ultimately owns or controls the customer, and record how the conclusion was reached. Complex structures may require further explanation and documents.
09Does a small real-estate broker need AML procedures?+
If the brokerage falls within the DNFBP category, its size does not eliminate the obligations. Procedures and resources should be proportionate to its activities and risks. A small firm still needs practical onboarding, screening, escalation, reporting and record-keeping controls.
10When should a firm file an STR or SAR?+
The designated reporting entity must promptly assess and report reasonable suspicion through the applicable UAE FIU process. The Ministry’s sector guidance says the obligation is not dependent on proof of a crime or on a minimum transaction value, and can apply to attempted or declined activity. Staff should escalate concerns internally without alerting the customer.
11Can an adviser submit a suspicious report instead of our MLRO?+
An adviser may help design controls or prepare information within an expressly agreed and authorised role. Reporting decisions, portal permissions, confidentiality and ultimate responsibilities remain governed by the reporting entity’s regulatory framework. A consultancy engagement does not automatically transfer those duties.
12What is the AML compliance officer or MLRO responsible for?+
The appointed officer oversees the firm’s AML/CFT/CPF controls, internal escalation and reporting processes, training and management information within the applicable regulatory framework. The Ministry’s guidance also expects senior-management oversight; appointing a title without authority, resources and evidence is inadequate.
13Are sanctions and PEP screening the same?+
No. Targeted-financial-sanctions screening and politically exposed person risk assessment address different risks and controls. Both need documented procedures, match review and escalation appropriate to the firm’s customers and activities.
14How often should our AML controls be reviewed?+
Review them when risks, services, ownership, customer profile, geography or regulatory requirements change, and at an appropriate periodic cadence under your programme. Refresh high-risk customer files more closely and keep evidence of decisions, training and independent testing.
15What will an AML inspection ask to see?+
A supervisor may request the goAML status, risk assessment, approved procedures, compliance-officer appointment, client CDD files, screening and monitoring evidence, training records, suspicious-activity escalation and independent-review findings. The exact request depends on the regulator and business.
16How much do AML compliance services cost in Dubai?+
Cost depends on the entity type, number of licences and branches, customer and transaction volume, sectors and geographies, condition of existing files, and whether the assignment covers a gap review, full programme, training or ongoing support. SAIF first agrees a defined scope and deliverables.
17Can SAIF help a financial institution or DIFC/ADGM firm?+
Those firms have sector- and jurisdiction-specific supervisors and requirements. We first review the proposed engagement and confirm whether the relevant regulated scope falls within our capabilities or requires a specialist provider. This page is primarily for UAE DNFBP compliance support.
Official sources reviewed
Reviewed 14 October 2026. Confirm your category, supervisor and current circulars before acting.
Work with SAIF
Build a programme you can explain and evidence.
Tell us your licensed activity, DNFBP category, supervisor and the help you need. We will define the review or implementation scope before starting.
