goAML Registration and AML Policy for DNFBPs in UAE (2026)

Is your business a DNFBP that must register on goAML?

If you work in one of six designated sectors and carry out the listed activities, yes. Size does not matter: a two-person brokerage has the same core duties as a large one.

Cabinet Resolution No. 134 of 2025 sets out the categories and triggers, and the supervisor depends on the sector and where you are licensed.

A gold trader or broker that is a DNFBP also carries tax duties; our guides on Corporate Tax for gold and jewellery traders and Corporate Tax for real estate brokers cover that side.

What changed in UAE anti-money laundering law in 2025?

A new law and a new executive regulation now apply, so any AML policy written before October 2025 needs updating. The core duties are familiar, but the legal references, the scope and several powers have changed. Our earlier overview of UAE AML compliance gives the background on who is covered.

Why proliferation financing matters to a small firm

Your risk assessment, customer screening and staff training must now consider proliferation financing red flags, such as dealings with dual-use goods traders or high-risk jurisdictions. A gold dealer supplying exporters or a company formation agent setting up trading companies should address this explicitly.

Beneficial ownership sits alongside AML

Your own company must keep its beneficial owner register current, with changes notified within 15 days, and you must identify the beneficial owners of your clients. Our UBO register guide explains the company side.

What must an AML/CFT policy contain for a DNFBP?

It must be approved by senior management and cover risk assessment, due diligence, sanctions screening, reporting, record keeping, training, a compliance officer and independent review. A generic downloaded template rarely passes, because inspectors check that the policy matches how you actually work.

Accounting records support the AML file: a jewellery business that tracks stock by weight and a brokerage that records each commission against a deal file are far easier to inspect. See accounting for jewellery shops and accounting for real estate brokerages.

Which reports do DNFBPs file on goAML: STR, REAR and DPMSR?

There are two kinds: suspicion-based reports, which have no minimum amount, and threshold reports for specific sectors. Both go through goAML.

Legal professional privilege

Lawyers and notaries have a narrow carve-out from filing a suspicious transaction report where information is covered by professional secrecy. Accountants and company service providers do not share that carve-out.

How to register on goAML and build your AML programme

Registration takes days; the programme behind it takes a few weeks to build properly. Do both before an inspection letter arrives.

What documents should your AML compliance file hold?

Inspectors ask for evidence, not intentions, so keep these in one place.

• goAML registration confirmation and compliance officer details
• Board or owner approval of the AML/CFT policy, with date
• Business-wide risk assessment, including proliferation financing
• Customer risk assessment forms for each client
• CDD and EDD files with ID, beneficial owner and source of funds evidence
• Sanctions screening logs and any freezing reports
• Internal suspicion reports and STR, REAR or DPMSR submissions
• Training materials and attendance records
• Independent audit or review report and action plan
• Records index showing 5 year retention

Which AML dates and time limits should DNFBPs track?

AML has fewer calendar deadlines than tax, but several time limits apply the moment something happens.

What penalties can DNFBPs face for AML failures?

Supervisors can impose administrative sanctions and serious failures are criminal offences. We do not quote specific fine amounts here, because the fine schedule is applied case by case; the table shows the types of sanction.

Enforcement is active. In its first half 2025 inspection results, MoET reported 1,063 violations and fines of more than AED 42 million: 495 violations at real estate brokerages, 473 at precious metals and stones dealers and 95 at corporate service providers and auditors. Weak areas named were due diligence, risk assessment methodology and suspicious transaction reporting.

8 AML mistakes brokers, gold dealers and accountants make

These are the gaps that turn an inspection into a violation report. Gold dealers should also keep VAT treatment straight, as our VAT guide for precious metals explains, and brokers can check the property tax side in our UAE real estate tax guide.

• A policy that still cites the old law. Documents referring to the replaced 2018 Decree-Law and 2019 regulation show the programme has not been reviewed.
• Registered, but no risk assessment. Registration is step one; inspectors ask for the documented assessment first.
• Template policy with no approval. Without senior management sign-off, the policy does not count.
• Missing a REAR because payments were split. Cash of AED 35,000 and AED 25,000 on one deal is AED 60,000, above the AED 55,000 threshold.
• Taking a booking before CDD is complete. Due diligence must come before the business relationship starts.
• No sanctions screening after onboarding. Lists change; screening only once leaves you exposed.
• Telling a client a report is being filed. That is tipping off, a criminal offence.
• Accountants assuming only banks and gold dealers are covered. Accounting firms handling client money or company formations are DNFBPs.

How to stay inspection-ready all year

A short routine keeps the file current without a scramble when the letter comes.

• Every client: complete CDD and screening before accepting money or signing
• Every deal: check cash payments against the AED 55,000 threshold
• Weekly: review sanctions list alerts and rescreen active clients
• Monthly: compliance officer reviews internal suspicion reports
• Quarterly: sample-check CDD files for completeness
• Annually: refresh the risk assessment and policy, and get them approved
• Annually: train all customer-facing staff and record attendance
• Annually: commission an independent review and close its findings

Received an inspection letter or found gaps in your AML file?

Start fixing immediately and document every step: a dated remediation plan with owners and deadlines shows the supervisor you are acting. Prioritise goAML registration, the risk assessment and an approved policy, then backfill CDD on active clients.

Answer every information request by the date in the letter and keep copies of what you send. If a sanction is imposed, take legal advice on the objection route in the decision itself. Tax penalties follow a different process; for those, see our FTA reconsideration guide. A internal audit of the AML file before the visit is often the fastest way to find what is missing.

Worked example: when a brokerage deal triggers a REAR

An illustrative Dubai brokerage handles a AED 1,200,000 freehold apartment sale. The buyer pays part of the booking in cash on two dates.

Neither cash payment alone reached AED 55,000, but together they did, so the brokerage files a REAR on goAML. Before accepting the first AED 35,000 it should also have completed CDD on the buyer and screened them against sanctions lists. If the buyer’s source of cash cannot be explained, the compliance officer considers a separate suspicious transaction report, and nobody tells the buyer.

Run AML in-house, hire a freelancer or use an accounting firm?

The compliance officer role stays inside your business, but building and reviewing the programme can be done in-house or with outside help.

Paci starts with a free 15-minute review with a qualified accountant and sends a fixed quote within 24 hours. Our compliance review service tests your AML file against how your business really operates, and our due diligence support helps with client files.

What DNFBP owners ask us about AML and goAML