Anti-Money Laundering enforcement in the UAE has moved from paperwork to serious supervision — and if your business is a DNFBP, the risk of a five- or six-figure fine is real. Many business owners do not even realise they fall into this category. Understanding AML compliance for UAE DNFBPs in 2026 is essential to protect your licence, your reputation and your bank relationships.
This guide explains what a DNFBP is, the core AML obligations, the goAML system, the penalties for getting it wrong, and a checklist to keep your business compliant.
What is a DNFBP?
DNFBP stands for Designated Non-Financial Business or Profession. These are businesses outside the banking sector that regulators consider higher risk for money laundering because of the nature of their transactions. In the UAE, DNFBPs include:
- Real estate agents and brokers (buying and selling property).
- Dealers in precious metals and precious stones (gold, diamonds, jewellery).
- Auditors and accountants providing professional services.
- Lawyers, notaries and independent legal professionals (for certain transactions).
- Corporate service providers that set up or manage companies for clients.
If your business appears on this list, AML obligations apply to you from the moment you are licensed — not from the moment you are inspected.
The core AML obligations for DNFBPs
1. Register on goAML
Every DNFBP must register on the UAE’s goAML platform, the Financial Intelligence Unit’s system for reporting. Registration is mandatory upon licensing, and failure to register is one of the most heavily penalised breaches.
2. Appoint a Compliance Officer
You must designate an AML/CFT Compliance Officer responsible for your programme, reporting and liaison with authorities.
3. Conduct customer due diligence (CDD)
Identify and verify your customers, understand the purpose of the relationship, and identify the ultimate beneficial owner behind corporate clients. Enhanced due diligence applies to higher-risk clients and politically exposed persons.
4. Carry out a business risk assessment
Document the money-laundering risks specific to your business, customers, geographies and transactions — and keep it current.
5. File Suspicious Transaction Reports (STRs)
If you suspect a transaction is linked to a crime, you must file an STR on goAML immediately — generally within 24 to 48 hours of forming the suspicion. Tipping off the customer is itself an offence.
6. Keep records and train staff
Maintain records for the required retention period and train your team so they can recognise and escalate red flags.
Penalties: why AML can’t be ignored
The UAE has committed to strong enforcement, and the fines reflect that:
- From AED 50,000 for failing to register on goAML or meet core obligations.
- Substantial fines — often ranging into the hundreds of thousands of dirhams — for failures such as inadequate due diligence, failing to file STRs, or not having a compliance programme.
- Licence suspension or cancellation for serious or repeated breaches.
Just as damaging is the knock-on effect: banks increasingly de-risk clients with weak AML controls, which can mean losing your corporate account.
An AML compliance checklist for DNFBPs
- Confirm whether your activity classifies you as a DNFBP.
- Register on the goAML portal and keep the registration renewed.
- Appoint a qualified AML/CFT Compliance Officer.
- Write and maintain AML/CFT policies and procedures.
- Complete an enterprise-wide risk assessment.
- Implement CDD and enhanced due diligence workflows.
- Screen customers against sanctions and PEP lists.
- Establish an STR process and file within required timeframes.
- Train staff and keep training records.
- Retain records for the mandated period.
Frequently asked questions
How do I know if my business is a DNFBP?
If you operate in real estate brokerage, deal in precious metals or stones, provide accounting or legal services, or act as a corporate service provider, you are almost certainly a DNFBP and subject to AML obligations.
What is goAML?
goAML is the UAE Financial Intelligence Unit’s online platform where DNFBPs register and file suspicious transaction and activity reports. Registration is mandatory.
How quickly must I file a Suspicious Transaction Report?
An STR should be filed as soon as suspicion arises — generally within 24 to 48 hours. Delaying or failing to file, or tipping off the customer, are serious offences.
What is the minimum AML penalty in the UAE?
Penalties commonly start at AED 50,000 for registration and core compliance failures and can rise significantly, up to licence suspension for serious breaches.
Stay compliant with HM Corporate Services
AML compliance is detailed, ongoing, and heavily penalised when neglected — but it doesn’t have to overwhelm your team. HM Corporate Services helps DNFBPs register on goAML, appoint a compliance officer, build policies and risk assessments, and stay inspection-ready all year round.
Request an AML compliance health check →
Disclaimer: This article is for general information only and does not constitute legal or compliance advice. AML/CFT obligations and penalties are set by UAE authorities and may change. Seek professional guidance for your specific situation.
