A UAE DNFBP must register on goAML, appoint and register a compliance officer, run a documented risk-based AML programme under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, apply enhanced due diligence to high-risk countries under Article 23 of the Executive Regulations as directed by the Ministry of Economy and Tourism's Circular No. 2 of 2026, screen against sanctions lists under Cabinet Decision No. 74 of 2020, and file suspicious transaction reports. The Ministry inspects and penalises both the business and its executives.
Who is a DNFBP
The federal framework applies its core AML/CFT obligations to designated non-financial businesses and professions as well as to financial institutions. The Ministry of Economy and Tourism supervises four sectors: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, and corporate service providers. Lawyers, notaries and other independent legal professionals are supervised by the Ministry of Justice. Free zone registered DNFBPs are supervised through the same framework with the free zone authority involved.
The obligations
- goAML registration. The business registers on the Financial Intelligence Unit's goAML portal through the SACM pre-registration step, with its trade licence and the compliance officer's identity documents. Registration is mandatory and is the first thing an inspector checks.
- Compliance officer. A named individual responsible for the programme and for reporting, registered on goAML. The framework does not require an employee, so an external compliance officer is possible, but responsibility stays with the business.
- Business risk assessment. A documented assessment of the money laundering, terrorist financing and proliferation financing risks of the business's actual customers, services, geographies and channels.
- Customer due diligence. Identification and verification of customers and beneficial owners, understanding of the purpose of the relationship, and risk rating. For real estate, both buyer and seller on a transaction. For corporate service providers, the beneficial owners of every company serviced, consistent with the beneficial ownership rules in Cabinet Decision No. 109 of 2023.
- Enhanced due diligence. For politically exposed persons, high-risk countries and other higher-risk situations: source of funds and wealth, senior management approval, closer monitoring.
- Sanctions screening. Against the UN Security Council lists and the UAE local terrorist list under Cabinet Decision No. 74 of 2020, with freeze and reporting steps if there is a match. See sanctions and targeted financial sanctions.
- Suspicious transaction reporting. Through goAML, without tipping off the customer. See goAML reporting.
- Record keeping, training and independent audit. Records for the statutory period, role-based training with records, and a periodic independent test of the programme proportionate to the business.
Circular No. 2 of 2026 on the FATF lists
On 14 September 2026 the Ministry issued Circular No. MOET AML/002/2026, replacing its earlier circular of the same year, applying Article 14 of Federal Decree-Law No. 10 of 2025 and Article 23 of Cabinet Resolution No. 134 of 2025 to the June 2026 FATF lists of high-risk jurisdictions subject to a call for action and jurisdictions under increased monitoring. For countries on the call-for-action list it requires enhanced due diligence on every relationship and transaction involving them, including natural persons, legal entities and anyone acting for them; internal mechanisms to monitor such activity and suspicious transaction reports to the Financial Intelligence Unit using the goAML high-risk jurisdiction report templates; a prohibition on relying on third parties located in those countries for customer due diligence; and compliance with targeted financial sanctions under the UN Security Council resolutions and Cabinet Decision No. 74 of 2020. It states that administrative penalties for non-implementation apply to the DNFBP, its executives and its senior management. DNFBPs must check the FATF and national committee lists regularly and re-evaluate due diligence when a country is delisted.
In practice the circular requires a specific high-risk country procedure in every DNFBP manual, a screening step that identifies country exposure at onboarding and on each transaction, and a record that the procedure was applied. Our 2025 law refresh guide explains how it fits with the wider update.
Sector notes
Real estate. The highest-volume DNFBP sector and the one the Ministry inspects most. Cash and crypto-funded purchases, off-plan resales and overseas buyers drive the risk. Brokers must perform due diligence on both sides of a transaction and report cash transactions above the prescribed thresholds. Corporate service providers. Risk concentrates in the beneficial owners of serviced companies, nominee arrangements and companies with no substance. The Ministry's inspections test whether the provider actually knows who owns what it administers. Auditors and accountants. Risk sits in the clients they introduce and the transactions they see. Precious metals and stones. Cash thresholds, trade-based laundering and the provenance of goods.
Where we come in
We build and refresh DNFBP programmes to the current law, including the Circular No. 2 of 2026 procedure, act as or support the compliance officer, run the independent review, and handle Ministry correspondence and penalty representations. For businesses that also need accounting, bookkeeping and tax compliance, our group's accounting arm Neo Finance works alongside us. See the AML compliance practice page.
Frequently asked questions
Which businesses are DNFBPs in the UAE?
Real estate brokers and agents, dealers in precious metals and stones, auditors and accountants and corporate service providers, supervised by the Ministry of Economy and Tourism, plus lawyers, notaries and independent legal professionals supervised by the Ministry of Justice.
Is goAML registration mandatory for a real estate broker in Dubai?
Yes. Every DNFBP must register on the Financial Intelligence Unit's goAML portal, through the SACM pre-registration step, and register a named compliance officer. It is the first item the Ministry checks on inspection.
What does MoET Circular No. 2 of 2026 require?
For jurisdictions on the FATF call-for-action list: enhanced due diligence on all relationships and transactions, internal monitoring and goAML reporting using the high-risk jurisdiction templates, no reliance on third parties located in those countries for customer due diligence, and targeted financial sanctions compliance. Penalties apply to the business and its executives. It was issued on 14 September 2026 under Article 14 of Federal Decree-Law No. 10 of 2025 and Article 23 of Cabinet Resolution No. 134 of 2025.
Can a DNFBP use an external compliance officer?
Yes. The framework requires a named compliance officer registered on goAML but does not require an employee. The business and its executives remain responsible for the programme and are personally exposed to penalties.
Do DNFBPs need an independent AML audit?
Yes, proportionate to their size and risk. The Executive Regulations require an independent audit function to test the programme, and Ministry inspectors ask for the most recent review and evidence that its findings were closed.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
