AML Compliance in the UAE: Complete 2026 Guide for Businesses & Real Estate

What is AML, and why does the UAE regulate it so closely?

Anti-Money Laundering (AML) compliance is the framework of laws, rules and internal controls designed to stop criminal proceeds from being disguised as legitimate funds — and to stop legitimate-looking businesses from being used, knowingly or not, to move money for terrorism or illegal activity. For a country with the UAE's scale of trade, banking, real estate and gold markets, this is treated as a serious national priority, not a box-ticking exercise: the regulatory system is backed by criminal law, substantial fines, and active, publicised enforcement.

If you run a business in a regulated sector — or you're buying or selling property and wondering why your broker is suddenly asking for proof of where your money came from — this guide explains the current rules in plain language, current as of the UAE's most recent legal overhaul.

The UAE AML legal framework (2025 overhaul)

This is the single most important thing to get right if you're researching UAE AML rules in 2026: the law changed substantially in late 2025, and a lot of older content online (including material referencing "Federal Decree-Law No. 20 of 2018") now describes a repealed framework.

• Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing — effective 14 October 2025. It repealed the previous Federal Decree-Law No. 20 of 2018 and its 2021 amendment (Federal Decree-Law No. 26 of 2021).
• Cabinet Resolution No. 134 of 2025, the executive regulation implementing the new law — effective 14 December 2025. It replaced the earlier Cabinet Decision No. 10 of 2019 and Cabinet Resolution No. 24 of 2022.

The 2025 overhaul isn't just a renumbering exercise. Among the substantive changes: proliferation financing is now expressly named as a primary offence alongside money laundering and terrorism financing; virtual assets and Virtual Asset Service Providers (VASPs) are now regulated directly within the federal AML law rather than by separate reference; and the definition of DNFBPs was widened to explicitly bring in operators of commercial games. If your business (or your compliance consultant) is still working from 2018/2019-era guidance, it's working from a superseded framework.

Who regulates AML in the UAE?

Supervision is split by sector, with one central reporting channel for everyone:

• Central Bank of the UAE (CBUAE) — supervises financial institutions (banks, exchange houses, insurers, finance companies, payment service providers) for AML/CFT compliance.
• Ministry of Economy and Tourism (MoET) — supervises DNFBPs, including real estate brokers and agents, dealers in precious metals and stones, trust and company service providers, lawyers and notaries, and auditors/accountants.
• Financial Intelligence Unit (FIU) — under the new law, the FIU is established as an independent unit within the Central Bank (Article 11 of Federal Decree-Law No. 10 of 2025). Every Suspicious Transaction Report, from any regulated sector, is filed exclusively through the FIU's goAML system.
• Executive Office for Control and Non-Proliferation (EOCN) — administers the UAE's Targeted Financial Sanctions list and the systems (Notification Alert System and Automatic Reporting System) regulated entities must subscribe to for sanctions screening.

Who must comply: financial institutions, DNFBPs & VASPs

UAE AML law applies to three broad categories of regulated entity:

• Financial Institutions — banks, exchange houses, insurance and reinsurance companies, finance companies, and payment service providers.
• Designated Non-Financial Businesses and Professions (DNFBPs) — a defined list of non-financial sectors considered higher-risk for money laundering, including: real estate brokers and agents (on purchase/sale transactions); dealers in precious metals and stones above relevant thresholds; trust and company service providers; lawyers, notaries and independent legal professionals (for certain specified activities); auditors and independent accountants; and, as of the 2025 reforms, operators of commercial gaming.
• Virtual Asset Service Providers (VASPs) — now regulated explicitly within the federal AML law itself.

A useful distinction for real estate specifically: being a "real estate professional" alone doesn't automatically make you a DNFBP under this law. The trigger is the activity — concluding a sale or purchase transaction for a client. Leasing, marketing, valuation and property management generally fall outside the statutory DNFBP scope, though firms doing a mix of activities should get this assessed properly rather than assume.

What this means specifically for real estate

Because this site covers Ajman property, it's worth spelling out exactly how this affects anyone buying, selling or working in real estate:

• If you're a broker or agent concluding sale or purchase transactions, you are a DNFBP. You must register on goAML, appoint a compliance officer, run customer due diligence on both the buyer and the seller, and file the required reports — including Real Estate Activity Reports (REARs) for qualifying transactions.
• If you're buying or selling a property, this is why your agent or the developer's sales team now routinely asks for a passport copy, proof of address, and — particularly for larger or cash-heavy deals — documentation on where your funds came from. This isn't optional paperwork your agent invented; it's a legal obligation on their side, and declining to provide it can mean the transaction simply can't proceed through a compliant broker or developer.
• The AED 55,000 figure you'll often see is specifically the threshold for reporting a single cash transaction (or several linked transactions that add up to that amount) to the FIU — it is not the threshold for whether due diligence applies at all. Customer due diligence on a real estate purchase or sale transaction applies without a minimum value threshold.
• This sits alongside, not instead of, the normal registration process at AjmanRe — see our title deed guide for that separate ownership-registration step, and our mortgage guide for the parallel documentation banks require when financing is involved.

The core compliance obligations

Whether you're a bank, a DNFBP or a VASP, the substance of what you're required to do is broadly similar:

• Business/Institutional Risk Assessment. Document how exposed your specific business is to money laundering and terrorism financing risk, based on your customers, products, geography and delivery channels — and keep it updated.
• Customer Due Diligence (CDD). Identify and verify who you're dealing with — individuals and, for companies, the underlying Ultimate Beneficial Owner(s) (UBO), commonly using a 25% ownership stake as the standard identification benchmark, though lower thresholds can apply where risk warrants it.
• Enhanced Due Diligence (EDD). Apply deeper scrutiny to higher-risk customers — politically exposed persons (PEPs), customers from higher-risk jurisdictions, complex ownership structures, or unusually large cash-based deals.
• Appointing a Compliance Officer / MLRO. A named individual at management level, with genuine independence in decision-making and the authority and competence to do the job, responsible for the AML programme and for filing reports directly with the FIU.
• goAML registration. Registering your entity — and your compliance officer — on the FIU's goAML platform, and keeping that registration active and current.
• Suspicious Transaction Reports (STRs) — and, for real estate specifically, Real Estate Activity Reports (REARs) — filed through goAML whenever a transaction looks unusual or meets a mandatory reporting trigger.
• Sanctions screening. Subscribing to the EOCN's Notification Alert System and Automatic Reporting System, screening customers and counterparties before onboarding and on an ongoing basis, and freezing and reporting any match without delay.
• Record-keeping. Retaining CDD records, transaction records and supporting documentation for at least five years after a transaction or the end of a business relationship.
• Staff training on AML obligations and red flags, delivered regularly, not just once at onboarding.
• Independent audit of the AML programme's effectiveness on a periodic basis.

Step-by-step: how a business becomes AML compliant

1. Confirm whether you're in scope. Check whether your specific activities fall under the Financial Institution, DNFBP or VASP definitions — for real estate, this hinges on whether you conclude sale/purchase transactions, not just your trade licence category.
2. Conduct your Business Risk Assessment. Document your exposure before building policies around it — a generic, copy-pasted assessment is one of the first things an inspection will flag.
3. Appoint your Compliance Officer/MLRO at management level, with a clear reporting line and the authority to act independently.
4. Register on goAML as an entity, and register your compliance officer as the authorised user who will file reports.
5. Build (or buy) your AML/CFT policies and procedures — CDD/EDD workflows, UBO identification steps, record-keeping processes, and an internal escalation path for suspicious activity.
6. Subscribe to EOCN's sanctions screening systems and integrate screening into onboarding and ongoing monitoring.
7. Train your staff on the policies, on recognising red flags, and on how to escalate internally.
8. Start applying CDD/EDD on every qualifying transaction — don't wait for a full rollout before applying it to new business coming in.
9. Commission a periodic independent audit of the whole programme, and act on its findings.

Given the complexity and the pace of recent legal change, most DNFBPs — real estate brokerages included — engage a licensed AML/compliance consultant to set this up and to handle goAML filings, rather than attempting it purely in-house from general guidance (including this article).

Penalties for non-compliance

These aren't theoretical numbers. UAE regulators imposed more than AED 380 million in AML-related fines in just the first eight months of 2025 alone, across banks, exchange houses, insurers and finance companies — and DNFBP-sector enforcement, including real estate, has been explicitly flagged as an increasing focus area. Beyond fines, non-compliant entities also risk licence suspension or revocation, which for a brokerage can mean being unable to legally transact at all.

The UAE's FATF status

Context worth knowing: the UAE was placed on the Financial Action Task Force's (FATF) "grey list" of jurisdictions under increased monitoring in 2022, and was formally removed from that list on 23 February 2024 after a sustained reform programme. The 2025 legal overhaul covered in this article is widely read as a continuation of that same trajectory — tightening the framework further rather than relaxing it now that the grey-list pressure has lifted. For businesses, the practical takeaway is the same either way: enforcement is active and the direction of travel is toward more scrutiny, not less.

Common mistakes businesses make

• Relying on outdated guidance. Given the law changed completely in October-December 2025, anything referencing only the 2018 law or the 2019 Cabinet Decision as current is out of date.
• Treating AML as a one-time setup task rather than an ongoing programme — risk assessments, training and screening all need to stay current, not just exist on paper from launch day.
• Misjudging DNFBP scope. Assuming a real estate licence alone triggers (or doesn't trigger) DNFBP status, instead of assessing the actual activity — sale/purchase brokerage specifically brings the obligation.
• Confusing the AED 55,000 cash-reporting threshold with a CDD threshold, and skipping due diligence on lower-value or non-cash transactions as a result.
• Appointing a compliance officer in name only, without the independence, authority or time to actually run the programme — regulators specifically look for genuine independence, not a title added to an existing role.
• Letting goAML registration lapse or go unused — a dormant registration is still treated as non-compliance if required reports aren't actually being filed.