Updated August 2026. The UAE’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CFT) framework is one of the most actively enforced compliance regimes in the region, overseen jointly by the Central Bank of the UAE (CBUAE), the Financial Intelligence Unit (FIU), and the Executive Office for Control & Non-Proliferation (ExOCN). Following the UAE’s successful exit from the Financial Action Task Force (FATF) grey list in June 2024, enforcement intensity has remained high. Penalties for AML/CFT violations can reach AED 50,000,000 per institution, and regulatory expectations on Money Laundering Reporting Officers (MLROs) have risen significantly. Annual compliance programme costs for regulated entities range from AED 150,000 for small businesses to AED 5,000,000+ for large financial institutions.
- Every regulated entity — banks, exchange houses, insurance companies, DNFBPs — must appoint a UAE-resident Money Laundering Reporting Officer (MLRO) registered with the relevant supervisory authority.
- goAML is the mandatory platform for filing Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) with the UAE FIU; non-filing penalties reach AED 1,000,000 per unreported transaction.
- Designated Non-Financial Businesses and Professions (DNFBPs) — including real estate brokers, auditors, law firms, and gold dealers — are subject to full AML/CFT obligations under UAE law.
- The CBUAE’s AML/CFT supervisory framework includes on-site inspections, risk-based examinations, and document review — deficiencies can trigger fines of AED 500,000–50,000,000.
- Sanctions screening must be conducted against UAE Local Terrorist List, UN Security Council lists, and OFAC/EU lists; violations can result in criminal prosecution and licence revocation.
UAE AML/CFT Legal Framework 2026
The UAE AML/CFT framework is built on Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations (AML Law), as amended. Cabinet Decision No. 10 of 2019 lists designated activities and businesses (DNFBPs). Cabinet Decision No. 58 of 2020 on Beneficial Ownership Procedures requires all UAE mainland and free zone companies to maintain and file beneficial ownership registers. The CBUAE’s AML/CFT Guidance for Licensed Financial Institutions (updated 2023) and the CBUAE Standards on AML/CFT for Exchange Houses set out detailed expectations for financial sector entities.
Key regulatory bodies: the Central Bank of the UAE (CBUAE) supervises banks, exchange houses, finance companies, and payment service providers; the UAE Securities and Commodities Authority (SCA) supervises investment firms and securities dealers; the Insurance Authority supervises insurance companies; the DNFBP Unit within the Ministry of Economy (MoE) supervises real estate brokers, auditors, lawyers, corporate service providers, and dealers in precious metals and stones; the ExOCN coordinates counter-proliferation financing (CPF) measures. All entities must register on goAML and file STRs/SARs through the FIU’s portal.
The UAE introduced its National AML/CFT Strategy 2024–2029 following FATF exit, emphasising risk-based supervision, virtual asset regulation (through VARA in Dubai and ADGM’s FSRA), and enhanced DNFBP oversight. Virtual Asset Service Providers (VASPs) are now fully within scope of UAE AML/CFT law, supervised by either VARA (Dubai) or ADGM-FSRA (Abu Dhabi).
Who Is the MLRO and What Are Their Duties?
Every regulated entity in the UAE must appoint a Money Laundering Reporting Officer (MLRO) — also called a Compliance Officer for AML/CFT purposes. The MLRO must be a UAE resident, employed directly by the entity (not through a labour supply agency), and registered with the relevant supervisory authority before taking up the role. For CBUAE-supervised entities, MLRO registration requires submission of a fit-and-fitness questionnaire, CV, academic qualifications, AML/CFT certifications, and a background check clearance.
The MLRO’s core duties include: receiving internal suspicious activity reports from staff and assessing whether to file an STR/SAR with the FIU via goAML; maintaining an AML/CFT Programme that meets regulatory minimum standards; conducting or overseeing Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures; providing AML/CFT training to all staff at least annually; maintaining required records for a minimum of five years; and producing an annual AML/CFT compliance report for the board. The MLRO must have direct access to the board or senior management and cannot simultaneously hold operational roles that create conflicts of interest.
MLRO salaries in UAE financial institutions range from AED 250,000 to AED 800,000 per year depending on institution size. External MLRO service providers (common for smaller DNFBPs) charge AED 80,000–200,000 per year. Appointing an MLRO without UAE residency is a CBUAE violation carrying fines of AED 100,000–1,000,000.
goAML Registration and STR/SAR Filing
goAML is the UAE Financial Intelligence Unit’s web-based reporting platform, powered by UNODC goAML software. Registration on goAML is mandatory for all regulated entities — banks, exchange houses, insurance companies, VASPs, and DNFBPs — before they begin business operations. Registration requires: entity name and licence details; MLRO’s full name, title, contact details, and Emirates ID; and supervisor-issued reference number.
Suspicious Transaction Reports (STRs) must be filed on goAML where a staff member or the MLRO has reasonable grounds to suspect that a transaction or attempted transaction involves the proceeds of crime, is connected to terrorist financing, or relates to sanctions evasion. There is no minimum transaction value threshold — suspicion, not amount, triggers the reporting obligation. STRs must be filed within the prescribed period (typically without undue delay, and before completing a transaction wherever possible). Tipping off the customer about an STR filing is a criminal offence carrying imprisonment of up to 1 year and fines up to AED 100,000.
Failure to file an STR where reasonable grounds for suspicion existed attracts fines of up to AED 1,000,000 per unreported transaction for institutional violations, and personal liability (fines and imprisonment) for the MLRO. The FIU provides quarterly typologies and red-flag indicators to assist MLROs in identifying suspicious activity, particularly in sectors such as real estate, gold trading, and virtual assets.
DNFBPs: Who Must Comply?
Designated Non-Financial Businesses and Professions (DNFBPs) are non-bank entities that face specific AML/CFT obligations due to the high inherent money laundering risk in their activities. Under UAE Cabinet Decision No. 10 of 2019, DNFBPs include: (1) real estate agents and brokers involved in buying or selling property (transactions above AED 55,000 trigger full CDD); (2) dealers in precious metals and stones (transactions above AED 55,000 in cash); (3) corporate service providers (company formation agents, registered agents); (4) auditors, accountants, and tax advisors acting as intermediaries; (5) lawyers and notaries when handling client funds or company structures; and (6) trust and company service providers (TCSPs).
DNFBPs are supervised for AML/CFT purposes by the UAE Ministry of Economy’s DNFBP Unit. DNFBPs must: register on goAML; appoint an MLRO; implement a risk-based AML/CFT compliance programme including CDD procedures, sanctions screening, and record-keeping; file STRs with the FIU; and submit to MoE inspections. Real estate developers and brokers selling or leasing property above the AED 55,000 cash threshold must conduct CDD on buyers and sellers and file Cash Transaction Reports (CTRs) for transactions above AED 55,000 in cash.
Customer Due Diligence (CDD) Requirements
Customer Due Diligence is the cornerstone of UAE AML/CFT compliance. All regulated entities must apply CDD measures before establishing a business relationship, before executing occasional transactions above AED 55,000, and when there are suspicions of money laundering or terrorist financing regardless of amount. Standard CDD includes: verifying the customer’s identity using official documents (passport, Emirates ID); verifying the identity of any beneficial owner (any individual owning or controlling 25% or more of the entity); understanding the nature and purpose of the business relationship; and ongoing monitoring of transactions for consistency with the customer’s profile.
Enhanced Due Diligence (EDD) must be applied to: Politically Exposed Persons (PEPs) and their family members and close associates; customers in high-risk countries identified by the FATF or UAE; high-value transactions; and relationships with correspondent financial institutions. EDD includes obtaining senior management approval to establish or continue the relationship, establishing the source of wealth and source of funds, and conducting enhanced ongoing monitoring.
Simplified Due Diligence (SDD) may be applied where the customer, product, or transaction presents a demonstrably low risk, following a documented risk assessment. AML/CFT technology solutions — screening platforms (e.g., Refinitiv World-Check, LexisNexis), transaction monitoring systems, and CDD workflow tools — cost AED 50,000–500,000 annually depending on institution size and transaction volume.
UAE AML/CFT Penalties 2026
| Violation | Regulatory Penalty | Criminal Penalty |
|---|---|---|
| Failure to file STR/SAR | AED 100,000–1,000,000 per occurrence | Imprisonment up to 1 year + fines |
| Tipping off (informing customer of STR) | AED 100,000–500,000 | Imprisonment up to 1 year + AED 100,000 |
| Failure to conduct CDD/EDD | AED 500,000–5,000,000 | N/A (regulatory) |
| Failure to appoint resident MLRO | AED 100,000–1,000,000 | N/A (regulatory) |
| Sanctions evasion/screening failure | AED 1,000,000–50,000,000 | Imprisonment up to 10 years |
| Money laundering offence | Licence revocation + AED 50,000,000 | Imprisonment up to 10 years + asset confiscation |
| Failure to register on goAML | AED 50,000–250,000 | N/A |
Building an Effective AML/CFT Compliance Programme
A sound AML/CFT compliance programme must contain six pillars: (1) Policies and Procedures — a written AML/CFT manual covering CDD, EDD, sanctions screening, record-keeping, and internal reporting, reviewed and approved annually by the board; (2) Risk Assessment — an annual Business Risk Assessment (BRA) evaluating the entity’s inherent risk from customers, products, channels, and geographies, and a Customer Risk Rating (CRR) model applied at onboarding and ongoing review; (3) MLRO and Governance — a registered, experienced MLRO with direct board reporting; (4) Controls — automated transaction monitoring, sanctions screening (pre-deal and batch), and adverse media screening; (5) Training — annual AML/CFT training for all staff, with specialist training for the MLRO and front-line staff; and (6) Independent Audit — an annual internal or external AML/CFT compliance audit.
Annual AML/CFT programme costs for a mid-size exchange house or DNFBP range from AED 300,000 to AED 800,000, covering MLRO salary, technology, legal advisory, and training. Large financial institutions budget AED 2,000,000–5,000,000+ annually for enterprise AML/CFT infrastructure.
What is the difference between an STR and a CTR in UAE?
A Suspicious Transaction Report (STR) is filed when a transaction or activity is suspected of involving money laundering, terrorist financing, or sanctions evasion — regardless of the transaction amount. A Cash Transaction Report (CTR) is filed for cash transactions at or above AED 55,000 (approximately USD 15,000), which is a mechanical threshold report not requiring suspicion. Both are submitted through goAML. Real estate brokers, dealers in precious metals, and exchange houses are among the entities most frequently required to file CTRs.
Who supervises DNFBPs for AML/CFT compliance in UAE?
The UAE Ministry of Economy’s DNFBP Unit is the primary supervisory authority for DNFBPs on the UAE mainland. The Dubai Land Department (DLD) supervises real estate sector AML/CFT compliance within Dubai. Free zone DNFBPs (e.g., legal or accounting firms in DIFC or ADGM) are supervised by their respective free zone regulatory authorities. The Ministry of Economy conducts on-site inspections, issues guidance, and can impose penalties of AED 50,000–5,000,000 for non-compliance.
Is goAML registration free?
Yes, registration on the UAE FIU’s goAML portal is free of charge. However, entities must provide a valid trade licence, MLRO details, and supervisory authority confirmation before registration is approved. The registration process typically takes 5–10 business days. Failure to register is a regulatory violation. Large institutions typically integrate their transaction monitoring systems with goAML via API for automated STR pre-population, which requires third-party technology investment of AED 80,000–300,000.
What are the UAE sanctions screening requirements?
Regulated entities must screen all customers, beneficial owners, and counterparties against: (1) the UAE Local Terrorist List (maintained by the ExOCN); (2) UN Security Council consolidated sanctions lists (UNSCR 1267, 1373, etc.); (3) UAE Cabinet Decision No. 83 of 2023 designated persons and entities list; and (4) optionally but strongly recommended, OFAC SDN list and EU consolidated sanctions list. Screening must occur at onboarding, at each transaction, and whenever lists are updated. Matches must be escalated immediately to the MLRO and reported to the ExOCN. Screening technology costs: AED 30,000–250,000 per year.
How often must AML/CFT training be conducted?
Under CBUAE and MoE guidance, AML/CFT training must be provided to all staff at a minimum annually. New employees must receive AML/CFT training within 30 days of joining. Front-line staff (customer onboarding, relationship management, tellers) should receive more frequent, role-specific training. The MLRO must complete specialist AML/CFT training annually, often through a recognised programme such as ICA Certificate in AML (AED 8,000–15,000 per person), ACAMS CAMS certification (AED 10,000–18,000), or CBUAE-approved local providers.