UAE AML Compliance Guide 2026: Anti-Money Laundering Requirements for Free Zone Companies

Updated August 2026. Anti-money laundering (AML) compliance is a mandatory legal obligation for every business registered in the UAE — including companies in free zones such as DMCC, JAFZA, ADGM, RAKEZ, and Dubai Internet City. Governed by Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, the UAE’s AML framework aligns with the global standards set by the Financial Action Task Force (FATF). Following the UAE’s landmark removal from the FATF grey list in February 2024 — achieved after more than 80 legislative and enforcement reforms — compliance obligations remain fully in force and regulatory enforcement has continued to intensify. This guide covers who must comply, the key obligations, penalties for violations, the UBO register requirements applicable to free zone companies, and what the FATF grey list removal means in practice.

UAE AML Legal Framework

The UAE’s AML framework rests on two primary instruments. Federal Decree-Law No. 20 of 2018 (the AML Law) criminalises money laundering and terrorist financing and establishes obligations for all reporting entities. Cabinet Decision No. 10 of 2019 provides the implementing regulations, including the definitions of Designated Non-Financial Businesses and Professions (DNFBPs), the customer due diligence measures required, and the record-keeping and reporting obligations that flow from them.

The UAE is a member of FATF and of MENAFATF (the Middle East and North Africa Financial Action Task Force). For free zone companies, the supervisory authority is the relevant free zone authority, working in coordination with the UAE Central Bank for financial institutions and the Ministry of Economy (MOEC) for mainland-supervised DNFBPs.

Who Must Comply: DNFBPs and Financial Institutions

All UAE-licensed businesses bear some degree of AML responsibility. However, the most comprehensive obligations — goAML registration, compliance officer appointment, full KYC, STR filing — apply to two specific categories: financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs). Free zone companies whose activities fall into these categories must comply regardless of which free zone issues their licence.

Core AML Obligations for Free Zone Companies

Whether your company operates in DMCC, JAFZA, ADGM, RAKEZ, Sharjah Media City, or any other UAE free zone, the following five obligations apply from the date your licence is issued.

1. Register on the goAML Portal

The goAML portal (goaml.gov.ae) is operated by the UAE Financial Intelligence Unit (UAEFIU) and is the government’s central AML reporting platform. All DNFBPs must register immediately upon obtaining their trade licence — registration is not deferred to the first client or the first transaction. Failure to register is an administrative offence carrying fines of AED 100,000 to AED 1,000,000. Once registered, goAML is also the platform through which your company files Suspicious Transaction Reports (STRs) and responds to UAEFIU requests.

2. Appoint a Dedicated AML Compliance Officer

Every DNFBP must designate a named AML compliance officer who is responsible for implementing the company’s AML programme, maintaining KYC records, filing STRs, and acting as the primary liaison with the supervisory authority. For small businesses with limited personnel, the business owner or general manager may assume this role. The compliance officer’s name and contact details must be registered with the relevant free zone authority or supervisory body.

3. Conduct Know Your Customer (KYC) Due Diligence

Before establishing a business relationship or executing a relevant transaction, you must verify the identity of your client. For individual clients: obtain a valid passport or Emirates ID. For corporate clients: obtain the company’s registration documents and identify the Ultimate Beneficial Owner (UBO) — any natural person who ultimately holds 25% or more of shares or voting rights, or who otherwise exercises effective control. Enhanced Due Diligence (EDD) is required for high-risk clients, including Politically Exposed Persons (PEPs), clients from FATF high-risk jurisdictions, and clients with complex or opaque corporate structures.

4. Maintain Records for Five Years

All KYC documentation, transaction records, and business correspondence must be retained for a minimum of five years from the date the business relationship ends or the transaction is completed. Records must be stored in a manner that allows prompt retrieval for regulatory inspection. Failure to maintain adequate records is an administrative offence carrying fines of AED 50,000 to AED 500,000.

5. File Suspicious Transaction Reports (STRs) When Required

If you suspect or have reasonable grounds to suspect that funds or a transaction are connected to money laundering, terrorist financing, or the proceeds of any criminal activity, you are legally required to file an STR via the goAML portal promptly — without alerting the client. The tipping-off prohibition is strict: informing a client that an STR has been or may be filed is a criminal offence in its own right, carrying fines up to AED 1,000,000. Failure to file an STR when one is required is a criminal offence carrying fines up to AED 5,000,000 and imprisonment of up to five years.

AML Penalties Reference Table

The penalties for AML violations in the UAE are among the most significant compliance risks facing any UAE business. The table below distinguishes administrative offences (fines only) from criminal offences (fines plus imprisonment).

Beneficial Ownership (UBO) Register Requirements

Cabinet Decision No. 58 of 2020 requires all UAE-registered companies — including every free zone entity — to maintain a Beneficial Ownership register. This obligation applies regardless of whether your business is a DNFBP. The UBO register is separate from and additional to your KYC obligations as a DNFBP; it concerns your own ownership structure, not your clients’.

UAE Removal from the FATF Grey List: February 2024

In March 2022, the Financial Action Task Force placed the UAE on its grey list — formally designated “Jurisdictions Under Increased Monitoring” — following a mutual evaluation that identified deficiencies in the UAE’s AML and counter-terrorist financing (CTF) framework. The practical consequences for UAE businesses were significant: international correspondent banks applied enhanced due diligence to UAE-origin transactions, some banks declined to maintain UAE correspondent relationships entirely, and UAE companies faced greater scrutiny when opening accounts with international financial institutions.

After implementing more than 80 legislative, regulatory, and enforcement reforms — including expanding the DNFBP supervisory framework, increasing goAML registrations, and significantly scaling up STR prosecutions — the UAE was formally removed from the FATF grey list in February 2024. This removal has had measurable effects: correspondent banking relationships have improved, international banks have reduced blanket enhanced due diligence on UAE counterparties, and the UAE’s standing as a compliant international financial centre has been reinforced. For free zone companies relying on cross-border payments, multi-currency banking, and international trade finance, this change translates into more banking options and fewer transaction delays through 2025 and 2026.

The underlying AML obligations, however, remain fully in force. The UAE has committed to FATF to sustain and deepen its AML programme, and enforcement activity — particularly against DNFBPs that have failed to register on goAML or maintain KYC records — has continued to increase since the grey list exit.

AML Compliance Checklist for Free Zone Companies

Frequently Asked Questions

Who needs to register on goAML in the UAE?

All Designated Non-Financial Businesses and Professions (DNFBPs) must register on the goAML portal (goaml.gov.ae), operated by the UAE Financial Intelligence Unit (UAEFIU). This includes: real estate agents and brokers handling transactions of AED 55,000 or more; precious metals and stones dealers at the same threshold; accounting and auditing firms; legal professionals including lawyers and notaries; corporate service providers who assist in company formation, provide nominee directors, or manage legal structures; and trust and company service providers. Financial institutions — banks, exchange houses, payment service providers, insurance companies — are also registered on goAML but supervised via the UAE Central Bank. Registration is mandatory upon obtaining a UAE trade licence; it is not deferred until the first client engagement. Non-registration carries administrative fines of AED 100,000 to AED 1,000,000.

What makes a business a DNFBP in the UAE?

A Designated Non-Financial Business or Profession (DNFBP) is any non-banking business that, by the nature of its services, carries a materially elevated risk of being used for money laundering or terrorist financing. The UAE DNFBP categories are defined in Cabinet Decision No. 10 of 2019 and include: real estate agents and brokers (for transactions of AED 55,000 or more); dealers in precious metals and precious stones (same threshold); accounting, bookkeeping, and auditing firms; lawyers, notaries, and other legal professionals when they assist clients with financial or corporate transactions; and corporate service providers that form companies, provide registered agents, or supply nominee directors or shareholders. Free zone companies in any of these categories are DNFBPs regardless of which free zone issued their licence — the DNFBP designation follows the business activity, not the jurisdiction within the UAE.

What triggers a Suspicious Transaction Report (STR) in the UAE?

A Suspicious Transaction Report must be filed via the goAML portal whenever there are reasonable grounds to suspect that a transaction — or an attempted transaction — is connected to money laundering, terrorist financing, or the proceeds of any criminal activity. You do not need certainty or proof; reasonable suspicion is the legal threshold. Common triggers include: a client who is unusually secretive about the source of funds or the purpose of a transaction; requests to conduct a transaction in a manner that appears designed to avoid reporting thresholds; complex corporate or ownership structures with no clear business rationale; a client identified on a government sanctions list; cash-heavy transactions or large round-figure payments with no supporting business context; a client who withdraws from a transaction upon being asked for identity documents; or any transaction that does not correspond to the client’s known profile and business. It is a criminal offence, carrying fines up to AED 1,000,000, to inform a client that an STR has been filed or is under consideration (the tipping-off prohibition). Failure to file an STR when one is required carries criminal penalties of up to AED 5,000,000 and five years imprisonment.

What are the UBO register requirements for UAE free zone companies?

Under Cabinet Decision No. 58 of 2020, all UAE-registered companies — including every free zone entity — must establish and maintain a Beneficial Ownership register. The register must identify every natural person who directly or indirectly owns 25% or more of the company’s shares or voting rights, or who otherwise exercises effective control over the company’s management or decisions, regardless of their ownership percentage. For each UBO, the register must record their full legal name, nationality, date of birth, passport or Emirates ID number, residential address, and the nature and extent of their ownership or control interest. The register must be updated within 60 days of any change in beneficial ownership and filed annually with the free zone authority or Ministry of Economy (MOEC) — most free zones require this at the time of licence renewal. Non-compliance carries administrative fines starting at AED 100,000. All major UAE free zones including DMCC, JAFZA, ADGM, RAKEZ, and DAFZA enforce this requirement.

How does the UAE’s removal from the FATF grey list affect free zone businesses?

The UAE was placed on the FATF grey list (Jurisdictions Under Increased Monitoring) in March 2022 following an evaluation that identified gaps in its AML and CTF enforcement framework. After implementing over 80 regulatory, legislative, and enforcement reforms, the UAE was formally removed from the grey list in February 2024. For free zone businesses, the practical impact of this removal includes: reduced enhanced due diligence requirements from international correspondent banks on UAE-origin transactions; improved access to international banking for UAE-registered companies, particularly those in trading, financial services, and cross-border logistics; reduced frequency of transaction delays and bank queries on international wire transfers; and an improved overall perception of the UAE as a compliant jurisdiction among international business partners and investors. The removal does not reduce your AML obligations — all DNFBP registration, KYC, STR, and UBO register requirements remain fully in force. Enforcement activity has continued to increase since February 2024 as the UAE demonstrates ongoing commitment to the FATF standards that secured its grey list exit.