Who Needs AML Compliance in the UAE Today?

A property deal with an unclear buyer, a client seeking to pay for gold in cash, or a new company formed through an intermediary can all create money-laundering risk. The question of who needs AML compliance in the UAE is therefore not limited to banks. Many business owners fall within the regime because of the services they provide, even where AML is not their primary line of work.

For UAE founders and directors, the practical issue is straightforward: if your business is a regulated financial institution or a designated non-financial business or profession, known as a DNFBP, you must have AML controls that work in day-to-day operations. Failing to do so can lead to regulatory action, significant fines, reputational damage and disruption to banking relationships.

Who needs AML compliance in the UAE?

The UAE’s anti-money laundering and counter-terrorist financing framework applies to financial institutions and certain non-financial sectors that may be used to move, conceal or legitimise illicit funds. The obligation is based on your regulated activity, not on the age of the company, its turnover or whether you have ever suspected a client of wrongdoing.

Financial institutions include banks, exchange houses, insurers, investment businesses, lenders, payment providers and other firms conducting regulated financial activities. These businesses face detailed obligations and are supervised by the relevant financial-services regulator.

For many SMEs, the more relevant category is the DNFBP. A business can be a DNFBP where it carries out activities such as:

• real estate agency or brokerage work involving the purchase or sale of property;

• dealing in precious metals and precious stones;

• audit and accounting services within the regulated scope;

• company formation, nominee, registered-office or other corporate service work; and

• certain legal services connected with financial or real estate transactions, company formation or management of client assets.

The exact classification depends on what the business actually does, not simply the description on its trade licence. An accounting practice, for example, should assess the services it delivers and whether they bring it within the applicable requirements. A consultant that merely gives general commercial advice may sit outside the scope, while one arranging companies, providing registered addresses or handling client structures may not.

Licensed virtual-asset businesses and other newer financial activities can also be subject to separate AML requirements. Where the position is unclear, a formal scope assessment is preferable to assuming that a small team or a low volume of transactions creates an exemption.

There is no VAT-style AML threshold

One of the most costly misunderstandings is treating AML like VAT or corporate tax registration. There is no general turnover threshold below which an in-scope business can ignore AML obligations. A newly formed real estate brokerage with one transaction can still need compliant procedures from the outset.

Equally, not every UAE trading company automatically becomes an AML-regulated entity. A business selling ordinary goods without providing regulated financial, property, professional or corporate services will not normally have the full DNFBP compliance burden. It may still be asked by its bank, landlord, customer or supplier to provide beneficial ownership records, source-of-funds evidence or sanctions information. Those commercial requests should be taken seriously, but they are different from being directly regulated as a DNFBP.

This distinction matters when budgeting for compliance. A company should build controls that match its real risk and legal status, rather than copying an expensive bank-level programme or relying on a generic policy downloaded from the internet.

The sectors that need particular attention

Real estate agents and brokers

Real estate remains a high-focus area because property can be used to place or layer illicit wealth. Agents and brokers should know who is buying or selling, identify the beneficial owner where a company is involved, understand the source of funds where risk indicators arise and keep a clear record of the transaction.

Risk rises when funds come from unrelated third parties, the buyer is a politically exposed person, ownership changes shortly before a deal, or the commercial rationale is difficult to explain. Cash-heavy arrangements and rushed instructions also deserve closer scrutiny. The correct response is not necessarily to refuse the client immediately. It is to pause, assess, obtain appropriate evidence and escalate concerns through the firm’s reporting process.

Dealers in precious metals and stones

Gold, jewellery, diamonds and similar assets can be portable, valuable and readily traded. Dealers need controls proportionate to their customer base, payment methods, transaction values and cross-border exposure. A shop serving local retail customers presents a different profile from a wholesaler buying from multiple jurisdictions, but both need documented risk assessment and client due diligence where required.

Accountants, auditors and corporate service providers

Professional firms are often trusted with the information that explains how a company is owned, funded and controlled. That makes accurate client onboarding essential. Before accepting work, firms should identify the client, verify ownership and control, understand the purpose of the engagement and consider whether the proposed activity is consistent with the client’s profile.

The risk is especially acute where a firm establishes entities, provides directors or addresses, manages shareholdings, assists with complex ownership chains or encounters unexplained transfers between related companies. Good bookkeeping alone does not satisfy AML requirements, but clean and timely financial records make unusual activity far easier to identify.

What AML compliance looks like in practice

AML is not a policy sitting unread in a shared folder. It is an operating system that links onboarding, transaction monitoring, record keeping and escalation. The UAE framework expects in-scope businesses to assess their risks, appoint appropriate responsibility, train staff and retain evidence that procedures are being followed.

A workable programme begins with a business-wide risk assessment. This should consider your clients, services, delivery channels, geography, payment methods and transaction patterns. A Dubai brokerage handling local salaried buyers will have a different risk profile from one serving overseas corporate investors. The assessment should explain those differences and determine where enhanced checks are necessary.

Client due diligence then turns the assessment into action. At a minimum, firms generally need reliable identification information for the client and, where applicable, the ultimate beneficial owner. They should understand the intended business relationship and screen against relevant sanctions and politically exposed person information. Higher-risk relationships may require enhanced due diligence, including stronger evidence of source of funds or source of wealth and senior approval before proceeding.

Ongoing monitoring is equally important. Customer information can become outdated, transaction behaviour can change and a previously ordinary relationship can develop warning signs. Set review intervals based on risk, not convenience. Higher-risk clients should be reviewed more frequently and material changes should trigger a fresh assessment.

Where suspicion arises, staff must know exactly who to tell internally. The nominated compliance officer or money laundering reporting officer should assess whether a report must be made to the UAE Financial Intelligence Unit through the applicable reporting system. Staff must not alert the client that a suspicious transaction report is being considered or submitted. This is known as tipping off and can create a separate legal problem.

Records matter because regulators will look beyond the existence of a policy. Keep identification documents, beneficial ownership evidence, risk assessments, screening results, transaction records, training logs and decision notes in an orderly, retrievable form. UAE AML record-keeping requirements generally require retention for at least five years, subject to the circumstances and any relevant authority direction.

A practical test for directors

If you are unsure whether your company needs AML controls, ask four questions. Do we arrange or facilitate property transactions? Do we trade in precious metals or stones? Do we provide audit, accounting, legal or corporate services that involve client money, entities, assets or ownership structures? Are we licensed or operating in a financial or virtual-asset activity?

A “yes” does not answer every technical question, but it should trigger a proper review. The review should cover your licence activities, actual service scope, regulator, registration position, internal responsibilities and the controls already in place. It is better to identify a gap while you can correct it than during a regulatory inspection or after a bank has frozen a transaction for unanswered questions.

Build controls that support growth

For a growing business, compliance should make onboarding more disciplined rather than slower by default. Clear client questionnaires, ownership-document checklists, approval rules and escalation routes reduce last-minute delays when a valuable deal is ready to close. They also give directors evidence that risk decisions were considered carefully.

James Watt For Accounting & Bookkeeping Co. LLC helps UAE businesses translate AML obligations into practical procedures that fit their operations, alongside accurate accounting and wider regulatory support. The aim is not paperwork for its own sake. It is a controlled business that can deal confidently with regulators, banks and commercial partners.

If your business may fall within the AML regime, start with your actual activities and client profile. A clear scope review now can protect the transactions, reputation and growth plans you have worked hard to build.