DNFBP AML Compliance in the UAE: What Matters in 2026

For UAE Designated Non-Financial Businesses and Professions (DNFBPs), 2026 reinforces an already serious compliance environment: firms are expected not only to maintain documented AML/CFT/CPF frameworks, but also to demonstrate through implementation, evidence, and governance that those controls work effectively in practice.

The New Legal Foundation

The core of the 2026 federal framework rests on two primary instruments:

Federal Decree-Law No. (10) of 2025: The principal statute governing AML/CFT/CPF.
Cabinet Resolution No. (134) of 2025: The Executive Regulations that operationalize the Decree-Law.

While this framework applies across the UAE, supervision is nuanced. Mainland firms and commercial free zones typically fall under the Ministry of Economy & Tourism, while those in the DIFC or ADGM must adhere to their specific free-zone regulatory expectations. Crucially, your AML exposure is dictated by the activity you perform, not just the words on your trade license.

Who is in Scope? Understanding the Triggers

Under Article (3) of the Executive Regulations, AML obligations attach to specific sectors, often triggered by the nature or value of a transaction:

Sector	Key Compliance Trigger
Commercial Gaming Operators	Single or linked transactions of AED 11,000 or more.
Real Estate Brokers & Agents	Concluding transactions involving the purchase or sale of real estate.
Dealers in Precious Metals/Stones	Single or linked cash transactions of AED 55,000 or more.
Lawyers & Accountants	Preparing or executing specified financial transactions for customers.
Trust & Company Service Providers	Providing specified formation, directorship, or nominee services.

A Note on Commercial Gaming: This sector is now expressly within the DNFBP perimeter. The GCGRA (General Commercial Gaming Regulatory Authority) is the sole authority for licensing in the UAE; operating without license carries criminal penalties.

From Policy to Proof: Six Core Controls

A defensible framework is built on implementation, not assumptions. To satisfy regulators in 2026, firms must evidence six core pillars:

Dynamic Risk Assessment: Identify risks across customers, geography, and delivery channels. This must be a “living” document, not a static file.
Robust CDD: Apply Customer Due Diligence at onboarding and continuously throughout the relationship.
Beneficial Ownership (BO): Follow the “waterfall” approach—identify ownership, then control, and finally senior management if necessary.
Enhanced Measures: High-risk scenarios require deeper scrutiny of Source of Funds (SoF) and Source of Wealth (SoW), alongside senior management approval.
Reporting & Non-Tipping Off: Suspicious matters must be reported via the proper FIU channel (GoAML) immediately.
Futureproofing: Maintain records for the required retention period and assess AML risks before launching new technologies or products.

High-Scrutiny Areas: Real Estate and Virtual Assets

Real estate remains a high-risk priority due to transaction sizes and ownership layering. Notably, the Ministry of Economy has issued specific REAR guidance. This requires GoAML reporting for freehold sales involving:

Cash transactions of AED 55,000 or more.
Payments made via virtual assets.
Transactions funded through the conversion of virtual assets.

The Cost of Non-Compliance

The 2025 Decree-Law makes one thing clear: compliance is not optional. Violations can lead to imprisonment and fines ranging from AED 200,000 to AED 10,000,000. Regulators have already demonstrated their resolve. In the first half of 2025 alone, inspections identified 1,063 violations, resulting in over AED 42 million in fines. This included significant penalties for real estate brokerages (AED 18.5 million) and precious metal traders (AED 20 million). Source: Ministry of Economy and Tourism, ‘Ministry of Economy and Tourism announces H1 2025 inspection results on private sector compliance with anti-money laundering laws’, 24 July 2025.

Final Word: What “Good” Looks Like

In 2026, a high-quality compliance program is one that is implemented, evidenced, and Review-ready. Businesses that understand their perimeter and escalate suspicious matters without delay will protect not only their operations but also their vital banking relationships. Disclaimer: This article is for general awareness and does not constitute legal advice.