Table of Contents
Frequently Asked Questions
Does a free zone company in Dubai have to follow federal AML law?
Yes. A free zone license changes how a company is licensed, not whether federal AML and counter-terrorist financing law, now Federal Decree-Law No. 10 of 2025, applies. If the licensed activity falls under a covered category, the company must run due diligence, identify beneficial owners, keep records and report suspicious activity. A Meydan Free Zone company is treated the same way.
Which businesses count as DNFBPs in the UAE?
Designated Non-Financial Businesses and Professions include real estate brokers, dealers in precious metals and stones, company service providers, auditors, accountants and lawyers. Your licensed activity, not your company size, decides whether you are covered. Reassess coverage whenever you add an activity to your license.
Do small businesses need a compliance officer?
Covered businesses must appoint a compliance officer, whatever their size. In a small firm, one senior person can hold the role if they have real authority and time to carry out the duties. Controls should match the business's risk and transaction volume.
How does a company report suspicious activity in the UAE?
Covered businesses register on the goAML platform and file a report with the UAE Financial Intelligence Unit as soon as suspicion arises. The compliance officer normally files the report. Keep an internal log of the escalation and the decision taken.
What records must a business keep for AML purposes?
Keep the customer due diligence file, identity documents, beneficial ownership records, transaction records, the business risk assessment, training records and a log of goAML reports. A regulator or bank can ask to inspect these. The retention period is set in current federal regulation, so follow it exactly.
Can a business tell a customer it has filed a suspicious transaction report?
No. Tipping off is prohibited under UAE AML law. Staff should decline or pause a transaction without giving the reason, and escalation should stay separate from any customer communication.
Who supervises AML compliance for non-bank businesses in Dubai?
Supervision depends on the business type. The Ministry of Economy and Tourism supervises most DNFBPs, including those in commercial free zones, and the Ministry of Justice supervises lawyers and notaries. The Central Bank of the UAE supervises banks and financial institutions, and the Securities and Commodities Authority supervises capital market firms. The FIU receives suspicious activity reports.
What happens if a company fails to identify its beneficial owner?
The company risks administrative fines, license action and, in serious cases, criminal liability for managers. Banks may also review or restrict the account if ownership records are incomplete. Identify the natural persons who ultimately own or control the company and keep that record current.
Topic Summary
What UAE Anti-Money Laundering Rules Mean
AML rules in the UAE are the federal laws and controls that stop criminal proceeds entering the legitimate economy. Covered businesses must identify customers, assess risk, keep records and report suspicious activity to the UAE Financial Intelligence Unit (FIU). The rules apply to mainland and free zone companies alike.
Which Dubai Businesses Carry AML Duties
Financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs) carry AML duties. DNFBPs include real estate brokers, dealers in precious metals and stones, company service providers, auditors, accountants and lawyers. Virtual asset service providers are also covered. Your licensed activity decides whether you fall in scope.
Core AML Duties for Dubai Businesses
Covered businesses must complete five core duties: assess business risk, run customer due diligence, identify the ultimate beneficial owner, keep records, and report suspicious activity. They must also appoint a compliance officer, train staff and screen against sanctions lists. Each duty needs written evidence.
Reporting Suspicious Activity Through goAML
Covered businesses report suspicious transactions to the FIU through goAML. Register, file without delay once suspicion arises, and never tip off the customer. Failing to file carries criminal and administrative consequences under UAE AML law.
Who Enforces AML Rules in the UAE
Enforcement depends on business type. The Central Bank of the UAE (CBUAE) supervises banks and financial institutions. The Securities and Commodities Authority supervises capital market firms. The Ministry of Economy and Tourism supervises most DNFBPs, including those in commercial free zones, while the Ministry of Justice supervises lawyers and notaries. Penalties include fines, license action and criminal liability.
AML Duties for a Meydan Free Zone Company
A Meydan Free Zone company remains subject to federal AML law. If its activity is covered, it must run due diligence, identify beneficial owners and report suspicious activity, like any mainland business.
Building an AML Programme Before You Are Asked
Build the programme around your actual risks. Write a risk assessment, appoint a compliance officer, set onboarding and escalation procedures, register on goAML and schedule training. Regulators look for evidence of operation, not policy documents alone.
Anti Money Laundering Duties for Dubai Businesses: Key Requirements
Many founders treat anti-money laundering (AML) duties as a bank's problem and assume a licensed company with a clean bank account is covered. It is not. Federal law reaches many non-bank businesses, and regulators expect documented controls, not good intentions.
This guide explains which Dubai businesses carry AML duties, what the law requires of them, and how to build controls before a regulator or bank asks for them.
What UAE Anti-Money Laundering Rules Mean
AML rules in the UAE are the federal laws and controls that stop criminal proceeds entering the legitimate economy. Covered businesses must identify customers, assess risk, keep records and report suspicious activity to the UAE Financial Intelligence Unit (FIU). The rules apply to mainland and free zone companies alike.
The Legal Framework in Plain Terms
The core law is Federal Decree-Law No. 10 of 2025, which replaced Federal Decree-Law No. 20 of 2018 and took effect on 14 October 2025. It applies in every emirate, free zones included. Cabinet decisions set the operating detail. Cabinet Decision No. 109 of 2023, for example, governs beneficial ownership. The Central Bank of the UAE publishes guidance on how the framework works in practice.
Picture a Dubai trading company that assumes its free zone license exempts it. Its bank then asks for full customer due diligence records. The company has none.
What Founders Often Get Wrong
AML is not limited to banks. A free zone license does not remove federal obligations. And controls must be documented, not informal. A consultancy handling client funds without a written risk assessment is exposed, however careful its staff are. For a wider view, read the UAE AML KYC regulations guide.
Which Dubai Businesses Carry AML Duties
Financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs) carry AML duties. DNFBPs include real estate brokers, dealers in precious metals and stones, company service providers, auditors, accountants and lawyers. Virtual asset service providers are also covered. Your licensed activity decides whether you fall in scope.
Financial Institutions and DNFBPs
- Activity, not company size, triggers coverage.
- A gold trader and a real estate brokerage are in scope.
- A software firm usually is not.
- Virtual asset businesses face separate rules.
Core AML Duties and the Evidence a Regulator Expects
| Control | Duty | Evidence to Keep |
|---|---|---|
| Business risk assessment | Rate risk by customer, product, geography and channel | Dated written assessment with review history |
| Customer due diligence file | Verify identity at or before onboarding | ID copies, screening results, risk rating per client |
| UBO identification record | Trace owners to the natural person | Ownership chart and verified owner documents |
| goAML registration and report log | Report suspicion to the UAE Financial Intelligence Unit | Registration confirmation, escalation notes, filed reports |
| Staff training record | Teach staff to spot red flags | Attendance sheets, dates and materials used |
How to Check Whether Your Activity Is Covered
Match your licensed activity to the DNFBP categories. If it is borderline, ask your supervisory authority. Reassess whenever you add an activity. A company that adds corporate services to its license picks up new obligations that day. The guide on when your business changes compliance obligations covers this.
Core AML Duties for Dubai Businesses
Covered businesses must complete five core duties: assess business risk, run customer due diligence, identify the ultimate beneficial owner, keep records, and report suspicious activity. They must also appoint a compliance officer, train staff and screen against sanctions lists. Each duty needs written evidence.
Business Risk Assessment and Compliance Officer
- Document risk by customer, product, geography and channel.
- Appoint a compliance officer with real authority.
- Review the assessment when the business changes.
A trading firm, for instance, rates customers from high-risk jurisdictions for enhanced checks.
Customer Due Diligence and UBO Identification
- Verify identity before or at onboarding.
- Identify the natural persons who own or control the customer.
- Apply enhanced checks to politically exposed persons and high-risk clients.
The beneficial ownership threshold is 25% or more of shares or voting rights (Cabinet Decision No. 109 of 2023). Say a customer is owned through two holding companies. You trace it to the individual. See our note on the ultimate beneficial owner UAE rules.
Record Keeping, Training and Sanctions Screening
Keep records for the retention period set in regulation, and make them easy to produce. A bank reviewing a client file will ask for them quickly. Train staff on red flags. Screen customers against the UAE local terrorist list and UN lists.
Reporting Suspicious Activity Through goAML
Covered businesses report suspicious transactions to the FIU through goAML. Register, file without delay once suspicion arises, and never tip off the customer. Failing to file carries criminal and administrative consequences under UAE AML law.
Registering and Filing Reports
Register the entity and the compliance officer. Use the right report type, such as a suspicious transaction report or suspicious activity report. Keep an internal log of escalations and decisions. If a staff member flags a customer paying large invoices in cash, the compliance officer reviews and files.
The Tipping-Off Prohibition
Never tell a customer a report was filed. Train front-line staff to decline politely without giving reasons. Keep escalation separate from customer communication.
Who Enforces AML Rules in the UAE
Enforcement depends on business type. The Central Bank of the UAE (CBUAE) supervises banks and financial institutions. The Securities and Commodities Authority supervises capital market firms. The Ministry of Economy and Tourism supervises most DNFBPs, including those in commercial free zones, while the Ministry of Justice supervises lawyers and notaries. Penalties include fines, license action and criminal liability.
Supervisors and Their Roles
- Federal supervisors and free zone authorities have separate roles.
- Your activity decides which supervisor applies.
- Inspections review documents, not intentions.
Penalties and Practical Risk
Fines and license consequences are set in current legislation. Managers can face criminal exposure in serious cases. The more common hit is banking. A bank that finds incomplete UBO records may restrict the account. Read about penalties for non-compliance in the UAE.
AML Duties for a Meydan Free Zone Company
A Meydan Free Zone company remains subject to federal AML law. If its activity is covered, it must run due diligence, identify beneficial owners and report suspicious activity, like any mainland business.
Federal Law Applies Inside a Free Zone
Free zone status changes licensing, not federal duties. Beneficial ownership details sit in the Share Register and company documents. A Meydan Free Zone consultancy should update its UBO details after any share transfer.
Practical Support for Clean Records
Meydan Free Zone issues the Business License, Certificate of Formation, Share Register and Memorandum and Articles of Association (MoA/AoA) digitally, which keeps ownership records easy to produce. mAccounting offers bookkeeping, VAT registration support and Corporate Tax support. mCore supports business bank account applications, but the bank makes the final decision.
Free Business Setup Cost Calculator
Calculate NowBuilding an AML Programme Before You Are Asked
Build the programme around your actual risks. Write a risk assessment, appoint a compliance officer, set onboarding and escalation procedures, register on goAML and schedule training. Regulators look for evidence of operation, not policy documents alone.
A Proportionate Approach for SMEs
Scale controls to risk and volume. Keep one owner for compliance decisions. Store records where you can produce them fast. A three-person advisory firm can run on a simple onboarding checklist and an annual review.
Next Decision for Founders
Confirm whether your activity is covered. Choose who owns compliance. Set a review date. Do this before adding a new service line.
Conclusion
AML duties in the UAE are operational. Coverage depends on your licensed activity, and the strongest position is a documented risk assessment, verified beneficial ownership, clean records and a working reporting process. For a Meydan Free Zone company, the Share Register is issued digitally, so ownership records can be checked against UBO files at any time. Confirm whether your activity is covered, assign a compliance officer and document your controls before your next bank or regulator review.
Ready to Launch Your Business in Dubai?
Let's Connect
