UAE AML compliance: who it catches, goAML, UBO filings and the penalties

The UAE's anti-money laundering framework has teeth, and the enforcement record since late 2025 proves it. Fines are landing on businesses that assumed AML was a concern only for banks. If you hold a UAE trade licence and your activity falls under the designated non-financial businesses and professions (DNFBP) category, you are subject to the same core obligations as a regulated financial institution: registration on the goAML platform, a functioning compliance programme, UBO filings, and ongoing reporting. The difference is that many DNFBPs still do not know they are caught, or they registered years ago and have done nothing since. Federal Decree-Law No. 10 of 2025, effective from 14 October 2025, overhauled the penalty regime and tightened supervisory powers, making ignorance a significantly more expensive position to hold. This article sets out who is caught, what you must do, and what happens if you do not, based on the rules as they stand in 2026.

Who the UAE AML rules actually catch

The UAE's AML regime applies to two broad groups: financial institutions (banks, exchange houses, insurance companies) and DNFBPs. Financial institutions sit under the Central Bank and other sector-specific regulators with their own, stricter requirements. DNFBPs fall primarily under the Ministry of Economy's supervision, though free zone authorities and the relevant emirate-level departments also play a role.

If your licence covers any activity that touches large-value transactions, corporate structuring, or asset movement, you should assume you are in scope until you confirm otherwise. The test is not whether you think of yourself as a financial business; it is whether your activity type appears on the DNFBP list.

DNFBPs: the businesses caught by name

The DNFBP category is defined by activity, not by size or turnover. The following are explicitly caught:

• Real estate agents and brokers
• Dealers in precious metals and stones
• Auditors and accountants
• Corporate service providers and company formation agents
• Independent legal professionals handling certain transactions (property purchases, company formation, managing client funds)

A single-person consultancy providing company formation services in a free zone carries the same AML obligations as a large real estate brokerage. The requirements scale with risk, not revenue. If you are unsure whether your licence activity places you in the DNFBP category, check your trade licence wording against the Ministry of Economy's published list or speak to a compliance adviser.

Registering on goAML, and staying active

Every DNFBP must register on the UAE Financial Intelligence Unit's goAML portal. Registration runs through the Ministry of Economy and Tourism's e-services platform, and the process requires your trade licence details, compliance officer information, and supporting documents.

Registration alone is not enough. The FIU expects you to remain active on goAML, which means logging in periodically and filing reports as required, even if that report is a nil return confirming no suspicious activity. A dormant goAML account is a red flag during inspections. If you registered in 2021 and have not logged in since, you have a problem that needs fixing before an inspector finds it. Cosmos coordinates goAML registration for its clients through licensed UAE partners, handling the documentation and follow-up so the account stays current.

The compliance programme you must actually have

A goAML registration without a compliance programme behind it is like a fire alarm with no batteries. The UAE expects a functioning, documented system that includes:

• An institutional or business risk assessment specific to your activities
• Customer due diligence (CDD) and enhanced due diligence (EDD) procedures
• Sanctions screening against UN, local, and other relevant lists
• Written AML/CFT policies and procedures
• Regular staff training with records
• A designated compliance officer with genuine authority
• Record keeping for a minimum of five years
• Independent audit or review of the programme

This is not a tick-box exercise. Inspectors will ask your compliance officer direct questions about your risk assessment methodology and how you handle high-risk customers. If the answer is "we bought a template and filed it," expect a finding.

UBO filings and the 25 per cent rule

Every UAE entity must maintain and file ultimate beneficial owner details. The threshold is 25 per cent: any natural person who owns or controls 25 per cent or more of the entity, whether directly or indirectly, must be declared. Where no individual meets the 25 per cent threshold, the senior managing official is recorded.

UBO filings must be updated promptly when details change, commonly within 15 days. A change of shareholder, a new director, or a restructuring that shifts control percentages all trigger an update obligation. Late or inaccurate UBO filings are treated as standalone violations, separate from any other AML failings. Cosmos handles UBO filing and updates for its clients through licensed partners, flagging changes before the 15-day window closes.

Reporting: STRs, SARs and threshold reports

Once your goAML account is active and your compliance programme is running, you need to actually use them. The reporting obligations for DNFBPs include:

• Suspicious transaction reports (STRs) for completed transactions that raise red flags
• Suspicious activity reports (SARs) for attempted or planned transactions that trigger concern
• Threshold transaction reports for cash or high-value transactions above sector-specific limits
• Sector-specific filings, such as real estate activity reports and dealers-in-precious-metals notifications

Reports must be filed through goAML. The FIU expects timely filing: sitting on a suspicious transaction for weeks before reporting it undermines the entire purpose. Your compliance officer should have a clear internal escalation process so that front-line staff know how and when to flag concerns.

The penalties, and how they are applied

The penalty framework under Federal Decree-Law No. 10 of 2025 is broad and graduated. Administrative fines commonly run from AED 50,000 to AED 1,000,000 per violation. Serious or repeated breaches can reach AED 5,000,000. Each individual failing counts as a separate violation, so a single inspection can produce multiple fines.

Beyond fines, regulators can suspend or revoke trade licences, publicly name non-compliant businesses, and refer cases for criminal prosecution. Deliberate concealment of beneficial ownership or wilful failure to report suspicious activity can bring criminal liability, including imprisonment. The reputational damage alone can be fatal for a professional services firm. A real estate brokerage that loses its licence over AML failings does not quietly restart under a new name: the market knows.

What changed in 2025 and 2026

Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025 and represents the most significant overhaul of the UAE's AML framework in years. The key shifts include higher maximum penalties, expanded supervisory powers for the Ministry of Economy and sector regulators, and clearer obligations around UBO accuracy and timeliness.

Through 2026, enforcement has intensified. The Ministry of Economy has conducted more inspections of DNFBPs, particularly targeting corporate service providers and real estate agents. The FIU has also improved its data-sharing with other government bodies, meaning that inconsistencies between your AML filings, corporate tax returns, and trade licence records are more likely to be spotted. The direction of travel is clear: the UAE is tightening compliance expectations and backing them with real consequences.

How Cosmos helps

Cosmos coordinates AML compliance, goAML registration, and UBO filings for UAE-licensed businesses through its network of licensed local partners. The service covers the full chain: initial goAML registration, building the compliance programme documentation, setting up CDD and sanctions screening workflows, filing and updating UBO records, and keeping your goAML account active with the required reporting cadence.

The value is not in replacing your compliance officer but in making sure the infrastructure around them actually works. Most DNFBP compliance failures stem from setup gaps and missed deadlines, not from wilful misconduct. Cosmos catches those gaps before an inspector does.

Frequently asked questions

Do I need a compliance officer if I am a sole practitioner?

Yes. The requirement applies regardless of business size. If you are a one-person DNFBP, you are the compliance officer, and you must be able to demonstrate you have the knowledge and procedures in place.

What happens if I registered on goAML but never filed anything?

A dormant account is a compliance risk. Log in, confirm your details are current, and file a nil return if you have had no reportable activity. Doing this now is far cheaper than explaining the gap during an inspection.

How quickly must I update my UBO filing after a change?

The standard expectation is within 15 days of the change taking effect. Late filings are treated as separate violations and can attract their own penalties.

Can I be fined for multiple violations from a single inspection?

Yes. Each failing is assessed individually. A business with no risk assessment, an inactive goAML account, and outdated UBO records could face three or more separate fines from one visit.

Are free zone companies caught by these rules?

If your free zone licence covers a DNFBP activity, yes. The AML obligations apply based on your activity type, not your licensing authority.

The UAE's AML framework is no longer a set of rules that exist mainly on paper. Enforcement is active, penalties are material, and the 2025 overhaul removed most of the ambiguity that businesses previously relied on. If you are a DNFBP, the checklist is straightforward: register on goAML, build a real compliance programme, file your UBO details accurately, and report when required. The cost of doing this properly is a fraction of the cost of getting it wrong. If you need help pulling the pieces together, Cosmos coordinates the full process through licensed UAE partners so nothing falls through the cracks.

AML rules and penalties are subject to change. Confirm current requirements with a qualified UAE compliance adviser. This guidance reflects the position as of 2026.

This is general information, not tax, legal or compliance advice. Rules change and depend on your circumstances; confirm your position with a qualified adviser in the relevant jurisdiction before acting.