AML compliance lawyer Dubai explains UAE AML rules for businesses

Businesses operating in Dubai must implement anti-money laundering (AML) measures in accordance with UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism, as amended by Federal Decree-Law No. 26 of 2021, which applies across the Emirate of Dubai and the wider UAE.

Related Services: Explore our Consumer Protection Disputes and AML Compliance services for practical legal support in this area.

WHAT ARE THE CORE AML OBLIGATIONS FOR COMPANIES IN DUBAI?

Under Federal Decree-Law No. 20 of 2018, Article 4 requires every legal person conducting relevant activities to establish and maintain an effective AML compliance programme, including risk assessment, internal policies, customer due diligence (CDD), ongoing monitoring, and record-keeping. The law obliges entities to appoint a compliance officer and to report suspicious transactions to the Financial Intelligence Unit (FIU) within the Central Bank of the UAE. Failure to comply can attract administrative fines of up to AED 5 million per violation, as prescribed in Article 30 of the same decree-law, and may lead to criminal prosecution under Article 31, which provides for imprisonment of up to two years and/or a fine. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation. For detailed procedural steps, see the Central Bank of the UAE's AML/CFT Guidelines, which outline the required documentation, timelines for submission of suspicious activity reports (SARs), and the associated administrative fees.

HOW DOES A COMPANY CONDUCT A RISK ASSESSMENT FOR AML PURPOSES?

Federal Decree-Law No. 20 of 2018, Article 5 mandates that businesses perform a documented risk assessment that considers products, services, customers, and geographic exposure. The assessment must identify high-risk factors, such as dealings with politically exposed persons (PEPs) or cash-intensive businesses, and must be updated at least annually or when material changes occur. The process involves gathering internal data, reviewing transaction patterns, and consulting external sources like the UAE's National Risk Assessment report. Companies must retain the risk assessment report for a minimum of five years, as stipulated in Article 12 of the decree-law, and make it available to regulators upon request. Costs associated with external consultants vary, but the Central Bank does not prescribe a fixed fee; entities should budget for professional services based on the scope of the assessment.

WHAT CUSTOMER DUE DILIGENCE MEASURES ARE REQUIRED IN DUBAI?

Article 6 of Federal Decree-Law No. 20 of 2018 obliges entities to apply CDD before establishing a business relationship or conducting occasional transactions above the applicable threshold (currently AED 55,000 for certain activities). CDD includes verifying the identity of customers using reliable, independent sources, obtaining information on the purpose and intended nature of the relationship, and conducting enhanced due diligence (EDD) for higher-risk clients, such as PEPs or those from high-risk jurisdictions. The law requires retention of identification documents and transaction records for at least five years after the relationship ends, per Article 12. Entities must also screen customers against sanctions lists maintained by the United Nations and the UAE, as outlined in the Central Bank's AML/CFT Guidelines. There is no statutory fee for performing CDD; however, entities may incur costs for verification services or software solutions.

WHEN MUST SUSPICIOUS TRANSACTION REPORTS BE FILED, AND WHAT INFORMATION MUST THEY CONTAIN?

Article 13 of Federal Decree-Law No. 20 of 2018 obliges the compliance officer to submit a SAR to the FIU without delay upon knowing, suspecting, or having reasonable grounds to suspect that funds are linked to money laundering or terrorism financing. The report must include the suspect's identity, transaction details, the grounds for suspicion, and any supporting documentation. The Central Bank's SAR submission portal specifies that reports should be filed within five business days of detection, although earlier submission is encouraged to mitigate risk. There is no filing fee for SARs, but entities may bear internal costs for investigation and documentation. Non-compliance with SAR obligations can result in administrative penalties under Article 30 and potential criminal liability under Article 31.

WHAT RECORD-KEEPING REQUIREMENTS APPLY TO AML COMPLIANCE IN DUBAI?

Article 12 of Federal Decree-Law No. 20 of 2018 requires businesses to keep all CDD files, transaction records, SARs, and related supporting documents for a minimum of five years from the date of the transaction or the end of the business relationship. Records must be stored in a format that ensures accessibility and integrity, whether electronic or physical. The law obliges entities to produce these records to the Central Bank or other competent authorities upon request, within the timeframe specified by the regulator. Failure to maintain adequate records can lead to fines of up to AED 2 million per violation, as indicated in the penalty schedule of the decree-law. There is no prescribed cost for record-keeping systems; organizations should allocate resources based on volume and regulatory expectations.

HOW DOES THE UAE ENFORCE AML COMPLIANCE AND WHAT ARE THE PENALTIES FOR VIOLATIONS?

Enforcement is carried out by the Central Bank of the UAE, the FIU, and the Public Prosecution, depending on the nature of the breach. Administrative sanctions, outlined in Article 30 of Federal Decree-Law No. 20 of 2018, include fines ranging from AED 50,000 to AED 5 million, suspension of licenses, or mandatory remedial actions. Criminal penalties, under Article 31, may involve imprisonment of up to two years and/or a fine for individuals found guilty of money laundering offenses. The Central Bank publishes periodic enforcement notices that detail specific cases and the sanctions applied. Entities should note that the UAE does not publish a fixed schedule for court fees in AML prosecutions; costs are determined on a case-by-case basis by the judicial authorities.

FREQUENTLY ASKED QUESTIONS

What is the legal definition of "money laundering" under UAE law?
Federal Decree-Law No. 20 of 2018, Article 2 defines money laundering as the conversion, transfer, concealment, or disguise of property knowing that it is derived from a criminal activity, or the acquisition, possession, or use of such property. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Are free zone companies subject to the same AML rules as mainland entities?
Yes. Federal Decree-Law No. 20 of 2018 applies to all legal persons operating within the UAE, including those in free zones, unless a specific free-zone regulation provides stricter standards. The law obliges free-zone entities to appoint a compliance officer, conduct CDD, and file SARs as described above.

How often must AML training be provided to employees?
While the decree-law does not prescribe a specific frequency, the Central Bank's AML/CFT Guidelines recommend that firms conduct AML awareness training at least annually and upon material changes to risk profiles or regulatory requirements. Training must cover the legal obligations, internal policies, and reporting procedures.

Can a business outsource its AML compliance function?
Article 9 of Federal Decree-Law No. 20 of 2018 permits the appointment of a compliance officer who may be an external consultant, provided the officer meets the qualifications set out in the Central Bank's guidelines and retains independence. The ultimate responsibility for compliance remains with the entity's management.

What steps should be taken if a SAR is filed in error?
If a SAR is submitted in error, the reporting entity should contact the FIU promptly to request withdrawal or correction, providing a clear explanation and any supporting evidence. The FIU evaluates each request on a case-by-case basis and may retain the report if it determines the information remains relevant for analysis.

Are there any exemptions for low-value transactions?
Federal Decree-Law No. 20 of 2018, Article 6 sets thresholds for occasional transactions; however, there is no blanket exemption for low-value activities. Entities must still perform CDD where the transaction exceeds the prescribed limit or where risk factors indicate a need for enhanced scrutiny.

If your matter involves aml compliance lawyer in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.