AML Compliance Obligations for Law Firms in the UAE

Law firms operating in the UAE must implement customer due diligence, ongoing monitoring, and suspicious transaction reporting under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations, as amended by Cabinet Decision No. 10 of 2019 and the UAE Central Bank's AML Guidelines, which apply across all emirates and free zones.

Related Services: Explore our AML Compliance and Due Diligence services for practical legal support in this area.

WHAT SPECIFIC AML DUTIES DOES FEDERAL DECREE-LAW NO. 20 OF 2018 IMPOSE ON LEGAL PRACTITIONERS IN THE UAE?

Legal practitioners are required to conduct customer due diligence (CDD) before establishing a business relationship, verify the identity of clients and beneficial owners, and obtain information on the purpose and nature of the engagement. The law obliges firms to apply enhanced due diligence for politically exposed persons (PEPs) and high-risk clients, maintain records for at least five years, and file suspicious transaction reports (STRs) with the Financial Intelligence Unit (FIU) when they know, suspect, or have reasonable grounds to believe that funds are linked to illicit activity. These obligations are set out in Articles 4-9 of Federal Decree-Law No. 20 of 2018 and reinforced by the Implementing Regulation in Cabinet Decision No. 10 of 2019. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

HOW MUST LAW FIRMS CONDUCT CUSTOMER DUE DILIGENCE UNDER THE UAE AML FRAMEWORK?

Customer due diligence begins with collecting reliable, independent source documents such as passports, Emirates IDs, trade licences, and, for corporate clients, certificates of incorporation and shareholder registers. Firms must identify the ultimate beneficial owner(s) and understand the ownership and control structure. For PEPs, senior management approval is required before proceeding, and ongoing monitoring must be intensified. The process includes screening clients against sanctions lists, adverse media, and watch-lists. Records of all CDD steps, supporting documents, and risk assessments must be retained for a minimum of five years after the business relationship ends, as stipulated in Article 6 of Federal Decree-Law No. 20 of 2018 and Article 4 of Cabinet Decision No. 10 of 2019. Where a reliable source does not publish a fixed fee for obtaining certain documents, firms should state that no official fee schedule exists rather than estimating.

WHAT ARE THE REPORTING THRESHOLDS AND TIMELINES FOR SUBMITTING SUSPICIOUS TRANSACTION REPORTS TO THE FIU?

A suspicious transaction report must be submitted promptly-no later than the next working day after forming the suspicion-via the goAML portal operated by the UAE Central Bank's FIU. There is no minimum transaction amount; any activity that raises suspicion, regardless of value, triggers the reporting duty. The report must include details of the parties involved, the nature of the transaction, the grounds for suspicion, and any supporting documentation. Failure to report within the prescribed timeframe can attract administrative penalties of up to AED 1 million and criminal sanctions, including imprisonment of up to two years under Article 9 of Federal Decree-Law No. 20 of 2018. The UAE Central Bank's AML Guidelines provide a step-by-step guide to completing the goAML form, which firms should follow to ensure compliance.

WHAT PENALTIES APPLY TO LAW FIRMS THAT BREACH AML OBLIGATIONS IN THE UAE?

Violations of the UAE AML regime can lead to both administrative and criminal penalties. Administrative fines range from AED 50 000 for minor infractions to AED 1 million for serious breaches such as repeated failure to conduct CDD or to file STRs. Criminal liability under Article 9 of Federal Decree-Law No. 20 of 2018 includes imprisonment for up to two years and/or a fine of up to AED 1 million for individuals who knowingly facilitate money laundering. The law also permits the confiscation of proceeds equivalent to the value of the laundered funds. Courts may impose additional disciplinary measures through the UAE Ministry of Justice, including suspension or revocation of a lawyer's licence. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

HOW OFTEN MUST LAW FIRMS REVIEW AND UPDATE THEIR AML POLICIES AND PROCEDURES?

Firms are required to review their AML policies, procedures, and internal controls at least annually, or sooner when there are material changes in the business, regulatory environment, or risk profile. The review should encompass risk assessments, CDD procedures, training programmes, and the effectiveness of transaction monitoring systems. Any deficiencies identified must be remedied promptly, and records of the review process must be retained. This expectation is derived from the risk-based approach outlined in the UAE Central Bank's AML Guidelines and the principle of ongoing compliance embedded in Federal Decree-Law No. 20 of 2018. Where no explicit frequency is prescribed by statute, firms should state that the regulator expects periodic reviews rather than inventing a specific interval.

FREQUENTLY ASKED QUESTIONS

What is the legal basis for customer due diligence requirements for lawyers in the UAE?
The legal basis is Article 4 of Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations, which obliges legal practitioners to identify clients and beneficial owners before commencing a professional relationship. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Are law firms in free zones such as DIFC or ADGM subject to the same AML rules?
DIFC and ADGM operate under their own regulatory regimes; they are not governed by UAE federal AML law. Firms established in those free zones must comply with the DIFC Law No. 1 of 2019 (Regulatory Law) and the ADGM AML Regulations 2020, respectively. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

What documents are needed to verify the identity of a corporate client under UAE AML rules?
Firms must obtain a copy of the corporate trade licence, certificate of incorporation, memorandum and articles of association, and a register of shareholders or beneficial owners. For companies registered outside the UAE, equivalent documents issued by the relevant foreign authority are required. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

How long must AML records be retained after a client relationship ends?
Records of customer due diligence, transaction files, and supporting documentation must be retained for a minimum of five years from the date the business relationship terminates, as stipulated in Article 6 of Federal Decree-Law No. 20 of 2018 and Article 4 of Cabinet Decision No. 10 of 2019. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Can a lawyer be held personally liable for an AML breach committed by the firm?
Yes. Under Article 9 of Federal Decree-Law No. 20 of 2018, individuals who knowingly assist in money laundering face imprisonment of up to two years and/or fines of up to AED 1 million, regardless of whether the act was performed in a professional capacity. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Is there a prescribed format for the suspicious transaction report submitted via goAML?
The UAE Central Bank's FIU provides a standardized electronic form on the goAML portal that captures offender details, transaction specifics, and the grounds for suspicion. Firms must complete all mandatory fields; the format is defined in the FIU's goAML User Manual, which is publicly available on the Central Bank's website. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

If your matter involves aml compliance in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.