AML compliance services UAE follow Federal Decree-Law No. 20 of 2018

AML compliance services UAE are required under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism, which applies to all persons conducting financial or non-financial business activities in the United Arab Emirates.

Related Services: Explore our AML Compliance and Data Protection Officer Service services for practical legal support in this area.

WHAT DOES THE UAE AML LAW REQUIRE FROM BUSINESSES?

The law requires businesses to implement risk-based policies, conduct customer due diligence, monitor transactions, and report suspicious activities to the Financial Intelligence Unit. Federal Decree-Law No. 20 of 2018 obliges entities to appoint a compliance officer, maintain records for five years, and undergo periodic audits.

To meet these obligations, a company must first perform a risk assessment that identifies products, services, customers, and geographic exposure linked to money-laundering or terrorist financing. The assessment informs the design of internal controls, including know-your-customer (KYC) procedures that verify identity using reliable, independent sources such as passports, Emirates ID, or corporate registers. Transaction monitoring systems must be calibrated to flag activity inconsistent with the customer's profile, and any alert must be investigated promptly. Suspicious transaction reports (STRs) are submitted electronically via the goAML portal maintained by the UAE Central Bank. Records of customer identification, transaction details, and internal investigations must be retained for at least five years after the business relationship ends. The law also mandates regular training for staff and independent audits to verify effectiveness of the AML programme. Failure to comply can attract administrative fines of up to AED 5 million, criminal penalties including imprisonment, and revocation of licences, as stipulated in Articles 24-26 of the same decree-law.

HOW DOES A BUSINESS REGISTER FOR GOAML IN DUBAI?

Registration for goAML is mandatory for all entities subject to the AML law and is completed through the UAE Central Bank's online portal. The process requires a valid trade licence, Emirates ID of the authorised signatory, and a detailed description of the business activity.

To begin, the authorised representative accesses the goAML website, creates an account using a corporate email, and selects "New Entity Registration". The system prompts entry of the trade licence number, expiry date, and issuing authority (e.g., Department of Economic Development Dubai). Next, the applicant uploads a scanned copy of the licence, the Emirates ID of the signatory, and a board resolution appointing the AML compliance officer. After submission, the Central Bank reviews the information; approval is typically granted within three to five working days, after which the entity receives a unique goAML identifier. There are no government fees for registration, although entities may incur costs for document preparation or external advisory services. The registered entity must then configure its internal systems to transmit STRs via the goAML API, a step that often requires technical integration support.

WHAT ARE THE PENALTIES FOR NON-COMPLIANCE WITH AML REGULATIONS IN THE UAE?

Penalties for non-compliance include administrative fines, criminal sanctions, and regulatory actions, all defined in Federal Decree-Law No. 20 of 2018.

Administrative fines range from AED 50,000 for minor infractions such as delayed reporting to AED 5 million for severe breaches like failure to implement an AML programme. Criminal liability may lead to imprisonment of up to ten years and/or a fine of up to AED 10 million under Article 25 when the offence involves money-laundering linked to terrorist financing. The UAE Central Bank may also suspend or cancel the entity's licence, prohibit directors from holding similar positions, and publish the sanction in the Official Gazette. Courts consider aggravating factors such as repeat offences, the value of illicit funds, and cooperation with authorities when determining the final sanction. Entities that voluntarily disclose violations and cooperate with investigations may receive reduced penalties, but the law does not provide leniency.

HOW OFTEN MUST AML POLICIES BE REVIEWED AND UPDATED?

AML policies must be reviewed at least annually and updated whenever there is a material change in risk, legislation, or business operations.

The UAE Central Bank's Guideline on AML/CFT Programs (issued 2021) states that the compliance officer shall conduct a yearly review of the risk assessment, policies, procedures, and training materials. If the business launches new products, enters new markets, or experiences a change in ownership, an immediate review is required to ensure controls remain effective. Updates must be documented, approved by senior management, and communicated to all relevant staff. Training sessions should follow any policy amendment to ensure employees understand new obligations. Failure to conduct timely reviews can be viewed as negligence and may attract penalties under Article 24 for inadequate internal controls.

WHAT DOCUMENTS ARE REQUIRED FOR AML COMPLIANCE AUDITS?

Auditors typically request the risk assessment report, AML policy manual, KYC files, transaction monitoring logs, STR copies, training records, and internal audit reports.

The risk assessment report outlines the methodology, identified risks, and risk-rating criteria used by the entity. The AML policy manual must contain the board-approved statement of commitment, organisational structure, roles and responsibilities, and detailed procedures for customer due diligence, monitoring, and reporting. KYC files should include identification documents, proof of address, source of wealth information, and any enhanced due diligence notes for high-risk customers. Transaction monitoring logs must show alerts generated, investigations performed, and outcomes, retaining raw data for at least five years. STR copies submitted via goAML must be archived with acknowledgment receipts. Training records need to list attendees, dates, topics covered, and materials used. Internal audit reports should highlight findings, corrective actions, and follow-up status. Auditors may also ask for board meeting minutes where AML matters were discussed and for any correspondence with regulators.

FREQUENTLY ASKED QUESTIONS

What is the legal basis for AML obligations in the UAE?
The legal basis is Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism, which applies to all persons conducting financial or non-financial business activities in the UAE. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Who must appoint a compliance officer under the AML law?
Every entity subject to the decree-law must appoint a compliance officer who possesses sufficient knowledge of AML/CFT requirements and reports directly to senior management or the board. This requirement is stated in Article 14 of Federal Decree-Law No. 20 of 2018.

How long must AML records be retained?
Records of customer identification, transaction details, and internal investigations must be retained for a minimum of five years after the business relationship ends, as prescribed in Article 18 of the same decree-law.

Are there fees for goAML registration?
The UAE Central Bank does not charge a fee for goAML registration; however, entities may incur costs for document preparation, legal advice, or technical integration to connect their systems to the goAML portal.

What steps should be taken if a suspicious transaction is identified?
The entity must immediately conduct an internal investigation, file a suspicious transaction report via the goAML portal without delay, and retain all related documentation for at least five years. The procedure and timeline are outlined in Article 21 of Federal Decree-Law No. 20 of 2018.

Can a business outsource its AML compliance function?
Yes, a business may outsource specific AML functions such as transaction monitoring or KYC verification, but the ultimate responsibility for compliance remains with the entity, and the outsourced provider must be supervised to ensure adherence to the law, as noted in the UAE Central Bank's Guideline on AML/CFT Programs.

Book a consultation to discuss your legal needs with our experienced team.

If your matter involves aml compliance services in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.