Anti-Money Laundering in Dubai Mainland: Complete Guide

First question: are you a reporting entity?

Many Dubai mainland businesses assume anti-money laundering rules are a banking problem. They are not. Alongside financial institutions, a category of non-financial businesses and professions carries its own obligations, and the businesses in it are ordinary mainland companies: real estate brokers and agents, dealers in precious metals and gemstones, auditors and accountants, and company service providers who form companies, provide registered offices or act as nominee directors or shareholders. Lawyers and notaries are caught when they carry out certain defined transactions for clients, such as handling money or property or arranging the sale of companies.

If your business is in that category, the obligations are direct. They do not arrive through your bank, and they are supervised — for these professions, by the Ministry of Economy, and by the relevant sectoral or emirate-level authority for others. The first task is therefore not to write a policy. It is to determine, in writing, whether the business is a reporting entity and for which of its activities.

The programme a supervisor expects to see

A business risk assessment

Everything else follows from this document. It should identify the risks the business actually faces given its customers, the countries it deals with, the products or services it offers and the channels through which it delivers them — and it should reach conclusions, not describe risk in general. A risk assessment that could have been written for any company in any sector is treated as evidence that no assessment was done.

Customer due diligence

Identify and verify the customer before establishing the relationship, and identify the ultimate beneficial owner behind any corporate customer — the natural person who owns or controls it, however many layers sit in between. Understand the purpose of the relationship and, where a person acts for someone else, verify their authority. Due diligence is calibrated to risk: simplified where risk is demonstrably low, enhanced where it is higher.

Enhanced measures apply to politically exposed persons, their family members and close associates, to customers connected to higher-risk countries, and to unusually complex or opaque structures. Enhanced means more: senior approval to take on or continue the relationship, better evidence of source of funds and source of wealth, and closer monitoring afterwards.

Screening

Customers, beneficial owners and, where relevant, counterparties must be screened against the applicable sanctions lists, including the UAE's local terrorist list and the lists issued under United Nations Security Council resolutions. Screening is not a one-off at onboarding; lists change, and the obligation is to re-screen and to act immediately on a match, including freezing without delay where the rules require it.

Ongoing monitoring

Monitor the relationship so that activity can be compared with what the customer told you at the outset. A transaction that is inconsistent with a customer's stated profile is the single most common trigger for a report. Keep due diligence records current, and refresh them on a schedule tied to risk rather than whenever someone remembers.

Governance, people and records

Appoint a compliance officer with the seniority and independence to challenge the business, and give that person direct access to the owners or board. Train staff who deal with customers, and keep evidence of who was trained and on what. Have the programme reviewed independently in a way that is proportionate to the size of the business.

Records of customer identification, due diligence files and transactions must be retained for the period the legislation specifies, in a form that can actually be produced when the supervisor asks. In inspections, the failure is rarely the absence of a policy. It is the absence of the file that proves the policy was applied.

Reporting suspicion

Where there is suspicion, or reasonable grounds to suspect, that funds are the proceeds of crime or connected to terrorist financing, a report goes to the UAE Financial Intelligence Unit through the reporting system it operates. Reporting entities must register on that system before they need it, not on the day a suspicion arises.

Two points are absolute. Suspicion is a lower threshold than proof, so the decision is not whether a crime can be established. And the customer must not be told that a report has been made, or that one is contemplated — the tipping-off prohibition binds the business and its staff. Record the reasoning behind both a decision to report and a decision not to; the second is examined as closely as the first.

Beneficial ownership and licensing records

Separately from the AML programme, mainland companies must maintain and file beneficial ownership information with their licensing authority and keep registers of shareholders and directors accurate. Ownership is determined by reference to the natural persons behind the structure, whatever the corporate chain says. Where a nominee arrangement exists, the person behind it is the one who must be disclosed. Companies are constituted under the Commercial Companies Law, Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015; the requirement for 51% UAE-national ownership of mainland companies was removed by Federal Decree-Law No. 26 of 2020, which makes accurate beneficial ownership records more important, not less.

Data protection sits alongside

Due diligence generates a large quantity of personal data. Handling it onshore engages the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, while DIFC and ADGM apply their own data protection regimes — relevant where files are held by a group entity in one of those centres. Collect what the AML obligation requires, keep it secure, and be clear internally about who may access it and to whom it may be disclosed.

Consequences and disputes

Supervisory failures attract administrative penalties and, for licensed activities, action against the licence. The commercial consequences often arrive earlier: banks withdraw from relationships they cannot document, counterparties walk away from transactions where ownership cannot be verified, and deals collapse mid-signature. Where a penalty, a frozen account or a terminated relationship is already in play, advice on financial dispute resolution should come before any response is filed, because the first written explanation tends to set the record.

A short self-check

• Have you determined in writing whether the business is a reporting entity, and for which activities?
• Is the business risk assessment specific to your customers, countries, products and channels?
• Do the due diligence files identify beneficial owners up to named individuals?
• Is screening repeated, not just performed at onboarding?
• Is the compliance officer appointed, senior enough, and registered on the reporting system?
• Could you produce a complete file for an older customer relationship today, without reconstructing it?

Where advice helps

Anti-money laundering compliance is a documentation discipline before it is a legal one. Most mainland businesses that fail an inspection had the right intentions and no evidence. For help determining whether your business is in scope, building a proportionate programme, or responding to a supervisory query, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

More of our writing on related subjects:

• Banking Regulations Compliance in the UAE
• Fintech Legal Frameworks for Dubai Businesses
• Anti-Money Laundering Compliance for UAE Investors
• Investment Advisory Strategies for Multinational Entities