AML Compliance in the UAE: Obligations and Risk Assessment

Introduction

Building an anti-money-laundering (AML) programme is one thing; understanding the legal obligations that programme must satisfy, and the risk assessment that drives it, is another. This guide focuses on what UAE law actually requires of businesses in scope and how a risk-based assessment shapes those duties, rather than the step-by-step of setting up a programme.

Who Is in Scope

AML obligations extend beyond banks to designated non-financial businesses and professions — real-estate brokers, dealers in precious metals and stones, corporate service providers and others. The first task for any business is to determine, honestly, whether it falls within scope, because the duties that follow are mandatory.

The Risk-Based Assessment

UAE AML law is built on a risk-based approach: businesses must assess the money-laundering and terrorist-financing risks presented by their customers, products, delivery channels and geographies, then calibrate controls to that risk. A documented risk assessment is both a legal expectation and the foundation for every other control.

Core Legal Obligations

In-scope businesses must conduct customer due diligence (enhanced for higher-risk relationships), screen against sanctions lists, monitor transactions, keep records, appoint a compliance officer, and file suspicious-transaction reports through the national system. These are legal duties, not optional best practice.

Enforcement and Penalties

Regulators actively supervise and penalise AML failings, with significant administrative fines and business restrictions for weak controls or missed reporting. The cost of non-compliance typically far exceeds the cost of a sound programme.

Conclusion

AML compliance in the UAE begins with two questions: are we in scope, and what is our risk? A documented, risk-based assessment turns the law's obligations into a proportionate set of controls — and is the first thing a regulator will ask to see.