What are the core AML obligations for companies operating in the UAE

Companies in the UAE must comply with Federal Decree-Law No. 20/2018 on Anti-Money Laundering and Combating the Financing of Terrorism, as amended, and the CBUAE's Consumer Protection Regulation, which together set the legal framework for AML obligations across all emirates and free zones【Federal Decree-Law No. 20/2018】.

Related Services: Explore our AML Compliance and Companies Set Up services for practical legal support in this area.

WHAT ARE THE CORE AML OBLIGATIONS FOR COMPANIES OPERATING IN THE UAE?

Companies must appoint an AML compliance officer, conduct risk assessments, implement policies and procedures, retain records for five years, and report suspicious transactions to the Financial Intelligence Unit【Federal Decree-Law No. 20/2018】. They are also obliged to screen customers against UN and UAE sanctions lists and to provide annual compliance certifications where required【Cabinet Decision 74/2020】. Failure to meet these duties can result in administrative fines, criminal liability, and suspension of licences.

The risk assessment must identify vulnerabilities linked to the company's products, services, delivery channels, and geographic exposure. Policies should cover customer due diligence (CDD), enhanced due diligence (EDD) for high-risk clients, transaction monitoring thresholds, and staff training programmes. Record-keeping obligations include maintaining identification documents, transaction records, and supporting evidence for at least five years after the business relationship ends【Federal Decree-Law No. 20/2018】. The AML officer must ensure that internal controls are tested regularly and that any deficiencies are remedied promptly. Reporting obligations arise when a transaction or activity is suspected of being linked to money laundering or terrorism financing; the report must be submitted electronically to the FIU within the prescribed timeframe.

HOW SHOULD A COMPANY DESIGN AND IMPLEMENT AN AML COMPLIANCE PROGRAM?

A company should begin with a board-approved AML policy that outlines roles, responsibilities, and escalation procedures, then develop detailed procedures for CDD, EDD, monitoring, and reporting【Federal Decree-Law No. 20/2018】. The programme must include mandatory training for all employees, with refresher courses at least annually, and independent audits to test effectiveness【Cabinet Decision 74/2020】. Documentation of the programme, including policy manuals, training logs, and audit reports, must be retained for regulatory inspection.

Implementation starts with a gap analysis comparing existing controls to legal requirements. The AML officer drafts a policy that specifies acceptable risk thresholds, approval processes for new relationships, and procedures for freezing assets when ordered by authorities. Procedures for CDD require collecting identification documents, verifying the beneficial ownership structure, and assessing the purpose of the business relationship. Enhanced due diligence applies to politically exposed persons, clients from high-risk jurisdictions, and those involved in complex or unusually large transactions. Transaction monitoring tools should generate alerts based on predefined rules, and investigators must review alerts within a set period, documenting their findings. Training modules cover legal obligations, red-flag indicators, and internal reporting lines, with attendance records kept as proof of compliance. Audits, whether internal or external, evaluate whether policies are followed, identify weaknesses, and recommend corrective actions, with reports submitted to senior management and retained for the statutory period.

WHAT ARE THE REQUIREMENTS FOR CUSTOMER DUE DILIGENCE AND TRANSACTION MONITORING?

Customer due diligence requires obtaining and verifying identification documents, understanding the nature of the client's business, and identifying the ultimate beneficial owner before establishing a relationship【Federal Decree-Law No. 20/2018】. For high-risk customers, enhanced due diligence includes obtaining senior management approval, conducting adverse media checks, and increasing monitoring frequency. Transaction monitoring must be risk-based, with thresholds set according to the company's risk assessment, and alerts investigated promptly【Cabinet Decision 74/2020】.

The CDD process begins with collecting a valid passport or Emirates ID, proof of address, and, for corporate clients, trade licence, memorandum of association, and board resolution authorising the account. Verification may involve checking documents against official databases or using trusted third-party services. The beneficial owner is defined as any natural person who ultimately owns or controls more than 25 % of the entity or exercises effective control. For EDD, the company must obtain additional information such as the source of wealth, the source of funds, and the purpose of the transaction, and must secure approval from senior management or the AML compliance officer before proceeding. Transaction monitoring systems should be configured to flag activities that deviate from the client's established profile, such as sudden large cash deposits, rapid movement of funds between accounts, or transactions involving sanctioned jurisdictions. Each alert must be investigated, documented, and, if warranted, reported to the FIU. Records of the CDD/EDD process and monitoring outcomes must be retained for five years.

HOW MUST SUSPICIOUS TRANSACTION REPORTS BE FILED AND WHAT ARE THE PENALTIES FOR NON-COMPLIANCE?

Suspicious transaction reports (STRs) must be submitted electronically to the UAE Financial Intelligence Unit via the goAML system as soon as suspicion arises, and no later than five working days after detection【Federal Decree-Law No. 20/2018】. The report must include details of the parties involved, the nature of the transaction, and the grounds for suspicion. Non-compliance can attract administrative fines of up to AED 5 million, imprisonment of up to two years, or both, depending on the severity of the breach【Federal Decree-Law No. 20/2018】.

The goAML portal requires the reporting entity to log in with authorised credentials, complete the STR form, and attach supporting documents such as transaction records and correspondence. The FIU acknowledges receipt and may request additional information; the reporting entity must cooperate fully. Penalties are determined by the Public Prosecution and the courts, taking into account factors such as the amount of money involved, the degree of intent, and any remedial actions taken by the company. In addition to criminal sanctions, regulators may impose administrative penalties, suspend licences, or prohibit the company from engaging in certain financial activities. Companies that demonstrate proactive compliance, timely reporting, and effective internal controls may benefit from reduced penalties or mitigation measures under the law.

FREQUENTLY ASKED QUESTIONS

What legal instrument governs AML obligations in the UAE?
Federal Decree-Law No. 20/2018 on Anti-Money Laundering and Combating the Financing of Terrorism, as amended, sets out the primary legal framework for AML obligations, supplemented by CBUAE regulations and Cabinet Decision 74/2020 on sanctions【Federal Decree-Law No. 20/2018】.

Who is responsible for AML compliance within a company?
The company's board must appoint an AML compliance officer who oversees the programme, ensures policies are implemented, and reports to senior management and regulators as required【Federal Decree-Law No. 20/2018】.

How long must AML records be retained?
Records of customer identification, transaction details, and supporting evidence must be kept for a minimum of five years after the business relationship ends【Federal Decree-Law No. 20/2018】.

What are the consequences of failing to file a suspicious transaction report?
Failure to file an STR can lead to administrative fines up to AED 5 million, imprisonment up to two years, or both, depending on the circumstances of the violation【Federal Decree-Law No. 20/2018】.

Are free zone companies subject to the same AML rules?
Yes, companies operating in UAE free zones must comply with Federal Decree-Law No. 20/2018 and CBUAE regulations, although they may also follow free-zone-specific guidance that does not contradict federal law【Federal Decree-Law No. 20/2018】.

If your matter involves anti-money laundering compliance for companies in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.