Since 14 October 2025 the UAE has had a new anti-money laundering law: Federal Decree-Law No. (10) of 2025. It fully replaced Federal Decree-Law No. (20) of 2018, which most consultants still quote. For a business this comes down to one thing: if you deal in real estate, gold, corporate services, accounting or virtual assets, an inspector will ask for four items — goAML registration, an AML policy backed by a risk assessment, an appointed compliance officer and proof of staff training. Each missing item is an administrative fine of up to AED 5,000,000 per breach.
Dynasty Business Adviser delivers AML compliance services in the UAE end to end: from confirming whether the requirements apply to you, through goAML registration and document drafting, to monthly support. We work with companies in Dubai, across all seven emirates and in the free zones — under the current law and the 2025 Executive Regulations. If you have been searching for AML compliance in Dubai or an AML consultant in Dubai who works from the 2025 legislation rather than the repealed one, this page sets out what the obligations are, what they cost to ignore and how we close them.
Check whether your company must comply with AML →
Who must comply with AML in the UAE
AML compliance in the UAE does not depend on ownership structure or on whether you are on the mainland or in a free zone. It depends on what you do. The law divides obliged entities into four groups: financial institutions, virtual asset service providers (VASPs), designated non-financial businesses and professions (DNFBPs) and non-profit organisations.
- Financial institutions — banks, exchange houses, insurers, brokerages, finance and leasing companies. Their supervisor is the Central Bank of the UAE or the Securities and Commodities Authority (SCA); in the DIFC and ADGM it is the DFSA and the FSRA respectively.
- VASPs — crypto exchanges, brokers, custodians and other virtual asset service providers. The new law makes them a separate category with obligations at the level of financial institutions. The threshold for occasional transactions is AED 3,500.
- DNFBPs — the main group of clients who need AML/CFT compliance services in Dubai and the wider UAE. The DNFBP list in the UAE covers six categories of business:
Table 1 — DNFBP categories and when AML requirements apply
| Category | When AML requirements apply | Supervisor (mainland and most free zones) |
|---|---|---|
| Real estate agents and brokers | Buying and selling real estate on behalf of clients | Ministry of Economy |
| Dealers in precious metals and stones (DPMS) | Cash transactions of AED 55,000 or more | Ministry of Economy |
| Lawyers, notaries and independent legal professionals | Preparing or carrying out transactions for a client: real estate, asset management, company formation | Ministry of Justice |
| Independent accountants and auditors | The same transactions as lawyers, when handling client funds | Ministry of Economy |
| Corporate and trust service providers (CSP/TCSP) | Company formation, nominee directors and shareholders, registered office, trust administration | Ministry of Economy |
| Commercial gaming operators | Transactions of AED 11,000 or more, including on vessels | GCGRA |
If your activity appears in the table, all four core obligations apply to you in full — regardless of turnover or headcount. The 2025 law also spells out obligations for non-profit organisations directly (Article 34): previously they were inferred from the general provisions; now they are written into the law.
We are in a free zone — does AML still apply?
Yes. A free zone gives you tax and customs advantages, but it does not exempt you from federal AML legislation. A company in DMCC, IFZA, RAKEZ, Meydan or SHAMS that trades gold, provides corporate services or works in real estate must register with goAML and meet every requirement on the same footing as a mainland company. Only the supervisor differs: DIFC and ADGM have their own regulators (DFSA and FSRA); for the other free zones it is, as a rule, the Ministry of Economy.
Even if your company is not a DNFBP — an ordinary trading or IT business, say — some requirements still reach it. Every company must keep a register of ultimate beneficial owners (UBO) and update it within 15 working days of any change. All persons in the UAE must also apply targeted financial sanctions, which means screening counterparties against sanctions lists. How to identify your category is explained in DNFBPs in the UAE.
What changed on 14 October 2025
The 2025 reform is the largest overhaul of UAE AML legislation since 2018. Federal Decree-Law No. (10) of 2025 was published in the Official Gazette on 30 September 2025 and came into force on 14 October 2025. Its Executive Regulations — Cabinet Resolution No. (134) of 2025 — took effect two months later, on 14 December 2025. The two dates are routinely confused, and an inspector spots the mistake in a company’s documents straight away.
Table 2 — UAE AML legislation before and after the reform
| Item | Before the reform | From 2025 |
|---|---|---|
| Principal law | Federal Decree-Law No. (20) of 2018 | Federal Decree-Law No. (10) of 2025 (in force from 14 October 2025) |
| Executive Regulations | Cabinet Decision No. (10) of 2019 | Cabinet Resolution No. (134) of 2025 (in force from 14 December 2025) |
| Proliferation financing | Fell under “financing of illegal organisations” | Stand-alone offence (CPF), including dual-use goods |
| Crypto businesses | No separate category | VASPs — a category with financial-institution obligations |
| Statute of limitations | Applied | Does not apply to ML, TF or proliferation financing |
| Financial intelligence body | Financial Information Unit | Financial Intelligence Unit, freezing orders of up to 30 days |
| Bearer shares | Restricted | Prohibited; conversion within 30 working days |
For business, the key change is the financing of proliferation of weapons of mass destruction (CPF). It is now a stand-alone offence, and a supply of dual-use goods that is perfectly lawful on its face — electronics, chemicals, machine tools — can fall under it if the context of the deal points to risk. For trading and re-export companies in the UAE this is the main practical shift: screening the counterparty and the end recipient becomes a mandatory part of the transaction.
The second practical conclusion: if your AML policy was written before October 2025 and cites Federal Decree-Law No. (20) of 2018 and Cabinet Decision No. (10) of 2019, it is out of date. An inspector will see that on page one. A detailed breakdown of the changes is in the new UAE AML law 10/2025.
The four obligations inspectors check first
When the Ministry of Economy inspects a company, it does not start with transaction analysis. It starts with the basic elements of the system. If even one is missing, the rest of the inspection follows a much harder script.
1. goAML registration
goAML is the platform of the UAE Financial Intelligence Unit (FIU) through which companies file suspicious transaction and activity reports (STR, SAR), partial name match reports (PNMR) against sanctions lists and other forms. goAML registration in the UAE is preceded by pre-registration in the SACM system. Without registration a company physically cannot meet its reporting obligation — which means it has been in breach from the day it started trading. Details on the goAML registration page.
2. AML policy and risk assessment
A company must have a written AML/CFT policy and internal procedures built on its own assessment of money laundering, terrorist financing and proliferation financing risks. The documents must set out KYC and CDD procedures, the triggers for enhanced due diligence (EDD), threshold amounts, transaction monitoring and record keeping for at least 5 years. A template downloaded from the internet does not work here: the AML risk assessment must reflect your actual client base, products, countries and sales channels. Details on the AML policy and procedures page.
3. An appointed compliance officer (MLRO)
The company appoints a person responsible for AML — a compliance officer, or MLRO (Money Laundering Reporting Officer). The MLRO receives internal reports of suspicious activity, decides whether an STR should be filed, liaises with the FIU and reports to management. For smaller companies keeping such a specialist on the payroll is expensive, so a common solution is an outsourced MLRO. Details on the Outsourced compliance officer (MLRO) page.
4. Staff training
Employees who deal with clients and money must complete AML/CFT training, and the company must keep evidence of it: the programme, the date, the list of participants and test results. A missing training log is one of the most frequent findings in inspections, simply because it is the easiest thing to overlook.
The cost of doing nothing
The new law has tightened liability considerably. Administrative sanctions are imposed by the supervisor without a court; criminal sanctions are imposed by a court following an investigation.
Table 3 — Liability for AML breaches in the UAE
| Type of liability | Amount / consequences | Legal basis |
|---|---|---|
| Administrative fine | AED 10,000 to AED 5,000,000 per breach | Federal Decree-Law No. (10) of 2025, Article 17 |
| Additional regulatory measures | Ban on operating in the sector, restrictions on management powers, suspension or revocation of the licence | Federal Decree-Law No. (10) of 2025, Article 17 |
| Publicity | The regulator may publish details of sanctions in the media | Federal Decree-Law No. (10) of 2025 |
| Fine for a legal entity on conviction | AED 5,000,000 to AED 100,000,000 | Federal Decree-Law No. (10) of 2025, Article 27(1) |
| Statute of limitations | Does not apply to ML, TF or proliferation financing | Federal Decree-Law No. (10) of 2025, Article 37(2) |
AML fines and penalties in the UAE are counted per breach. No goAML registration, no policy and no appointed MLRO are three separate breaches, not one.
There are also consequences that are not written into the law but are felt sooner than any fine. When opening an account and at every annual KYC review, UAE banks ask DNFBPs for proof of goAML registration and a copy of the AML policy. No documents — no account, or the account is frozen at the next review. More on this on the Opening a bank account in the UAE page. The publication of sanctions in the media, which the law now expressly permits, does more damage to a company’s standing with partners and clients than the fine itself. A detailed breakdown by type of breach is in AML fines and penalties in the UAE.
Our services
We cover AML compliance in full or in separate blocks, depending on what the company already has in place.
- goAML registration. SACM pre-registration, two-factor authentication set-up, preparation and upload of documents, support until approval. Turnaround from 3 working days.
- AML policy and procedures. AML/CFT policy, ML/TF/PF risk assessment, CDD/EDD procedures, KYC questionnaires, transaction monitoring and record-keeping rules — tailored to your activity and to Federal Decree-Law No. (10) of 2025.
- Outsourced compliance officer (MLRO). A designated specialist for your company: client screening, STR filing through goAML, liaison with the FIU, annual report to management. No need to hire an employee. Our MLRO services in Dubai also cover companies in the other emirates and free zones.
- AML audit and staff training. An independent review of your existing system ahead of an inspection, plus staff training with certificates and a training log. AML audit services in the UAE are offered as a stand-alone engagement.
How we work
Turnkey AML implementation runs in six stages. The timings below are for a typical DNFBP with a single licence.
- Diagnostic (1–2 working days). We establish which category the company falls into, who your supervisor is, which mandatory items are already in place and where the gaps are.
- SACM and goAML registration (from 3 working days). We prepare the documents, complete the registration and hand over the credentials.
- Risk assessment and AML policy. We analyse your clients, products, countries and sales channels, and write the policy and procedures on that basis.
- Appointment of the MLRO. We appoint your employee and prepare them for the role — or take on the function ourselves under an outsourcing agreement.
- Staff training. We train client-facing employees and prepare the training log and certificates.
- Ongoing support. We handle routine reporting, client and counterparty screening, annual updates of the risk assessment and policy, and preparation for inspections.
If the company is only now being set up, it makes sense to run AML in parallel with incorporation: the goAML registration deadline runs from the date the licence is issued.
Discuss AML implementation for your company →
Pricing
The cost depends on the category of the company, the number of licences and which mandatory items are already done. That is why we do not sell one package for everyone — we build it from blocks.
Table 4 — Dynasty AML service packages
| Package | What is included | Billing |
|---|---|---|
| goAML | SACM pre-registration, goAML registration, handover of credentials | One-off fee |
| AML documents | ML/TF/PF risk assessment, policy, CDD/EDD procedures, KYC questionnaires | One-off fee |
| Turnkey AML | goAML + documents + MLRO appointment + staff training | One-off fee |
| Outsourced MLRO | Designated compliance officer, client screening, STR filing, annual report | Monthly subscription |
| Staff training | Employee training, training log, certificates | One-off fee |
We fix the exact price in the contract before work starts — after a free diagnostic, which takes one working day. Most AML consultants in the UAE do not publish their prices at all; we quote the cost upfront so that you can set it against the size of a potential fine.
Why Dynasty
- We work from the law in force. Every document is drafted under Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 — with no references to repealed acts, which still turn up in templates and in the work of many consultants.
- One point of contact for your UAE business. AML compliance is tied to accounting, audit and bank accounts. We run all of this within one team, so the figures in your policy, your reporting and your bank KYC file match.
- We know the requirements from the inside. As a corporate service provider we are a DNFBP ourselves and go through the same procedures as our clients.
- A licensed company. Dynasty Business Adviser operates under DED licences No. 829095 and No. 1222411, with an office in Business Bay, Dubai.
- Transparent pricing. Package prices are fixed before work begins.
Build your AML compliance before the inspection, not after
Send us your business activity and licence type, and within one working day we will tell you whether your company must comply with AML, who your supervisor is and what needs to be done first. The diagnostic is free.
WhatsApp / phone: +971 52 634 1022
Get a free diagnostic ⬇
Information current as of October 2026. Legal basis: UAE Federal Decree-Law No. (10) of 2025 and UAE Cabinet Resolution No. (134) of 2025. This page is for general guidance only and does not constitute legal advice — for an assessment of your situation, consult a specialist.
