4 October 2026
Since 14 October 2025 the UAE has combated money laundering, terrorist financing and proliferation financing under Federal Decree-Law No. 10 of 2025, which repealed Federal Decree-Law No. 20 of 2018. Its Executive Regulations, Cabinet Resolution No. 134 of 2025, have applied since 14 December 2025 and replaced Cabinet Decision No. 10 of 2019. If your company brokers real estate, deals in precious metals and stones, or provides accounting, legal or corporate services, it may be a designated non-financial business or profession (DNFBP). A DNFBP needs a working AML programme: goAML registration, a compliance officer approved in advance by the supervisor, a documented risk assessment, customer due diligence, sanctions screening with freezing within 24 hours, suspicious transaction reporting and records kept for at least five years. Administrative fines under the new law range from AED 10,000 to AED 5,000,000 per violation.
The new legal framework at a glance
| Act | What it covers | Status |
|---|---|---|
| Federal Decree-Law No. 10 of 2025 | Main AML, CFT and CPF law: crimes, supervision, reporting duties, administrative and criminal penalties. Repealed Federal Decree-Law No. 20 of 2018 | In force since 14 October 2025, Official Gazette No. 808 |
| Cabinet Resolution No. 134 of 2025 | Executive Regulations: list of DNFBPs, risk assessment, due diligence, compliance officer, records, beneficial owners. Repealed Cabinet Decision No. 10 of 2019 | In force since 14 December 2025, Official Gazette No. 811 |
| Cabinet Resolution No. 71 of 2024 | Unified list of 41 violations with fine ranges for entities supervised by the Ministry of Justice and the Ministry of Economy | In force; written under the 2018 law |
| Cabinet Decision No. 74 of 2020 | Targeted financial sanctions: terrorism lists and UN Security Council resolutions | In force |
Under Article 41(3) of the new Decree-Law, regulations, resolutions and circulars issued under the 2018 law stay effective as long as they do not conflict with it, until replacements are issued. Article 39 instructs the Cabinet to adopt a new resolution on violations and administrative penalties. At the time of writing it has not appeared on the website of the Ministry of Economy and Tourism (MOET) or on the UAE Legislation portal, so the fine table of Cabinet Resolution No. 71 of 2024 remains the practical reference.
Who is a DNFBP under Cabinet Resolution 134 of 2025
Article 3 of the Resolution lists six groups. A business becomes a DNFBP when it carries out the activity described, not because of the name on its licence:
- Commercial gaming operators, a new category, for a single transaction or linked transactions of AED 11,000 or more.
- Real estate brokers and agents, when they conclude transactions or settlements for customers in the purchase or sale of real estate.
- Dealers in precious metals and stones, for a single cash transaction or linked transactions of AED 55,000 or more.
- Lawyers, notaries, other independent legal professionals and independent accountants, when they prepare or carry out transactions for customers in five areas: buying and selling real estate; managing customer funds; managing bank, savings or securities accounts; organising contributions for companies; establishing, operating or managing legal persons or arrangements, or buying and selling businesses.
- Company and trust service providers, for the five activities described below.
- Any other business or profession named by a resolution of the supervisory authority in coordination with the National Committee.
Company and trust service providers: the five activities
Under Article 3(5), a company and trust service provider is a DNFBP when it carries out a transaction for or on behalf of a customer in relation to: acting as an agent in the incorporation of a legal person; acting, or arranging for another person to act, as a director, secretary or partner; providing a registered office, business address, place of residence, correspondence or administrative address; acting, or arranging for another person to act, as trustee of an express trust; acting, or arranging for another person to act, as a nominee shareholder. MOET’s supplemental guidance for this sector (April 2026) adds that a registered office is not a purely administrative service: even without a broader business relationship, minimum due diligence must be met.
Who supervises and how risky each sector is
According to the MOET Guidelines for DNFBPs (March 2026), MOET is the AML supervisor for accountants and auditors, company and trust service providers, dealers in precious metals and stones, and real estate agents and brokers on the mainland and in commercial free zones. Law firms and other legal professionals are supervised by the Ministry of Justice, DNFBPs in DIFC by the DFSA and DNFBPs in ADGM by the FSRA. If you are still choosing a jurisdiction, our guide to mainland vs free zone companies in the UAE explains the licensing differences; for AML purposes a mainland DNFBP and a commercial free zone DNFBP answer to the same supervisor.
MOET’s practical guide to the 2024 National Risk Assessment rates money laundering risk by sector: real estate brokers and agents High, dealers in precious metals and stones Medium-High, corporate service providers Medium, independent accountants Medium-Low. The same guide is clear that every DNFBP, whatever its rating, must apply proportionate risk-based measures.
What changed compared with the old framework
- New acts and new article numbers. Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 are repealed (Article 41 of the Decree-Law, Article 70 of the Resolution). Policies, customer forms and training materials that still cite the old acts need new references.
- A new type of DNFBP. Commercial gaming operators, including gaming on board vessels, are now on the list for transactions of AED 11,000 or more (Article 3(1)). The activities that bring lawyers, notaries and independent accountants into scope are now set out in five points (Article 3(4)).
- Due diligence triggers for DNFBPs. Customer due diligence is required at the start of a business relationship, when a crime is suspected and when there are doubts about identification data obtained earlier (Article 7(1)). The AED 55,000 occasional transaction and AED 3,500 wire transfer thresholds in Article 7(2) apply to financial institutions. For corporate service providers, MOET’s supplemental guidance says a business relationship is typically established when the provider agrees to create, manage or support a legal person for a client, so due diligence starts at that point.
- Compliance officer approval in the Regulations. The supervisor keeps an updated list of compliance officers, notifies the Financial Intelligence Unit (FIU) and requires prior approval before an officer is appointed (Article 49(18)). The officer must sit at management level, be independent and have appropriate competence and experience, and prepares periodic reports for senior management, with a copy to the supervisor on request (Article 22).
- A new fine scale and publicity. Administrative fines run from AED 10,000 to AED 5,000,000 per violation, alongside measures from a warning to licence revocation. A repeated violation within one year can attract an incremental fine, and the supervisor may publish the penalties it imposes (Article 17).
- Beneficial owner updates in 15 working days. Companies update their basic and beneficial owner information within 15 working days of a change (Article 38), and a nominee director or shareholder must notify the company of changes within the same period (Article 39).
- Sanctions reports renamed. The former Funds Freeze Report is now the Confirmed Name Match Report (CNMR). A CNMR or a Partial Name Match Report is filed through goAML within five business days (MOET guidance on STRs and SARs, March 2026).
Compliance checklist for a DNFBP
- Register on goAML, the FIU reporting system, and keep the registration active; the compliance officer registers as the user.
- Register on the website of the Executive Office for Control and Non-Proliferation (EOCN) to receive sanctions list notifications.
- Appoint a compliance officer at management level after the supervisor’s prior approval.
- Carry out and document a business risk assessment covering customers, countries, products, services, transactions and delivery channels, using the National Risk Assessment; MOET guidance suggests doing it at least annually in most cases.
- Adopt policies approved by senior management on due diligence, suspicious transaction reporting, compliance arrangements, employee screening, training and an independent audit function (Article 21).
- Identify and verify each customer and beneficial owner: ownership of 25% or more, then control by other means, then senior management (Article 10).
- Apply enhanced due diligence to high-risk customers, politically exposed persons and black-listed countries.
- Screen customers, potential customers, beneficial owners and transaction parties against UN and UAE lists regularly and whenever the lists change; on a confirmed match, freeze without delay, within 24 hours, and file a CNMR.
- Report suspicious transactions and activity through goAML without delay, regardless of the amount, and never tip off the customer.
- Keep records for at least five years, counted from the latest relevant date, such as the end of the relationship, an occasional transaction, an inspection or a final court judgment (Article 25(2)).
- Train staff regularly and test the programme through an independent audit function.
Obligations and fines under Cabinet Resolution 71 of 2024
Cabinet Resolution No. 71 of 2024 still cites article numbers of the 2018 law. The table maps key violations to the current legal basis and the fine range per violation.
| Obligation | Current legal basis | Fine under CR 71/2024 |
|---|---|---|
| Policies and controls approved by senior management | Decree-Law Art. 19(1)(d); Resolution 134 Art. 21 | AED 100,000 to AED 200,000 |
| Business risk assessment | Decree-Law Art. 19(1)(a); Resolution 134 Art. 5 | AED 50,000 to AED 500,000 |
| Customer due diligence | Resolution 134 Art. 7 | AED 50,000 to AED 200,000 |
| Enhanced due diligence for high risk | Resolution 134 Art. 5(2)(c) | AED 100,000 to AED 500,000 |
| Suspicious transaction reports | Decree-Law Art. 18 | AED 100,000 to AED 500,000 |
| Registration on goAML | Decree-Law Art. 18; MOET Guidelines | AED 50,000 to AED 200,000 |
| Competent compliance officer | Resolution 134 Art. 22 and 49(18) | AED 50,000 to AED 200,000 |
| Record keeping | Resolution 134 Art. 25 | AED 50,000 to AED 200,000 |
| No tipping off | Decree-Law Art. 24; Resolution 134 Art. 19 | AED 100,000 to AED 500,000 |
| EOCN registration for list notifications | Cabinet Decision 74/2020 Art. 21(1) | AED 50,000 to AED 1,000,000 |
| Ongoing sanctions screening | Cabinet Decision 74/2020 Art. 21(2) | AED 50,000 to AED 1,000,000 |
| Freezing funds promptly on a list match | Cabinet Decision 74/2020 Art. 21(3) | AED 500,000 to AED 1,000,000 |
Criminal liability is separate. Failing to report a suspicious transaction, deliberately or through gross negligence, is punishable by imprisonment and a fine of AED 100,000 to AED 1,000,000, or either (Article 28 of the Decree-Law). Tipping off carries imprisonment and a fine of at least AED 50,000, or either (Article 29). Violating EOCN instructions on targeted financial sanctions carries imprisonment and a fine of at least AED 20,000, or either (Article 33).
MOET circulars and guidance in 2026
MOET Circular No. 2 of 2026, dated 14 September 2026, updates the lists of high-risk countries and countries under increased monitoring in line with the FATF lists published in June 2026, and replaces Circular No. 1 of 2026. For black-listed jurisdictions it requires enhanced due diligence on all relationships and transactions, including with persons acting on their behalf, suspicious transaction reports in the goAML high-risk jurisdiction formats (HRC and HRCA), and no reliance on third parties based there. DNFBPs should also review due diligence for countries removed from the lists. In 2026 MOET also issued updated Guidelines for DNFBPs, supplemental guidance for each of the four sectors it supervises and guidance on STRs, SARs and red flag indicators.
What to do now: a step-by-step plan
- Map the activities you actually perform against Article 3 of Cabinet Resolution No. 134 of 2025 and record the conclusion.
- If the company is a DNFBP, register on goAML and with the EOCN, and keep both registrations active.
- Choose a compliance officer and obtain the supervisor’s prior written approval before the appointment.
- Prepare or update the business risk assessment, including proliferation financing risk and the 2024 National Risk Assessment.
- Rewrite policies and customer forms with references to the 2025 Decree-Law and Resolution.
- Set up screening so that a confirmed match is frozen within 24 hours and reported within five business days.
- Train staff, document the training and arrange an independent review of the programme.
How Atlant Capital can help
Atlant Capital helps owners of UAE companies build an AML framework under the new law. We assess whether your activities make the company a DNFBP, prepare the goAML and EOCN registrations, draft the AML policy and the business risk assessment, train your staff and support the appointment of a compliance officer, including the request for the supervisor’s prior approval. Our team has passed the ICA and MOET Certificate in AML/CFT for DNFBPs. If you are only starting out, we handle company setup in the UAE and prepare the AML file in parallel. To discuss your situation, contact us.
Conclusion
Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 did not remove any core duty of a DNFBP, but they changed the references, widened the list of covered businesses, put prior approval of the compliance officer into the Regulations and set administrative fines from AED 10,000 to AED 5,000,000 per violation. A company that brokers property, trades precious metals and stones, or forms and administers companies for clients should check its status under Article 3 and bring its registrations, policies and records in line with the new acts.
Source: Ministry of Economy and Tourism, AML/CFT, UAE Legislation: Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025.
FAQ
What is the main anti-money laundering law in the UAE in 2026?
Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing. It has applied since 14 October 2025 and repealed Federal Decree-Law No. 20 of 2018. Its Executive Regulations, Cabinet Resolution No. 134 of 2025, have applied since 14 December 2025 and replaced Cabinet Decision No. 10 of 2019.
Is a company formation agent a DNFBP in the UAE?
Yes, when it acts for customers. Under Article 3(5) of Cabinet Resolution No. 134 of 2025, company and trust service providers are DNFBPs when they act as agents in forming legal persons, act as or arrange directors, secretaries or nominee shareholders, provide a registered office or business address, or act as trustees. On the mainland and in commercial free zones they are supervised by the Ministry of Economy and Tourism.
What is the fine for a DNFBP that is not registered on goAML?
Under the unified list of Cabinet Resolution No. 71 of 2024, failure to register on the FIU electronic system carries a fine of AED 50,000 to AED 200,000. Failure to register with the EOCN for sanctions list notifications carries AED 50,000 to AED 1,000,000. The 2025 Decree-Law allows administrative fines of AED 10,000 to AED 5,000,000 per violation.
Does a DNFBP need approval to appoint a compliance officer?
Yes. Article 49(18) of Cabinet Resolution No. 134 of 2025 requires supervised entities to obtain the supervisor’s prior approval before appointing their compliance officer, and the MOET Guidelines for DNFBPs require prior written approval. The officer must be at management level, independent and have appropriate competence and experience.
