UAE goAML & AML Compliance 2026: DNFBP Rules & Penalties

• 21 July, 2026
• By Safvan, Managing Partner
• Compliance

The compliance regime that catches accountants and brokers

Designated Non-Financial Businesses and Professions (DNFBPs) — real-estate brokers and agents, dealers in precious metals and stones, independent accountants and auditors, lawyers and notaries, and corporate service providers — must register on the goAML portal of the UAE Financial Intelligence Unit, run customer due diligence, keep a risk assessment and AML programme, and file Suspicious Transaction Reports. Obligations apply by activity, not size. The framework was overhauled by Federal Decree-Law No. 10 of 2025 (in force 14 October 2025), and fines run from AED 50,000 to AED 1,000,000 per violation.

If you run a Dubai accounting practice, a real-estate brokerage, a gold shop or a company-formation business, you are almost certainly a DNFBP — and AML compliance is not optional. It applies whether you are a large firm or a sole practitioner. Here is what you must do.

Who is a DNFBP

Your core AML obligations

DNFBPs must: register on goAML (and on the Ministry of Economy's supervision systems); appoint a compliance officer; run customer due diligence (CDD) and enhanced due diligence for higher-risk clients; maintain a business risk assessment and written AML/CFT programme; screen against sanctions lists; keep records; and file Suspicious Transaction Reports (STRs) and other reports through goAML.

The 2026 framework and fines

Why size is no excuse

The obligations attach to the activity, so a one-person Dubai brokerage or accounting practice is caught just like a large firm. Failing to register on goAML, skipping CDD, or missing an STR are among the most heavily penalised breaches — and STR failures can be treated as criminal, not just administrative.

How to get compliant

1. Confirm you are a DNFBP: check your activity against the five categories.
2. Register on goAML: and on the Ministry of Economy supervision system.
3. Appoint a compliance officer: and adopt a written AML/CFT programme.
4. Run CDD and screening: identify clients, beneficial owners and sanctions risk.
5. File STRs and stay inspection-ready: report suspicions and keep records.

A worked example: the cost of ignoring goAML

Take a two-partner Dubai accounting practice that never registered on goAML because “we are too small.” Obligations attach by activity, not size: as independent accountants they are a DNFBP from the day the licence issued. In a Ministry of Economy sweep, failure to register, missing CDD files and no AML programme are three separate violations — at AED 50,000 to AED 1,000,000 each, a first inspection can exceed AED 150,000 before any suspicious-transaction failure (a criminal matter) is even considered. Registration itself costs nothing but time.

Your first 30 days of AML compliance

1. Register on goAML with the UAE Financial Intelligence Unit and your supervisory authority portal.
2. Appoint an AML compliance officer — even in a sole practice, someone must own the function.
3. Write the business risk assessment covering customers, geographies, products and delivery channels.
4. Stand up CDD procedures: identify customers and their beneficial owners, screen against sanctions lists, and risk-rate every relationship.
5. Train staff and document it — inspectors ask for the training log before almost anything else.

How do you register on goAML?

1. Appoint your compliance officer / MLRO first — the registration is built around a named natural person with an Emirates ID.
2. Pre-register on the supervisory portal to obtain your goAML access credentials (the SACM step).
3. Complete the goAML portal registration with your trade licence, the MLRO's ID and passport, and an authorisation letter.
4. Wait for approval, then log in and verify the entity profile — reporting categories, activities and contact details.
5. Stand up the internal side: the registration only opens the reporting channel; the risk assessment, CDD files and screening process described above still have to exist behind it.

Registration itself is free and usually approved within days — which removes the last excuse. The businesses that get fined are almost never the ones that struggled with the portal; they are the ones that never appointed an MLRO and never started.

Common mistakes

The legal basis

The framework was overhauled by Federal Decree-Law No. 10 of 2025 (in force 14 October 2025), which replaced Federal Decree-Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 (in force 14 December 2025), with DNFBP supervision by the Ministry of Economy. Administrative fines run from AED 50,000 to AED 1,000,000 per violation, and up to AED 5,000,000 for serious breaches. Exiloz builds AML files as part of accounting engagements for DNFBPs and aligns them with your UBO register so one inspection file answers both regimes.

Frequently Asked Questions