21 July 2026 · Penalties
AML Penalties & Enforcement
AML violations by DNFBPs carry administrative fines generally from AED 50,000 to AED 1,000,000 per violation, with higher penalties — up to AED 5,000,000 — reserved for serious breaches. Crucially, fines are assessed per violation, not per inspection, so a single Ministry of Economy visit that finds no goAML registration, no CDD files and no written AML programme can produce three separate fines that add up well before any Suspicious Transaction Report failure is even considered. STR failures sit in a different category altogether: beyond a fine, they can carry criminal liability, because failing to report a suspected crime is treated as a distinct offence from simply having a weak compliance file. Registration itself is free, which is exactly why regulators treat non-registration so harshly — there is no cost-based excuse for skipping it.
Exiloz Management & Tax Consultant · Dubai-based FTA-focused advisory · VAT, corporate tax & accounting
How much it actually costs
Administrative fines run from AED 50,000 to AED 1,000,000 per violation, and the phrase "per violation" does the real damage here — a business found without a goAML registration, without CDD files and without a written risk assessment is not looking at one fine but at up to three, stacked from a single inspection. Serious breaches attract penalties up to AED 5,000,000, and repeated or wilful non-compliance escalates the response further still.
- AED 50,000 to AED 1,000,000 per violation, not per inspection visit.
- A single inspection can uncover several separate violations at once.
- Up to AED 5,000,000 for serious or repeated breaches.
- Non-registration on goAML is among the most heavily penalised standalone breaches.
- Weak or missing CDD files are one of the most common inspection findings.
Beyond the fine itself
A fine is rarely the only consequence. Failure to file a required Suspicious Transaction Report can carry criminal liability rather than a purely administrative penalty, and a serious or repeated AML finding can put a licence at risk and damage a firm's standing with banks, developers and other business partners who increasingly ask DNFBPs to evidence AML compliance before working with them.
- STR failures can be treated as a criminal offence, not just an administrative fine.
- A serious or repeated finding can put your trade licence at risk.
- Banks and larger counterparties increasingly ask DNFBPs to evidence AML compliance.
- Repeated breaches escalate the regulatory response, not just the fine amount.
- Inspections are becoming more frequent as the Ministry of Economy programme matures.
What a real inspection can cost
Take a two-partner Dubai accounting practice that never registered on goAML because it assumed it was "too small to matter." Obligations attach by activity, not size, so as independent accountants the practice was a DNFBP from the day its licence issued. In a Ministry of Economy sweep, missing registration, missing CDD files and no written AML programme are recorded as three separate violations — at AED 50,000 to AED 1,000,000 each, a first inspection can already exceed AED 150,000 before any suspicious-transaction failure, which carries criminal exposure, is even considered. The registration that would have avoided the first violation costs nothing but time.
- No goAML registration: a standalone violation from AED 50,000 upward.
- No CDD or KYC files: AED 50,000 to AED 1,000,000 on its own.
- No AML programme or risk assessment: a further AED 50,000 to AED 1,000,000.
- A missed STR sits on top of these as a potential criminal matter, not just a fine.
Building a file that survives inspection
Most DNFBP penalties trace back to gaps that are cheap to fix before an inspection and expensive to explain during one — a missing registration, a client file with no beneficial-owner check, or a risk assessment that was never actually written down. Exiloz builds and documents your AML programme so that when an inspector asks for the file, there is a complete one to show, rather than a registration number and not much else behind it.
- We check your registration, CDD files and risk assessment against what inspectors actually ask for.
- We close gaps before an inspection finds them, not after.
- We build a defensible STR process so suspicious activity is reported, not sat on.
- We keep your file current as your business and client base grow.
Related guides
Frequently Asked Questions
For understanding exactly what is at stake if your AML compliance has gaps.
How much are AML fines for DNFBPs?
Generally AED 50,000 to AED 1,000,000 per violation, with penalties up to AED 5,000,000 for serious breaches. Because fines are assessed per violation rather than per inspection, a single visit that finds several gaps at once — registration, CDD files, risk assessment — can produce several fines stacked together.
What is the most penalised breach?
Failure to register on goAML, weak or missing customer due diligence, and failure to file a required Suspicious Transaction Report are consistently the most heavily penalised findings. All three are also the easiest for an inspector to identify quickly, which is exactly why they come up first in most reviews.
Can AML breaches be criminal?
Yes. Failure to file a required STR can carry criminal liability rather than being treated as a purely administrative matter, because withholding a report about a suspected crime is a distinct offence from simply having a weak compliance programme. This is the one area where "just a fine" does not apply.
Are fines really stacked per violation?
Yes. A single inspection can record several separate violations — for example, no registration, no CDD files and no written programme — and each one is fined individually rather than treated as one combined issue. This is exactly why a first inspection on a genuinely non-compliant business can already run into six figures before any STR question arises.
Does being a small firm reduce the fine?
No. Fine ranges are set by the nature of the violation, not the size of the business committing it, so a sole practitioner faces the same AED 50,000 to AED 1,000,000 range as a larger firm for the same breach. Size affects how proportionate your programme needs to be, not how much a violation costs.
What happens on a repeat finding?
Repeated or wilful non-compliance escalates the regulatory response — penalties can move toward the higher end of the range or beyond it, and a pattern of findings raises the risk of licence-level consequences rather than a fine alone. A second inspection is generally treated far less sympathetically than a first.
Can Exiloz reduce our risk?
Yes. We review your registration, CDD files, risk assessment and STR process against what an inspector actually checks, close the gaps we find, and keep the file current so your compliance position holds up under scrutiny rather than only looking complete on paper.
Avoid AML penalties
Exiloz builds and documents AML compliance that closes the gaps inspectors actually look for, keeping you clear of the AED 50,000–1,000,000 per-violation fines.