Does Your Business Have AML Obligations?

A bank asks for your goAML registration, or a client asks who your compliance officer is. Perhaps you run a property brokerage, a jewellery business, an accounting practice or a company formation service, and you are not sure the anti-money laundering rules reach you at all. The first question is not how to log in to goAML. It is whether your business carries out an activity that the regulations list.

The short answer: Cabinet Resolution No. (134) of 2025, the Executive Regulations of the 2025 anti-money laundering law, lists designated non-financial businesses and professions (DNFBPs) by activity, some with a value threshold. Article 18(1) of Federal Decree by Law No. (10) of 2025 states that DNFBPs with a suspicion "shall notify the Unit without delay and directly", "through the electronic system designated by the Unit or by any other approved means". The Ministry of Economy and Tourism (MoET) states on its goAML page: "All Designated Non-Financial Businesses and Professions (DNFBPs) were required to register on the goAML portal."

This article covers anti-money laundering duties only, as published on 20 September 2026. For tax duties, start with the overview of UAE corporate tax, and for tax registration itself see corporate tax registration in the UAE.

The rules in force, as read on 20 September 2026

Article 41(1) of the 2025 law states: "Federal Decree by Law No. (20) of 2018, referred to herein above, shall hereby be repealed."

Some official pages still refer to the older framework. MoET's goAML page, updated 19 September 2026, states: "Under Federal Decree Law No (20) of 2018 and Article 20(2) of Cabinet Decision No (10) of 2019, it is obligatory to have procedures in place to report suspicious transactions". MoET's registration guide defines regulated entities by "Article 3 in UAE Cabinet Decision 10 of 2019". The UAE Government Portal page on combating money laundering also cites the 2018 law. This article cites the 2025 instruments as current; where an older reference affects you, ask MoET which text it applies.

Who counts as a DNFBP, in the regulation's own words

The 2025 law defines DNFBPs in Article 1 as "Any person engaged in one or more of the commercial or professional activities or businesses, as specified in the Executive Regulations of this Federal Decree by Law." Article 3 of Cabinet Resolution No. (134) of 2025 then lists them, quoted here as the portal returned them on 20 September 2026.

• Gaming: "Commercial Gaming Operators, including Commercial Gaming conducted on board vessels or marine craft, when conducting a single financial transaction or several transactions that appear to be linked and whose value equals or exceeds eleven thousand dirhams (AED 11,000)."
• Real estate: "Real estate brokers and agents, when concluding transactions or settlements on behalf of their customers in relation to the purchase or sale of real estate."
• Precious metals and stones: "Dealers in valuable metals and precious stones, when carrying out any single cash transaction or several transactions that appear to be linked and whose value equals or exceeds fifty-five thousand dirhams (AED 55,000)."
• Legal and accounting professions: "Lawyers, notaries, other independent legal professionals, and independent accountants, whether practicing individually, as partners, or as professionals within a firm practicing such profession,"
• The item continues: "when they prepare, conduct, or execute financial transactions on behalf of their customers in relation to the following activities: a. Buying and selling real estate; b. Managing funds owned by the customer;"
• Then: "c. Managing bank accounts, savings accounts, or securities accounts; d. Organizing contributions for the establishment, operation, or management of Companies;"
• And: "e. Establishing, operating, managing legal persons or Legal Arrangements, or selling, or purchasing commercial entities."
• Company and trust services: "Company and Trust Service Providers, when carrying out or executing any transaction for the benefit of, or on behalf of, their customers in relation to the following activities:"
• The activities: "a. Acting as an agent in the incorporation or establishment of Legal Persons; b. Acting, or arranging for another person to act, as a director or secretary of a company, or as a partner or in a similar position in another Legal Person;"
• Then: "c. Providing a registered office, business address, place of residence, correspondence address, or administrative address for a company, any legal person, or a Legal Arrangement;"
• And: "d. Acting, or arranging for another person to act, as a Trustee of an express Trust or performing an equivalent function for another form of Legal Arrangement; e. Acting, or arranging for another person to act, as a Nominee Shareholder for another person."
• Others: "Any other businesses or professions may be determined by a resolution issued by the Supervisory Authority, in coordination with the National Committee."

Compare the licence with what the business actually does

Start with the licence's listed activities; see the types of UAE trade licence and how to verify a UAE trade licence. Then list the transactions the business actually carries out. Article 3 opens: "Designated Non-Financial Businesses and Professions (DNFBPs) shall include any person who carries out one or more of the following commercial or professional activities or businesses:" Invest in Dubai's activity search describes code 4690018, General Trading, as covering "importing, trading and re-exporting of any of the allowed goods". A company on a general trading licence can check whether its actual goods include valuable metals or precious stones.

Precious metals and stones: three official wordings

• Article 3 of Cabinet Resolution No. (134) of 2025 refers to "any single cash transaction or several transactions that appear to be linked" at or above AED 55,000.
• MoET's Supplemental Guidance for dealers (March 2026), listed on its AML page, states: "This obligation occurs where a DPMS carries out any single transaction, or series of transactions that appear to be related, whose monetary value equals or exceeds AED 55,000." The text returned did not include "cash".
• The UAE Financial Intelligence Unit's (FIU) "goAML Report Types" document (V1.2, 29 April 2024) sets report triggers for individuals "for cash equal to or more than AED 55,000" and for companies "whether in cash or through wire transfer".

We have not reconciled these wordings. A dealer should ask MoET which one applies to its transactions.

Legal professionals and gaming operators

MoET's goAML page and its DNFBP self-check page list four questions: "Are you a real estate firm?"; "Are you an auditing or accounting firm?"; "Are you a dealer of precious metals or stones?"; "Are you a trust or company service provider?". Legal professionals and commercial gaming operators, both in Article 3, are not in that list. We did not find a supervisor named for commercial gaming operators on the MoET, CBUAE and DFSA pages listed in the sources, or in the text of Cabinet Resolution No. (134) of 2025 returned, reviewed on 20 September 2026.

Which supervisor applies

The 2025 law defines the Supervisory Authority as "The federal and local authorities entrusted under the legislation with the supervision of the financial institutions, designated non-financial businesses and professions, virtual asset service providers, and non-profit organizations (NPOs)."

This article follows the federal framework. ADGM and DIFC rules were not reviewed in full. A firm licensed in a financial free zone should confirm its duties with its own regulator.

goAML: what registration involves

Article 18(1) of the 2025 law requires DNFBPs with a suspicion to "notify the Unit without delay and directly", "through the electronic system designated by the Unit or by any other approved means". We did not find the word "goAML" in the 2025 law or regulation text returned on 20 September 2026. The UAE Government Portal states: "All financial entities and Designated Non-Financial Businesses or Professions (DNFBPs) have to register on this system."

MoET's goAML page lists two steps: "01 Register in the protection system (SACM) of goAML portal and get a username. 02 Get the password from the Google Authenticator app and use it to access the goAML portal." It lists these requirements:

• "Authorisation letter from the institution you represent"
• "A copy of your passport, resident visa, and Emirates ID"
• "A copy of the commercial trade license (for companies)"
• "Download the 'Google Authenticator' application on your phone"

MoET's registration guide adds an "Authorisation letter from the entity appointing the Compliance Officer/Money Laundering Reporting Officer (MLRO)" and that officer's Emirates ID or passport. It states: "The above mentioned documents should be scanned as a single PDF document as the system allows only one (1) attachment." The attachment "should not exceed 5MB." Plan the compliance officer appointment first.

The FIU's FAQ page states that "The respective Supervisory Body/Regulator will be approving their regulated entities" registrations.

We did not find a registration deadline on MoET's goAML page, its AML page, its self-check page or the registration guide, or a registration fee on the goAML page or the guide, reviewed on 20 September 2026. The list annexed to Cabinet Resolution No. 71 of 2024 includes the violation "Failure of the facility to register at the electronic system approved at the Financial Information Unit."

Duties that continue after registration

Registration is one step. The continuing duties, with their wording and legal source, are in Part C of the practical asset below. Banks apply the same due diligence law to their own customers; see opening a UAE company bank account.

Reports filed through goAML

The FIU's "goAML Report Types" document says a reporting entity that suspects transactions "related to money laundering, fraud or terrorist financing" should "submit an STR to the FIU promptly". A suspicious activity report (SAR) covers "any activity or an attempted transaction (i.e. a non-executed transaction)". For real estate, its triggers include freehold sales or purchases "where the method of payment includes cash and the amount is AED 55,000 or more; be it in a single payment or multiple payments". Payment by virtual asset is a separate trigger.

The law's wording is "without delay", and Article 18(1) covers suspicions "regardless of their value". We could not confirm a filing period in days for suspicious transaction or activity reports from the FIU pages read on 20 September 2026; confirm any period with the FIU or your supervisor.

Targeted financial sanctions

Cabinet Resolution No. (74) of 2020, Article 15(1), states: "Any person; without delay and without prior notice; shall freeze funds under the Sanctions List and the Local Lists". Article 21(1) refers to registering "on the Office website with the aim of receiving notifications related to the new designation, re-designation as well as updating or de-listing notifications". The annex to Cabinet Resolution No. 71 of 2024 lists failure to register on the Executive Office website as a violation.

Penalties set by the 2025 law

Article 17(1) of Decree-Law No. (10) of 2025 lists penalties the Supervisory Authority may impose, starting with "a. Warning." and "b. An administrative fine of not less than ten thousand dirhams (AED 10,000) and not exceeding five million dirhams (AED 5,000,000) for each violation." Further measures run to "g. Revocation of the license." Article 17(3) allows "an incremental administrative fine" for the same violation repeated within one year. The Supervisory Authority decides whether a penalty applies.

The self-assessment framework and checklists

Practical asset: the DNFBP self-assessment framework, goAML preparation checklist and ongoing duties list. Work through Part A for each activity the business carries out, date your answers and take them to your supervisor or a qualified AML compliance professional. It does not decide your position. Part A. Decision framework (Cabinet Resolution No. (134) of 2025, Article 3) | Activity | Threshold or condition, as worded | Supervisor on the pages reviewed | Next step | |---|---|---|---| | Real estate brokers and agents | No value stated in the Article 3 item. "when concluding transactions or settlements on behalf of their customers" | MoET (mainland, commercial free zones). FSRA or DFSA in financial free zones. | Do we conclude such transactions? If yes, go to Part B. | | Dealers in valuable metals and precious stones | "any single cash transaction or several transactions that appear to be linked" at or above "(AED 55,000)" | MoET (state level, commercial free zones). | List sales at or above AED 55,000 by payment method. Ask MoET which wording applies. | | Lawyers, notaries, independent legal professionals | No value stated in the Article 3 item. Activities a to e | Not named on the pages reviewed on 20 September 2026. | Mark activities a to e. Ask the Ministry of Justice which supervisor applies. | | Independent accountants | No value stated in the Article 3 item. Activities a to e | MoET's self-check lists accounting firms. | Mark activities a to e. Confirm with MoET. | | Company and Trust Service Providers | No value stated in the Article 3 item. Activities a to e | MoET's self-check lists these providers. | Mark activities a to e. Confirm with MoET. | | Commercial Gaming Operators | "equals or exceeds eleven thousand dirhams (AED 11,000)" | Not named on the pages reviewed. | Ask the licensing authority which supervisor applies. | | Other businesses | "may be determined by a resolution issued by the Supervisory Authority" | Not stated in Article 3. | Check for later resolutions. | If no row applies, keep a dated note of the review and repeat it when the activities change. Part B. goAML registration preparation checklist (MoET goAML page and guide) 1. Trade licence copy. [ ] 2. Compliance officer appointed, with the authorisation letter "appointing the Compliance Officer/Money Laundering Reporting Officer (MLRO)". [ ] 3. Passport, resident visa and Emirates ID copies of the person registering (MoET page), and the compliance officer's Emirates ID or passport (guide). [ ] 4. All documents in one PDF of no more than 5MB. [ ] 5. Google Authenticator installed on the registering person's phone. [ ] 6. SACM registration and username, then entity registration on goAML. [ ] 7. Submission date and the supervisor's reply recorded. [ ] 8. Separate registration on the Executive Office website for sanctions notifications. [ ] Part C. Ongoing duties and their legal source 1. Risk assessment: "Identify, understand, manage, assess, document, and continuously update the risks of the Crime within their business scope..." (Decree-Law No. (10) of 2025, Art. 19(1)(a)). 2. Policies: "internal policies, controls, and procedures, approved by senior management" (Art. 19(1)(d)). 3. Due diligence: a business is "prohibited from establishing or continuing a Business Relationship or executing a Transaction where they are unable to apply Customer Due Diligence measures" (Cabinet Resolution No. (134) of 2025, Art. 14(1)). 4. Compliance officer "at management level", with duties including "Monitoring Transactions related to the Crime." (Art. 22(1)). 5. Suspicion reports to the FIU "without delay and directly" (Decree-Law No. (10) of 2025, Art. 18(1)). 6. Sanctions: "Implement forthwith the instructions issued by the Executive Office" (Art. 19(1)(e)). 7. Records for "not less than five (5) years" (Cabinet Resolution No. (134) of 2025, Art. 25(1)). 8. "An independent audit function to test the effectiveness and adequacy of internal anti-crime policies, controls, and procedures" (Art. 21(6)).

A worked example: a mainland company holds a licence for trading in jewellery. Its owner marks each sale of the last quarter at or above AED 55,000 as cash, card or bank transfer. The owner takes that list, with the three wordings quoted above, to MoET and to an AML compliance professional. The framework organises the question; the supervisor's reading answers it.

Who decides, what you prepare, what a provider can do

What the authority decides. The supervisor decides whether a goAML registration is approved, according to the FIU's FAQ, whether a business has met its duties and whether any penalty applies. The FIU receives the reports. No provider decides any of these.

What the business prepares. The Part A review, the Part B documents and the Part C policies, assessments and records.

What a provider can do. Within its licensed activity, a provider can help assemble registration documents and track correspondence. Article 3's item on Company and Trust Service Providers names activities including "Acting as an agent in the incorporation or establishment of Legal Persons". You can ask any provider how it meets its own duties. See how to choose a PRO services company in the UAE.

For how these rules apply to your business, consult a qualified AML compliance professional and your supervisor. This article describes published requirements and is not legal or compliance advice.

Last verified: 20 September 2026. Information verified against official sources on 20 September 2026.

If you are preparing documents for goAML registration, contact RINJAZ to confirm availability, scope and quotation. RINJAZ is a privately licensed UAE service provider. It is not a government entity and does not act for any authority.

A provider's role, within whatever its licensed activity covers, is to prepare documents, submit them through the correct channel and track progress. Your supervisor, such as MoET for DNFBPs at the state level and in commercial free zones, decides whether a goAML registration is approved, and no provider can promise the outcome.