Starting a business in the UAE involves more than obtaining a trade licence and opening a corporate bank account. Businesses operating in certain sectors must also understand and implement UAE AML and goAML requirements. This is particularly important for designated non-financial businesses and professions (DNFBPs), including real estate businesses, accounting and auditing firms, dealers in precious metals and stones, and trust or company service providers. The UAE Ministry of Economy & Tourism states that DNFBPs under its supervision must register on the goAML portal, which is used for submitting applicable suspicious transaction and activity reports. However, goAML registration is only one part of AML compliance. A compliant business also needs appropriate customer due diligence, beneficial-owner checks, risk assessment, record-keeping, internal controls, and reporting procedures.

What Are UAE AML and goAML Requirements?

UAE AML refers to the country’s Anti-Money Laundering framework and related measures that address terrorist and proliferation financing. Businesses within the regulated framework must establish controls that help identify, assess, and manage financial-crime risks. goAML is the electronic reporting system used by the UAE Financial Intelligence Unit (FIU) to receive and analyse suspicious transaction reports (STRs) and suspicious activity reports (SARs).

The important distinction is:

• AML compliance = the broader system of policies, procedures, and controls.
• goAML registration = registration on the relevant reporting platform.
• STR/SAR reporting = reporting suspicious transactions or activities when applicable.
• MLRO/Compliance Officer = the person responsible for key AML oversight and reporting functions.

Therefore, registering on goAML does not mean a business has completed all of its AML obligations.

Which UAE Businesses Must Follow AML and goAML Rules?

The first step for a new company is to determine whether its activity falls within the Designated Non-Financial Businesses and Professions (DNFBP) framework.

The Ministry’s current goAML guidance identifies several relevant categories.

Real Estate Brokers and Agents

Real estate businesses can face significant money-laundering risks because property transactions can involve substantial funds, complex ownership structures and multiple parties. Real estate brokers and agents should maintain appropriate customer and transaction records and follow applicable reporting requirements. The Ministry has also established specific reporting requirements for certain real estate transactions through goAML.

Dealers in Precious Metals and Stones

Gold, jewellery, diamonds, and other precious metals or stones can create higher financial-crime risks because of their value, portability, and potential use in complex transactions. Businesses in this sector should establish appropriate customer identification, risk assessment, record-keeping, and transaction monitoring procedures.

The Ministry identifies dealers in precious metals and precious stones as DNFBPs subject to AML/CFT obligations.

Accounting and Auditing Firms

Accounting and auditing professionals can encounter financial information, corporate structures, and transactions that require careful customer and beneficial-owner assessment. Businesses providing relevant accounting or auditing services should determine their regulatory status and implement the AML controls applicable to their activities.

Trust and Company Service Providers

Company formation and corporate administration businesses can face risks when creating or managing companies for third parties.

Relevant services can include:

• Company formation
• Business administration
• Corporate structuring
• Registered business address services
• Certain services involving legal persons

The Ministry’s goAML guidance specifically includes trust and company service providers among the DNFBP categories it asks businesses to assess.

Why New UAE Businesses Should Set Up AML Compliance Early

New businesses sometimes treat AML as something to address after they start receiving customers. That approach can create unnecessary compliance gaps. A better approach is to build AML controls into the business from the beginning.

Before onboarding customers, a relevant business should understand:

• Whether its activity falls within the DNFBP framework
• Which authority supervises the activity
• Who will manage AML responsibilities
• What customer information must be collected
• How customer risk will be assessed
• How suspicious activity will be escalated
• What records must be retained
• When reporting through goAML may be required

A business should also avoid treating AML as a one-time registration exercise. Effective compliance continues throughout the customer relationship.

goAML Registration Requirements in the UAE

For DNFBPs subject to Ministry of Economy & Tourism supervision, goAML registration is mandatory. The Ministry’s current page states that the portal is used for STR and SAR reporting and warns that failure to register may lead to penalties.

Documents Required for goAML Registration

The current Ministry guidance identifies information and documentation relating to the nominated Compliance Officer or MLRO and the business.

Common requirements include:

• Valid trade licence
• Authorisation letter appointing the nominated Compliance Officer/MLRO
• Passport copy
• UAE residence visa, where applicable
• Emirates ID, where applicable
• Valid email address
• Valid mobile number
• Google Authenticator for the access process

The Ministry’s technical instructions state that supporting documents should be prepared in a unified PDF and that the total attachment size must be below 5 MB.

How to Register on the goAML Portal

The process generally involves two main stages:

1. Register through the Services Access Control Manager (SACM).
2. Complete the entity registration on goAML.

The Ministry’s technical instructions state that businesses should register as a reporting organisation and select the appropriate supervisory body. They also note that accurate email and mobile information is important because OTPs and other registration communications are sent through these channels.

The Ministry currently states that goAML registration is free.

UAE AML Compliance Requirements Beyond goAML Registration

One of the most important points for new businesses is that goAML registration does not equal complete AML compliance.

A business needs a broader compliance framework.

Customer Due Diligence (CDD)

Customer due diligence helps a business understand who its customer is and whether the relationship presents financial-crime risks.

Depending on the applicable requirements, this can involve:

• Identifying the customer
• Verifying identity
• Understanding the customer’s business
• Understanding the purpose of the relationship
• Identifying beneficial owners
• Assessing customer risk
• Keeping information updated

Enhanced Due Diligence (EDD)

Higher-risk customers may require additional checks.

Potential risk indicators can include:

• Complex ownership structures
• High-risk jurisdictions
• Politically exposed person (PEP) exposure
• Unusual transaction activity
• Unclear source of funds
• Transactions inconsistent with the customer’s profile

EDD should be applied using a risk-based approach rather than automatically treating every customer as high risk.

Beneficial Owner Identification

A company should understand who ultimately owns or controls the customer where beneficial-ownership requirements apply.

This becomes particularly important when a business encounters:

• Multiple corporate shareholders
• Layered ownership
• Nominee arrangements
• Cross-border structures
• Unclear control relationships

A trade licence alone may not provide enough information to understand the full ownership and control structure.

AML Risk Assessment

A risk assessment allows a business to identify where its exposure to money laundering and related financial crimes may be greater.

Businesses can consider:

• Customer risk
• Geographic risk
• Product or service risk
• Transaction risk
• Delivery-channel risk
• Ownership and control risk

The UAE’s 2026 DNFBP guidance emphasizes a structured, risk-based approach to identifying, assessing and mitigating relevant risks.

Transaction Monitoring

Businesses should have procedures for identifying activity that does not make sense in light of the customer’s profile or expected business activity.

For example, a transaction may require additional review when its size, structure, frequency or parties appear inconsistent with what the business knows about the customer.

AML Record Keeping

Good AML compliance depends on good documentation. A business should maintain relevant customer, transaction, risk-assessment and compliance records for the period required by applicable UAE rules.

What Is an AML Risk-Based Approach in the UAE?

A risk-based approach means that a business does not apply exactly the same level of controls to every customer. Instead, it identifies relevant risks and applies controls proportionate to those risks.

Lower-Risk Customer Indicators

Examples may include:

• Transparent ownership
• Straightforward business activity
• Predictable transactions
• Clear commercial purpose

Higher-Risk Customer Indicators

Potential indicators can include:

• Complex or opaque ownership
• Unusual transaction patterns
• High-risk jurisdiction exposure
• PEP relationships
• Unexplained source of funds
• Transactions inconsistent with the customer’s stated business

A risk indicator does not automatically prove money laundering. It should prompt appropriate review based on the business’s AML procedures.

Suspicious Transaction Reporting Through goAML

One of the main reasons DNFBPs need access to goAML is to meet applicable suspicious transaction and activity reporting obligations.

What Is an STR?

An STR, or Suspicious Transaction Report, is a report concerning a transaction that raises relevant suspicion of money laundering, terrorist financing, or related financial crime.

What Is an SAR?

An SAR, or Suspicious Activity Report, relates to suspicious activity that may not be limited to a single transaction. The UAE FIU uses goAML to receive and analyse these reports.

When Should a Business Consider Reporting?

A business should follow its AML procedures when facts or circumstances create relevant grounds for suspicion. Importantly, the business does not need to independently prove that a criminal offence occurred before following applicable reporting procedures.

The 2026 DNFBP guidance provides detailed guidance on identifying and reporting suspicious activity.

Businesses should therefore avoid two opposite mistakes:

• Ignoring genuine warning signs
• Reporting activity mechanically without applying appropriate internal review

UAE AML Requirements by High-Risk Business Sector

Different sectors face different risk profiles, so AML controls should reflect the nature of the business.

AML Requirements for Real Estate Businesses in UAE

Real estate businesses should pay particular attention to:

• Customer identification
• Beneficial ownership
• Transaction information
• Source-of-funds considerations where applicable
• Risk assessment
• Record keeping
• Applicable goAML reporting

The Ministry has specifically required real estate brokers and agents to maintain transaction and identification information and has introduced reporting mechanisms for specified real estate activities.

AML Requirements for Gold and Jewellery Businesses

Dealers in precious metals and stones should consider:

• Customer identification
• Transaction monitoring
• Risk assessment
• Beneficial ownership where relevant
• Record keeping
• Enhanced controls for higher-risk situations

The sector is supervised within the UAE’s DNFBP AML/CFT framework.

AML Requirements for Accounting and Audit Firms

Accounting and auditing firms should establish appropriate processes for:

• Customer identification
• Beneficial-owner verification
• Customer risk assessment
• Understanding the purpose of the engagement
• Identifying unusual activity
• Escalating suspicious concerns
• Maintaining compliance records

AML Requirements for Company Formation Businesses

Company formation and corporate service providers should pay particular attention to ownership and control structures.

Relevant checks can include:

• Customer identity
• Beneficial ownership
• Business purpose
• Ownership structure
• Source-of-funds or wealth information where applicable
• Customer risk rating
• Ongoing monitoring

This is especially important when a client wants to create multiple entities or uses a complicated cross-border structure without a clear commercial explanation.

Role of an AML Compliance Officer or MLRO in UAE

The Money Laundering Reporting Officer (MLRO), often referred to within AML frameworks as a Compliance Officer, plays an important role in maintaining the business’s AML programme.

Responsibilities can include:

• Overseeing AML procedures
• Reviewing customer risks
• Managing internal escalations
• Supporting suspicious activity reporting
• Maintaining compliance documentation
• Coordinating AML training
• Monitoring regulatory requirements

The Ministry’s current registration instructions specifically require information about the nominated Compliance Officer/MLRO.

Does Every New UAE Business Need an MLRO?

Not every UAE business automatically has identical AML obligations. The requirement depends on the business activity, regulatory classification, and applicable supervisory framework. For a business that falls within the relevant DNFBP framework, however, it is important to determine the appropriate AML responsible person before starting the registration and compliance process.

AML Training for Employees

Employees who interact with customers or transactions should understand their AML responsibilities.

Training can cover:

• KYC procedures
• Customer risk indicators
• Suspicious activity red flags
• Escalation procedures
• Sanctions awareness
• Record keeping
• Internal AML policies

AML Red Flags New UAE Businesses Should Watch

New businesses should develop procedures for identifying warning signs rather than relying on a single transaction amount.

Potential red flags include:

• Unexplained source of funds
• Complex ownership without a clear commercial reason
• Unusual cash activity
• Transactions inconsistent with the customer’s profile
• Rapid or unusual movement of funds
• High-risk jurisdiction exposure
• Unusual use of virtual assets
• Reluctance to provide identification documents
• Unexplained third-party payments
• Unusual property transaction structures

A red flag is not proof of financial crime. It indicates that the business may need to conduct further review under its risk-based AML procedures.

UAE AML Penalties and Compliance Risks

AML non-compliance can expose a business to regulatory, financial and reputational consequences.

Potential compliance failures include:

• Failing to register where registration is mandatory
• Weak customer due diligence
• Inadequate beneficial-owner checks
• Poor record keeping
• Failure to maintain appropriate AML procedures
• Failure to meet applicable reporting obligations
• Inadequate risk assessment
• Weak AML governance

The Ministry provides an administrative penalty framework and AML-related enforcement services for businesses within its supervisory scope.

Because penalties and regulatory requirements can change, businesses should always check the latest official UAE requirements instead of relying on an old penalty figure from a third-party website.

UAE AML Compliance Checklist for New Businesses

A practical checklist can help new businesses avoid common gaps.

Before Starting Operations

• Confirm whether the business is a DNFBP
• Identify the relevant supervisory authority
• Conduct an AML risk assessment
• Appoint the responsible AML officer
• Prepare AML policies
• Establish customer due diligence procedures
• Determine beneficial-owner procedures
• Review reporting requirements

Before Customer Onboarding

• Identify the customer
• Verify customer information
• Identify beneficial owners where applicable
• Understand the business relationship
• Assess customer risk
• Review relevant sanctions and PEP risks
• Collect required supporting documents

During Business Operations

• Monitor relevant transactions
• Update customer information
• Reassess higher-risk relationships
• Document unusual activity
• Escalate concerns internally
• File applicable reports through goAML
• Maintain required records
• Provide employee training
• Review AML controls periodically

UAE AML Compliance Example for a New Business

Consider a newly established Dubai real estate brokerage.

The brokerage receives a proposed property transaction involving a corporate buyer with a complicated ownership structure and an unusual payment arrangement.

Instead of simply accepting the transaction, the business should follow its AML procedures.

The process could involve:

1. Identifying and verifying the relevant parties.
2. Understanding the corporate ownership structure.
3. Identifying the beneficial owner where required.
4. Understanding the nature and purpose of the transaction.
5. Assessing the customer’s and transaction’s risk.
6. Applying enhanced controls if the risk assessment requires them.
7. Documenting the review and decision.
8. Determining whether applicable reporting obligations arise.
9. Using goAML if a report is required.

This example demonstrates why goAML registration is only one component of UAE AML compliance.

Common UAE AML and goAML Mistakes to Avoid

New businesses should avoid these common mistakes:

• Assuming goAML registration completes AML compliance
• Copying generic AML policies without adapting them
• Failing to identify beneficial owners
• Not updating customer information
• Ignoring risk assessments
• Failing to document compliance decisions
• Delaying mandatory registration
• Not training employees
• Treating AML as only an accountant’s responsibility
• Ignoring unusual customer behaviour
• Assuming suspicious activity must be proven before internal escalation

How to Stay AML-Compliant as Your UAE Business Grows

AML compliance should evolve as the business grows.

A company should periodically review whether its:

• Customers have changed
• Services have changed
• Geographic exposure has changed
• Ownership structures have changed
• Transaction patterns have changed
• AML risks have increased
• Internal controls remain effective

The UAE Ministry’s 2026 DNFBP guidance is designed to help supervised DNFBPs strengthen compliance programmes, governance, reporting and risk management.

Businesses should also monitor official regulatory updates rather than relying exclusively on older articles or templates.

How Ripple Business Setup Can Help With UAE AML Compliance

New UAE businesses often need help understanding where AML and goAML requirements fit into the wider company setup and compliance process. Ripple Business Setup can assist businesses with business setup and related compliance support, including guidance around accounting, bookkeeping, VAT, Corporate Tax and AML-related requirements. The right approach depends on the business activity, licence, regulatory classification, and applicable supervisory authority. Rather than assuming every company has the same obligations, businesses should first determine which requirements apply to their specific activities.

If you are setting up a UAE business in real estate, accounting, auditing, precious metals, corporate services or another potentially regulated sector, professional guidance can help you identify the relevant compliance steps before operations begin.

• +971 50 593 8101
• info@ripplellc.ae

FAQ

What is goAML in the UAE?

goAML is the electronic reporting system used by the UAE Financial Intelligence Unit to receive and analyse suspicious transaction and activity reports. Relevant DNFBPs must register where registration requirements apply.

Who needs goAML registration in the UAE?

Relevant DNFBPs under the applicable supervisory framework must register on goAML. The Ministry’s guidance specifically covers sectors such as real estate, accounting and auditing, precious metals and stones, and trust or company service providers.

Is goAML registration mandatory for DNFBPs?

Yes. The UAE Ministry of Economy & Tourism states that registration on the goAML portal is mandatory for DNFBPs within its supervisory scope.

What documents are required for goAML registration?

Requirements include information and documents relating to the nominated Compliance Officer/MLRO, the business trade licence and identification documents. The Ministry also provides specific technical instructions for preparing and submitting the documents.

Is goAML registration free in the UAE?

The Ministry’s current technical instructions state that registration on the goAML platform is free.

What is the difference between AML and goAML?

AML refers to the broader compliance framework used to prevent and detect money laundering and related financial crimes. goAML is the reporting platform used by the FIU for applicable suspicious transaction and activity reports.

Does a new UAE business need an AML policy?

If the business falls within the applicable AML framework, it should establish the required policies, procedures and controls. The exact requirements depend on the activity and regulatory classification.

What is an MLRO in the UAE?

An MLRO, or Money Laundering Reporting Officer, is the person responsible for important AML oversight and reporting functions within a relevant business.

What is an STR in UAE AML compliance?

An STR is a Suspicious Transaction Report. It is used to report applicable suspicious transactions to the relevant authorities through the prescribed reporting system.

What is enhanced due diligence in AML?

Enhanced due diligence involves applying additional customer or transaction checks when the risk assessment identifies higher financial-crime risk.

What are the AML penalties in the UAE?

AML violations can result in administrative and other regulatory consequences. The applicable penalty depends on the violation and regulatory framework, so businesses should consult current official UAE guidance rather than relying on outdated penalty figures.

Do free zone businesses have AML obligations?

A free-zone licence does not automatically mean that AML obligations disappear. The applicable requirements depend on the activity, regulatory framework and supervisory authority. Businesses should determine their specific classification before assuming they are outside the AML framework.

How often should AML procedures be reviewed?

Businesses should review AML controls periodically and whenever there are significant changes to customers, services, ownership, geographic exposure, transaction patterns or regulatory requirements.

Conclusion

UAE AML and goAML requirements are not limited to registering a business on an online portal. New businesses in high-risk sectors need a wider framework covering customer due diligence, beneficial ownership, risk assessment, monitoring, record-keeping, and applicable reporting. For DNFBPs, establishing these controls early can reduce compliance gaps as the business grows. Because UAE AML requirements continue to develop, businesses should verify their obligations against current official guidance and their specific supervisory framework before relying on a generic checklist.

Disclaimer: This article provides general information and is not legal or regulatory advice. AML obligations can vary by business activity and supervisory authority; confirm the current requirements with the relevant UAE authority or qualified professional.