AML/CFT obligations in the UAE apply to financial institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs). This includes sectors such as real estate, precious metals and stones, legal and accounting services, company service providers, and other regulated businesses that fall within the UAE’s AML framework.

A Risk-Based Approach means designing AML/CFT controls in proportion to the risks presented by your customers, products, services, geographies, and delivery channels. Rather than applying the same level of scrutiny to every relationship, businesses are expected to allocate stronger controls where the risk of money laundering or terrorist financing is higher. This is a core requirement under UAE AML law.

Money laundering is traditionally described in three stages: Placement, Layering, and Integration. Placement involves introducing illicit funds into the financial system, layering is the process of obscuring the origin of those funds through multiple transactions or structures, and integration is the stage at which the funds re-enter the economy appearing legitimate. In practice, modern typologies often blur or overlap these stages.

goAML is the UAE Financial Intelligence Unit’s reporting platform used for the submission of Suspicious Transaction Reports (STRs) and other required financial crime-related reports. Regulated entities subject to UAE AML obligations are generally required to register on the platform and use it for reporting in line with applicable legal and regulatory requirements.

Predicate crimes are the underlying criminal offences that generate proceeds which may then be laundered. These can include offences such as fraud, corruption, drug trafficking, tax evasion, human trafficking, bribery, and other crimes that produce illicit funds.

Enhanced Due Diligence (EDD) refers to additional checks and controls applied where a customer, transaction, or relationship presents a higher level of AML/CFT risk. This may include deeper scrutiny of politically exposed persons (PEPs), complex ownership structures, higher-risk jurisdictions, unusual transaction activity, or source of wealth and source of funds concerns.

As a general rule, AML/CFT records in the UAE must be retained for at least five years from the end of the business relationship or from the date of the transaction, depending on the nature of the record. In some cases, longer retention periods may apply depending on the sector, regulator, or specific legal requirement.

AML enforcement in the UAE is increasingly robust, with regulators taking a more active and visible approach to inspections, remediation, and penalties across financial institutions, DNFBPs, and other regulated entities. Recent enforcement actions and significant monetary penalties demonstrate that firms are expected to maintain effective AML controls, strong documentation, timely reporting, and a defensible risk-based compliance framework.