UAE AML & KYC Compliance Programs

Every UAE business classed as a Designated Non-Financial Business or Profession (DNFBP) under Federal Decree-Law No. 10 of 2025 must run a written AML/CFT program. It includes customer due diligence (CDD) and enhanced due diligence (EDD) procedures, screening against UN, EU, and UAE sanctions lists, suspicious transaction reports to the FIU via goAML, and an annual risk assessment. Financial institutions additionally need a CBUAE licence. We build the program around your profile.

AML/CFT oversight in the UAE is split across regulators: the Central Bank (CBUAE) covers banks and payment services, the SCA covers investment firms, VARA covers virtual asset providers, and the Ministry of Economy covers DNFBPs (real estate, gold, precious metals, lawyers, accountants). Every Suspicious Transaction Report (STR) goes to the Financial Intelligence Unit (FIU) at the Ministry of Finance via the goAML system. We hold the regulator map for you.

The DFSA (Dubai Financial Services Authority) regulates financial services inside the DIFC — banking, insurance, capital markets, fund management. VARA (Virtual Assets Regulatory Authority), established in 2022, holds mandatory jurisdiction over all virtual asset activity in Dubai except the DIFC. The DFSA runs its own crypto framework for DIFC firms; VARA covers the rest of Dubai and every emirate except Abu Dhabi, where ADGM/FSRA applies. We set the licence perimeter up front.

Yes, for regulated entities. Banks, insurers, payment institutions, and DNFBPs with annual revenue above AED 1 million must appoint a Compliance Officer / MLRO. For VARA-licensed VASPs, an MLRO is mandatory and must be a UAE resident. They file STRs via goAML, maintain AML policies, and train staff. INNOVA provides outsourced MLRO services for qualifying UAE companies.

Administrative penalties under Federal Decree-Law No. 10 of 2025 — in force since 14 October 2025, replacing Decree-Law No. 20 of 2018 — run from AED 10,000 to AED 5,000,000 per violation. Money laundering carries up to 10 years' imprisonment for individuals and fines up to AED 100,000,000 for legal entities. The UAE's exit from the FATF "grey list" in 2024 locked compliance in as a priority. The Ministry of Economy inspects DNFBPs every year and fines on the spot for missing AML policies.