AML & KYC Compliance for UAE Businesses: What You Need to Know in 2026

A practical guide to Anti-Money Laundering and Know Your Customer obligations for UAE companies.

Why AML/KYC Matters in the UAE

The UAE has significantly strengthened its Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) framework following its inclusion on the FATF grey list in 2022. After successfully addressing all action items, the UAE was removed from the grey list, but the enhanced compliance standards remain.

Every UAE business, from free zone startups to mainland corporations, has obligations under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations.

Who Must Comply?

Designated Non-Financial Businesses and Professions (DNFBPs)

Other Businesses

Key AML/KYC Obligations

1. Customer Due Diligence (CDD)

2. Know Your Customer (KYC)

For individuals:

• Valid passport or Emirates ID
• Proof of address
• Source of funds declaration
• Screening against sanctions lists (UN, OFAC, UAE local)

• Trade license and registration documents
• Memorandum/Articles of Association
• Identification of Ultimate Beneficial Owners (UBOs)
• Board resolution or Power of Attorney
• Source of funds and nature of business

3. Ultimate Beneficial Owner (UBO) Identification

• Identify all individuals who own or control 25%+ of the entity
• If no individual meets the threshold, identify the senior managing official
• Maintain a UBO register and update it annually
• Report UBO information to the relevant authority

goAML Registration

goAML is the UAE Financial Intelligence Unit's (FIU) reporting platform. Registration is mandatory for all DNFBPs:

Who Must Register

• All businesses classified as DNFBPs
• VASPs licensed by VARA, DFSA, or FSRA
• Banks and financial institutions (handled via Central Bank)

How to Register

1. Visit the goAML portal (goaml.uaefiu.gov.ae)
2. Submit entity details and compliance officer information
3. Obtain login credentials
4. File Suspicious Transaction Reports (STRs) when required

Suspicious Transaction Reporting (STR)

You must file an STR with the FIU if you suspect or have reasonable grounds to suspect that:

• A transaction involves proceeds of crime
• Funds are related to terrorism financing
• A customer is trying to launder money
• There are unusual patterns inconsistent with the customer's profile

What Triggers an STR?

• Unusually large cash transactions
• Complex transactions with no apparent economic purpose
• Customers unwilling to provide identification
• Transactions involving sanctioned individuals or countries
• Unusual urgency or secrecy around a transaction
• Inconsistencies in customer documentation

STR Filing Process

• File via goAML within reasonable time of suspicion
• Include all relevant transaction details and supporting documents
• Do NOT tip off the customer (tipping off is a criminal offense)
• Maintain confidentiality of the STR filing

AML Compliance Program

Every DNFBP must establish an AML compliance program that includes:

1. AML Policy Manual

• Documented AML/CTF policies and procedures
• Board-approved and regularly updated
• Covers customer onboarding, monitoring, and reporting

2. Compliance Officer

• Appoint a qualified AML Compliance Officer
• Must be senior enough to have authority
• Responsible for STR filing, training, and regulatory liaison

3. Employee Training

• Annual AML awareness training for all staff
• Specialized training for front-line and compliance staff
• Training records must be maintained

4. Record Keeping

• Maintain all CDD and transaction records for minimum 5 years
• Records must be available to regulators upon request
• Digital storage is acceptable with proper security

5. Risk Assessment

• Conduct a business-wide risk assessment annually
• Identify money laundering and terrorism financing risks
• Implement controls proportionate to identified risks

Penalties for Non-Compliance

Recent Regulatory Changes (2026)

Enhanced UBO Requirements

• All UAE companies must now maintain a UBO register
• Free zones require UBO disclosure at registration and annually
• Penalties for non-disclosure significantly increased

VARA AML Standards

• VASPs must implement Travel Rule compliance
• Enhanced transaction monitoring for virtual asset transfers
• Regular independent AML audits required

Corporate Tax Integration

• AML compliance records support corporate tax audits
• Transfer pricing documentation aligns with CDD requirements
• Penalties compound; AML violations can trigger tax investigations

How Two Pillars Advisory Can Help

• AML Risk Assessment: Business-wide risk evaluation
• Policy Development: Customized AML/KYC policy manuals
• goAML Registration: Setup and configuration support
• Training Programs: Staff AML awareness training
• Compliance Officer Support: Outsourced compliance officer services
• Ongoing Monitoring: Regular compliance health checks

Important Disclaimer

Two Pillars Advisory FZCO is an independent corporate services consultancy. AML/KYC compliance involves complex legal obligations. Always consult qualified legal counsel for your specific situation. Non-compliance can result in severe criminal and administrative penalties. This article is for informational purposes only and does not constitute legal advice.

Need help with your AML compliance? Contact Two Pillars Advisory for a free assessment.