UAE anti-money laundering legislation extends beyond banks and financial institutions. Federal Decree-Law No. 20 of 2018 and its Executive Regulations designate specific non-financial businesses and professions as subject to the same AML compliance obligations as regulated financial entities. Accountants, audit firms, and advisers serving small and medium enterprises are within this framework, and many businesses in those sectors remain unaware of the specific obligations they carry.
Who Is a Designated Non-Financial Business or Profession
The UAE AML Law designates several categories of non-financial businesses and professions (DNFBPs) as subject to full AML compliance requirements. Those most directly relevant to the accounting and advisory sector include:
External auditors and independent accountants. Any auditor or accountant providing external audit or accounting services to clients in the UAE is classified as a DNFBP and is required to meet all AML obligations applicable to that designation.
Company formation agents and corporate service providers. Firms that form companies, provide registered office services, act as nominee directors or shareholders, or manage the corporate affairs of clients on an ongoing basis.
Legal professionals. Lawyers, notaries, and legal practitioners who carry out specific types of transactions on behalf of clients, including managing client funds, forming companies, or transferring real property.
Real estate agents. Those assisting clients in buying, selling, or renting property in the UAE.
Dealers in precious metals and stones. Any business transacting in precious metals or gems in amounts exceeding AED 55,000 in a single transaction or related transactions.
Core Compliance Obligations in Practice
Registration on goAML. All DNFBPs must register with the UAE Financial Intelligence Unit via the goAML platform. This is a legal obligation, not an optional step. The penalty for failure to register applies independently of whether any suspicious activity is ever detected.
Risk assessment. You must document an assessment of the money laundering and terrorist financing risks your business faces. This involves identifying the types of clients you serve, the jurisdictions they come from, the transactions you conduct, and the delivery channels you use, and assessing each for risk level. The assessment must be reviewed and updated regularly.
Customer due diligence. Before accepting a new client or entering a transaction, you must identify the client, verify their identity using reliable documentation, and understand the nature and purpose of the business relationship. For corporate clients, CDD extends to identifying the ultimate beneficial owner: the natural person who ultimately owns or controls the entity. For higher-risk clients, enhanced due diligence requires additional steps beyond standard verification.
Ongoing monitoring. CDD is not performed once and then archived. You must monitor existing client relationships for changes in circumstances or patterns of behaviour that indicate elevated risk, and update records when material changes occur.
Suspicious transaction reporting. If, in the course of your work, you identify a transaction or attempted transaction that gives reasonable grounds to suspect it involves proceeds of crime or is connected to money laundering or terrorist financing, you are required to file a suspicious transaction report (STR) through goAML. This obligation applies whether or not the transaction was completed. Filing an STR does not require certainty: the threshold is reasonable suspicion.
Consequences of Non-Compliance
Administrative penalties apply for failure to register on goAML, failure to maintain required records, failure to conduct customer due diligence, and failure to report suspicious transactions. Criminal liability attaches to active participation in or facilitation of money laundering.
The UAE was placed on the FATF grey list in 2022 and made significant legislative and enforcement changes to achieve removal. The period of heightened compliance scrutiny that followed increased enforcement activity across the DNFBP sector and this focus has remained. Regulators have made clear that DNFBP compliance is a continuing priority, not a historical exercise.