Get Response within 60 Seconds.
Share a few details and get an instant response — one of our setup advisors will follow up with your personalized breakdown right away
In the first half of 2025 alone, the UAE Ministry of Economy and Tourism uncovered 1,063 AML compliance violations across the non-financial sector and issued fines exceeding AED 42 million — real estate brokerages and precious-metals dealers accounted for more than AED 38 million of that total between them. That enforcement wave landed just before the UAE replaced its entire anti-money laundering law. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, and its Executive Regulations, Cabinet Resolution No. 134 of 2025, followed on 14 December 2025 — together repealing the 2018/2019 framework that most existing guidance online is still describing.
If your business touches real estate, precious metals, legal services, accountancy, corporate structuring, or commercial gaming in the UAE, you are almost certainly a Designated Non-Financial Business or Profession (DNFBP) under this new law — whether or not anyone has told you so. This guide explains, in plain terms and against the current 2025/2026 legal framework, who counts as a DNFBP, what you are legally required to do, who supervises you, what non-compliance actually costs, and exactly how to close the gap.
What Is a DNFBP?
A Designated Non-Financial Business or Profession (DNFBP) is a business or licensed profession that is not a bank or financial institution, but which regulators have identified as vulnerable to being used — knowingly or unknowingly — as a channel for money laundering, terrorist financing, or proliferation financing (ML/TF/PF). These businesses often handle large-value transactions, hold or move client funds, or help structure legal entities, which makes them attractive to criminals seeking to convert illicit cash into legitimate-looking assets.
In the UAE, DNFBPs sit inside the same AML/CFT/CPF legal perimeter as banks, exchange houses, and virtual asset service providers (VASPs). The categories of DNFBP are set out in Article 3 of Cabinet Resolution No. (134) of 2025, and their core legal obligations appear in Article 19 of Federal Decree-Law No. (10) of 2025.
Who Qualifies as a DNFBP in the UAE? (6 Categories)
Article 3 of Cabinet Resolution No. 134 of 2025 sets out six categories of DNFBP. Several carry an explicit monetary threshold that triggers the obligation — below that threshold, AML/CFT duties for that specific transaction type do not apply, though registration and governance obligations generally still do once a business falls within a category.
| Category | Triggering Activity | Threshold | Supervisor |
|---|---|---|---|
| Real estate brokers & agents | Concluding a sale, purchase, or related transaction on behalf of a customer | No set minimum — applies to the transaction itself | MoET |
| Dealers in Precious Metals & Stones (DPMS) | Any single cash transaction, or linked transactions, involving precious metals or stones | AED 55,000 or more | MoET |
| Lawyers, notaries & independent legal professionals | Specified activities: property transactions, managing client funds/assets, company formation or management, buying/selling business entities | As specified per activity | MoJ |
| Independent accountants & auditors | Specified financial or transactional activities carried out for a client | As specified per activity | MoET |
| Company & Trust Service Providers (TCSPs) | Forming legal persons; acting as/arranging director, secretary, nominee shareholder; providing a registered office or correspondence address | N/A — activity-based | MoET |
| Commercial gaming operators | Single or linked financial transactions connected to gaming, including on vessels/marine craft (chips-only transactions excluded) | AED 11,000 or more | GCGRA |
Article 3(6) also gives the Cabinet a standing power to designate any other business or profession as a DNFBP by resolution — the category list is not permanently fixed.
Commercial gaming operators are the newest addition to this list. Before Cabinet Resolution No. 134 of 2025, gaming was outside the DNFBP perimeter; it was brought in alongside the creation of the General Commercial Gaming Regulatory Authority (GCGRA) in 2023.
The UAE AML Legal Framework for DNFBPs in 2026
DNFBP obligations are not contained in a single document. The framework is layered: one federal law sets the legal duty, one Cabinet Resolution operationalises it, and a stack of sector guidance from the supervisory authorities fills in the practical detail.
| Instrument | In Force / Issued | What It Does |
|---|---|---|
| Federal Decree-Law No. (10) of 2025 | 14 October 2025 | Primary AML/CFT/CPF law; repeals the 2018 law; adds Proliferation Financing as a standalone offence; removes any statute of limitations on ML prosecutions |
| Cabinet Resolution No. (134) of 2025 | 14 December 2025 | Executive Regulations; repeals Cabinet Resolution No. 10 of 2019; defines the 6 DNFBP categories, thresholds, and operational detail |
| Cabinet Decision No. (74) of 2020 | In force (TFS procedures) | Targeted Financial Sanctions regime; UN and local terrorist list screening and freezing obligations |
| Cabinet Decision No. (109) of 2023 | In force | Regulates Beneficial Ownership procedures |
| Cabinet Resolution No. (132) of 2023 | In force | Administrative penalties for Beneficial Ownership violations |
| Cabinet Resolution No. (71) of 2024 | In force | Regulates violations and administrative penalties for MoJ- and MoET-supervised entities |
| MoET AML/CFT Guidelines for DNFBPs (Revised) | September 2025 | Sector-wide playbook: governance, CDD, STR, and recordkeeping expectations |
| MoET Implementation Guide on Customer Risk Assessment (CRA) | November 2024 | Step-by-step methodology for scoring customer risk |
| MoET Implementation Guide on CDD | December 2024 | Step-by-step due diligence methodology |
| UAE National Risk Assessment (NRA) 2024 | 2024 | Sector-by-sector ML/TF/PF risk findings that every DNFBP must build into its own risk assessment |
What Actually Changed from the Old 2018/2019 Regime
- Proliferation Financing (PF) is now an explicit, standalone criminal offence — not folded into terrorist financing.
- Commercial gaming operators are newly captured as a DNFBP category.
- Virtual Asset Service Providers (VASPs) are now directly and explicitly regulated within the same law, with stricter licensing and transfer-tracing requirements.
- The minimum administrative fine dropped from AED 50,000 to AED 10,000 — counter-intuitively, this makes smaller, more frequent enforcement actions more likely, not less.
- The UAE Financial Intelligence Unit (FIU) gained expanded freezing and suspension powers.
- There is now no statute of limitations on money laundering prosecutions — conduct from years ago remains prosecutable today.
- Supervisors are shifting focus from “do policies exist on paper” to “do controls demonstrably work in practice,” with more emphasis on evidence, testing, and remediation trails during inspections.
Who Supervises Your DNFBP?
| Regime | Supervisory Authority | Applies To |
|---|---|---|
| UAE Mainland & commercial free zones | Ministry of Economy and Tourism (MoET) | Real estate, DPMS, accountants & auditors, TCSPs |
| UAE Mainland & commercial free zones | Ministry of Justice (MoJ) | Lawyers, notaries, independent legal professionals |
| UAE Mainland | General Commercial Gaming Regulatory Authority (GCGRA) | Commercial gaming operators |
| Dubai International Financial Centre (DIFC) | Dubai Financial Services Authority (DFSA) | DNFBPs registered/licensed within the DIFC |
| Abu Dhabi Global Market (ADGM) | Financial Services Regulatory Authority (FSRA) | DNFBPs registered/licensed within the ADGM |
Free zone registration is not an AML exemption. Businesses licensed in the DIFC or ADGM still sit within the same underlying federal AML/CFT/CPF perimeter — they are simply directly supervised by the DFSA or FSRA rather than MoET or MoJ, and each maintains its own detailed rulebook layered on top of the federal law.
The 8 Core AML/CFT Compliance Obligations for DNFBPs
Regardless of category, every DNFBP is expected to build a defensible, risk-based control framework around eight pillars. Supervisory inspections are increasingly structured around testing exactly these eight areas.
1. Enterprise-Wide Risk Assessment (EWRA)
Identify and score your ML/TF/PF exposure across customers, products, delivery channels, and geographies — explicitly linked to the findings of the UAE National Risk Assessment 2024, not written as a generic template.
2. AML/CFT Policies, Controls & Procedures
A board-approved policy translated into working procedures: who does what, at what threshold, and with what escalation path — referencing Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 directly.
3. Appointment of a Compliance Officer (and Alternate)
A named, fit-and-proper Compliance Officer (often also the MLRO) with real authority to approve, delay, or decline a business relationship, plus a designated alternate for continuity.
4. Customer Due Diligence (CDD) & Enhanced Due Diligence (EDD)
Identity verification, beneficial ownership tracing, source-of-funds checks, and Politically Exposed Person (PEP) screening before onboarding — escalating to EDD for higher-risk customers, including other DNFBPs acting as your counterparty.
5. Ongoing Transaction Monitoring
Recognising red flags and known typologies in customer behaviour over time, not just at onboarding — and documenting why an alert was cleared or escalated.
6. Suspicious Transaction Reporting (STR/SAR)
Filing through the FIU’s goAML portal, with no minimum value threshold and no delay for internal sign-off politics. “Tipping off” a customer that a report has been filed is a separate offence in itself.
7. Targeted Financial Sanctions (TFS) Screening
Screening customers and counterparties against the UNSC Consolidated List and the UAE’s local terrorist list, and freezing assets without delay on a confirmed match, per instructions from the Executive Office for Control and Non-Proliferation (EOCN).
8. Record-Keeping & Staff Training
Retaining CDD files, transaction records, and STR documentation for a minimum of five years, plus mandatory, role-specific AML/CFT training — including Know-Your-Employee (KYE) screening at recruitment — refreshed at least annually.
Sector Risk Profile: What the National Risk Assessment 2024 Found
The UAE’s 2024 National Risk Assessment scores each DNFBP sector for residual money-laundering risk. Every DNFBP is expected to reflect these sector-level findings inside its own enterprise-wide risk assessment — supervisors will ask to see that link explicitly.
| Sector | NRA 2024 Residual ML Risk Rating |
|---|---|
| Real estate | High |
| Dealers in Precious Metals & Stones (DPMS) | Medium-High |
| Company & Trust Service Providers (TCSPs) | Medium |
| Accounting & audit | Medium-Low |
| Legal professionals | Medium-Low |
| Commercial gaming | Newly regulated — treated as elevated risk given cash intensity |
Penalties for Non-Compliance
Federal Decree-Law No. 10 of 2025 widened both the enforcement toolkit and the range of exposure. The floor for administrative fines actually dropped — which, combined with more active supervision, means more DNFBPs are being fined more often, even for procedural gaps rather than proven laundering.
| Violation | Legal Basis | Penalty |
|---|---|---|
| General administrative violation (per breach) | Article 17, FDL 10/2025 | AED 10,000 – AED 5,000,000 per violation, plus possible suspension or revocation of licence |
| Operating as a DNFBP without licence/registration/enrolment | Articles 20 & 32, FDL 10/2025 | Imprisonment plus AED 200,000 – AED 10,000,000 |
| Legal person convicted of ML, TF or PF | Article 27, FDL 10/2025 | AED 5,000,000 – AED 100,000,000, plus potential dissolution and closure of premises |
| Natural person convicted of ML, TF or PF | FDL 10/2025 | Imprisonment plus substantial fines |
| Any ML offence | Article 37(2), FDL 10/2025 | No statute of limitations — remains prosecutable indefinitely |
Enforcement in Numbers (H1 2025)
| Metric | Figure |
|---|---|
| Total DNFBP violations identified by MoET, H1 2025 | 1,063 |
| Total fines imposed by MoET, H1 2025 | AED 42 million+ |
| Real estate brokerage violations / fines | 495 violations — AED 18.5 million |
| Precious metals & gemstone trader violations / fines | 473 violations — AED 20 million |
| Cumulative MoET fines on DNFBPs since late 2022 | AED 130 million+ |
Enforcement is accelerating ahead of the UAE’s upcoming 2026 FATF mutual evaluation — the UAE was removed from the FATF grey list in February 2024, and regulators have a strong incentive to demonstrate sustained, real-world enforcement rather than paper compliance in the run-up to that review.
Mainland vs DIFC vs ADGM: A Different Rulebook in the Free Zones
DNFBPs licensed inside the DIFC follow the DFSA Rulebook’s own AML Module, which defines DNFBPs slightly differently — notably including Single Family Offices, and describing Company Service Providers with more granular, activity-based language than the federal law. ADGM entities sit under the equivalent FSRA framework. Both financial free zones layer their own detailed rules on top of — not instead of — the federal AML/CFT/CPF perimeter.
One frequently missed compliance gap: a group with a mainland brokerage and a DIFC-registered advisory arm needs two aligned but distinct compliance programmes, each mapped to its own supervisor (MoET/MoJ vs. DFSA), not one shared policy document with the wrong regulator’s name find-and-replaced in.
Step-by-Step DNFBP Compliance Checklist for 2026
- Confirm your DNFBP category and identify the correct supervisory authority (MoET, MoJ, GCGRA, DFSA, or FSRA).
- Register — or update an existing registration — on the FIU’s goAML platform.
- Conduct or refresh your Enterprise-Wide Risk Assessment, explicitly mapped to the NRA 2024 sector findings and to Federal Decree-Law No. 10 of 2025.
- Appoint (or reconfirm) a fit-and-proper Compliance Officer and an alternate, with documented authority to block a transaction.
- Rewrite AML/CFT policies and procedures to cite Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 directly — not the repealed 2018/2019 instruments.
- Update CDD/EDD workflows: identity verification, beneficial ownership tracing, source-of-funds checks, PEP and sanctions screening.
- Embed Targeted Financial Sanctions screening with same-day freezing capability against the UNSC and UAE local terrorist lists.
- Refresh red-flag and typology training across the business and keep dated attendance records.
- Walk-test your STR/SAR escalation pathway end-to-end through goAML, including the tipping-off safeguards.
- Confirm your record-retention systems meet the five-year minimum and can produce a complete file on demand.
- Commission an independent AML audit or structured self-assessment before your next scheduled inspection.
Common Compliance Gaps Regulators Keep Finding
- Policy-heavy, execution-light frameworks — a well-written policy with no evidence it is actually followed.
- Generic customer risk scoring that isn’t calibrated to sector-specific reality (e.g., treating a high-value off-plan property deal the same as a routine rental).
- No documented link between the National Risk Assessment findings and the firm’s own risk model.
- Weak or incomplete beneficial ownership verification, especially through layered corporate structures.
- Late, defensive, or internally-blocked STR filing — waiting for “certainty” instead of reporting on reasonable suspicion.
- Assuming free zone licensing status equals an AML exemption — it does not.
- Treating AML training as a one-time onboarding checkbox rather than an annually refreshed, role-specific programme.
Frequently Asked Questions
What does DNFBP stand for?
Designated Non-Financial Business or Profession — a business or licensed profession outside the financial sector that UAE law identifies as vulnerable to money laundering, terrorist financing, or proliferation financing, and therefore subjects to AML/CFT compliance obligations.
Which businesses count as DNFBPs in the UAE?
Real estate brokers and agents, dealers in precious metals and stones, lawyers and notaries, independent accountants and auditors, company and trust service providers, and commercial gaming operators, as defined in Article 3 of Cabinet Resolution No. 134 of 2025.
What is the current UAE AML law for DNFBPs?
Federal Decree-Law No. 10 of 2025 (in force since 14 October 2025) is the primary legislation, supported by its Executive Regulations, Cabinet Resolution No. 134 of 2025 (in force since 14 December 2025). Together they repealed the 2018 AML law and its 2019 executive regulations.
Are law firms considered DNFBPs in the UAE?
Yes. Lawyers, notaries, and other independent legal professionals are a designated DNFBP category, supervised by the Ministry of Justice rather than MoET, when they carry out specified activities such as property transactions, managing client funds, or company formation.
What is the AED 55,000 threshold about?
It is the cash-transaction threshold that brings a Dealer in Precious Metals and Stones (DPMS) transaction within full AML/CFT scope — a single cash transaction, or linked transactions, reaching AED 55,000 or more.
What happens if a DNFBP fails to register with goAML?
Operating a DNFBP activity without proper licence, registration, or enrolment is a specific offence under Articles 20 and 32 of Federal Decree-Law No. 10 of 2025, carrying imprisonment alongside a fine of AED 200,000 to AED 10,000,000.
Do DIFC or ADGM businesses still need to comply?
Yes. DIFC and ADGM entities remain within the federal AML/CFT/CPF perimeter and are additionally supervised directly by the DFSA or FSRA under their own detailed rulebooks — free zone status is not an exemption.
How often should AML/CFT training be refreshed?
At least annually, with additional training whenever the law, guidance, or a firm’s own risk profile changes materially — alongside Know-Your-Employee screening at the point of recruitment.
What is the maximum penalty a DNFBP can face?
Administrative fines run up to AED 5,000,000 per violation under Article 17. Where a legal person is criminally convicted of money laundering, terrorist financing, or proliferation financing, fines can reach AED 100,000,000 under Article 27, alongside potential dissolution of the entity.
Key Takeaway
The UAE’s DNFBP regime has moved decisively from “do you have a policy” to “can you prove your controls work.” Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 widened the DNFBP perimeter, sharpened penalties, and removed the safety net of a prosecution time limit — all while enforcement activity is visibly accelerating ahead of the UAE’s 2026 FATF review. For any real estate, precious metals, legal, accounting, corporate services, or gaming business operating in the UAE, the question for 2026 isn’t whether the AML rules apply — it’s whether the current programme can survive an inspection under the new law, not the old one.
