UAE AML/CFT Compliance for SMBs — Cabinet Decision 74/2020 Walkthrough

The UAE AML/CFT framework — Federal Decree-Law 20/2018 + Cabinet Decision 10/2019 + Cabinet Decision 74/2020 (Targeted Financial Sanctions) + Cabinet Decision 58/2020 (UBO) — applies to far more SMBs than most owners realize. Real-estate brokers, dealers in precious metals, lawyers, accountants, and trust service providers fall under DNFBP obligations. Every UAE-resident business has TFS screening obligations. Every Mainland and Free Zone entity has UBO obligations. This guide walks the framework end-to-end with the practical compliance checklist.

Why UAE AML/CFT applies to more SMBs than owners realize

The UAE was placed on the FATF "grey list" in March 2022 over AML/CFT shortcomings, and was removed in February 2024 after a significant enforcement push. The framework that emerged from that period has teeth — fines now reach 5 million per violation, with substantial enforcement activity across DNFBP sectors. SMBs that assumed "AML applies to banks, not us" have been a frequent enforcement target.

The real scope:

• Every UAE-resident business has TFS screening obligations under Cabinet Decision 74/2020 — including SMBs that don't think of themselves as financial-services adjacent
• Every Mainland and Free Zone entity has UBO register obligations under Cabinet Decision 58/2020
• Defined Designated Non-Financial Businesses + Professions (DNFBPs) have full AML programme obligations under Cabinet Decision 10/2019 Article 3
• Specific high-value sectors (real estate, precious metals/stones, certain legal/accounting work) face enhanced obligations

The four-layer regulatory framework

DNFBP scope — who must comply with the full AML programme

Cabinet Decision 10/2019 Article 3 defines four DNFBP categories that fall under the full AML programme (risk assessment, CDD, STR, training, compliance officer):

• Real estate brokers and agents — when carrying out transactions involving the purchase/sale of real estate for clients
• Dealers in precious metals and precious stones — when carrying out transactions valued at 55,000 or more (cash or otherwise)
• Lawyers, notaries, and accounting professionals — when preparing or carrying out transactions on behalf of clients involving: buying/selling real estate, managing client money/securities/assets, managing bank/savings/securities accounts, organising contributions for the formation/operation/management of companies, creating/operating/managing legal persons
• Trust and company service providers — when providing services such as acting as a formation agent for legal persons, providing a registered office or business address, acting as a trustee, acting as a nominee shareholder

If your business falls in one of these categories, you have full DNFBP obligations including: appointing a Compliance Officer reporting to senior management, implementing a Customer Due Diligence (CDD) programme, conducting annual risk assessments, providing annual AML training to staff, maintaining records for 5 years minimum, and filing STRs with the UAE FIU.

Targeted Financial Sanctions screening — every business

Cabinet Decision 74/2020 applies to every UAE-resident business regardless of sector. The core requirement: screen counterparties against the UAE Local Terrorist List and the UN Security Council Sanctions List before establishing a business relationship, and on an ongoing basis.

Counterparties to screen:

• Customers — particularly when receiving payments or providing goods/services on credit
• Suppliers — particularly when making payments to or providing goods/services to
• Employees — at hiring + on ongoing basis
• Beneficiaries of any payment
• Beneficial owners of corporate customers/suppliers
• Directors and officers of corporate customers/suppliers

What happens on a hit

If a screening returns a positive match against the TFS lists:

1. Immediate freezing — funds or assets associated with the matched person must be frozen immediately, without prior notice to the customer
2. FIU reporting within 24 hours — submit the report through the goAML portal
3. No transactions executed with the matched person without explicit authorization from the relevant authority
4. Confidentiality — the fact of the screening + the freezing must not be disclosed to the customer ("tipping off" is a separate offence)

The UAE goAML portal

UAE FIU operates the goAML portal as the central system for AML/CFT reporting. Every business with reporting obligations (DNFBP + financial institutions + others) is required to register on goAML. The portal handles: STR submissions, TFS reporting, UBO data exchange in some scenarios, and ongoing communications with FIU.

UBO register obligations — Cabinet Decision 58/2020

The UBO Register requirement applies to every UAE-licensed entity except specific carve-outs (UAE-government-owned entities, listed companies with regulated disclosure, etc.). Every entity must:

1. Identify the Ultimate Beneficial Owner(s) — natural persons who ultimately own 25%+ of the entity directly or indirectly, OR who exercise ultimate control through other means (board control, voting rights, contractual arrangements)
2. Maintain a UBO Register internally with: full name, nationality, date of birth, address, basis of UBO determination, date became UBO, supporting documentation
3. File with the licensing authority within 60 days of license issuance (or within 60 days of the framework taking effect for existing entities) — DED for Mainland Dubai, ADED for Abu Dhabi, individual Free Zone authorities for Free Zones
4. Update within 15 days of any change in UBO data
5. Provide UBO information to the regulator on request

Suspicious Transaction Reports — when and how

DNFBPs and financial institutions must file Suspicious Transaction Reports (STRs) with the UAE FIU when they identify a transaction (or attempted transaction) involving funds suspected to be proceeds of crime, related to terrorism financing, or otherwise suspicious.

STR triggers commonly include:

• Unusually large cash transactions
• Customer reluctance to provide standard CDD information
• Customer using complex or unusual ownership structures without commercial rationale
• Patterns suggesting structuring (multiple transactions just below reporting thresholds)
• Customer profile inconsistent with declared business activity
• Transactions involving jurisdictions on the FATF high-risk list
• Customer requesting unusual transaction routing

STRs are filed through the goAML portal. Filing is confidential — the customer must not be informed (tipping-off offence). STR filing does not in itself confirm wrongdoing; it triggers FIU investigation.

Penalty regime

The UAE AML/CFT penalty regime, administered through the AML/CFT Committee and the Executive Office, has been substantially strengthened since 2022:

The practical compliance checklist

For UAE SMBs evaluating their AML/CFT exposure and building a compliance programme:

1. Determine scope: Are you a DNFBP? Where do you fall in the four-layer framework?
2. Register on goAML if you're a DNFBP or otherwise required
3. Appoint a Compliance Officer (if DNFBP) reporting to senior management. The role can be combined with other compliance functions but must be documented.
4. Conduct a Money-Laundering and Terrorism-Financing risk assessment — customer types, product types, geographies, transactions. Update annually.
5. Build a CDD programme: identify + verify customers, identify UBOs, ongoing monitoring, enhanced CDD for higher-risk customers
6. Implement TFS screening — automated or manual screening of every customer + supplier + employee against the UAE Local Terrorist List + UN Sanctions List. Pre-onboarding + ongoing.
7. File UBO with the licensing authority + maintain internal UBO register + update within 15 days of changes
8. Document an STR procedure — clear escalation path from staff who notice suspicious activity to the Compliance Officer to the goAML filing
9. Provide annual AML training — documented attendance, content updated for any framework changes
10. Maintain records for 5 years minimum — CDD documents, transactions, STRs, training records, risk assessments
11. Plan for annual independent audit of the AML programme (DNFBPs)
12. Engage an AML advisor for the first programme build — especially for higher-risk DNFBP sectors

FAQ