🔍 Article overview
|
| This article explains what AML/CFT compliance entails for DNFBPs in the United Arab Emirates. It emphasizes that these obligations apply not only to banks, but also to several non-financial professions and activities, such as real estate, precious metals, auditing, accounting, corporate services and certain legal activities. The text details the main requirements: CDD, KYC, reporting suspicious transactions through goAML, retaining documents for five years, sanctions screening, internal controls and a compliance officer. It also highlights the most common mistakes, such as failing to register on goAML, overly weak KYC procedures, a lack of a risk-based approach, insufficient training and inadequate documentation. Finally, it stresses that AML/CFT compliance not only helps avoid penalties, but also protects the company’s reputation and governance. |
AML/CFT does not concern only banks
Many companies still believe that anti-money laundering rules (AML for
Anti-Money Laundering) and combating the financing of terrorism (CFT for
Combating the Financing of Terrorism) apply only to banks or financial institutions. In reality, in the United Arab Emirates, the scope is much broader. AML/CFT obligations also apply to certain non-financial activities, particularly DNFBPs (
Designated Non-Financial Businesses and Professions), meaning designated non-financial businesses and professions. This includes, for example, real estate agents, gold and jewelry dealers, auditors, accountants, corporate service providers, as well as certain lawyers depending on the nature of the transactions handled.
This is precisely where many organizations make mistakes. They believe they are not on the authorities’ radar, even though they are clearly covered. In the current UAE context, compliance is no longer a secondary issue. It has become a basic requirement for operating with confidence and limiting exposure to regulatory risks.
What AML/CFT really entails in the UAE context
AML/CFT encompasses the rules and procedures designed to prevent funds of illicit origin from being concealed, used or integrated into the legitimate economy. The objective is also to prevent terrorist financing, fraud and corruption. The publications consulted point out that, in the United Arab Emirates, this framework is closely monitored by the competent authorities and that expectations regarding transparency and controls are increasing.
For a DNFBP, this means one simple thing: you can no longer settle for compliance in name only. It is not enough to have a few documents filed away or an internal policy copied from a standard template. What is expected is a genuine system that is applied on a daily basis, documented and consistent with the risks of your business.
The main AML/CFT obligations of a DNFBP in the UAE
The first pillar is customer identification. In other words, you must know who you are working with. This involves Customer Due Diligence and Know Your Customer measures. You must verify identity, understand the business relationship and not stop at appearances when an entity or transaction seems more complex than it initially appears. The publications also emphasize the need to identify the beneficial owner, a point that is often overlooked in practice.
The second obligation is reporting suspicious transactions. When a transaction raises a concern, it must be reported through the goAML system. The posts point out that this process cannot be postponed indefinitely on the grounds of uncertainty. When a red flag exists, inaction exposes the company to risk. For DNFBPs, this reporting reflex is part of the foundation of compliance.
You must also retain data and documentation for five years. This requirement is not incidental. In AML/CFT matters, the absence of written records almost always works against the company. In practice, if a review is conducted and nothing has been properly retained, it becomes difficult to demonstrate that the controls were actually carried out.
Another essential point is sanctions screening, the implementation of internal policies and controls, and the appointment of a compliance officer. The publications also remind us that enhanced due diligence is expected for certain high-value cash transactions, particularly those exceeding 55,000 AED.
Where DNFBPs most often make mistakes
The first and very common misstep is failing to register on goAML and failing to follow the EOCN’s
sanction list. This failure comes up frequently, particularly among smaller organizations and certain DNFBPs that still underestimate their level of exposure. Yet registration is not merely an administrative detail. It is a basic requirement.
Another common mistake is overly weak KYC procedures. Superficial checks, poorly verified identities, ignored beneficial owners and incomplete files. This type of practice creates the illusion of compliance, but does not hold up for long when a serious review takes place.
There is also the absence of a risk-based approach. Treating all customers in the same way may seem simpler, but it is not compliant. A DNFBP must be able to adapt its level of scrutiny according to the customer’s profile, the nature of the transaction, the sector, the country concerned or the complexity of the structure used. The publications also point out that the regulatory environment is changing rapidly and that high-risk jurisdictions must be incorporated into assessments and ongoing monitoring.
Finally, many companies overlook two very practical issues: staff training and the quality of documentation. A team that does not understand the warning signs cannot fulfill its role. And a company that does not document its controls exposes itself to a straightforward conclusion by the regulator: what is not proven is considered not to have been done.
Being compliant is not just about avoiding a penalty
Of course, there is the issue of penalties. The posts mention heavy fines, potentially reaching very high amounts, as well as the risk of license suspension and, in serious cases, criminal liability. But reducing AML/CFT to fear of penalties would be a mistake.
For a DNFBP, compliance also helps protect its reputation, strengthen its governance and build trust. In a market where regulatory oversight is intensifying, demonstrating that your organization can identify risks, control its business relationships and respond appropriately is no longer merely an advantage. It has become a condition of credibility.
The real question to ask
The right question is therefore not whether AML/CFT applies to you. For a DNFBP in the UAE, the answer is often already yes. The real question lies elsewhere: is your compliance framework genuinely operational, or merely theoretical?
If your controls are weak, your files are incomplete, your team is not trained or your monitoring relies on informal practices, then the risk is very real. Conversely, a well-structured compliance framework helps anticipate the authorities’ expectations, reduce gray areas and secure business operations over the long term.
With regard to AML/CFT in the UAE, remaining compliant is no longer a one-off exercise. It is an ongoing, demanding but essential process.
Are you subject to this regulation?
If your company is covered (or if you would like us to verify this for you), we invite you to fill out this form:
https://merri.tt/fr-dnfbp
