By Alia Noor, FCMA, CGMA, MBA
UAE Registered Tax Agent | Associate Partner – Taxation & Compliance Advisory
Ahmad Alagbari Chartered Accountants
AED 42 million.
That was the value of fines imposed following Anti-Money Laundering compliance inspections of Designated Non-Financial Businesses and Professions (DNFBPs) by the UAE Ministry of Economy & Tourism in just the first half of 2025.
But there is another number worth noticing.
1,063.
That was the number of violations identified.
Real estate brokers accounted for 495 violations, dealers in precious metals and gemstones for 473, while corporate service providers and auditors accounted for another 95 violations.
The fines tell us about enforcement.
The violations tell us something more important: where compliance is still going wrong.
The Numbers Tell the Story
AML enforcement is not confined to DNFBPs.
In May 2025, the Central Bank of the UAE imposed an AED 200 million financial sanction on an exchange house following examinations that revealed failures relating to its AML/CFT framework and related regulations. Days later, another exchange house received an AED 100 million sanction.
Banks, insurers and other regulated businesses have also faced enforcement action.
These are no longer isolated headlines. They reveal a clear shift from AML compliance on paper to AML effectiveness in practice.
Having an AML framework and having one that actually works are two very different things.
The AML Rulebook Has Changed
The legislation has evolved alongside enforcement.
The UAE's current framework includes Federal Decree-Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing, together with Cabinet Resolution No. 134 of 2025 issuing its Executive Regulations.
The explicit inclusion of Proliferation Financing (PF) is particularly important.
Businesses should therefore revisit AML frameworks developed under previous legislation and assess whether their risk assessments, policies, controls and employee training remain aligned with current requirements.
Changing the date on the cover of an AML manual is not an update.
The Policy Is Not the Programme
A business may be registered on goAML.
It may have appointed a Compliance Officer.
It may have an AML policy, customer risk-rating methodology and completed KYC files.
And it may still have a compliance problem.
AML weaknesses often emerge between the policy and its implementation.
A customer may be classified as low risk without adequate justification. CDD may have been completed at onboarding but not kept current. The Ultimate Beneficial Owner may be recorded without sufficiently understanding or verifying the ownership structure.
A high-risk relationship may continue without meaningful Enhanced Due Diligence. An unusual transaction may have an explanation, but nobody tests whether that explanation makes commercial sense. A red flag may be identified but not appropriately escalated.
A suspicious transaction rarely arrives labelled “suspicious.”
Effective AML compliance depends on whether the organisation can recognise risk when it appears and demonstrate how it responded.
goAML Registered? Good. But What Happens Next?
For businesses within the applicable scope, goAML registration and reporting obligations are important.
But goAML is only one component of an effective AML framework.
Businesses need to understand their exposure to money laundering, terrorist financing and proliferation financing risks; identify and verify customers and Beneficial Owners; apply enhanced measures where risk is higher; conduct ongoing monitoring; manage sanctions exposure; maintain appropriate records; train relevant employees; and report suspicious activity where required.
The objective is not more compliance paperwork.
It is controls that work when they are needed.
Five Questions Worth Asking
Before the regulator asks, businesses should test themselves:
- Does our risk assessment reflect how our business actually operates today?
- Can we establish and verify who ultimately owns or controls our customers?
- Can we demonstrate why higher-risk customers were accepted and what Enhanced Due Diligence was performed?
- Would our monitoring identify activity inconsistent with a customer's expected profile?
- Can we demonstrate how red flags were investigated, escalated and resolved?
If the answers are unclear, adding another page to the AML manual is unlikely to solve the problem.
Are You Next — or Are You Ready?
The UAE's enforcement numbers are more than a warning about penalties.
They show where AML compliance can break down.
Businesses should use these lessons to test their risk assessments, customer classifications, beneficial ownership checks, Enhanced Due Diligence and transaction monitoring before the regulator does.
The real question is not:
“How high can the fine be?”
It is:
“If your AML framework were tested today, could you prove that it works?”
Disclaimer
This article is intended for general information and educational purposes only and does not constitute legal, regulatory or professional advice. AML/CFT/CPF obligations depend on the nature of the business, regulated activity, applicable Supervisory Authority and specific circumstances. Readers should refer to current UAE legislation, regulations and official guidance and seek appropriate professional advice where required.
Tags
UAE AML, AML Compliance, Anti-Money Laundering, UAE AML Law, AML Enforcement, AML Penalties, DNFBP, goAML, Customer Due Diligence, CDD, Enhanced Due Diligence, EDD, Ultimate Beneficial Owner, UBO, AML Risk Assessment, Suspicious Transaction Reporting, Sanctions Compliance, Proliferation Financing, Financial Crime, UAE Compliance
