goAML registration UAE: AML compliance for DNFBPs explained
Real estate brokers, precious metals dealers, corporate service providers, and accountants: if you fall under the DNFBP definition, goAML registration is not optional, and fines start at AED 50,000 for skipping it.
If your business is a real estate brokerage, a dealer in precious metals or stones, a corporate service provider, or an accounting or audit firm carrying out specified activities, UAE anti-money laundering law treats you the same way it treats a bank. That means a compliance officer, a written programme, customer due diligence, and registration on the goAML portal. None of it is optional, and the fine for simply not registering starts at a reported AED 50,000, before you have done anything else wrong.
This is one of the most commonly ignored compliance obligations in the UAE, mainly because business owners assume AML rules are a bank’s problem. They are not.
What is a DNFBP
DNFBP stands for Designated Non-Financial Business or Profession. It is the UAE’s term for businesses outside the financial sector that are still considered exposed to money laundering risk, because of the nature of what they sell, broker, or advise on.
| DNFBP category | Typical trigger |
|---|---|
| Real estate brokers and agents | Any purchase or sale transaction concluded for a customer |
| Dealers in precious metals and stones | Cash transaction, single or linked, of AED 55,000 or more |
| Corporate and trust service providers | Acting as agent in forming a legal person, or providing a registered office, nominee director, or similar service |
| Lawyers, notaries, and independent legal professionals | Specified activities such as managing client funds or assets |
| Accountants and auditors | Specified activities such as preparing transactions for a client involving buying or selling real estate or managing client funds |
| Commercial gaming operators | Reported at an AED 11,000 threshold |
The common thread is not the industry label, it is the activity. A real estate agent who only ever advertises listings without concluding transactions sits in a different position from one who closes a sale on a client’s behalf. A corporate service provider forming a company that will hold real estate is a DNFBP for that engagement even if most of its work is routine incorporation.
Registering on goAML
goAML is the portal run by the UAE Financial Intelligence Unit for registering as a reporting entity and, where necessary, filing suspicious transaction reports and other statutory reports. Registration itself is the first legal obligation, and it stands on its own, separate from whether you ever encounter anything suspicious.
A DNFBP that meets the definition has to:
- Register the entity on goAML and designate a compliance officer
- Adopt a written AML/CFT programme, including a risk assessment specific to the business
- Carry out ongoing Customer Due Diligence on clients and transactions
- File Suspicious Transaction Reports (STRs) through goAML when something meets the reporting threshold for suspicion, regardless of transaction value
- Keep records of due diligence and transactions for the retention period required by law
Registering late, or not at all, is treated as a standalone violation, independently of whether the business has ever had a reportable transaction.
Core CDD duties
Customer Due Diligence is the practical backbone of AML compliance. In simple terms, it means knowing who you are actually dealing with, not just who signed the engagement letter.
CDD has to be performed:
- When establishing a business relationship, ongoing or one-off, regardless of the value involved
- For occasional transactions above the relevant threshold, reported at AED 55,000 for cash transactions relevant to DNFBPs such as precious metals dealers
- Whenever money laundering is suspected, no matter how small the transaction
At a minimum, CDD involves identifying the customer and verifying their identity from a reliable source, identifying the beneficial owner behind a corporate customer, understanding the purpose of the relationship, and applying ongoing monitoring rather than a one time check at onboarding. Higher risk customers, politically exposed persons, or unusual transaction patterns call for Enhanced Due Diligence, a deeper version of the same process.
What non-compliance actually costs
The penalty structure is designed to scale with the seriousness of the failure, not just apply a flat fine.
- Failure to register on goAML: reported administrative penalty starting at AED 50,000
- Failure to implement an AML programme, or failure to file a required STR: penalties that can scale up to AED 5,000,000 depending on severity
- Additional measures: restrictions on licences, and reputational exposure once enforcement action becomes public
The Ministry of Economy and Tourism, which supervises most DNFBP categories, has published cumulative fine figures well into the tens of millions of dirhams across enforcement actions in recent years, which signals this is an actively enforced area rather than a dormant rule on the books.
Practical mistakes we see
Assuming AML is only for banks. The single biggest gap. A real estate brokerage or a company formation agent that has never registered on goAML is not quietly compliant by omission, it is in active breach the moment it meets the DNFBP definition.
No named compliance officer. A programme without a designated, accountable person responsible for it is not treated as a functioning programme during an inspection.
CDD done once at onboarding and never revisited. Ongoing monitoring is part of the requirement, not a nice to have. A client relationship that changes in risk profile over time needs the due diligence to keep pace.
Treating goAML registration as something to get to later. Because there is no penalty for having nothing to report, businesses assume there is no urgency in registering. The penalty attaches to not being registered, independent of activity.
Conclusion
If your business concludes real estate transactions, deals in precious metals or stones above the cash threshold, forms companies as an agent, or provides accounting, audit, or legal services touching client funds, you are very likely a DNFBP under UAE law. Registering on goAML, naming a compliance officer, and running real CDD is the baseline, not an advanced step. The fines start at the point of not registering, before anything has gone wrong operationally.
We support DNFBP clients with bookkeeping and the compliance documentation trail that sits alongside AML obligations, as part of our accounting and advisory services, at fixed prices.
Talk to us, the initial consultation is free.
As of July 2026. This article is general information and is no substitute for advice in an individual case. AML obligations and thresholds are set by UAE Federal Decree-Law and Cabinet Resolutions and are subject to change, confirm current requirements with a licensed AML consultant or the Ministry of Economy and Tourism.
Read on: The cost of non-compliance in the UAE · Audit requirements for UAE companies · UBO registration in the UAE
Frequently asked questions
What does DNFBP mean and who does it apply to?
DNFBP stands for Designated Non-Financial Business or Profession. In the UAE this covers real estate brokers and agents, dealers in precious metals and stones, corporate and trust service providers, and independent lawyers, notaries, accountants, and auditors carrying out specified activities. If your business falls into one of these categories, UAE anti-money laundering law applies to you in the same way it applies to banks.
What is goAML and do I have to register even with no suspicious activity?
goAML is the UAE Financial Intelligence Unit portal used to register as a reporting entity and file suspicious transaction reports. Registration is a standalone legal obligation, separate from ever having something to report. A DNFBP that qualifies has to register on goAML regardless of whether it has ever encountered a suspicious transaction.
What cash amount triggers AML obligations for a DNFBP?
AED 55,000, whether as a single cash transaction or as linked transactions that add up to that amount. For dealers in precious metals and stones this threshold is central to when the AML programme has to apply. Real estate brokers and corporate service providers have their own triggers tied to their specific activities, not only cash.
What is CDD and when does a DNFBP have to carry it out?
Customer Due Diligence is the process of identifying and verifying who you are dealing with, and understanding the purpose of the relationship. It applies when establishing a business relationship, for occasional transactions above the relevant threshold, and whenever there is suspicion of money laundering, regardless of the amount involved.
What are the penalties for AML non-compliance in the UAE?
Failing to register on goAML carries a reported administrative penalty starting at AED 50,000. Failing to implement an AML programme or failing to file a required suspicious transaction report can scale up to AED 5,000,000, alongside other administrative measures such as licence restrictions.
Who supervises DNFBPs for AML compliance in the UAE?
The Ministry of Economy and Tourism supervises accountants, auditors, corporate and trust service providers, dealers in precious metals and stones, and real estate brokers and agents for AML purposes. The Ministry has publicly reported well over AED 100 million in cumulative administrative fines issued to DNFBPs since supervision intensified.