UAE AML Obligations for Accountants and Auditors

Accountants and auditors in the United Arab Emirates are classed as Designated Non-Financial Businesses and Professions (DNFBPs) under the country's anti-money laundering and counter-terrorist financing (AML/CFT) framework. That brings duties to assess risk, verify clients, register with the national reporting system and report suspicious activity. The framework was rebuilt in late 2025, and advisory commentary says the UAE has been under pressure to show effective enforcement ahead of a Financial Action Task Force (FATF) mutual evaluation due in 2026, so firms that treated AML as a paper exercise are now taking it more seriously. This guide explains who is covered, the legal basis, and what a firm should have in place. It draws on published advisory commentary, so confirm details against the official legislation and the Ministry's guidance before relying on them.

The legal framework

According to UAE advisory firms, the governing statute is Federal Decree-Law No. 10 of 2025 on combating money laundering, terrorist financing and the financing of illegal organisations, which took effect on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. The executive regulation is Cabinet Resolution No. 134 of 2025, which defines the DNFBP categories. Earlier guidance often cites Cabinet Decision No. 10 of 2019, so older articles may use outdated references. If you are reading a checklist written before late 2025, check which instrument it relies on.

Who is covered and who supervises

The DNFBP categories include real estate brokers, dealers in precious metals and stones, trust and company service providers, lawyers and notaries, and accountants and auditors. Advisory commentary says that accountants and auditors on the mainland and in commercial free zones are supervised by the Ministry of Economy and Tourism (MoET), while firms licensed in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) fall under their own financial free zone regulators. Commentary also says that accounting firms which manage client funds or accounts are expressly cited as grounds for DNFBP classification, so a firm with that kind of activity should assume it is covered.

Core obligations for an accounting or audit firm

• Business-wide risk assessment. Identify and assess the money laundering, terrorist financing and proliferation financing risks of your clients, services, geographies and delivery channels. Commentary says this should be reviewed at least annually. Our firm-wide AML risk assessment guide shows how to structure one.
• Customer due diligence. Apply standard, simplified or enhanced measures based on risk. Identify and verify beneficial owners and keep ownership information up to date. For higher-risk relationships, see our guide to enhanced due diligence for accountants.
• Sanctions screening. Screen clients against UAE and UN lists, and update your process when the lists change. Commentary cites a 2025 circular requiring this.
• Registration on goAML. Register on goAML, the UAE Financial Intelligence Unit's reporting platform, after approval from your supervisor. Advisory firms describe this as mandatory for covered accountants and auditors.
• Suspicious transaction reporting. File a report through goAML when you have reasonable grounds to suspect that funds are the proceeds of crime or linked to terrorist financing. There is no minimum value, and commentary says the test is suspicion, not proof.
• Compliance officer. Appoint a person responsible for AML, with the seniority and independence to do the job. One advisory source says the 2025 law places personal responsibility on the officer as well as the firm. Our guide to the MLRO role in an accountancy firm sets out the duties.
• Policies, training and records. Board-approved written policies, staff training and records that you can produce on inspection. Advisory firms report a minimum retention period of five years.
• No tipping off. Do not tell a client that a report has been or may be filed.

Enforcement and penalties

Advisory commentary describes a pattern of Ministry inspections and fines against DNFBPs since 2022, with enforcement said to be accelerating ahead of the FATF evaluation. Published figures for the maximum fines differ between sources, so we do not quote a single range here. The 2025 law includes both administrative sanctions and criminal penalties, including for operating a covered activity without the right registration and for tipping off. Read the penalty provisions in the Decree-Law itself and in Ministry notices before you advise on exposure.

Free zones and the DIFC and ADGM

If your firm sits in the DIFC or ADGM, the Dubai Financial Services Authority or the Financial Services Regulatory Authority rulebooks may apply instead of, or alongside, the mainland framework. Firms that operate in several locations should map which rules apply to each licensed entity and avoid assuming that one policy covers everything.

A starter checklist

1. Confirm your licence type, supervisor and whether the firm is a DNFBP.
2. Register on goAML and record the date.
3. Complete and approve a written business risk assessment.
4. Appoint and document your compliance officer.
5. Set a client onboarding checklist covering identity, ownership, sanctions and politically exposed persons (PEPs).
6. Train staff and keep attendance records.
7. Test the programme annually and keep evidence.

Frequently asked questions

Do UAE accountants have to report suspicious transactions?

Yes, according to advisory commentary, covered accountants and auditors must file reports through goAML when they suspect proceeds of crime or terrorist financing.

Which law applies?

Federal Decree-Law No. 10 of 2025 is the primary law according to advisory firms, supported by Cabinet Resolution No. 134 of 2025.

Is AML training required?

Training is part of the compliance programme that supervisors expect. You can build on our CPD courses to support staff learning.