UAE AML/CFT Compliance for Free Zone Companies 2026
UAE has significantly strengthened its Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework since 2021, following FATF mutual evaluation. UAE free zone companies must understand and comply with UAE AML obligations. This guide covers AML/CFT requirements for free zone businesses in 2026.
UAE AML Legal Framework
- Federal Decree-Law No. 20/2018 on AML/CFT
- Cabinet Decision No. 10/2019 on AML/CFT implementing regulations
- CBUAE AML/CFT guidelines for licensed financial institutions
- Executive Office of AML/CFT (UAE’s central AML authority) guidelines
Who Has AML Obligations?
Not all UAE free zone companies have the same AML obligations. Two categories:
- Financial Institutions (FIs): banks, insurance companies, payment service providers, exchange houses — subject to comprehensive AML obligations including KYC, ongoing monitoring, and STR filing
- Designated Non-Financial Businesses and Professions (DNFBPs): real estate agents, lawyers, accountants, auditors, corporate service providers, precious metals/stones dealers, virtual asset service providers — subject to specific AML obligations when transactions exceed defined thresholds
General trading, IT, and service companies that are NOT FIs or DNFBPs have lighter AML obligations but still must not facilitate money laundering and should maintain basic transaction records.
goAML Registration
UAE FIs and DNFBPs must register on the goAML system (UAE’s AML reporting platform). goAML is used for: filing Suspicious Transaction Reports (STRs), filing Suspicious Activity Reports (SARs), and filing Threshold Transaction Reports (TTRs) for cash transactions above AED 55,000. goAML registration is mandatory for all regulated FIs and all DNFBPs in UAE.
KYC Requirements for DNFBPs
DNFBP businesses must perform Customer Due Diligence (CDD) on clients:
- Identify the client and verify identity (passport, trade licence, MoA)
- Identify the UBO (Ultimate Beneficial Owner)
- Understand the nature of the business relationship
- Conduct Enhanced Due Diligence (EDD) for high-risk clients (PEPs, high-risk countries)
- Maintain KYC records for 5 years minimum
UAE Sanctions Screening Obligations
All UAE businesses (not only FIs and DNFBPs) must screen clients, counterparties, and employees against UAE sanctions lists:
- UAE Local Terrorist List (Cabinet Decision No. 83/2021)
- UN Consolidated Sanctions List
- OFAC SDN List (for USD transactions)
- EU Consolidated Sanctions List
Free zone companies should implement periodic sanctions screening of client and supplier databases using compliant screening tools (World-Check, Comply Advantage, or similar).