By Jouslin Khairallah, Founder & Managing Director — Anti-Money Laundering & Corporate Strategy.
Good AML compliance is not about treating every customer as a criminal — it is about building a defensible, risk-based system that satisfies the regulator without strangling the business. Too many UAE companies swing between the extremes: no program at all until a fine arrives, or paperwork so heavy it turns the compliance officer into a Business Prevention Officer. The law requires neither. It requires proportionate, documented, risk-based controls — and that is precisely what a lawyer-led program delivers.
The UAE AML Framework on One Page
The architecture is built on Federal Decree-Law No. 20 of 2018 (as amended by Decree-Law 26/2021) and its implementing Cabinet Decision No. 10 of 2019, supervised by the Central Bank, the Ministry of Economy and sectoral regulators. Around it sit the goAML reporting platform, targeted financial sanctions obligations, and the new KYC framework under Cabinet Resolution No. 55 of 2025, which restructures how customer-verification data is produced, stored and exchanged. Non-compliance is an administrative-penalty regime with real teeth: fines range into the millions of dirhams, and license consequences follow persistent failure.
Who Must Comply — It’s Wider Than You Think
Beyond banks and finance companies, the law captures Designated Non-Financial Businesses and Professions (DNFBPs):
- Real estate brokers and agents (for sale/purchase transactions)
- Dealers in precious metals and stones
- Auditors and accountants
- Corporate service providers and company formation agents
- Lawyers and notaries in defined transaction work
Plus Virtual Asset Service Providers (VASPs) under their own regulatory overlay. If your business is on this list and unregistered on goAML, you are already non-compliant — before a single transaction is examined.
KYC Under Cabinet Resolution 55/2025 — What Changed
The 2025 Resolution created a unified framework for KYC reports: how they are issued, processed, stored and exchanged. For businesses this changes onboarding mechanics, record-keeping duties and the interaction between KYC data and the UAE’s data protection regime. We published one of the first analyses of the Resolution — read it here — and we build its requirements into every compliance program we design.
Building an AML Program That Survives Inspection
- Business risk assessment — documented, specific to your customers, products, channels and geographies. The regulator’s first request in any inspection.
- Customer due diligence (CDD) and enhanced due diligence (EDD) — proportionate tiers, PEP screening, sanctions screening, beneficial-owner identification.
- MLRO appointment — a named, empowered compliance officer with direct board access.
- goAML registration and reporting — STRs filed correctly and on time, with escalation procedures that produce defensible decisions not to report as well.
- Policies, training and independent review — the living documents and annual checks that turn a binder into a program.
Inspections, Penalties — and How to Respond
Ministry of Economy and Central Bank inspection campaigns have made AML fines routine for unprepared DNFBPs. If you have received an inspection notice or a penalty: respond within the deadlines, but not before advice — penalty reconsideration and grievance routes exist, and the difference between a well-documented response and a defensive scramble is usually the difference in outcome. We handle inspection responses, penalty challenges and remediation plans.
Our AML Health Check
A fixed-fee review of your current exposure: registration status, risk assessment adequacy, CDD file sampling, reporting procedures, sanctions screening and training records — delivered as a gap report with a prioritized remediation plan. It is the fastest way to know where you stand before the regulator tells you.
Why KH Legal
AML compliance at KH Legal is led personally by Jouslin Khairallah, whose practice combines corporate strategy, company restructuring and anti-money laundering — on both sides: building compliance programs for businesses and defending clients in AML proceedings. Advice that has been stress-tested in prosecutions is different in kind from template compliance. English, Arabic and Russian service.
Frequently Asked Questions
My company is a small real estate brokerage. Do AML rules really apply to us?
Yes — real estate brokers are DNFBPs under the UAE framework, with goAML registration, CDD and reporting obligations. Size does not exempt you; several enforcement campaigns have focused precisely on smaller DNFBPs.
What is goAML and do we have to register?
goAML is the UAE Financial Intelligence Unit’s platform for registration and suspicious transaction reporting. All financial institutions and DNFBPs must register and report through it — being unregistered is itself a violation.
What fines are we exposed to?
Administrative penalties scale from tens of thousands to millions of dirhams depending on the violation, with license measures for persistent failure. The cost of a program is a fraction of the cost of not having one.
When must we file a Suspicious Transaction Report?
When you have reasonable grounds to suspect funds relate to crime — and the obligation is to report promptly, without tipping off the customer. What that means in your sector, and how to document decisions either way, is exactly what your procedures should define.
How does the new KYC framework affect existing customer files?
Cabinet Resolution 55/2025 tightens how KYC data is produced, stored and exchanged — existing files and onboarding flows should be reviewed against it, together with UAE data protection law. Our health check covers this alignment.
Can you act as our outsourced AML counsel?
Yes — retainers covering MLRO support, STR decision advice, training, annual reviews and regulator correspondence are among our most-used arrangements for DNFBPs that cannot justify a full-time compliance hire.
Book an AML health check: call +971 4 427 0845 or message us on WhatsApp.
Facing an accusation instead? See our money laundering defense practice.