A UAE real estate broker, gold dealer or corporate service provider is a designated non-financial business or profession (DNFBP) when it carries out the activities and transactions listed in the executive regulation of the 2025 AML law. From that point it carries most of the AML duties a bank does: a documented risk assessment, customer due diligence down to the beneficial owner, sanctions screening, suspicious transaction reports through goAML, five-year records and a compliance officer with the authority to decide what gets reported. The sector-specific reports, the REAR for real estate and the DPMSR for gold and jewellery, sit on top of those duties. They don't replace them.
This guide is for the compliance officer of a mainland or commercial free zone DNFBP. It works from the federal texts and the supervisor's own circulars as we checked them on October 14, 2026. It is a practical reading of those texts, not legal advice, and your licence, emirate and free zone can change the detail.
Check that each link in the chain explains the next: the business-wide risk assessment explains the policy, the policy explains the client file, and the client file explains every report or decision not to report.
A UAE real estate broker, gold dealer or corporate service provider is a DNFBP when it carries out the activities listed in Cabinet Resolution No. 134 of 2025. It then owes most of the AML duties a bank does: a risk assessment, due diligence down to the beneficial owner, sanctions screening, goAML suspicious transaction reports, five-year records and a compliance officer who decides what gets reported. The REAR and DPMSR threshold reports sit on top of those duties.
The federal law doesn't list the businesses itself. Federal Decree-Law No. 10 of 2025 leaves the list of DNFBP activities to its executive regulation, Cabinet Resolution No. 134 of 2025. Article 3 of that regulation names five groups, and in most cases it's the activity, not the trade licence, that brings a business into scope. The supervisor can add other businesses or professions by resolution, in coordination with the National Committee.
Real estate brokers and agents are in scope when they conclude transactions or settlements for customers in the purchase or sale of real estate. Dealers in precious metals and stones are in scope for any single cash transaction, or several transactions that appear to be linked, worth AED 55,000 or more. Lawyers, notaries, other independent legal professionals and independent accountants are in scope when they prepare or carry out transactions for clients in five listed areas, such as buying and selling real estate, managing client funds or setting up companies. Company and trust service providers are in scope when they act for customers in company formation, act as or arrange directors, secretaries, partners, trustees or nominee shareholders, or provide a registered office or business address. Commercial gaming operators form a fifth group, with their own AED 11,000 threshold, and fall outside this guide.
| Sector | When the regulation brings you into scope | National risk rating for money laundering |
|---|---|---|
| Real estate brokers and agents | Concluding purchase or sale transactions or settlements for customers | High |
| Dealers in precious metals and stones | Cash transactions of AED 55,000 or more, single or linked | Medium-High |
| Company and trust service providers | Formation, nominee, director, trustee and registered-address services for customers | Medium (corporate service providers) |
| Lawyers, notaries and independent accountants | Preparing or carrying out listed transactions for clients | Medium-Low (independent accountants) |
The risk ratings in the last column come from the Ministry's practical guide to the UAE's 2024 National Risk Assessment for DNFBPs. That guide rates real estate brokers and agents High because of high-value property transactions, third parties and cash. It rates dealers in precious metals and stones Medium-High because of cash intensity, cross-border trade and weak responsible sourcing in some segments. It rates corporate service providers Medium because of nominee arrangements and the difficulty of verifying ultimate beneficial owners.
The ratings don't let a lower-rated firm do less than the law requires. The guide says that whatever the assessed risk level, every DNFBP must apply proportional, risk-based measures in line with the national findings.
For a general definition of the term and how FATF uses it, see our DNFBP glossary entry. For the international standard behind these duties, our page on FATF Recommendation 22 and DNFBP customer due diligence covers what FATF expects of each sector.
The Ministry of Economy and Tourism (MoET) supervises the DNFBP sector at state level and in commercial free zones. For most brokers, gold and jewellery dealers, corporate service providers and accounting firms outside the financial free zones, that means MoET.
Other supervisors exist. When a reporting entity registers for goAML access, the FIU's registration form asks it to choose a supervisory body, and the list includes the Ministry of Economy and Tourism, the Ministry of Justice, the Dubai Financial Services Authority and Abu Dhabi Global Markets. Confirm your supervisor from your licence before you build anything else, because the circulars, the inspection approach and the registration route follow from it.
The UAE replaced its AML framework in late 2025. Federal Decree-Law No. 10 of 2025, issued on September 30, 2025, repealed Federal Decree-Law No. 20 of 2018. Cabinet Resolution No. 134 of 2025, the executive regulation issued on October 29, 2025, repealed Cabinet Resolution No. 10 of 2019.
The change doesn't wipe out the sector instructions you already follow. The older circulars issued under the 2018 law stay in force insofar as they don't conflict with the 2025 law, until replacements are issued. That matters for DNFBPs, because the REAR and DPMSR requirements come from Ministry circulars issued under the old framework.
Some Ministry pages also still cite the 2018 law and its regulation. The goAML registration page, for example, refers to Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. Read those pages for process and forms, and check the legal basis against the 2025 texts.
The penalties are worth reading closely. A Supervisory Authority can impose an administrative fine of AED 10,000 to AED 5,000,000 for each violation. It can raise the fine when the same violation recurs within a year, and it may publish the penalties it imposes. Other sanctions in the same article include a warning, suspending the activity and revoking the licence. Separately, the law makes deliberate or grossly negligent failure to report suspicion a criminal offence.
The same set of duties applies to every DNFBP group, scaled to the size and risk of the business. The order below runs from the risk assessment to the records, because each duty builds on the one before.
You must identify and assess your money laundering, terrorist financing and proliferation financing risks, considering customer, country, product, service, transaction and delivery channel risks before you set the overall risk level. You must document the assessment, keep it updated and give it to the authorities on request. The Ministry expects that business-wide risk assessment to reflect the 2024 national findings, and it expects your customer risk model to follow from it.
The business-wide risk assessment drives the policies, controls and procedures that senior management approves. Those policies must cover customer due diligence, suspicious transaction reporting, a compliance officer at management level, staff screening, training and an independent audit function. If you are writing or rewriting the governance document, our AML program charter template gives you a structure for roles, authority and reporting lines.
You must verify the identity of the customer and the beneficial owner before or during the relationship, or before a transaction for a customer you have no relationship with. For a company, the regulation starts with any natural person who owns 25% or more. You must understand the purpose of the relationship and the customer's ownership and control structure.
If you can't complete due diligence, you must not start or continue the relationship or carry out the transaction, and you should consider an STR. You can rely on a regulated third party for parts of due diligence, but you stay responsible for its accuracy.
For a foreign PEP, you need senior management approval for the relationship, reasonable measures to establish source of funds and wealth, and enhanced ongoing monitoring. For domestic PEPs and people with prominent roles in international organizations, the same measures apply where the relationship is high risk.
Customer due diligence feeds ongoing monitoring, which checks each transaction against what you know about the customer. The regulation also asks you to set indicators of suspicion and keep them current.
Ongoing monitoring sends suspicion to the compliance officer, who decides whether to report to the FIU or keep the matter on file with reasons. That decision belongs to a named person at management level with independence and the right experience. When a report is due, the business must notify the FIU immediately and without delay through the FIU's electronic system, whatever the amount. No one may tell the customer that a report has been or will be filed.
Customer due diligence and every report produce records that you keep for at least five years. The records must be organized well enough to reconstruct individual transactions.
| Duty | Where it comes from | What an inspector will ask to see |
|---|---|---|
| Business-wide risk assessment | Resolution 134, Article 5 | The methodology, the current report and its revisions, with senior management approval |
| Policies and controls | Resolution 134, Article 21 | Approved policies, the compliance officer appointment, training records and the audit report |
| Customer due diligence | Resolution 134, Articles 6 to 10 | Client files with verified identity, beneficial owner and purpose of the relationship |
| PEPs | Resolution 134, Article 16 | Approval records and source of funds and wealth evidence for PEP clients |
| Suspicious transaction reporting | Resolution 134, Articles 17 to 19 | Internal escalations, the compliance officer's decisions and reasons, and goAML filings |
| Records | Resolution 134, Article 25 | Files that let you rebuild a transaction five years later |
The documentation list in the inspector's column follows the Ministry's own guide. It expects the BWRA and CRA methodologies and reports with their revisions, senior management approvals and records of training and staff briefings.
Key insight: an inspector reads a DNFBP's file as a chain. The risk assessment should explain the policy, the policy should explain the client file, and the client file should explain every report or decision not to report. A gap anywhere in that chain is hard to explain to an inspector.
Our AML compliance guide covers the same program elements as they apply to banks. A DNFBP program is smaller, but it's tested on the same logic.
Real estate brokers and agents carry the highest rating among the DNFBP sectors in the Ministry's guide to the national assessment. The guide lists high-value property transactions, the use of third parties and cash-based dealings as its main findings. Our real estate money laundering typology page describes the patterns in more detail.
On top of the core duties, the Ministry's Circular No. 5 of 2022 adds a threshold report for brokers and agents. The circular's subject line calls it a Real Estate Activity Report, and its instructions call it a Real Estate Transaction Report, filed as a REAR on goAML.
A freehold purchase or sale paid with AED 55,000 or more in physical cash triggers a REAR on goAML. That includes a single cash payment or several payments that together reach the threshold, for the whole price or part of it. A freehold deal paid wholly or partly in a virtual asset also triggers a REAR, as do funds converted from a virtual asset. For each of these deals, you collect and record identity documents, receipts, invoices, contracts and the sale and purchase agreement.
When the buyer or seller is a legal person, the REAR file needs the trade licence, articles of association and register of beneficial owners. The circular also asks for ID for every beneficial owner and every shareholder or partner. You keep those records for at least five years.
A REAR does not replace an STR, which the compliance officer still files when there is suspicion. The circular says the REAR doesn't exempt you from STR, SAR, Funds Freeze Report, Partial Name Match Report, High Risk Country Report and High Risk Country Activity Report obligations. In practice the two reports answer different questions. The REAR records a defined type of transaction. The STR records a judgement by your compliance officer that something looks wrong.
The regulation's threshold for this sector is about cash. Linked cash transactions that together reach AED 55,000 bring a dealer in precious metals and stones into scope. Most of the work sits in the word "linked". A customer who buys AED 30,000 of gold on Monday and AED 30,000 on Wednesday has crossed the threshold if the purchases appear to be linked, even though neither receipt has.
The Ministry's goAML page describes the sector widely: producers, intermediate buyers and brokers, cutters and polishers, refiners and jewellery manufacturers that sell to the public or trade in secondary and scrap markets. The Ministry's Circular No. 08/AML/2021 sets the threshold report for the sector. At AED 55,000 in cash, the dealer collects an Emirates ID or passport and files a DPMSR on goAML. For company buyers, wire transfers of AED 55,000 or more also go on a DPMSR. In those company deals, the dealer also takes a copy of the trade licence and the ID of the person representing the company. The dealer keeps those records for at least five years.
The national assessment rates the sector Medium-High, citing cash intensity, cross-border trade and weak responsible sourcing in some segments. Two practical points follow. First, your monitoring has to link a customer's visits, including purchases split across staff, days or branches. Second, a DPMSR is a threshold record. Staying under AED 55,000 removes the DPMSR, not the duty to consider an STR, and a pattern that looks designed to stay under the threshold is exactly what your compliance officer should review.
Illustrative scenario, not a customer result.
A Dubai jewellery retailer licensed on the mainland has one compliance officer. A walk-in customer buys AED 30,000 of gold bars in cash on a Monday and returns on Wednesday to buy another AED 30,000 at a different counter.
Together the purchases reach AED 55,000, so the dealer treats them as linked and files the threshold report. Whether the split was designed to avoid the threshold is a separate question. Software can link the receipts, match the ID and draft the report, but only the compliance officer can decide whether the pattern is suspicious.
Corporate service providers form the companies, provide the addresses and sometimes supply the nominee directors and shareholders that other people hide behind. The regulation brings them into scope for exactly those services, including acting as a nominee shareholder for another person. The Ministry's goAML page describes the sector as providing company establishment or business administration services to third parties.
The national assessment rates corporate service providers Medium, citing potential misuse of legal persons, nominee arrangements and the difficulty of verifying ultimate beneficial owners. Beneficial ownership is the core of the work, and the regulation sets out the order:
The Ministry's guide adds two expectations that matter for a provider that keeps acting for a company after formation. It asks for stronger due diligence on structures that are complex or opaque. It also asks DNFBPs to monitor changes in ownership, control or authorized representatives that may indicate misuse.
Lawyers, notaries and accountants who provide the same services carry the same due diligence duties when they act in a listed transaction. Their reporting duty has one important limit. Lawyers, notaries, other independent legal professionals and independent statutory auditors are exempt from the STR duty for information obtained while assessing a client's legal position, representing the client in proceedings, or in other circumstances subject to professional secrecy.
Every DNFBP needs goAML access before it needs to file. The Ministry's goAML page states that all DNFBPs were required to register on the portal and that failure to register may lead to penalties. Our step-by-step guide to goAML registration and STR filing in the UAE walks through registration, roles and the filing workflow.
The STR duty in the law is direct. Where a DNFBP suspects, or has reasonable grounds to suspect, that funds are proceeds of crime or linked to it, it must notify the FIU without delay with a detailed report on the transaction and the parties. There is no minimum amount, and the duty applies regardless of value.
Targeted financial sanctions run on a different clock. The Ministry's targeted financial sanctions page lists the DNFBP obligations under Cabinet Resolution No. 74 of 2020. The first is registration in the automatic sanctions reporting system, so you receive listing updates for the local terrorist lists and UN lists. Before any transaction or new relationship, you search your customer database to confirm the person isn't listed. Screen every beneficial owner against the sanctions and local terrorist lists, and freeze without delay on a match. The freeze comes without prior notice to the listed person, and you also need procedures that stop staff from tipping off a customer.
For UN Security Council Resolutions 1718 (2006) and 2231 (2015), which cover North Korea and Iran, the Ministry's Circular No. 2 of 2022 sets reporting deadlines. A confirmed match goes on a Funds Freeze Report within 5 business days of the freeze. A potential match goes on a Partial Name Match Report within 5 business days of applying suspension measures. Check the Ministry's current circulars before you rely on any deadline, because the sanctions instructions are updated more often than the law.
Senior management approves the risk assessment and policies, staff collect due diligence and threshold data, any AI agent layer prepares the file within limits the business sets, the compliance officer decides what is reported, and the supervisor and FIU receive what the law requires.
| Component | Responsibility | Boundary |
|---|---|---|
| Senior management | Approves the business-wide risk assessment, policies, controls and procedures. | Does not decide individual suspicious transaction reports. |
| Front-line staff | Collect identity documents, deal documents and payment details at the point of sale or engagement. | Escalate concerns internally and never tip off the customer. |
| AI agent layer (optional) | Traces ownership, screens parties, links transactions and drafts reports from the case evidence. | Does not file with the FIU, acts only within the autonomy the business sets, and stops when the kill switch is used. |
| Compliance officer | Reviews escalations, decides whether to report to the FIU or keep the matter on file with reasons, and reports to senior management. | Remains accountable for reporting decisions whatever the software does. |
| Supervisor and UAE FIU | The supervisor inspects and can impose administrative penalties; the FIU receives STRs and threshold reports through goAML. | External bodies; the business does not delegate its duties to them. |
Senior management approves the risk assessment and policies, and the compliance officer decides every report to the FIU and records the reasons. Any AI agent works only within the autonomy the business sets, and anyone authorized can switch it off.
Repeal of the 2018 law, survival of consistent older circulars, STR duty regardless of value, administrative fines of AED 10,000 to AED 5,000,000 per violation.
UAE federal law, issued September 30, 2025; MoET-hosted copy.
2026-10-14
DNFBP scope and thresholds (Article 3), risk assessment, CDD, 25% beneficial ownership, PEPs, STRs, compliance officer and five-year records.
UAE executive regulation, issued October 29, 2025; MoET-hosted copy.
2026-10-14
REAR triggers for freehold deals paid with AED 55,000 or more in cash or involving virtual assets; legal-person documents; REAR does not replace STRs.
Real estate brokers and agents supervised by MoET; issued under the 2018 framework.
2026-10-14
DPMSR for cash transactions of AED 55,000 or more, and company wire transfers of AED 55,000 or more; five-year records.
Dealers in precious metals and stones licensed in the UAE; issued under the 2018 framework.
2026-10-14
Sector risk ratings, BWRA and CRA expectations, documentation an inspector expects, nominee and ownership monitoring.
Supervisory guidance for DNFBPs, not legislation.
2026-10-14
Registration for listing notifications, screening of parties and beneficial owners, freeze without delay and without prior notice, and FFR and PNMR within 5 business days for UNSCRs 1718 (2006) and 2231 (2015) under Circular No. 2 of 2022.
DNFBPs under Cabinet Resolution No. 74 of 2020.
2026-10-14
| Metric | Definition | Decision guardrail |
|---|---|---|
| Policy-to-control coverage | Share of policy clauses mapped to a live, tested control. | A clause with no control is reported as a gap, not hidden. |
| Beneficial owner completion | Share of corporate clients with the beneficial owner identified and verified. | An untraced chain stays open with the reason recorded. |
| Threshold report timeliness | Share of REARs or DPMSRs filed within your internal deadline. | Measured against the transaction date, not the review date. |
| STR decision record | Share of escalations with a written compliance officer decision and reason. | Every decision not to report keeps its reason on file. |
| Screening coverage | Share of parties, including beneficial owners, screened before the transaction. | A missed party blocks completion until screened. |
A UAE DNFBP's AML program is judged as one chain. The business-wide risk assessment sets the policy, the policy sets what goes in each client file, and the client file has to explain every threshold report, every STR and every decision not to report. The 2025 law changed the legal basis but kept the REAR and DPMSR circulars in force where they don't conflict, so most of the day-to-day work stays the same. What an inspector checks is whether the compliance officer's decisions are written down and can be traced back.
If your team is deciding how much of the file work to automate, our page on FluxForce for DNFBPs shows where AI agents prepare client files and draft reports while your compliance officer keeps every filing decision.
A DNFBP is a business or profession that carries out the commercial or professional activities listed in Article 3 of Cabinet Resolution No. 134 of 2025. The groups are commercial gaming operators, real estate brokers and agents, dealers in precious metals and stones, lawyers, notaries and independent accountants, and company and trust service providers.
Under the regulation, a dealer is in scope when it carries out cash transactions of AED 55,000 or more, single or linked. Because a single walk-in customer can cross that threshold, it's safer to plan your controls as if you are in scope. Check your own position with your supervisor or legal counsel.
A REAR and a DPMSR are threshold reports set by Ministry circulars for real estate and precious metals transactions. An STR is a suspicion report under the law, with no minimum amount. Filing a REAR doesn't remove the duty to file an STR when there's suspicion.
The compliance officer decides whether to report suspicious transaction data to the FIU, files through goAML, and reports periodically to senior management on the program.
At least five years from completion of the transaction or the end of the business relationship, and longer in some cases, such as after an inspection or investigation.
Yes, provided the business stays responsible for the outcome. The regulation allows reliance on regulated third parties for parts of due diligence, but the business remains responsible for accuracy. With FluxForce, agents prepare the file and draft reports, and your compliance officer reviews, edits and files them.
No. Circulars issued under the 2018 law remain effective insofar as they don't conflict with the 2025 law, until replacements are issued. Watch the Ministry's circulars page for any update.