Under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, mainland and free zone entities in the UAE face automated, real-time verification of their Ultimate Beneficial Owner (UBO) records and anti-money laundering controls. Supervisory authorities now cross-check corporate registries, banking data, and goAML portal filings simultaneously. Any discrepancy between your public trade license records, bank declarations, and internal statutory registers risks administrative fines ranging from AED 20,000 to AED 5,000,000 alongside trade license suspension.
This regulatory framework targets Designated Non-Financial Businesses and Professions (DNFBPs), investment holding vehicles, family offices, and cross-border commercial traders. Static compliance manuals kept on a shelf no longer satisfy inspection teams. Regulators now require verifiable operational proof that your business screens transactions, identifies beneficial ownership through multi-tiered corporate layers, and actively reports suspicious patterns.
Key Takeaways
- Digital integration allows corporate registries, the FIU, and commercial banks to cross-check UBO declarations automatically in real time.
- Statutory penalties under Cabinet Resolution No. 134 of 2025 scale from AED 20,000 to AED 5,000,000, with repeated infractions causing license cancellation.
- DNFBPs, corporate service providers, real estate brokers, and commodity traders must maintain active transaction monitoring on the goAML portal.
- Declaring a legal entity as the ultimate owner without piercing through to natural persons owning 25% or more leads to an immediate registry freeze.
- Commercial banks are freezing accounts where corporate KYC data diverges from federal registry entries.
What changes under Decree-Law No. 10 of 2025?
Federal Decree-Law No. 10 of 2025 marks a structural pivot in the UAE's anti-money laundering regime. In preceding years, regulatory bodies focused on establishing baseline administrative compliance: requiring entities to draft an AML/CFT manual, appoint a compliance officer on paper, and submit an initial registration on the Financial Intelligence Unit's (FIU) goAML platform.
That introductory phase has concluded. The Ministry of Economy, the Central Bank of the UAE, and local licensing departments have shifted from passive documentation reviews to active operational testing. Under the enhanced framework, authorities assess whether internal policies match daily commercial conduct. Inspectors look at the date stamps on client due diligence files, cross-reference transaction values against client economic profiles, and evaluate whether a company's compliance officer has filed mandatory notifications.
This development operates alongside the broader UAE enhanced AML framework, which aligns federal requirements with mutual evaluation criteria established by the Financial Action Task Force (FATF). Under Cabinet Resolution No. 134 of 2025, enforcement powers are direct, digitized, and largely automated. Supervisory bodies do not need to conduct an on-site visit to uncover discrepancies; automated data pipelines surface irregularities remotely.
Active Monitoring Replaces Paper Compliance
Holding a generic AML policy template without documented screening results, customer risk assessments, and verified transaction files is treated as a systemic compliance failure. Regulators require tangible audit trails for all client onboarding and ongoing reviews.
Which entities qualify as DNFBPs under federal law?
The statutory definitions under Federal Decree-Law No. 10 of 2025 apply to professional intermediaries, high-value asset brokers, and entities engaged in structuring corporate vehicles. If your enterprise conducts any of the qualifying business activities, you fall squarely under DNFBP supervision regardless of whether you operate on the mainland or within a commercial free zone.
Specific sectors subject to direct supervisory oversight include:
- Trust and Company Service Providers (TCSPs): Entities that assist with business setup, provide registered office addresses, act as nominee directors or shareholders, or manage holding structures on behalf of third parties.
- Real estate brokers and developers: Intermediaries participating in transactions involving the purchase, sale, or long-term lease of real property for foreign or domestic buyers.
- Dealers in precious metals and stones: Commercial traders and wholesale distributors completing single or linked transactions involving physical precious metals, rough diamonds, or jewelry.
- Independent accountants and auditors: Firms providing accounting services, financial record preparation, audit verifications, or capital restructuring advice.
- Lawyers, notaries, and legal professionals: Practitioners preparing or executing transactions for clients concerning property acquisition, business entity formation, asset management, or bank account opening.
Entities operating in commercial free zones face identical scrutiny. The legal obligation to identify beneficial owners and file transaction reports is identical whether a firm is licensed in an economic department on the mainland or situated inside a free zone, as outlined in our analysis of free zone AML/CFT obligations.
Beyond Traditional DNFBPs: Family Offices and Holding Entities
Decree-Law No. 10 of 2025 extends operational scrutiny toward entities that might not hold a traditional DNFBP trading license but handle significant private capital. Single family offices, multi-jurisdictional holding companies, and private investment vehicles managing international capital flows are under enhanced monitoring.
Supervisory authorities review these entities to prevent the use of multi-tiered shell arrangements designed to conceal source of funds or beneficial control. Where an entity provides treasury, management, or administrative functions to affiliated group companies, regulators examine whether those services meet the threshold of corporate service provision.
How does real-time cross-verification work?
The operational core of the 2025 regulatory changes is inter-agency systems integration. In previous years, corporate information resided in isolated silos: the Department of Economy and Tourism (DET) or free zone authorities held shareholder registries, commercial banks held separate Know Your Customer (KYC) records, and the Ministry of Economy supervised goAML reports independently.
That fragmentation no longer exists. Digital integration links corporate licensing authorities, the FIU, the Ministry of Economy, and domestic commercial banks into a continuous data exchange loop.
+----------------------------+ +-----------------------------+
| Corporate Registry | | Commercial Banks |
| (DET / Free Zone Auth.) | | (KYC & Transaction Data) |
+--------------+-------------+ +--------------+--------------+
| |
v v
+---------+------------------------------------+---------+
| Unified National Economic Register (NER) |
| Automated Beneficial Ownership Audit |
+-------------------------+------------------------------+
|
v
+---------------+---------------+
| Ministry of Economy / FIU |
| (goAML Reporting) |
+-------------------------------+
When an enterprise updates its trade license, files an annual economic substance notification, opens a corporate banking facility, or submits a goAML filing, the data passes into the centralized registry system. The automated audit engine evaluates key data points:
- Beneficial ownership consistency: The natural person declared as the UBO on your trade license must match the beneficial owner declared on your corporate bank mandate.
- Shareholding percentage accuracy: Any natural person owning or controlling 25% or more of voting equity across all ownership layers must be identified with a valid Emirates ID or passport.
- Managerial and operational control: Where ownership is divided below 25% across dispersed holdings, the declared UBO must reflect the individual exercising effective operational control, such as the Managing Director or Chief Executive Officer.
- Sanctions list matching: Client and beneficial owner details run continuously against the UAE National Terrorist List and the UN Consolidated Sanctions List.
If the digital audit reveals a mismatch (for example, if a company reports an offshore entity as its owner to the licensing authority without declaring the underlying individual to the bank), the system generates an automated compliance flag. This alert prompts a formal inquiry, a suspension of registry modifications, or a direct site audit.
Audit Cross-Platform Naming Conventions
Discrepancies often stem from administrative carelessness rather than intentional evasion. Transposed names, differing transliterations from Arabic to English, or outdated passport numbers between your commercial license and bank KYC files can trigger automated flags. Reconcile these records across all platforms immediately.
What penalties apply under Cabinet Resolution No. 134 of 2025?
Cabinet Resolution No. 134 of 2025 establishes clear administrative penalties for non-compliance. Sanctions apply progressively based on the severity of the violation, whether the entity has failed previous audits, and how promptly the leadership cooperates with regulatory inspectors.
| Violation Type | Regulatory Action | Financial Penalty |
|---|---|---|
| Failure to maintain or update internal UBO registers | Formal warning notice and registry modification freeze | AED 20,000 to AED 100,000 |
| Inaccurate, incomplete, or contradictory beneficial ownership filings | Trade license renewal block | AED 50,000 to AED 200,000 |
| Failure to register, appoint a compliance officer, and monitor goAML | Operational review notice and supervisory summons | AED 50,000 to AED 500,000 |
| Neglecting internal AML controls, screening, and suspicious activity reporting | Temporary trade license suspension (up to 6 months) | AED 100,000 to AED 1,000,000 |
| Egregious, repeated, or systemic non-compliance | Commercial license cancellation and referral to public prosecution | Up to AED 5,000,000 |
The Cascade Effect on Commercial Banking
Financial fines represent only the direct regulatory cost. For most operating companies, the indirect commercial consequences are far more damaging.
When a licensing authority flags an entity for beneficial ownership discrepancies or goAML failures, that status communicates directly to the banking system. Commercial banks operate under strict anti-money laundering mandates from the Central Bank of the UAE. A regulatory flag or license renewal block triggers an immediate internal risk reassessment by your bank.
The typical institutional response unfolds rapidly:
- Inward and outward international foreign exchange wires are frozen pending enhanced documentation.
- Daily transactional accounts are restricted or placed on debit-freeze status.
- The compliance desk issues an un-negotiable 30-day account closure notice if remediation is not achieved promptly.
- The company and its registered directors are entered into internal compliance databases, complicating attempts to establish replacement banking relationships elsewhere in the country.
Further detail on how regulatory bodies approach enforcement escalations is detailed in our guide on avoiding DNFBP UBO fines and license suspensions.
What are the mandatory compliance controls for DNFBPs?
To withstand an audit under Decree-Law No. 10 of 2025, qualifying businesses must implement four primary compliance components. These procedures must be active, documented, and fully integrated into daily commercial operations.
1. Verification of the Real Beneficial Owner (UBO)
Under UAE statutory rules, every commercial legal entity must identify every natural person who holds ultimate ownership or control. Relying on an intermediate corporate holding company, trust, or offshore vehicle is strictly insufficient.
- The 25% threshold: Identify every individual who owns or controls 25% or more of the company's shares or voting rights, directly or through intermediate entities.
- Trace through indirect chains: If Company A is owned by a BVI holding company, which is owned by a Cayman foundation, the compliance register must trace upward through each entity until it identifies the natural person holding the underlying interest.
- The control test: If no individual holds 25% or more, identify the natural person who exercises practical control over operational or financial decisions through formal voting agreements, power of attorney, or family governance arrangements.
- The senior management fallback: If no natural person meets either test, the entity must register its senior executive manager as the UBO on the official register.
To align with broader regulatory expectations, companies should review the statutory procedures detailed in our report on accurate beneficial ownership records.
2. Operationalizing goAML and Mandatory Reporting
Registering on the FIU's goAML portal is step one. Maintaining compliance requires understanding which specific report types apply to your commercial transactions:
- Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs): Mandatory filings when a business suspects or has reasonable grounds to suspect that transaction funds derive from illicit activity or relate to money laundering or terrorist financing.
- Dealers in Precious Metals and Stones Reports (DPMSRs): Required for cash transactions or payment instruments equal to or exceeding AED 55,000 carried out by precious metal or gem traders.
- Real Estate Activity Reports (REARs): Required for real estate transactions involving cash payments of AED 55,000 or more, or transactions involving virtual assets.
- Partial Name Match Reports (PNMRs): Required when a client or counterparty partially matches an entry on an official sanctions list, allowing the FIU to review the entity.
Inaction Is Treated as Non-Compliance
Firms that remain registered on goAML for years without ever completing an annual risk review, updating their compliance officer details, or screening their client base are classified as high risk by supervisory algorithms. Dormancy on the platform triggers automated inspection notices.
3. Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)
Every DNFBP must execute customer due diligence prior to establishing a commercial relationship or executing an occasional transaction. The diligence level must correspond to the customer's risk profile:
- Standard Customer Due Diligence: Collect and verify certified corporate documents, constitutional instruments, trade licenses, and the identification of authorized signatories and beneficial owners. Establish the legitimate nature and economic purpose of the commercial relationship.
- Enhanced Due Diligence: Compulsory when dealing with Politically Exposed Persons (PEPs), clients residing in designated high-risk jurisdictions, complex cross-border ownership arrangements, or transactions involving significant volumes of cash or virtual assets. EDD requires verifying the legitimate source of wealth and source of funds through bank statements, audited accounts, or tax returns, alongside senior management sign-off before onboarding.
- Continuous ongoing monitoring: Customer profiles must be reviewed systematically. High-risk accounts require review at least annually; medium and low-risk accounts require updates every two to three years, or whenever a material change occurs in the client's corporate structure or transaction volume.
4. Appointment and Governance of a Compliance Officer
Every DNFBP must designate a qualified compliance officer. This individual carries direct statutory responsibility for overseeing internal AML systems, liaising with the Ministry of Economy and the FIU, and ensuring employees complete mandatory training.
The compliance officer must possess sufficient autonomy, seniority, and unfettered access to all commercial transaction records, client agreements, and executive deliberations. Under Decree-Law No. 10 of 2025, supervisory bodies require that this individual demonstrate adequate knowledge of UAE AML laws during regulatory interviews.
What pitfalls trigger regulatory audits and sanctions?
Regulatory inspections are rarely random. Authorities analyze cross-registry flags, banking reports, and corporate filings to target companies exhibiting measurable risk indicators. Companies frequently encounter regulatory issues through several recurring mistakes:
- Relying on nominee arrangements without disclosure: Some businesses use nominee shareholder or director agreements to fulfill regulatory requirements or preserve privacy without documenting the real beneficial owner on official registers. Under Resolution No. 134 of 2025, this constitutes a severe violation, leading directly to license suspension and legal referral.
- Holding expired identification documents: Failing to update the register when a beneficial owner or director renews their passport or Emirates ID. Automated registry audits flag expired credentials instantly.
- Using generic AML manual templates: Adopting a copied compliance manual that references foreign legislation (such as UK or European directives) without addressing UAE federal statutes, local reporting thresholds (such as the AED 55,000 cash rule), or the goAML reporting framework.
- Failing to train front-line personnel: Omitting regular, documented training for employees who handle client onboarding, property sales, or corporate advisory services. Inspectors consistently request employee training logs during audits.
- Ignoring the AED 55,000 threshold: Real estate agencies and precious metal traders failing to record and file cash or virtual asset payments that hit or exceed the statutory limit of AED 55,000.
For a broader perspective on federal statutory developments, consult our analysis of the UAE AML/CFT compliance overhaul and legal framework.
What should UAE businesses do now?
If your enterprise operates in mainland UAE or within any commercial free zone, evaluate your internal compliance records before a regulatory notification arrives. The immediate priority is reconciling internal records with external filings. Cross-verify the shareholder, director, and UBO details documented on your commercial trade license against what is held on file by your corporate banks, your goAML profile, and your internal statutory registers. Any naming variance, outdated residential address, or omitted intermediate holding vehicle should be corrected immediately across all systems.
Next, confirm that your designated compliance officer is actively managing the goAML portal. Review your client onboarding files to ensure that risk classifications, verified identity documents, and source-of-wealth proofs are present for every active customer, especially those categorized as high-risk or involving complex offshore structures. Documenting these processes creates the verifiable operational trail that supervisory authorities demand under Decree-Law No. 10 of 2025.
Where corporate structures involve multi-tiered overseas holding vehicles, family offices, or specialized DNFBP activities, engaging independent regulatory counsel provides an objective assessment of your operational posture. Carrying out a structured compliance audit now insulates your business against administrative penalties, preserves your commercial banking relationships, and ensures uninterrupted licensing across the Emirates.
Source & References
This article is for general information only and does not constitute professional, legal, tax, or financial advice. Speak to Aurne for guidance specific to your situation.