Some UAE businesses outside the financial sector have specific anti-money-laundering obligations because their services or transactions can be exposed to elevated risk. These designated non-financial businesses and professions, or DNFBPs, need more than a trade licence and a generic policy: they require risk-based controls that operate in real customer work.
The Ministry of Economy and Tourism’s official DNFBP and goAML guidance identifies relevant sectors and states that registration on the goAML reporting portal is mandatory for DNFBPs. Businesses should confirm their supervisory authority and current legal requirements rather than relying on an old checklist.
Who may fall within DNFBP scope?
| Activity | Typical trigger | First check |
|---|---|---|
| Real estate | Buying or selling property for customers | Map services and transaction role |
| Auditing or accounting | Professional assurance or financial services | Confirm regulated activity |
| Precious metals or stones | Production, broking, refining or trade | Review customer and cash exposure |
| Trust or company services | Formation, registered address or administration | Identify services provided to third parties |
| Legal services | Specified transactions for clients | Confirm scope and professional rules |
Classification depends on actual activity, not only the company name. Record the analysis and seek competent advice where the position is unclear.
Build the compliance framework
- Document enterprise-wide money-laundering, terrorist-financing and proliferation-financing risks
- Appoint an appropriately empowered compliance officer or MLRO
- Create customer and beneficial-owner verification procedures
- Apply enhanced checks where risk is higher
- Screen sanctions and targeted-financial-sanctions requirements
- Train relevant staff and test understanding
- Keep records and review controls periodically
Beneficial ownership data must stay aligned with corporate records. Use our UAE beneficial-owner guide and business record-keeping guide to organise the evidence trail.
Customer due diligence is not a single form
Identify the customer, verify reliable documents, understand the purpose of the relationship and establish the beneficial owner where relevant. Risk rating should consider service, geography, delivery channel, transaction pattern and ownership complexity. Refresh information when circumstances change.
Digital records need controlled access and incident planning. The UAE cyber-incident response guide explains containment and evidence preservation, while the online transaction records guide shows why clear payment evidence matters.
goAML and suspicious reporting
goAML registration enables regulated entities to submit suspicious transaction and activity reports. Staff must know how to escalate an internal concern without alerting the customer. A delayed report, a poor narrative or tipping off can create serious risk.
Do not create a transaction threshold and treat everything below it as automatically safe. Suspicion comes from context, behaviour and inconsistencies as well as value.
Audit and management oversight
Senior management should receive meaningful information: overdue reviews, high-risk customers, alerts, training gaps and remediation dates. Independent testing should confirm that files match policy. Our operational-risk guide offers useful governance principles even though its specific regulatory scope differs.
When evidence is disputed, a clear chronology helps. See the Dubai business-dispute records guide, the cashless-payments checklist and the e-invoicing record update.
Test the framework with real files
A useful annual review samples actual customer files rather than checking only whether a policy exists. Test whether identity evidence is current, ownership was resolved, risk ratings are supported, alerts were closed properly and reports were escalated without delay. Assign each weakness to an owner with a completion date, then verify closure. When the business adds a service, country, payment channel or customer type, update the risk assessment before assuming existing controls remain adequate.
Questions people often ask
What does DNFBP mean?
It means designated non-financial business or profession, covering specified higher-risk activities outside conventional financial institutions.
Is goAML registration mandatory?
The Ministry’s guidance states that DNFBPs must register on goAML to file required suspicious reports.
Does a small business still need a risk assessment?
Size affects how controls are designed, but it does not remove applicable legal obligations.
Should every unusual transaction be reported?
Unusual activity should be assessed under the business’s procedures. A report is required when the legal suspicion threshold is met.
Can staff tell a customer that a report was filed?
No. Unlawful disclosure or tipping off can breach AML obligations.
