UAE businesses are facing increasing attention on corporate governance, ownership records, anti-money laundering controls and regulatory compliance.
The UAE Economic Integration Committee has reviewed measures relating to corporate governance, AML/CFT controls, inspections and the use of regulatory data.
For businesses, the key message is clear: corporate records, ownership information, AML procedures and supporting documentation should be accurate, current and consistent.
The recent UAE discussions on stronger corporate governance and AML supervision do not, by themselves, create a new universal filing deadline for every UAE company.
Businesses should instead ensure that their existing corporate, ownership and AML obligations are properly maintained and supported by appropriate records.
Did the UAE Introduce New Corporate Governance or AML Rules?
The UAE Economic Integration Committee has discussed strengthening corporate governance, anti-money laundering and counter-terrorism financing measures, inspections and the use of regulatory information.
The announcement does not establish a single new AML filing deadline applicable to all UAE businesses.
However, the increased focus on regulatory data and inspections means businesses should be prepared to demonstrate that their existing compliance obligations are being followed in practice.
Do not wait for an inspection or regulatory request before checking your company records, UBO information, management resolutions, AML policies, customer files and goAML access.
What Areas Are Receiving Greater Attention?
| Area | What Businesses Should Check |
|---|---|
| Corporate Governance | Ownership records, management authority, approval procedures, company registers and accountability. |
| AML / CFT | Risk assessments, customer due diligence, enhanced due diligence, screening, monitoring and reporting. |
| Regulatory Inspections | Current compliance files, written procedures, evidence of implementation and management oversight. |
| Regulatory Data | Consistency between trade licences, UBO records, tax information, bank records, accounts and customer documentation. |
Existing UAE Corporate Governance and AML Requirements
Businesses should understand that stronger regulatory attention does not replace the existing legal and regulatory requirements that already apply to them.
The exact compliance obligations depend on the company's legal form, business activity, licensing authority and relevant regulator.
| Law / Regulation / Guidance | General Area Covered |
|---|---|
| Federal Decree-Law No. 10 of 2025 | Money laundering, terrorism financing and proliferation financing. |
| Cabinet Resolution No. 134 of 2025 | Executive regulations supporting the UAE AML legislative framework. |
| Ministry DNFBP AML Guidance | Risk assessments, customer checks, monitoring, reporting, record keeping and staff training. |
| Cabinet Decision No. 109 of 2023 | Procedures relating to beneficial ownership and company ownership information. |
| Federal Decree-Law No. 32 of 2021 | Company formation, management, shareholder rights, corporate records and company obligations. |
Businesses should determine which requirements apply to their specific structure and regulated activities instead of applying a generic compliance checklist.
Which UAE Businesses Are Most Affected?
Private LLCs
Review ownership records, manager authority, resolutions, UBO information, financial records and licence details.
Real Estate Businesses
Review customer identification, beneficial ownership, source-of-funds information, transaction records and suspicious activity procedures.
Accountants & Auditors
Review client risk ratings, CDD files, enhanced due diligence, screening results and suspicious activity procedures.
Precious Metals & Stones Dealers
Review high-value transactions, cash transactions, sanctions checks, source-of-funds evidence and supporting trade records.
Trust & Company Service Providers
Review customer onboarding, ownership structures, nominee arrangements, registered addresses and ongoing customer checks.
Public Joint-Stock Companies
Review board structures, committees, disclosures, conflicts of interest and related-party transactions.
Free Zone Companies
Review federal requirements alongside applicable free zone, registrar and sector-specific obligations.
Other Regulated Businesses
Businesses regulated by specialised authorities should identify and follow the requirements applicable to their specific sector.
Which Businesses Are Classified as DNFBPs in the UAE?
Designated Non-Financial Businesses and Professions, commonly known as DNFBPs, have specific AML obligations under the UAE framework.
Main DNFBP categories supervised by the Ministry include:
- Real estate brokers and agents involved in relevant property transactions.
- Independent accountants and auditors providing professional services to third parties.
- Dealers in precious metals and stones, including businesses dealing in gold and diamonds.
- Trust and company service providers involved in forming or administering companies and related services.
Lawyers, financial institutions, virtual-asset service providers and businesses operating under financial free zone regimes may fall under other supervisory authorities.
Corporate Governance Checks for UAE Companies
Corporate governance is not limited to large listed companies. Private UAE companies should also maintain clear records showing who owns the business, who controls it and who has authority to make important decisions.
| Governance Area | Records the Company Should Maintain |
|---|---|
| Ownership & UBO | Updated shareholder register, UBO information, ownership chart and nominee information where relevant. |
| Manager & Board Authority | Written confirmation of who can sign contracts, approve payments, hire employees, borrow funds and deal with financial institutions. |
| Approval Limits | Clearly documented approval levels for purchases, payments, contracts, loans and major commitments. |
| Meetings & Resolutions | Signed shareholder and board resolutions and appropriate meeting records. |
| Conflicts of Interest | Declarations and documentation relating to personal interests of directors, managers and shareholders. |
| Financial Records | Accurate accounts, reconciliations, invoices, supporting documents and management reports. |
| Consistency of Information | Consistent legal name, ownership, business activity and address across corporate and financial records. |
Key AML Requirements for UAE DNFBPs
Conduct a Business Risk Assessment
Assess money laundering and terrorism financing risks associated with customers, countries, services, products, ownership structures, transaction values and payment methods.
Maintain Effective AML Policies
AML policies should clearly address customer acceptance, customer due diligence, enhanced due diligence, sanctions screening, transaction monitoring, reporting and record keeping.
Appoint a Compliance Officer or MLRO
Where required, appoint a qualified Compliance Officer or Money Laundering Reporting Officer with appropriate access to customer information, transaction data, management and relevant reporting systems.
Perform Customer & Beneficial Owner Checks
Identify customers, authorised representatives and ultimate beneficial owners. Apply enhanced checks where higher-risk customers, politically exposed persons, complex structures or higher-risk jurisdictions are involved.
Conduct Screening & Transaction Monitoring
Screen customers and connected parties against applicable sanctions and PEP lists and maintain dated evidence of screening and review.
Maintain goAML & Reporting Procedures
Relevant DNFBPs should maintain active registration and appropriate access to goAML and establish internal escalation procedures for suspicious transactions or activities.
Maintain Records, Training & Testing
Maintain required AML records, train relevant employees and periodically test whether the company's procedures are being implemented effectively.
What Should a Complete Customer Due Diligence File Contain?
Customer due diligence is more than simply collecting an Emirates ID or passport.
A properly maintained customer file should demonstrate who the customer is, who controls the customer, why the relationship exists and, where required, how funds or wealth are sourced.
| CDD Area | Examples of Supporting Records |
|---|---|
| Customer Identity | Passport, Emirates ID, trade licence and incorporation documents. |
| Authorised Representative | Board resolution, power of attorney or authorised signatory information. |
| Beneficial Owner | Ownership chart, shareholder records and identity documents for the final natural person who owns or controls the business. |
| Purpose of Relationship | Engagement letter, transaction agreement, property agreement or customer explanation. |
| Source of Funds | Bank statements, sale agreements, business income, investment documents or other relevant evidence. |
| Customer Risk Rating | Documented low, medium or high-risk classification supported by the business risk assessment methodology. |
| Screening | Dated sanctions, PEP and relevant adverse-information screening records. |
UBO and Company Records: What Should Be Updated?
UAE companies should identify the natural person who ultimately owns or controls the business and maintain appropriate supporting records.
Where ownership involves multiple companies, trusts, nominees or foreign entities, the company should maintain documentation showing the ownership chain through to the ultimate beneficial owner.
- Ultimate Beneficial Owner register
- Shareholder or partner register
- Manager, director and authorised signatory information
- Nominee director or nominee shareholder information, where applicable
- Ownership charts for complex or layered structures
- Identity and address documents for shareholders and UBOs
- Shareholder resolutions and share-transfer documents
- Evidence that relevant ownership changes have been properly reported
Company information should be consistent across the trade licence, constitutional documents, bank KYC records, Corporate Tax records, accounting records and documents provided to auditors or other professional advisers.
What Documents Could UAE Inspectors Request?
Businesses should maintain a structured compliance file so that important documents can be produced efficiently if requested by the relevant authority.
| Inspection Area | Documents to Keep Ready |
|---|---|
| Corporate Governance | Organisation chart, authority limits, resolutions, meeting minutes and conflict declarations. |
| AML Responsibility | Compliance Officer / MLRO appointment, management approvals and AML reports. |
| Business Risk | Current Business Risk Assessment, risk methodology and management approval. |
| Customer Files | CDD and EDD files, customer risk ratings, UBO documents and review dates. |
| Screening | Sanctions, PEP and relevant adverse-information checks with dates and review notes. |
| goAML | Entity registration, active MLRO access and internal reporting procedures. |
| Staff Training | Training materials, attendance records, assessments and follow-up actions. |
| AML Testing | Internal audit, independent assessment results and corrective-action records. |
Six Corporate Governance and AML Checks Businesses Can Complete Now
Confirm Your Requirements
Check your company's legal form, licensed activities, regulator and whether the business falls within a DNFBP category.
Compare Your Company Records
Compare your trade licence, constitutional documents, UBO register, bank records and Corporate Tax information for consistency.
Test Customer Files
Select representative low, medium and high-risk customers and check identity, ownership, screening, risk ratings and source-of-funds documentation.
Check goAML Access
Confirm that the relevant entity registration and Compliance Officer or MLRO access remain active and contain current information.
Correct Missing Records
Update expired identification documents, ownership charts, customer risk ratings, training records and company resolutions.
Document Management Approval
Prepare a list of required corrections, assign responsibility, record target dates and retain evidence that management has reviewed the compliance actions.
Do UAE Free Zone Companies Have AML Obligations?
A free zone licence does not automatically provide a general exemption from UAE AML obligations.
Where a free zone company conducts an activity covered by applicable federal AML legislation or the requirements of its supervisory authority, the relevant obligations should be followed.
Free zone businesses should review both the requirements applicable to their licensed activity and the rules of their relevant licensing or supervisory authority.
Is goAML Registration Required for DNFBPs?
Relevant DNFBPs are required to register with the UAE's goAML system and maintain appropriate access for their appointed Compliance Officer or MLRO.
The system supports the submission of suspicious transaction and suspicious activity reports where the reporting obligation arises.
Businesses should also establish internal procedures so employees know how to escalate potential AML concerns to the responsible Compliance Officer or MLRO.
How Long Should AML Records Be Kept?
Relevant AML records, including customer due diligence, transaction information, risk assessments and suspicious-reporting records, generally need to be retained for at least five years, subject to applicable requirements.
Businesses should ensure that records are organised, retrievable and protected against unauthorised alteration or loss.
What Does an MLRO Do?
The Money Laundering Reporting Officer, or MLRO, plays a central role in the AML compliance framework of an applicable business.
- Overseeing the AML compliance programme
- Reviewing customer due diligence procedures
- Monitoring relevant transactions and risk indicators
- Managing internal AML escalations
- Maintaining appropriate goAML access
- Coordinating AML training
- Assessing suspicious activity and reporting requirements
- Maintaining appropriate AML records
Senior management should provide the MLRO with appropriate authority, access to information and resources necessary to perform the role.
What Is an AML Business Risk Assessment?
An AML Business Risk Assessment identifies and evaluates the money laundering and terrorism financing risks associated with a business.
Depending on the business, the assessment may consider:
- Customer risk
- Geographic and country risk
- Product and service risk
- Delivery-channel risk
- Ownership and control structures
- Transaction risk
- Payment methods
The assessment should also explain the controls the business uses to reduce and manage the identified risks.
Common Corporate Governance and AML Mistakes
Outdated UBO Information
Ownership changes are not reflected consistently across corporate and regulatory records.
Incomplete CDD Files
Customer identity documents exist, but ownership, purpose, risk or source-of-funds information is missing.
Weak Risk Assessment
The Business Risk Assessment is generic and does not reflect the actual products, customers or transactions.
Expired Documents
Identification documents and corporate records are not reviewed and updated on a timely basis.
Poor Screening Records
Screening may have been performed, but the business cannot demonstrate when and how the checks were completed.
No Evidence of Training
Employees may have received informal instructions without proper training records or documented assessments.
Frequently Asked Questions
Did the UAE announce a new AML filing deadline in 2026?
The recent Economic Integration Committee discussion did not announce a new universal AML filing deadline for UAE businesses. Companies should continue complying with the requirements applicable to their activities and regulatory status.
What is corporate governance?
Corporate governance refers to the systems, policies, authority structures and controls through which a company is managed and decisions are made.
What does AML mean?
AML stands for Anti-Money Laundering. UAE AML requirements are designed to prevent businesses and financial systems from being misused for money laundering, terrorism financing and related financial crimes.
Which businesses are DNFBPs?
Key DNFBP categories supervised by the Ministry include relevant real estate brokers and agents, independent accountants and auditors, dealers in precious metals and stones, and trust and company service providers.
Is goAML registration compulsory for relevant DNFBPs?
Relevant DNFBPs are required to register on goAML and maintain appropriate access for their appointed Compliance Officer or MLRO.
Do free zone companies have AML obligations?
Yes, where the company's activity falls within applicable AML requirements. Holding a free zone licence does not automatically create a general exemption from AML obligations.
Does every UAE LLC follow the same governance requirements?
No. Requirements can vary depending on the company's legal form, licensing authority, business activity and applicable regulator.
How long should relevant AML records be retained?
Relevant AML records generally need to be retained for at least five years, subject to applicable legislation, regulatory requirements and any specific instruction that requires a longer retention period.
What is a Business Risk Assessment?
It is a documented assessment of the money laundering and terrorism financing risks associated with a business and the controls implemented to manage those risks.
Final Takeaway for UAE Businesses
Strong corporate governance and effective AML controls are becoming increasingly important for businesses operating in the UAE.
Companies should not wait until a regulatory inspection, bank review, audit or customer due diligence request exposes gaps in their records.
A proactive compliance review can help identify inconsistencies in ownership information, management authority, UBO records, customer files, risk assessments, screening records and AML procedures.
Businesses should also ensure that their written policies are actually implemented in day-to-day operations and that they can produce appropriate evidence when required.
Strengthen Your UAE Corporate Governance & AML Compliance
YESS Consultancy helps UAE businesses review their corporate records, ownership information, AML documentation, compliance procedures and supporting business records.
Whether you operate a private company, free zone entity, professional business or an activity subject to DNFBP requirements, maintaining accurate and organised compliance records can help your business respond more effectively to regulatory, banking and audit requirements.
Our support can include corporate governance review, UBO record review, AML documentation review, customer file checks, Business Risk Assessment support and compliance documentation.
Contact YESS Consultancy to review your UAE corporate governance and AML compliance requirements.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal, tax, accounting, regulatory or financial advice. UAE laws, regulations, guidance and regulatory practices may change. The specific obligations of a business depend on its legal form, licensed activities, licensing authority and relevant regulator. Businesses should obtain professional advice and confirm the requirements applicable to their individual circumstances before taking action.
