Registering on goAML is the entry ticket. What an inspection actually examines is whether you run a programme — a documented risk assessment, customer due diligence procedures, transaction monitoring, record retention and staff training. A registration with nothing behind it fails the same inspection as no registration at all.
What a compliant AML policy contains
- Business risk assessment — documented, and updated at least annually
- AML policy and procedures manual tailored to your actual activity
- Customer due diligence procedures, with enhanced measures for higher-risk relationships
- Ongoing transaction monitoring appropriate to your volume
- Suspicious transaction reporting process, with goAML filing generally within 24 to 48 hours of discovery
- Record retention for a minimum of five years
- An appointed compliance officer, and an MLRO where required
- Staff training, delivered and evidenced on a recurring basis
An inspector will ask to see your risk assessment, your training records and a sample of your customer files. Those three things reveal within minutes whether a programme exists or whether a template was downloaded and filed.
The risk assessment is the foundation
Everything else derives from it. Your procedures should be proportionate to the risks you actually face, and you cannot demonstrate proportionality without having assessed them.
A credible assessment covers customer risk (who you deal with, and whether any are politically exposed), geographic risk (jurisdictions involved), product and service risk (what you provide and how it could be misused), and delivery channel risk (face to face versus remote onboarding).
Generic assessments that could describe any business are the most common finding we correct. If yours does not name your actual customer types and jurisdictions, it will not survive scrutiny.
Who needs this
Every DNFBP: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, lawyers and notaries, and corporate service providers forming companies or acting as registered agent or nominee.
The last category is broader than people assume. If you form companies for clients or provide a registered address, you are in scope regardless of what you call yourself — see am I a DNFBP.
What non-compliance costs
Administrative fines run from AED 50,000 to AED 1,000,000 per violation, and they stack across multiple findings in a single inspection. Failure to register alone starts at AED 50,000.
There is criminal exposure too, with imprisonment and fines between AED 200,000 and AED 10,000,000 for certain violations — separate from anything a supervisor imposes. The enforcement picture is set out in UAE AML fines.
Your bank acts before the regulator
UAE banks screen corporate customers for DNFBP status under their own CBUAE obligations, and an unregistered or non-compliant DNFBP is a flagged counterparty.
In practice that means accounts frozen pending evidence of compliance, outbound remittances blocked, and new applications declined. For most businesses this bites months or years before an inspection ever happens — and a frozen account stops trading immediately. See why accounts get frozen and rejected.
How we build it
- Scope and risk assessment — we assess your actual customers, jurisdictions and services
- Policy and procedures drafted around that assessment, not a template
- Compliance officer appointment and MLRO support where required
- goAML registration completed or verified across SACM, EmaraTax and the portal
- Onboarding forms and CDD templates your team will actually use
- Staff training delivered and documented
- Annual review to keep the assessment current
The deliverable is a programme your team can operate, not a manual nobody opens. Procedures that are too elaborate for the business get ignored, and an ignored procedure is worse than a simpler one that is followed.
Frequently asked questions
No. Registration is the entry point. An inspection examines whether you maintain a risk assessment, procedures, monitoring, records and training.
At least annually, and whenever your business changes materially - new customer types, new jurisdictions or new services.
Financial institutions require one. DNFBPs must appoint a compliance officer, and the role carries real responsibility rather than being a name on a form.
A minimum of five years, and the obligation continues after a relationship ends.
You can start from one, but a generic policy that could describe any business is a common inspection finding. It must reflect your actual risk.
Promptly on discovery - generally within 24 to 48 hours, through the goAML portal.
Getting started
Tell us what your business actually does and who your customers are. If you are in scope we will build the programme; if you are not, we will say so rather than sell you one.