UAE free zone registration does not create an exemption from anti-money laundering and combating the financing of terrorism obligations. Whether your company is in a commercial free zone or a financial free zone, AML/CFT compliance requirements apply based on your business activity and the authority that supervises your sector. This guide covers the core obligations, who they apply to, and what you need to do to stay compliant in 2026.
Key Takeaways
- A UAE free zone licence does not exempt your business from federal AML/CFT law.
- Financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs) operating in free zones can be in scope regardless of their licensing jurisdiction.
- Core obligations include customer due diligence, ultimate beneficial owner identification, goAML registration where applicable, suspicious transaction reporting, sanctions screening, and five-year record retention.
- Your supervisory authority depends on your business type: Ministry of Economy and Tourism, Central Bank of the UAE, DFSA, FSRA, or another competent authority.
- Non-compliance can result in administrative penalties, supervisory measures, and consequences for your licence or regulatory standing.
What AML/CFT means in the UAE?
AML/CFT stands for anti-money laundering and combating the financing of terrorism. A related concept, CPF, or combating proliferation financing, is now built directly into the UAE’s primary AML legislation, alongside guidance issued by the Central Bank of the UAE for licensed financial institutions. Together, these form the country’s financial crime prevention framework.
The UAE’s AML/CFT regime is grounded in Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, which came into effect on 14 October 2025 and repealed and replaced the earlier Federal Decree-Law No. 20 of 2018. It is supported by its implementing Cabinet Resolution No. 134 of 2025, which came into force on 14 December 2025, alongside subsequent regulatory guidance and updates. The regime applies across relevant business types and extends to entities registered in UAE free zones where the activity or business classification brings them within scope.
Who must comply with UAE AML/CFT rules in free zones?
The UAE AML/CFT framework applies primarily to three categories of entities: financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs). Free zone registration does not change this. The question is whether your activity places you in one of these categories.
Financial institutions in free zones
Banks, money service businesses, insurance companies, investment firms, and other entities licensed to carry out regulated financial activities are financial institutions for AML/CFT purposes. In commercial free zones, an entity conducting regulated financial services remains subject to the financial institution framework. In DIFC and ADGM, the UAE’s financial free zones, the applicable regulators are the Dubai Financial Services Authority (DFSA) and the Financial Services Regulatory Authority (FSRA) respectively, each operating their own rulebooks within the broader UAE AML/CFT ecosystem.
DNFBPs in free zones
DNFBPs are the non-financial businesses and professions that UAE law designates as being within the AML/CFT supervisory perimeter. The core DNFBP categories under UAE regulations include:
- Real estate brokers and agents
- Dealers in precious metals and stones
- Auditors and accountants
- Corporate service providers, including trust and company service providers
- Legal professionals, including lawyers and notaries
- Commercial gaming operators, brought into scope under the 2025 framework
If your free zone company falls into any of these categories, you have AML/CFT obligations regardless of the free zone in which you are licensed. Free zone DNFBP guidance, such as that published by individual free zone authorities, typically frames these obligations directly in a free-zone licensing context, confirming that the federal framework applies alongside local licensing requirements.
VASPs in free zones
Virtual asset service providers (VASPs), businesses conducting crypto and other virtual asset activities, are a distinct regulated category under the 2025 AML framework, separate from financial institutions and DNFBPs. In Dubai, the Virtual Assets Regulatory Authority (VARA) supervises VASPs across mainland and free zones, including free zones with dedicated virtual asset ecosystems such as DMCC, with the exception of DIFC, where the DFSA applies. In ADGM, VASPs fall under the FSRA. A free zone trade licence does not by itself authorise virtual asset activities: a separate VASP licence from the relevant regulator is required, and VASPs remain subject to the same goAML suspicious reporting obligations as other covered entities.
Other in-scope entities
Companies that provide trust, nominee, or corporate administration services, or businesses whose activities otherwise bring them within the AML/CFT framework, may also fall within scope. If there is any doubt about whether your activity is in scope, the safest approach is to identify your supervisory authority and confirm with them.
Key regulators and supervisory authorities
Understanding who supervises you is the first practical step in UAE AML/CFT compliance for free zone businesses. The following authorities are the principal ones:
Ministry of Economy and Tourism (MoET)
The Ministry of Economy and Tourism, renamed from the Ministry of Economy in 2025, maintains AML/CFT supervision and compliance resources for DNFBPs operating outside the financial free zones. Its AML portal and business compliance mechanisms are a key channel for many free zone DNFBPs to interact with the federal framework.
Central Bank of the UAE (CBUAE)
The CBUAE supervises licensed financial institutions. It publishes a detailed AML/CFT rulebook and has issued updated guidance on AML/CFT/CPF compliance expectations for licensed financial institutions.
UAE Financial Intelligence Unit (FIU)
The FIU operates the goAML reporting ecosystem, which is the national portal for suspicious transaction and suspicious activity reporting. Covered entities that are required to report suspicious matters do so through this system.
Securities and Commodities Authority (SCA)
The SCA is relevant for regulated securities and investment activities.
DFSA and FSRA
These authorities regulate firms in DIFC and ADGM respectively. Firms in these financial free zones follow the DFSA or FSRA AML rulebooks, while still operating within the broader UAE AML/CFT legal framework.
Free zone authorities
Licensing authorities such as individual free zone regulators may enforce local compliance steps, but they do not replace the AML/CFT obligations that apply to your business category.
Core AML/CFT obligations for UAE free zone businesses
The following obligations apply to covered entities, financial institutions and DNFBPs, operating in UAE free zones.
1. Appoint a compliance officer
Businesses within the AML/CFT framework should designate a responsible compliance officer or equivalent function, sometimes referred to as a money laundering reporting officer (MLRO), to oversee AML/CFT controls, manage internal escalations, and ensure reporting obligations are met.
2. Conduct an enterprise-wide risk assessment
Covered entities must carry out a risk assessment that evaluates their exposure to money laundering and terrorist financing risk. This assessment should consider:
- Customer risk profiles
- Geographic risk
- Products and services offered
- Delivery channels used
- Transaction types and volumes
The risk assessment should be documented, reviewed periodically, and updated whenever there are significant changes to the business or regulatory environment.
3. Implement customer due diligence (CDD)
Before entering a business relationship or conducting a transaction where CDD is required, covered entities must identify and verify their customers. CDD requires:
- Verifying the identity of the customer using reliable, independent documents
- Understanding the nature and purpose of the business relationship
- Identifying the ultimate beneficial owner where the customer is a legal entity
- Maintaining documentation supporting each step
4. Apply enhanced due diligence (EDD) when required
EDD applies to higher-risk relationships and situations. Triggers for enhanced scrutiny include:
- Politically exposed persons (PEPs) and related parties
- Unusual or complex ownership structures
- Customers or counterparties linked to higher-risk jurisdictions
- Unusual transaction patterns that do not match the stated business purpose
- Cross-border or multi-layered fund flows
Where EDD applies, additional verification, senior management approval, and more intensive ongoing monitoring are typically required.
5. Identify ultimate beneficial owners (UBOs)
UAE businesses are required to identify the natural person or persons who ultimately own or control the company. Ownership documentation should be collected, maintained, and made available to competent authorities on request. The obligation applies to customers that are legal entities and, separately, to the free zone company itself as part of its own governance and transparency requirements.
6. Register for goAML and report suspicious activity
Entities that are required to file suspicious transaction or suspicious activity reports, including in-scope free zone DNFBPs and financial institutions, must register on the UAE FIU’s goAML portal. This is the system through which suspicious transaction reports (STRs) and suspicious activity reports (SARs) are submitted to the FIU. Businesses should have an internal escalation path so that staff can identify, document, and route suspicions promptly through the appropriate channels.
7. Screen for targeted financial sanctions
UAE businesses must screen customers, beneficial owners, and relevant counterparties against applicable sanctions lists, including the UAE Local Terrorist List and relevant UN Security Council lists. Screening should occur at onboarding and on an ongoing basis. Where a match is identified, the entity must follow the applicable freeze and reporting procedures.
8. Maintain records for at least five years
AML/CFT compliance requires retention of:
- CDD files and customer identification documents
- Transaction records
- Internal risk assessments
- Suspicious transaction reports and supporting evidence
- Related compliance records
Records must be retained for a minimum of five years, unless a stricter requirement applies to your entity type or supervisory authority.
9. Train relevant staff
Staff whose roles bring them into contact with customers, transactions, or compliance decisions must receive appropriate AML/CFT training. Training records should be maintained as part of your compliance documentation.
AML/CFT compliance checklist for UAE free zone companies
Use this checklist as a practical starting point for your 2026 compliance review:
- Confirm whether your business is a financial institution, DNFBP, VASP, or otherwise in scope
- Identify your supervisory authority (MoET, CBUAE, DFSA, FSRA, or other)
- Appoint a compliance officer or MLRO-equivalent function
- Complete and document your enterprise-wide risk assessment
- Build written CDD and EDD procedures
- Set up UBO collection and recordkeeping processes for both customers and your own entity
- Register on goAML and operationalise your suspicious reporting workflow, if applicable
- Implement sanctions screening at onboarding and on an ongoing basis
- Set up five-year minimum record retention processes
- Deliver AML/CFT training to relevant staff and retain training records
- Make sure policies, templates, and training reference the 2025 law and regulations rather than the repealed 2018 framework
- Test and review controls regularly
Common AML/CFT Mistakes Free Zone Companies Make
Free zone businesses, particularly those that are newer or smaller, often make predictable compliance errors. The most common include:
Assuming the free zone licence covers everything. A free zone authority issues your trade licence, but it does not by itself determine your AML/CFT supervision. Those obligations sit with the relevant federal or sectoral authority, and local free zone requirements may also apply.
Treating CDD as a one-time exercise. Customer due diligence is an ongoing process. Relationships must be monitored, and CDD must be refreshed when circumstances change or when a risk-based trigger arises.
Skipping goAML registration. Entities that are required to register on goAML sometimes delay doing so because they are uncertain whether the obligation applies. The safer position is to confirm your status and register if you are in scope.
Failing to document the risk assessment. UAE supervisory authorities expect to see evidence of a structured, documented risk assessment, not just a general awareness that your business is low risk.
Poor record management. Keeping CDD documents in ad-hoc folders or email threads without a clear retention structure creates gaps that are difficult to remediate under regulatory scrutiny.
Relying on the repealed framework. Policies, templates, and training that still cite Federal Decree-Law No. 20 of 2018 or Cabinet Decision No. 10 of 2019 are out of date and should be updated to the 2025 law and its executive regulations.
Penalties for AML/CFT non-compliance in the UAE
UAE authorities can impose administrative penalties and supervisory measures for AML/CFT failures. Non-compliance may affect your licensing, approvals, or regulatory standing depending on the authority and the nature of the breach. Under the 2025 framework, administrative fines apply per violation and can accumulate across multiple findings in a single inspection, while more serious breaches can carry criminal penalties. Importantly, free zone registration does not insulate a business from AML/CFT enforcement action. Businesses should not assume that operating in a free zone reduces their exposure to regulatory consequences.
How BCL Globiz supports UAE free zone AML/CFT compliance?
BCL Globiz is a Dubai-based accounting, tax, and business advisory firm that works with free zone companies, management consultancies, technology businesses, e-commerce entities, and trading companies across the UAE. BCL helps businesses structure their compliance documentation, governance workflows, and regulatory readiness, including the accounting, bookkeeping, and corporate tax support that underpins AML/CFT record-keeping and reporting obligations.
Services relevant to free zone AML/CFT compliance include:
- Accounting and bookkeeping: accurate transaction records form the foundation of AML/CFT audit trails and suspicious activity identification
- VAT and corporate tax compliance: structured tax filings and documentation support the broader compliance posture required by supervisory authorities
- Company setup and free zone setup: getting the right licence, structure, and governance framework from the outset reduces downstream compliance risk
- Compliance documentation support: helping clients organise and maintain the files, records, and procedures that AML/CFT regulations require
Each client is assigned a dedicated Manager and Account Executive, with SOP-driven execution and direct WhatsApp access for fast responses. BCL’s pricing starts from AED 500 per month, with all-inclusive packages covering accounting, VAT, and corporate tax.
To discuss AML/CFT compliance support for your UAE free zone company, contact BCL Globiz.
Frequently Asked Questions
Do UAE free zone companies need to comply with AML/CFT regulations?
Yes. UAE free zone registration does not create an exemption from AML/CFT obligations. If your business is a financial institution, a DNFBP, or a VASP, regardless of the free zone in which it is licensed, the UAE AML/CFT framework applies, and you must comply with the obligations relevant to your supervisory authority.
Which UAE free zone businesses are considered DNFBPs?
The DNFBP categories under UAE AML/CFT law include real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, legal professionals such as lawyers and notaries, and, under the 2025 framework, commercial gaming operators. If your free zone business falls into one of these categories, DNFBP AML/CFT obligations apply.
Is goAML registration mandatory for free zone companies in the UAE?
goAML registration is mandatory for entities that are required to file suspicious transaction or suspicious activity reports with the UAE FIU. DNFBPs and financial institutions in scope of the UAE AML/CFT framework, including those in free zones, are required to register and use the goAML portal for their reporting obligations.
What are the main AML/CFT obligations for UAE free zone companies?
The main obligations are: appointing a compliance officer, completing an enterprise-wide risk assessment, implementing CDD and EDD procedures, identifying UBOs, registering on goAML where applicable, screening for targeted financial sanctions, maintaining records for at least five years, and training relevant staff.
What is customer due diligence under UAE AML rules?
Customer due diligence (CDD) is the process of identifying and verifying the identity of customers before entering a business relationship or conducting a relevant transaction. It includes verifying identification documents, understanding the purpose of the relationship, identifying beneficial owners where the customer is a legal entity, and maintaining documentation of all steps taken.
What is enhanced due diligence and when is it required?
Enhanced due diligence (EDD) is a higher level of scrutiny applied to customers or transactions that carry elevated money laundering or terrorist financing risk. It is required for politically exposed persons, unusual or complex ownership structures, higher-risk geographic exposures, and unusual transaction patterns. EDD typically requires additional verification, senior management approval, and more intensive monitoring.
How long should AML/CFT records be kept in the UAE?
AML/CFT records, including CDD files, transaction records, risk assessments, suspicious reporting records, and related compliance documentation, must be retained for a minimum of five years. A stricter retention period may apply depending on your entity type or the requirements of your supervisory authority.
What are the penalties for AML/CFT non-compliance in the UAE?
UAE authorities can impose administrative penalties, supervisory measures, and licensing consequences for AML/CFT non-compliance. The severity depends on the nature of the breach, the supervisory authority involved, and the entity type. Free zone licensing does not reduce or eliminate exposure to AML/CFT enforcement.
Do UAE free zone companies need an AML compliance officer?
Yes. Businesses in scope of the UAE AML/CFT framework, whether in a free zone or on the mainland, are expected to designate a responsible compliance officer or equivalent function to manage AML/CFT controls, oversee internal escalations, and ensure that reporting obligations are met.
Can BCL Globiz help with AML/CFT compliance for UAE free zone companies?
BCL Globiz supports UAE free zone companies with the accounting, bookkeeping, corporate tax, VAT, compliance documentation, and company setup services that underpin AML/CFT regulatory readiness. Each client is assigned a dedicated Manager and Account Executive for structured, responsive support. Visit bcl.ae to discuss your requirements.
Reach out to us at info@bcl.ae
