AML Compliance for Accounting & Bookkeeping Firms UAE (2026)

AML compliance for accounting and bookkeeping firms in the UAE is the set of obligations that apply when an accounting practice is a Designated Non-Financial Business and Profession (DNFBP) — registration on the goAML portal, a documented risk assessment, customer due diligence, a named compliance officer, record keeping and suspicious transaction reporting under Federal Decree-Law No. 10 of 2025, effective 14 October 2025.

TL;DR

• Accountants and auditors are DNFBPs under Federal Decree-Law No. 10 of 2025, effective 14 October 2025.
• Register on goAML and appoint a Money Laundering Reporting Officer (MLRO) before any reporting duty arises.
• Independent accountants must conduct CDD and file STRs/SARs via goAML.
• Administrative penalties run from AED 50,000 to AED 5,000,000 per violation under the Decree-Law's Article 14.
• The Ministry of Economy supervises DNFBPs; the UAE FIU receives the reports.

Why accounting firms are DNFBPs

The UAE's AML framework — Federal Decree-Law No. 10 of 2025, which repealed and replaced Federal Decree-Law No. 20 of 2018 with effect from 14 October 2025 — classifies independent accountants, auditors and similar professionals as DNFBPs when they prepare for or carry out transactions for clients concerning the buying and selling of real estate, managing client money, managing bank or securities accounts, or organising contributions for the creation or operation of companies.

How to set up AML compliance in an accounting firm

Step 1 — Confirm your DNFBP status

Not every accounting engagement triggers AML duties. If the firm only prepares financial statements and tax returns for clients, the exposure is narrower than for a practice that also handles client money, company formation or real estate transactions. Map your service catalogue against the DNFBP definitions before building anything — the Ministry of Economy's AML legislation pages are the reference document.

Step 2 — Run a documented enterprise-wide risk assessment

The assessment must cover the firm's own exposure: which clients are highest risk (PEPs, cash-intensive sectors, cross-border ownership chains), which services are most abusable (nominee directorships, escrow handling), and which geographies carry sanctions or FATF-listed exposure. The Ministry of Economy's enhanced DNFBP guidelines expect measurable outcomes, not a policy binder.

Step 3 — Register on goAML

Registration happens through the goAML portal: the entity registers first, then the nominated MLRO. Firms that skip registration are in breach before they have filed a single report — inspectors check registration, policies and MLRO appointment as separate violations.

Step 4 — Build CDD into onboarding

Customer due diligence means identifying the client, verifying identity from reliable sources, identifying beneficial owners, and understanding the purpose of the relationship. For accounting firms, the practical test is: could you evidence who controls a client entity and why you accepted them, within minutes of an inspector's request?

Step 5 — Report suspicious activity through goAML

When a transaction or client behaviour raises suspicion, the firm files a Suspicious Transaction Report through goAML. The threshold is suspicion, not proof — and tipping off the client is itself an offence under Federal Decree-Law No. 10 of 2025.

Step 6 — Train, test and refresh annually

The Ministry of Economy's inspection campaigns consistently find the same gaps: no MLRO, no training records, policies written once and never revisited. An annual refresh of the risk assessment, the CDD files and the staff training log is the minimum that survives an inspection.

The penalty exposure

Under Article 14 of the AML Decree-Law, supervisory authorities can impose administrative penalties of no less than AED 50,000 and no more than AED 5,000,000 per violation on DNFBPs that breach the law and its Implementing Regulation (Ministry of Economy AML legislation resource). The common violations are procedural: missing goAML registration, no appointed MLRO, no documented risk assessment, no training records — and separate breaches are each penalised individually. Inspectors do not need to find laundering; the absence of the compliance framework is itself the breach.

FAQs

Are accountants DNFBPs in the UAE?

Yes — independent accountants and auditors are designated DNFBPs under UAE law when they prepare for or carry out transactions for clients in areas like real estate transactions, managing client money or company formation, and must comply with Federal Decree-Law No. 10 of 2025.

What is goAML and who must register?

goAML is the UAE FIU's reporting portal. DNFBPs including accounting firms must register the entity and its MLRO on the portal before they can file Suspicious Transaction Reports.

What are the AML penalties for UAE accounting firms?

Administrative penalties range from AED 50,000 to AED 5,000,000 per violation under Article 14 of the AML Decree-Law, and separate breaches — registration, MLRO appointment, risk assessment, training — are each penalised individually.

Last reviewed: September 2026 by Krishna Subash Nair, Compliance Advisory, Finanshels. Rules per Federal Decree-Law No. 10 of 2025 and Ministry of Economy DNFBP guidance; verify current obligations against the Ministry of Economy and UAE FIU before acting.

Finanshels' AML compliance services cover goAML registration, risk assessment, CDD frameworks and MLRO support for UAE accounting practices.