Audit firms and sole-practitioner auditors in the UAE are designated non-financial businesses and professions (DNFBPs) supervised for anti-money laundering by the Ministry of Economy, and since 14 October 2025 their obligations sit under Federal Decree-Law No. 10 of 2025 — a stricter framework than the 2018 law most firms built their files on.
TL;DR
- Auditors fall squarely within the DNFBP sectors the Ministry of Economy supervises — alongside real estate brokers, precious metals dealers and corporate service providers.
- Federal Decree-Law No. 10 of 2025, effective 14 October 2025, replaced Federal Decree-Law No. 20 of 2018 as the core AML law; its Executive Regulations (Cabinet Resolution No. 134 of 2025) took effect 14 December 2025.
- Registration on the goAML portal, a compliance officer, risk-based customer due diligence and sanctions screening are baseline obligations.
- Suspicious transactions must be reported through goAML; administrative fines under the 2025 law run from AED 10,000 up to AED 5,000,000 per violation.
- Records supporting due diligence and reporting must be kept for at least five years.
Why auditors are DNFBPs
An audit firm's raw material is other people's records — including the records of businesses whose transactions may be laundering proceeds. That is why the UAE's AML framework places auditors, together with real estate agents and brokers, precious metals and gemstone dealers, and corporate service providers, under the Ministry of Economy's supervision. The Ministry runs inspection campaigns on these sectors and publishes enforcement outcomes: in one quarter of 2023 alone it reported AED 65.9 million in fines across 137 DNFBP companies, with auditors named among the inspected categories (Ministry of Economy & Tourism).
What changed in 2025
| Rule | Status | Reference |
|---|---|---|
| Federal Decree-Law No. 10 of 2025 | In force 14 October 2025 | UAE Legislation portal — replaced Federal Decree-Law No. 20 of 2018 |
| Cabinet Resolution No. 134 of 2025 (Executive Regulations) | In force 14 December 2025 | UAE Legislation portal — replaced the 2019 regulations |
| goAML registration and reporting | Mandatory for DNFBPs, continuing under the new framework | Ministry of Economy goAML guidance |
| Record keeping | At least five years from transaction completion or relationship end | Federal Decree-Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025 |
Firms whose AML manuals cite the 2018 law and its 2019 regulations need a documented gap review: the 2025 framework broadens the preventive-measures regime, sharpens beneficial-ownership verification and widens the record-keeping scope to screening logs, internal analyses and monitoring outputs.
The obligations in practice
| Obligation | What it means for an audit firm | Reference |
|---|---|---|
| AML/CFT programme | Written policies approved by senior management; an appointed MLRO; staff training | Federal Decree-Law No. 10 of 2025 |
| Enterprise risk assessment | Documented assessment of client, service, geography and channel risks, updated periodically | Cabinet Resolution No. 134 of 2025 |
| Customer due diligence | Identify and verify the audit client and its beneficial owners before accepting the engagement; EDD for high-risk clients | Federal Decree-Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025 |
| Sanctions screening | Screen clients and related parties against UAE and UN targeted financial sanctions lists, and retain evidence | Cabinet Resolution No. 134 of 2025 |
| goAML registration | Register the firm on the goAML portal before any report becomes necessary | MoET guidance |
| Suspicious transaction reporting | File STR/SAR through goAML when suspicion arises — filing is a legal duty, not an accusation | Federal Decree-Law No. 10 of 2025 |
| Record keeping | Keep CDD files, screening results and reporting records at least five years | Federal Decree-Law No. 10 of 2025 |
Auditor-specific red flags
Audit work surfaces money-laundering indicators that other DNFBPs never see. Patterns that should move an engagement toward an STR:
- Books and records that cannot be reconciled to bank statements, or revenues inconsistent with the client's stated activity.
- Clients that are shell-like entities — registered but with no staff, premises or plausible economics — especially when the audit is requested for a licence renewal, a bank account or a sale.
- Transactions routed through third parties or jurisdictions without commercial rationale.
- Cash-heavy activity patterns inconsistent with the industry, or unexplained loans between related entities.
- Reluctance to provide underlying documentation during fieldwork.
Penalties for non-compliance
Under Federal Decree-Law No. 10 of 2025, administrative fines for preventive-measures violations range from AED 10,000 to AED 5,000,000 per violation, and the law adds supervisory measures — warnings, sector bans — alongside the fines. Criminal money-laundering penalties under the same law are measured in millions of dirhams. The Ministry's enforcement record shows the regime is actively inspected rather than theoretical.
How Finanshels handles this
We build and run AML programmes for professional firms: risk assessments, CDD and EDD workflows, sanctions screening, goAML registration and reporting, and inspection-ready record keeping. If your AML manual still cites the 2018 law, talk to our AML team.
FAQs
Are auditors DNFBPs in the UAE?
Yes. Auditors are among the DNFBP categories supervised for AML by the Ministry of Economy, alongside real estate brokers, precious metals dealers and corporate service providers.
Which AML law applies to auditors now?
Federal Decree-Law No. 10 of 2025, effective 14 October 2025, replaced Federal Decree-Law No. 20 of 2018. The Executive Regulations, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025.
Do audit firms need to register on goAML?
Yes — goAML registration is the standard route through which DNFBPs, including audit firms, file suspicious transaction and activity reports with the UAE Financial Intelligence Unit.
What are the penalties for AML violations by audit firms?
Administrative fines under Federal Decree-Law No. 10 of 2025 range from AED 10,000 to AED 5,000,000 per violation, with supervisory measures such as warnings and sector prohibitions on top. The Ministry of Economy's published enforcement actions confirm active inspections.
How long must AML records be kept?
At least five years from the date the transaction was completed or the business relationship ended, whichever is later, under Federal Decree-Law No. 10 of 2025 and its Executive Regulations.
Last reviewed: September 2026 by Krishna Subash Nair, Team Lead – AML & Compliance Advisory, Finanshels. Rules as of Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025; verify current requirements against MoET (moet.gov.ae) and UAE FIU guidance before acting.
