AML Compliance for Corporate Service Providers in the UAE (2026)
Corporate service providers — company formation agents, registered agents and businesses that set up or administer companies for clients — are Designated Non-Financial Businesses and Professions (DNFBPs) under UAE law, and the obligations tightened sharply on 14 October 2025 when Federal Decree-Law No. 10 of 2025 replaced the 2018 AML law. The decisions that matter in 2026 are whether your firm is registered on goAML, whether your customer due diligence meets the new law's evidentiary bar, and whether your internal risk assessment reflects the expanded scope. Every material claim below carries an official source.
The law that governs CSPs in 2026
Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, repeals and replaces Federal Decree-Law No. 20 of 2018 and aligns the UAE with the latest FATF standards. Its Executive Regulations were issued under Cabinet Resolution No. 134 of 2025. (Mondaq — Federal Decree-Law No. 10 of 2025; UAE Legislation Portal) Company service providers sit squarely in the DNFBP perimeter, which the new law broadened — including explicit coverage of virtual-asset related services. UAE FIU
What a CSP must actually do
| Obligation | What it means for a CSP | Source |
|---|---|---|
| AML/CFT risk assessment | Document the firm's exposure: nominee arrangements, layered ownership, high-risk jurisdictions, shells formed for unclear purposes | FD-L 10/2025 risk-based approach |
| Customer due diligence (CDD) | Identify the client and beneficial owners, verify identity documents, understand the corporate structure being formed or administered | FD-L 10/2025; Cabinet Resolution No. 134 of 2025 |
| Enhanced due diligence (EDD) | Higher-risk clients — politically exposed persons, complex offshore structures, cash-heavy introducers — need senior-management approval and deeper source-of-funds checks | FD-L 10/2025 |
| goAML registration and reporting | Register with the UAE Financial Intelligence Unit and file suspicious transaction reports through goAML | UAE FIU — goAML |
| Record keeping | Retain CDD and transaction records per the law's retention periods, accessible to supervisors on request | FD-L 10/2025 |
| Compliance officer and training | Appoint an AML compliance officer, screen staff, train on red flags annually | FD-L 10/2025; Executive Regulations |
What changed under the 2025 law
The new regime raises the bar in ways CSPs feel directly. Evidentiary thresholds for enforcement are lower and clearer; penalties are elevated; senior management carries explicit liability for failures; and the scope now expressly captures virtual assets and proliferation financing. (Greenberg Traurig — UAE's new AML law) The core money-laundering offence carries 1–10 years' imprisonment and a fine of AED 100,000 up to AED 5,000,000 or the value of the criminal property, whichever is higher. (Mondaq — FD-L 10/2025 penalties table) Administrative penalties for DNFBP breaches sit on top of the criminal exposure.
The compliance calendar for 2026
A CSP that has not yet re-baselined its programme to the 2025 law should treat the following as this quarter's work:
- Re-issue the firm-wide risk assessment against the new law's scope (including virtual-asset-adjacent introductions).
- Refresh CDD on every active client structure, prioritising older entities and those with opaque ownership.
- Confirm the goAML registration is live and the reporting workflow reaches the FIU within required timelines. UAE FIU
- Retrain staff on the new law's evidentiary standards and senior-management liability.
Our AML team handles the full programme build — see AML compliance services and our setup guide, how to set up AML compliance for a UAE business. Auditors carry their own DNFBP duties, covered in AML compliance for auditors in the UAE.
Frequently asked questions
Are company formation agents really DNFBPs? Yes — businesses that create, register or administer legal persons for clients fall in the DNFBP perimeter, so the full obligations (CDD, goAML, record keeping) apply.
Which law applies now — the 2018 or 2025 law? Federal Decree-Law No. 10 of 2025, effective 14 October 2025, replaced the 2018 law; the 2018 law survives only for historical conduct.
What is the first reportable red flag for a CSP? A client forming an entity with no discernible business purpose, nominee ownership the client cannot explain, or funds moving immediately after incorporation — file a suspicious transaction report through goAML.
Reviewed by Krishna Subash Nair, Anti-Money Laundering Consultant at Finanshels, September 2026. Rules are date-scoped to 2026 and should be re-checked against the UAE FIU and current legislation before compliance decisions.
