AML Compliance for Gold, Jewellery and Precious Metals Businesses in the UAE (2026)

Selling gold, jewellery or precious stones in the UAE involves more than managing inventory, negotiating prices and keeping customers happy. If your business falls under the relevant regulatory requirements, you also need to know who you are dealing with, understand transaction risks and maintain the right records.

This is where anti-money laundering (AML) compliance comes in. The UAE has a dedicated framework for businesses dealing in precious metals and stones (DPMS), recognising the potential for these products to be used to move or conceal the proceeds of crime.

And this is not just a box-ticking exercise. In the first half of 2025, the Ministry of Economy and Tourism reported 1,063 compliance violations and more than AED 42 million in fines across the DNFBP sector it supervises. Precious metals and gemstones traders accounted for 473 violations and AED 20 million in fines.

So, what does AML compliance mean for your business, who needs to register on goAML, and what should you prepare for an inspection? This guide covers the key AML requirements for gold, jewellery and precious metals businesses in the UAE, from customer checks and transaction reporting to record-keeping and inspection readiness.

What Is Precious Metals AML Compliance in the UAE?

Precious metals AML compliance refers to the measures a business takes to prevent its products, customers or transactions from being used for money laundering, terrorist financing or proliferation financing.

In simple terms, it means knowing your customers, understanding where the money comes from, recognising unusual transactions and reporting suspicions through the appropriate channels.

What does DPMS mean in UAE AML regulations?

DPMS stands for Dealers in Precious Metals and Stones. It covers relevant businesses dealing in products such as gold, silver, platinum, diamonds and other precious stones, subject to the applicable regulatory definition.

Businesses that qualify as DPMS are included in the DNFBP framework. The exact obligations depend on the nature of the activity, the relevant transaction and the applicable legislation.

For example, a gold wholesaler selling bullion, a diamond trader supplying retailers and a jewellery business handling qualifying transactions may all need to assess whether DPMS requirements apply to them.

The important point is that you should not assume your business is outside the rules simply because it is small or operates primarily through retail sales.

Why are gold and jewellery businesses exposed to money laundering risks?

Gold and precious stones have characteristics that can make them attractive for financial crime. They can hold substantial value in a relatively small physical form, be traded across borders, and change hands through complex supply chains.

The UAE Financial Intelligence Unit's DPMS sector report provides useful context. It reports that UAE foreign trade in precious stones, metals and related articles grew from AED 497 billion in 2021 to more than AED 959 billion in 2024.

The report also records 8,191 DPMS entities registered with the UAE Financial Intelligence Unit's goAML reporting system as of 30 June 2025, up from 4,521 in June 2022.

These figures illustrate the scale of the sector and why effective controls matter. They do not mean that legitimate gold or jewellery trading is inherently suspicious. Instead, they highlight the need for businesses to understand their individual risk exposure and maintain appropriate safeguards.

Which UAE authorities oversee AML compliance for DPMS businesses?

The relevant authorities and reporting channels depend on the business's activities and regulatory classification.

Key institutions include:

• Ministry of Economy and Tourism: Supervises relevant DNFBPs within its remit and publishes AML guidance for precious metals and stones dealers.
• UAE Financial Intelligence Unit (UAEFIU): Receives and analyses suspicious transaction and activity reports through the goAML system.
• Relevant licensing and supervisory authorities: May have additional oversight responsibilities depending on the business's jurisdiction and activities.

Businesses should refer to the Ministry of Economy and Tourism's AML resources and the applicable UAE legislation rather than relying on informal summaries alone.

Who Qualifies as a DPMS DNFBP in the UAE?

Not every business that sells an item containing gold or precious stones automatically qualifies as a DPMS. The nature of the business and its regular activities matter.

Which gold dealers, jewellers and precious stones traders fall under DPMS?

Businesses should assess their activities against the applicable legal definition, including whether dealing in precious metals or stones forms part of their commercial activity.

Potentially relevant businesses include:

• Gold and bullion dealers.
• Jewellery wholesalers and retailers.
• Precious metals importers and exporters.
• Diamond and precious stones traders.
• Businesses that regularly purchase precious metals for resale or processing as part of their trading activities.

The classification should be based on the applicable rules, not simply the business's trade licence name or the type of products displayed in its shop.

For instance, a business that regularly buys and resells gold may need a different assessment from a retailer that occasionally sells an unrelated item containing precious metal.

How does the AED 55,000 threshold apply to DPMS businesses?

The UAE's 2026 supplemental DPMS guidance identifies AED 55,000 as the threshold relevant to covered transactions that trigger the mandatory application of full AML/CFT/CPF measures under the applicable framework.

However, there is an important distinction: AED 55,000 is not a universal safe harbour.

The Ministry's guidance explicitly warns against interpreting this threshold as an exemption from risk-based measures on lower-value transactions. Businesses must consider the nature, pattern and context of transactions when assessing risk.

Consider a practical example.

A jewellery retailer usually sells individual pieces to walk-in customers. Over several weeks, the retailer notices an unusual increase in cash purchases of loose diamonds by apparently unrelated customers. Each transaction is below AED 55,000, but the overall pattern is unusual.

That pattern may warrant closer scrutiny. The retailer should assess whether the transactions are connected, whether the threshold is being deliberately avoided, and whether a report is required under the applicable rules.

The threshold should therefore be treated as a legal trigger, not as the only factor in an AML risk assessment.

Official source: 2026 Supplemental Guidance for Dealers in Precious Metals and Stones.

Do small jewellery shops have AML obligations?

Yes, potentially. A small business is not automatically exempt simply because it has few employees, operates from one location, or serves mostly individual customers.

The business should determine whether it qualifies as a DPMS and identify the obligations that apply to its activities. Risk-based controls may still be necessary even when individual transactions fall below the covered-transaction threshold.

If you are unsure whether your business qualifies, seek clarification from the relevant supervisory authority or a qualified AML professional before assuming that no action is needed.

What Are the AML Requirements for Gold Dealers in the UAE?

Once a business determines which requirements apply, the next step is turning those requirements into everyday procedures.

A policy document is useful, but it will not be enough if employees do not follow it or the business cannot demonstrate how risks are managed.

Conduct a business-wide money laundering risk assessment

Start by identifying where your business could be exposed to financial crime.

Consider factors such as:

• The types of precious metals and stones you trade.
• Whether you deal with individuals, companies or intermediaries.
• Your use of cash and other payment methods.
• Your suppliers, customers and geographic markets.
• Cross-border transactions and unusual trading patterns.
• The risks associated with the origin of funds and the supply chain.

Document the risks you identify, assess their likelihood and potential impact, and record the controls you use to manage them.

Your assessment should reflect how your business actually operates. Copying a generic policy from another company without adapting it to your activities will not give you a reliable picture of your risks.

Establish written AML policies and internal controls

Your AML procedures should explain how the business identifies customers, evaluates risk, handles unusual transactions, maintains records, and escalates concerns.

They should also make responsibilities clear. Employees need to know who to approach when something does not look right and what to do when additional checks are required.

Review your policies whenever your operations change significantly or applicable regulatory requirements are updated.

Appoint an AML compliance officer where required

Relevant businesses must determine whether they are required to appoint a compliance officer or money laundering reporting officer under the applicable framework.

Where required, the appointed person should have clearly defined responsibilities, sufficient authority and access to the information needed to perform the role.

Responsibilities may include overseeing AML controls, reviewing alerts, coordinating reporting, maintaining records and ensuring staff understand their obligations.

Simply naming someone in a policy is not enough. The business must ensure the person can carry out the role effectively.

Implement customer due diligence and transaction monitoring

Customer due diligence (CDD) involves identifying and verifying customers, understanding the purpose and nature of a business relationship where relevant, and assessing associated risks.

Transaction monitoring complements these checks by helping the business identify activity that differs from expected behaviour.

For example, a customer who regularly makes modest purchases may suddenly attempt several high-value cash transactions, provide inconsistent information or refuse to explain the source of funds. These circumstances may warrant further review.

Your procedures should explain how employees recognise unusual activity, document their concerns and escalate cases to the responsible person.

Apply sanctions screening and targeted financial sanctions

Businesses must comply with applicable targeted financial sanctions requirements, including relevant screening and action requirements.

Screening procedures should cover the appropriate customers and other relevant parties, using current and reliable information. Potential matches must be assessed carefully rather than automatically dismissed or treated as confirmed matches.

Where a match or other concern requires action, follow the applicable legal requirements and internal escalation procedures.

Train employees on AML responsibilities

Employees are often the first people to notice unusual customer behaviour or transaction patterns.

Training should cover the business's AML procedures, customer verification, red flags, escalation routes, record-keeping, and restrictions on disclosing suspicious reporting.

Keep evidence of training and update it when procedures or regulatory requirements change.

How Do KYC and Customer Due Diligence Work for Jewellery Businesses?

Know Your Customer (KYC) and customer due diligence help a business establish who it is dealing with and whether a transaction makes sense in context.

The level of checking should reflect the applicable legal requirements and the risk involved.

What customer identification documents should businesses collect?

Depending on the customer type and applicable requirements, relevant information may include:

• For individuals: Identification details and supporting identity documents.
• For companies: Registration details, corporate documents and information about authorised representatives.
• For beneficial owners: Information needed to identify the individuals who ultimately own or control a corporate customer.
• For relevant transactions: The purpose of the transaction and supporting information needed to assess its legitimacy.

Do not treat this list as a universal document checklist. The exact information required depends on the customer's circumstances, the type of transaction and the applicable due diligence rules.

How should businesses verify corporate customers and beneficial owners?

When selling to or purchasing from a company, it is important to understand more than the name on the invoice.

Where required, verify the company's identity, understand its ownership and control structure, and identify its ultimate beneficial owners. Check whether the person acting on its behalf is authorised to do so.

If ownership information is unclear, inconsistent or difficult to verify, investigate the issue and escalate it according to your procedures.

When are enhanced due diligence checks necessary?

Enhanced due diligence may be required when a customer, transaction or business relationship presents a higher level of risk.

Potential triggers include:

• Politically exposed persons (PEPs), where applicable.
• Connections with high-risk jurisdictions.
• Complex or unusual ownership structures.
• Unclear sources of funds or wealth.
• Transactions that appear inconsistent with a customer's known activities.
• Other circumstances identified through your risk assessment.

Depending on the circumstances and applicable rules, additional checks may include obtaining further information about the source of funds, understanding the purpose of a transaction and securing the required level of approval.

How should businesses assess high-risk transactions?

Look at the complete picture rather than relying on a single indicator.

A high-value transaction is not automatically suspicious. Equally, a low-value transaction is not automatically legitimate.

Consider the customer's normal activity, payment method, transaction history, explanation for the purchase, and any other relevant information. Document the reasoning behind your decision and escalate concerns when necessary.

Do Gold Dealers and Jewellery Businesses Need to Register with goAML?

goAML is the reporting system used by the UAE Financial Intelligence Unit for relevant financial intelligence reports.

Businesses should determine their registration and reporting obligations based on their classification and applicable rules.

Who needs to register on the UAE goAML platform?

Relevant reporting entities, including businesses that fall within the applicable DPMS requirements, should establish whether goAML registration is mandatory for them.

Registration is only one part of compliance. Businesses should also maintain appropriate procedures for identifying reportable activity, preparing reports, and managing records.

For official information, start with the Ministry of Economy and Tourism's AML guidance and the relevant UAEFIU resources.

What are the steps for registering a DPMS business on goAML?

The process should be checked against the current instructions for your entity type. In general, businesses should be prepared to:

1. Confirm their regulatory classification and reporting obligations.
2. Gather the required business, licence, and authorised-person information.
3. Follow the applicable registration and verification process.
4. Complete the required steps to activate access.
5. Establish internal procedures for reporting and maintaining supporting documentation.

Do not rely on an old registration walkthrough without checking that it still matches the current portal and requirements.

What is a DPMSR, and when is it required?

DPMSR refers to a Dealers in Precious Metals and Stones Report. It is associated with reporting covered transactions under the applicable UAE framework.

Businesses should distinguish this reporting requirement from suspicious transaction or activity reporting. A covered-transaction report and a suspicious transaction report serve different purposes, and one should not automatically be treated as a substitute for the other.

Confirm the current report types, triggers, and submission procedures against official guidance before filing.

How should businesses report suspicious transactions and activities?

Where the applicable reporting threshold and legal conditions are met, suspicious transactions or activities should be reported through the appropriate channel to the UAE Financial Intelligence Unit.

A business should not wait until it has proof of a crime before escalating a genuine suspicion. Nor should employees confront a customer or disclose a report in a way that could constitute prohibited tipping-off.

The appropriate process is to document the concern, escalate it internally, and follow the applicable reporting requirements. Reporting decisions should be handled by the responsible person under the business's AML procedures.

For a broader overview of the framework, reporting responsibilities, and compliance steps, see Finanshels' guide to setting up AML compliance for a UAE business.

What AML Records Should Gold and Precious Metals Businesses Maintain?

Good record-keeping helps a business demonstrate that its controls are more than paperwork.

If an inspector asks why a customer was accepted, how a transaction was assessed, or what happened after an alert was raised, the business should be able to produce a clear record.

Which customer and transaction records should be retained?

Depending on the applicable requirements, records may include:

• Customer identification and verification information.
• Corporate ownership and beneficial ownership records.
• Transaction details, invoices and relevant supporting documents.
• Risk assessments and due diligence findings.
• Sanctions-screening results and the resolution of potential matches.
• Suspicious activity reviews and relevant reporting records.
• AML training records and evidence of internal reviews.

Records should be accurate, accessible to authorised personnel and organised so that relevant information can be retrieved promptly.

How long must AML records be kept?

Record-retention periods depend on the applicable UAE legislation and the type of record.

Businesses should verify the current requirements under Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and any applicable supervisory guidance. Avoid adopting a retention period simply because it appears in an older checklist.

Your retention policy should identify the relevant record categories, applicable retention periods, access controls and procedures for secure disposal when permitted.

How can businesses organise records for regulatory review?

A practical approach is to maintain a central, access-controlled repository with consistent naming conventions and clear ownership.

For example, a customer file might include identification documents, verification evidence, risk classification, transaction records and the outcome of any additional checks.

Regular internal reviews can help identify missing documents, expired information, and unresolved alerts before an inspection.

What Are the AML Red Flags for Gold and Jewellery Businesses?

There is no single sign that proves money laundering is taking place. Red flags are indicators that may justify closer examination in the context of a customer's behaviour and transaction history.

Large or repeated cash transactions

Cash is not automatically suspicious. However, repeated cash purchases that differ from a customer's usual behaviour may warrant closer scrutiny, particularly when the business cannot establish a reasonable explanation.

Transactions structured to avoid reporting thresholds

A customer may attempt to split a purchase into several smaller transactions to avoid triggering applicable requirements.

Look for patterns, links between transactions and other indicators of unusual behaviour. Do not assess each sale in isolation when there are reasonable grounds to consider whether transactions are connected.

Customers unwilling to provide information

Refusal to provide required identification, inconsistent explanations about the purpose of a transaction or reluctance to clarify the source of funds may be warning signs.

Staff should follow the appropriate escalation procedures rather than making assumptions about the customer.

Unusual buying and selling patterns

Examples may include a sudden increase in high-value purchases, repeated transactions that do not fit the customer's known profile, or activity involving goods that the customer appears to have little commercial reason to buy.

Document the facts and assess them against the business's risk criteria.

Transactions involving high-risk jurisdictions or sanctioned parties

Cross-border transactions may require closer scrutiny where relevant parties or jurisdictions present elevated risks. Applicable sanctions requirements must also be followed.

Use current screening information and established escalation procedures. A possible match should be assessed carefully, with any required action taken in accordance with the applicable rules.

How Can DPMS Businesses Prepare for an AML Inspection in the UAE?

An AML inspection can involve a review of documentation, internal controls, customer files, and the way a business handles transactions. Preparing only a policy document at the last minute is unlikely to address every potential gap.

Review AML policies and risk assessments

Make sure your written policies reflect your actual operations and current legal requirements.

Check that the business-wide risk assessment identifies relevant exposure, that controls are proportionate to the risks and that responsibilities are clearly assigned.

Check goAML registration and reporting records

Verify that applicable registration requirements have been met and that reporting procedures are documented.

Review relevant submissions and supporting records, where applicable, to ensure they can be retrieved and reconciled with internal documentation.

Verify customer files and screening evidence

Select a sample of customer files and check whether the required identification, verification, due diligence, and risk assessment steps were completed.

Review how potential sanctions matches and unusual transactions were handled. If there are gaps, document them and take appropriate corrective action.

Confirm employee training and compliance responsibilities

Check that employees understand how to recognise and escalate concerns. Make sure the responsible compliance officer, where required, has the necessary authority and access to information.

Maintain evidence of training, internal reviews and corrective actions.

Identify and correct gaps before an inspection

A periodic internal review can help identify incomplete files, outdated procedures, unresolved alerts, and weaknesses in reporting processes.

Assign each issue to a responsible person, establish a realistic completion date, and retain evidence that the corrective action was completed.

The goal is not simply to have documents ready. It is to demonstrate that the business understands its risks and applies its controls consistently.

What Are the Penalties for AML Non-Compliance in the UAE?

AML non-compliance can result in administrative penalties and other consequences under the applicable legal framework. Depending on the nature and severity of a violation, businesses may also face operational, licensing, and reputational risks.

What do recent UAE enforcement figures show?

The Ministry of Economy and Tourism's H1 2025 inspection results provide a useful indication of enforcement activity:

Source: UAE Ministry of Economy and Tourism.

These figures relate to the reported inspection period and supervised sector; they should not be interpreted as a universal fine for every DPMS violation.

What can lead to compliance problems?

Potential weaknesses include incomplete customer checks, inadequate risk assessments, missing records, ineffective monitoring, failures to make required reports and failure to implement applicable sanctions requirements.

The consequences depend on the relevant provision, the facts of the case and the applicable penalty framework.

Businesses should consult the current legislation and competent authority guidance rather than relying on a generic penalty range that may not apply to their circumstances.

How can businesses reduce the risk of violations?

Start with a clear understanding of your obligations. Then implement practical procedures, train employees, keep records organised, and review the effectiveness of your controls.

When a requirement is unclear, seek qualified advice before making assumptions. Addressing a compliance gap early is generally more manageable than trying to reconstruct missing records or explain an undocumented decision during an inspection.

AML Compliance Checklist for Gold, Jewellery and Precious Metals Businesses

Use this checklist as a starting point for reviewing your business. It is not a substitute for a business-specific legal assessment.

• Confirm whether your business qualifies as a DPMS DNFBP.
• Identify the AML/CFT/CPF requirements applicable to your activities.
• Complete and document a business-wide risk assessment.
• Maintain appropriate written AML policies and internal controls.
• Appoint a compliance officer where required.
• Register on goAML where applicable.
• Implement customer identification and due diligence procedures.
• Identify beneficial owners of corporate customers where required.
• Apply enhanced due diligence when required by the risk and legal framework.
• Implement applicable sanctions screening and targeted financial sanctions procedures.
• Monitor transactions and identify unusual patterns.
• Understand the difference between covered-transaction reporting and suspicious transaction or activity reporting.
• Maintain required customer, transaction, training and reporting records.
• Train employees and document completion.
• Review controls periodically and correct identified gaps.

Final Thoughts

AML compliance for gold, jewellery and precious metals businesses in the UAE is about more than having the right documents in a folder. It is about understanding your risks, knowing your customers, recognising unusual activity and being able to explain the decisions your business makes.

The AED 55,000 threshold, goAML registration, customer due diligence and transaction reporting are all important parts of the picture, but they need to be understood in the context of the wider legal framework.

Start by confirming which requirements apply to your business. Build practical procedures around those requirements, keep your records organised, and review your controls regularly. That way, compliance becomes part of how you run the business rather than something you scramble to address when an inspection is announced.

Frequently Asked Questions About Precious Metals AML Compliance in the UAE