Yes. Every Financial Institution, Designated Non-Financial Business and Profession (DNFBP) and Virtual Asset Service Provider in the UAE must appoint a Compliance Officer — written directly into Article 22 of Cabinet Resolution No. 134 of 2025, the Executive Regulations of the new Federal Decree-Law No. 10 of 2025 AML framework that replaced the 2018/2019 regime. The officer must sit at management level, act independently, hold the right competence and experience, and be appointed with the regulator's prior approval where required. Miss the appointment and the administrative penalties run high and per violation.
TL;DR
- Yes — Article 22, Cabinet Resolution 134/2025 mandates a Compliance Officer.
- Applies to Financial Institutions, DNFBPs and VASPs.
- Management-level, independent, competent — prior regulator approval may be needed.
- The 2018 law and 2019 Cabinet Decision were repealed in late 2025.
- Non-appointment is a penalised violation, enforced per entity and per breach.
Is it mandatory to appoint an AML compliance officer in the UAE?
Yes, and the requirement survived the 2025 legal overhaul intact — arguably strengthened. Federal Decree-Law No. 10 of 2025 (effective 14 October 2025) repealed Federal Decree-Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 (effective 14 December 2025) repealed Cabinet Decision No. 10 of 2019. Article 22 of the new Executive Regulations carries the obligation forward for every Financial Institution, DNFBP and VASP: appoint a Compliance Officer at management level, under the entity's responsibility, with decision-making independence and appropriate competence and experience.
| Entity type | Compliance Officer required? | Governing provision |
|---|---|---|
| Financial Institutions (banks, exchange houses, insurers) | Yes | CR 134/2025, Article 22 |
| DNFBPs — real estate brokers, precious metals and stones dealers, auditors, corporate service providers, law firms | Yes | CR 134/2025, Article 22 |
| Virtual Asset Service Providers | Yes | CR 134/2025, Article 22 |
| Commercial gaming operators (newly in scope under the 2025 framework) | Yes, when transaction thresholds are crossed | CR 134/2025 DNFBP scope |
| Businesses with no AML-regulated activity | No | Outside the AML framework's scope |
Who counts as a DNFBP in 2026?
The DNFBP categories under the new framework cover, in practice: real estate agents and brokers handling transactions; dealers in precious metals and stones above threshold transactions; auditors, accountants and tax advisers; corporate service providers and company formation agents; independent legal professionals; and — a change from the 2019 regime — commercial gaming operators. If your business sits in any of these, the appointment obligation applies from your first regulated activity, and the officer's appointment may require the supervisor's prior written approval.
What the Compliance Officer must actually do
Article 22 sets the officer's duties: monitoring transactions related to money laundering, terrorism financing and proliferation financing; overseeing internal AML policies, procedures and controls; ensuring Suspicious Transaction Reports are filed with the FIU through goAML without interference; delivering staff training; and reporting directly to senior management. The officer needs unrestricted access to records, systems and decision-making forums, and answers under their own responsibility.
Small business, same obligation
The 2025 framework keeps the principle that size does not remove the duty: all DNFBPs must maintain an AML programme, appoint a compliance officer, register on goAML, and file STRs regardless of headcount. What scales with size is the depth of the programme, not its existence. A two-person real-estate brokerage and a 200-employee gold refinery both need a named, competent officer — the refinery simply needs more programme around them.
What happens if you do not appoint one
Failure to appoint a Compliance Officer is an administrative violation under the new regime's penalty framework, and AML penalties are imposed per violation and can run into hundreds of thousands of dirhams for the largest breaches — with licensing consequences on top. Enforcement under the new law also reaches senior management personally, which is why boards now treat the appointment as a governance item, not an HR formality. Businesses reviewing their AML posture against the new law should start with the AML compliance framework and the AML obligations for free zone companies walkthrough.
How to appoint an officer that passes inspection
- Choose competence over title. The officer must have genuine AML competence and experience; supervisors increasingly test for it.
- Fix the reporting line. Management level, direct access to senior management, independence in STR decisions — document all three.
- Secure approvals. Where your supervisor requires prior written approval of the appointment, obtain it before the officer acts.
- Register the officer on goAML. FIU reporting access depends on it.
- Review annually. Competence, capacity and independence drift as the business grows; retest the appointment each year alongside your risk assessment.
FAQ
Is it mandatory to appoint an AML compliance officer in the UAE?
Yes. Article 22 of Cabinet Resolution No. 134 of 2025 requires every Financial Institution, DNFBP and VASP to appoint a Compliance Officer at management level with appropriate competence and independence.
Which UAE businesses need an AML compliance officer?
Financial institutions, DNFBPs (real estate brokers, precious metals and stones dealers, auditors, accountants, corporate service providers, legal professionals, gaming operators) and VASPs.
Did the new 2025 AML law change the compliance officer requirement?
No — it retained and reinforced it. Federal Decree-Law No. 10 of 2025 replaced the 2018 law, and Cabinet Resolution No. 134 of 2025 replaced the 2019 Executive Regulations; the Article 22 obligation continues in the new framework.
Can one person be the AML compliance officer and the owner?
The owner can hold the role where they have competence, independence and management level — small DNFBPs commonly do this — but the officer's duties and reporting duties must still be genuinely performed.
Does a free zone company need an AML compliance officer?
Yes, where it conducts AML-regulated activity. Free zone entities follow the federal AML framework alongside any additional rules from their zone regulator.
What are the penalties for not appointing a compliance officer?
Administrative penalties under the new regime's penalty framework, imposed per violation, with AML fines that can reach hundreds of thousands of dirhams — plus licensing consequences from the supervisor.
