The grey-list exit lowered the headlines, not the scrutiny.
Federal Decree-Law No. 10 of 2025 sets defined obligations on Designated Non-Financial Businesses and Professions, the DNFBPs. The UAE left the FATF grey list in 2024, and inspection of these firms rose. The standard moved from registering once to proving the programme runs. The DNFBPs it covers:
- Corporate service providers.
- Accountants and auditors.
- Lawyers.
- Real estate brokers.
- Dealers in precious metals and stones.
The bar was registration.
Get listed, file the manual, move on.
Paperwork on hand counted as compliance.
The bar is a programme that operates.
Inspections test whether the policy is followed.
What cannot be evidenced is treated as a gap.
A quieter consequence sits under the rule: you do not have to be a DNFBP to be exposed by one. The firm that filed your licence is, and its compliance posture is written into your file. A weak provider upstream becomes your problem downstream.
What a DNFBP must be able to evidence at inspection.
Five ongoing obligations. Registration is the floor. A supervisor tests whether each one operates, not whether a manual exists.
An applied AML/CFT policy
A documented policy, programme, and procedures manual approved by senior management. The test is whether it is followed. An unused manual reads as a gap.
A registered Compliance Officer
Appointed and registered with the relevant supervisory authority. A name on paper is not enough. The role has to be live, reachable, and exercised.
Real customer due diligence
Complete CDD files, with enhanced diligence on high-risk clients, Politically Exposed Persons, and parties in high-risk jurisdictions. Incomplete files are the finding inspectors write up most.
goAML registration and reporting
Registration on the goAML system run by the UAE Financial Intelligence Unit, plus Suspicious Transaction Reports filed when the duty triggers. Registration without reporting is a hollow control.
Who decides here: the FIU, not the firmDocumented annual training
Staff training on spotting and reporting suspicious activity, run and recorded every year. The record matters as much as the session: what cannot be evidenced never happened.
The obligation sits on one firm. The consequence travels.
It starts with the regulated provider, follows the file into the bank, and lands back on you.
The regulated DNFBP
A CSP, accountant, or broker carries the obligation, and the inspection.
Your file
Whatever they captured, or skipped, becomes your corporate record.
The bank's KYC
The same due-diligence questions return, and a gap stalls the account.
Back to you
The correction lands in your name, at the worst possible moment.
The integrity of your company file is set by whoever built it, long before a bank or supervisor ever looks at it.
DNFBPs are supervised by sector. The Ministry of Economy oversees corporate service providers, accountants, auditors, and precious-metals dealers; land departments and RERA cover real estate. When supervision reaches a firm, it reaches the records that firm created: the beneficial-ownership data, the source-of-funds trail, the due diligence the file should have captured at the start. Where the provider cut corners, the founder inherits the corrections, usually when a bank declines to open and the same questions land again.
This is not abstract regulatory news. The cheapest filing is often the one assembled without the discipline a supervisor now expects, and that shortcut never shows on the setup invoice. It shows up later, in your name.
We are not explaining this from the outside.
DM Consultancy lives under the same framework it advises on. We hold the programme a supervisor expects to find, so your file survives both inspection and the bank.
Registered DNFBP-CSP
DET Trade Licence 1457744.
AML/CFT programme
Approved policy manual in force.
Compliance Officer
Appointed and registered.
goAML
Registered, with reporting discipline.
The standard we hold internally is the one we apply to your file. Read our wider work on AML/CFT compliance for UAE businesses and on corporate banking readiness, where the same due-diligence questions decide whether an account opens.