Key takeaways
- Federal Decree-Law No. 10 of 2025 sets defined AML/CFT obligations on DNFBPs, including corporate service providers.
- Since the UAE left the FATF grey list in 2024, inspections test whether the compliance programme actually operates.
- Gaps a provider leaves in your due diligence file can surface later in bank KYC, under your name.
What AML Law 10 of 2025 changes
The UAE AML law, Federal Decree-Law No. 10 of 2025, sets defined obligations on Designated Non-Financial Businesses and Professions, the DNFBPs.
The UAE left the FATF grey list in 2024, and inspection of these firms rose. The standard moved from registering once to showing that the programme runs. The DNFBPs it covers:
- Corporate service providers.
- Accountants and auditors.
- Lawyers.
- Real estate brokers.
- Dealers in precious metals and stones.
There is a less obvious consequence: a company can be exposed by a DNFBP without being one.
The firm that filed your licence is a DNFBP, and its compliance standards are written into your file, so a weak provider becomes your problem later.
What a DNFBP must evidence at inspection
There are five ongoing obligations, and registration is only the first. A supervisor tests whether each one operates in practice.
An applied AML/CFT policy
Approved by senior management, and tested on whether it is followed.
A registered Compliance Officer
Registered with the supervisor, and doing the job day to day.
Real customer due diligence
Complete files, with enhanced checks on high-risk clients, because incomplete files are a frequent inspection finding.
goAML registration and reporting
Registration with the UAE Financial Intelligence Unit is not the duty on its own; reporting is.
Documented annual training
Run every year and recorded, since the record matters as much as the session.
How a provider's gap reaches you
It starts with the regulated provider, follows the file into the bank and comes back to you.
The regulated DNFBP
A CSP, accountant, or broker carries the obligation, and the inspection.
Your file
Whatever they captured, or skipped, becomes your corporate record.
The bank's KYC
The same due-diligence questions return, and a gap stalls the account.
Back to you
The correction falls to you, often at a bad moment.
The integrity of your company file is set by whoever built it, long before a bank or supervisor ever looks at it.
When supervision reaches a provider, it reaches the records that provider created: the beneficial-ownership data, the source-of-funds trail and the due diligence on your file.
Where corners were cut, the founder inherits the corrections, usually when a bank declines and asks the same questions again. That gap does not show on the setup invoice and tends to surface later, in your name.
Our own AML framework
DM Consultancy operates under the same framework it advises on. We run the programme a supervisor expects to find, and build client files to meet both inspection and bank KYC.
Registered DNFBP-CSP
AML/CFT programme
Approved policy manual in force.
Compliance Officer
Appointed and registered.
goAML
Registered, with reporting discipline.
The standard we hold internally is the one we apply to your file. Read our guide to being a DNFBP in the UAE and on corporate banking readiness, where the same due-diligence questions decide whether an account opens.
