UBO, AML and what UAE banks ask in 2026
A new AML law since October 2025, fines up to AED 5 million per violation and personal liability for managers. Here is who is covered, how beneficial ownership works and how to get a bank file approved.
Federal Decree-Law No. 10 of 2025
The UAE replaced its anti-money laundering statute in 2025. Federal Decree-Law No. 10 of 2025 on anti-money laundering, combating the financing of terrorism and countering proliferation financing came into force on 14 October 2025, and its executive regulations, Cabinet Resolution No. 134 of 2025, from 14 December 2025. Together they repeal the 2018 law and its 2019 regulations. The new framework broadens the offences, lowers the knowledge thresholds for liability, expands personal liability for managers, and sets administrative fines of AED 10,000 to AED 5 million per violation for regulated entities.
The law reflects the UAE's position after its removal from the FATF grey list in 2024: the authorities want to show sustained, effective enforcement. For businesses, that means the questions from banks, free zone authorities and supervisors are more detailed than they were, and answers that were accepted in the past may no longer be enough.
Financial institutions and DNFBPs
| Sector | Supervisor |
|---|---|
| Banks, exchange houses, finance companies | Central Bank of the UAE |
| Securities and capital markets | The capital markets regulator |
| DIFC and ADGM financial firms | DFSA and FSRA |
| Real estate brokers and agents | Ministry of Economy (or the relevant supervisor) |
| Dealers in precious metals and stones | Ministry of Economy |
| Corporate service providers, auditors and accountants | Ministry of Economy and relevant authorities |
| Lawyers and notaries | Ministry of Justice |
These designated non-financial businesses and professions (DNFBPs) must register with the UAE Financial Intelligence Unit's goAML system, carry out customer due diligence, apply enhanced checks to higher-risk customers, screen against sanctions lists, file suspicious transaction reports and keep records. A company formation or management service provider is itself a DNFBP, which is why it asks its clients the questions it does.
Cabinet Resolution No. 109 of 2023
Every mainland and non-financial free zone company must identify its beneficial owners, keep a register of them, and file the information with its licensing authority under Cabinet Resolution No. 109 of 2023. A beneficial owner is a natural person who ultimately owns or controls 25% or more of the company, holds 25% or more of the voting rights, or has the right to appoint or remove the majority of directors, or otherwise exercises ultimate control. Where no one meets those tests, the person who controls the company by other means, or ultimately the senior manager, is recorded.
Register
Keep a register of beneficial owners, partners or shareholders, and nominee directors with their nominators.
File
Submit the information to the licensing authority at formation and update it when it changes, within the deadline set by the rules.
Nominees
Nominee shareholders and directors must disclose their status and who they act for.
Penalties
Failure to keep or update the register is a violation sanctioned by the licensing authority, and it also blocks banking.
KYC under the new law
UAE banks apply the same law as everyone else, but as financial institutions supervised by the Central Bank they apply it most rigorously. Opening an account for a new company, they will want the licence and constitutional documents, the beneficial ownership information on file with the licensing authority, identification of directors, signatories and beneficial owners, proof of address, a description of the business model with expected transaction volumes and counterparties, and evidence of the source of funds and source of wealth of the owners.
Three issues cause most delays: beneficial ownership that does not match between the bank's file and the licensing authority's records; business descriptions too vague to assess, such as general trading with no named counterparties; and links to higher-risk jurisdictions or sectors without a clear explanation. A clean, consistent file prepared before the first meeting shortens the process more than anything else.
The activities on the licence, the beneficial owners filed with the authority, the business plan given to the bank and the first transactions on the account should all match. When they do not, the bank's compliance team stops the account or asks for explanations that take weeks.
What the 2025 law changed in practice
Personal liability
Managers of regulated entities can be personally liable for AML failures, which raises the stakes for boards and compliance officers.
Knowledge threshold
Liability can arise where a person knew or should have known that funds were proceeds of crime, which makes wilful blindness a risk.
Administrative fines
AED 10,000 to AED 5 million per violation for regulated entities, alongside warnings, suspension and licence restrictions.
Proliferation financing
Countering proliferation financing is now integrated into the same framework, with targeted financial sanctions screening.
For ordinary trading and service companies that are not DNFBPs, the direct obligations are lighter but real: accurate beneficial ownership records, cooperation with banks' due diligence, and avoiding transactions they know or should know are suspicious. For DNFBPs, including real estate brokers and corporate service providers, the law requires a documented compliance programme with a named compliance officer, risk assessment, training and goAML reporting.
A trading company and its bank
A free zone general trading company owned 50/50 by two individuals through a BVI holding company applies for a bank account. The bank asks for the BVI company's register of members and directors, the identity of the two individuals as beneficial owners, the source of the capital, and the expected suppliers and customers. The application stalls because the free zone's beneficial ownership filing lists the BVI company rather than the individuals, the business plan says only general trading, and the first supplier is in a jurisdiction the bank classifies as higher risk.
Fixed properly, the company updates its beneficial ownership filing to show the two individuals, provides a business plan naming its product categories, main suppliers and customers with expected monthly volumes, documents the source of funds with bank statements and a sale agreement, and explains the supplier relationship with contracts and shipping records. The same bank opens the account a few weeks later. Nothing about the business changed; only the file did.
goAML and targeted financial sanctions
Regulated entities must screen customers and transactions against the UAE local terrorist list and United Nations sanctions lists, freeze funds without delay when there is a match, and report through the UAE Financial Intelligence Unit's goAML platform. Suspicious transaction reports must be filed promptly when there are reasonable grounds to suspect, and tipping off the customer is an offence. The obligation is to report suspicion, not to prove a crime; most enforcement cases concern reports that should have been filed and were not.
For businesses dealing with counterparties in sanctioned or high-risk jurisdictions, these rules interact with sanctions regimes of other countries, which UAE banks also apply in practice to protect their correspondent relationships. A transaction that is lawful under UAE law can still be refused by a UAE bank because of its exposure to US, EU or UK sanctions. Plan trade flows and payment routes with that in mind, and document the legitimacy of each relationship before the bank asks.
And why it is not optional
A company formation agent, registered agent or corporate service provider in the UAE is itself a DNFBP with AML obligations. Before forming a company or providing a registered office, it must identify and verify the client, the beneficial owners and the source of funds, understand the intended business, screen everyone against sanctions lists and keep records. If it cannot complete due diligence, it must decline the business. The same applies to auditors, accountants and lawyers acting in defined transactions.
Clients sometimes see these questions as bureaucracy to be minimised. In practice, the file a good service provider builds at formation becomes the basis of the bank application, the beneficial ownership filing and the first audit, and preparing it once, properly, avoids repeating the exercise with each institution.
Where scrutiny is highest
Real estate and precious metals and stones are the sectors the UAE authorities watch most closely. Real estate brokers must conduct due diligence on buyers, particularly for cash purchases above set thresholds and transactions involving virtual assets, and report through goAML. Dealers in precious metals and stones face similar obligations above transaction thresholds. A foreign investor buying property in Dubai should expect the broker, the developer and the bank to ask for source-of-funds evidence, and should have it ready: the same documents will serve a Golden Visa application later.
Questions we get asked first
What is the UAE's current AML law?
Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, with executive regulations in Cabinet Resolution No. 134 of 2025 from 14 December 2025. It replaced Federal Decree-Law No. 20 of 2018.
What are the AML fines in the UAE?
Administrative fines of AED 10,000 to AED 5 million per violation for regulated entities, plus other sanctions, and criminal penalties for offences.
Who is a beneficial owner in the UAE?
A natural person who ultimately owns or controls 25% or more of a company or its voting rights, can appoint or remove the majority of directors, or otherwise exercises ultimate control, under Cabinet Resolution No. 109 of 2023.
Do free zone companies need a beneficial ownership register?
Yes, non-financial free zone companies keep a register and file it with their free zone authority. DIFC and ADGM have their own equivalent rules.
Why do UAE banks ask so many questions?
They are supervised by the Central Bank under the AML law and must verify beneficial owners, the business model and the source of funds and wealth. Inconsistent or vague information is the main cause of delays.
What are DNFBPs?
Designated non-financial businesses and professions, such as real estate brokers, dealers in precious metals, corporate service providers, auditors and lawyers, which have their own AML obligations and register with goAML.
One story, told consistently
The UAE's 2025 AML law raised fines and personal liability and made banks and service providers more demanding. Keep accurate beneficial ownership records with your licensing authority, describe your business concretely, document the source of funds, and make sure the licence, the filings and the bank file all say the same thing.
Need a bank-ready company file?
We prepare the beneficial ownership filings, business description and source-of-funds documents that UAE banks expect.
Email us →Related reading
This article is general information, current as of 2026, and is not advice for any specific situation. Confirm current rules with the MOIC, the NBR or the relevant authority before acting.