UAE AML Compliance Update 2026: What the Third National Risk Assessment Means for Businesses

UAE Strengthens Its Financial Crime Compliance Framework

The UAE has launched its third National Risk Assessment covering money laundering, terrorism financing and proliferation-financing risks. The assessment is one of the country’s most comprehensive financial-crime reviews and is designed to update the national understanding of risks across the economy.

The review examines more than 20 sectors and 21 categories of predicate offences, using information from 84 government and private-sector entities. Advanced artificial intelligence will also be used to analyse large volumes of financial information and identify suspicious patterns that may not be detected through traditional reviews.

For UAE businesses, the message is clear: AML compliance must be active, documented and regularly updated. Written policies alone are not enough if customer files, accounting records, risk assessments and transaction-monitoring evidence do not support them.

Businesses that need practical support can begin by reviewing their AML compliance position, strengthening accounting and bookkeeping records and organising reporting readiness through goAML registration assistance.

What Is the UAE National Risk Assessment?

The National Risk Assessment, often called the NRA, evaluates threats, vulnerabilities and potential consequences of financial crime across the UAE economy. Its findings help authorities understand where risks are concentrated and how supervision, guidance, inspections and regulatory priorities should develop.

The assessment helps authorities determine:

• Higher-risk sectors: Which industries and activities require closer monitoring.
• Compliance weaknesses: Where businesses may need stronger controls, records or risk-based procedures.
• Inspection priorities: How supervisory authorities should focus future reviews and enforcement activity.
• Legislative needs: Whether additional rules, guidance or sector-specific expectations are required.
• Emerging risks: How public and private organisations should respond to new financial-crime patterns.

The assessment covers offences such as fraud, bribery, forgery, drug trafficking, tax evasion, terrorism financing and other crimes capable of generating illegal proceeds. Its findings support the UAE National Strategy for Anti-Money Laundering, Countering the Financing of Terrorism and Countering Proliferation Financing for 2024–2027.

Does the Announcement Create a New Deadline?

The launch of the third National Risk Assessment does not itself introduce a new registration or filing deadline for businesses. However, companies should not wait for final findings or a regulatory inspection before reviewing their AML framework.

The assessment may influence future regulatory expectations in areas such as:

• Regulatory inspections and supervisory priorities.
• Sector-specific risk classifications.
• Customer due-diligence expectations.
• Transaction-monitoring requirements.
• Compliance reporting obligations.
• Enforcement activity and follow-up reviews.

A proactive review through AML, KYC and reporting support can help a business identify gaps before they become inspection issues.

Which UAE Businesses Are Most Affected?

The update is particularly relevant for financial institutions and Designated Non-Financial Businesses and Professions, commonly known as DNFBPs. These businesses often interact with customers, assets, ownership structures or transactions that may require enhanced financial-crime controls.

Independent accountants and auditors are treated as DNFBPs under the current UAE AML framework. Trust and corporate service providers are also covered by updated DNFBP guidance. Businesses can also review broader compliance obligations through compliance and regulations support.

Seven AML Compliance Areas Businesses Should Review

1. Business-Wide Risk Assessment

Regulated businesses should maintain a documented and current assessment of their exposure to money laundering, terrorism financing and proliferation-financing risks. A generic document that does not reflect the company’s actual operations may not demonstrate effective compliance.

• Customer profiles and customer types.
• Business activities, products and services.
• Countries and geographical exposure.
• Transaction values and payment methods.
• Ownership structures and delivery channels.

2. Customer Due Diligence

Customer due diligence should be completed before establishing a business relationship or carrying out a qualifying transaction. The Ministry of Economy and Tourism has emphasised that customer and beneficial-owner risks should be assessed throughout the relationship, not only during onboarding.

• Verify the customer’s identity and registration documents.
• Identify the ultimate beneficial owner.
• Understand the purpose and expected nature of the relationship.
• Determine source of funds where required.
• Identify politically exposed persons and conduct sanctions screening.
• Assign a customer-risk rating and perform ongoing monitoring.

3. Ultimate Beneficial Owner Verification

Businesses must understand who ultimately owns or controls a customer. Collecting a trade licence or shareholder register alone may not be sufficient where the ultimate controlling person has not been identified.

Additional verification may be required where a structure involves multiple corporate layers, offshore companies, foreign shareholders, nominee arrangements, trusts or foundations, frequent shareholder changes or unclear control arrangements.

Well-organised ownership and client records can also support due diligence reviews and accounting review services.

4. goAML Registration and Reporting

Applicable DNFBPs must register with the UAE Financial Intelligence Unit’s goAML system. goAML is used to submit reports concerning suspicious transactions and activities. Failure to register or comply with reporting requirements may lead to regulatory action.

Businesses should also ensure that employees know how to identify, escalate and document suspicious activity. This is especially important where staff interact with customers, invoices, payments, supplier relationships or unusual account movements.

5. Enhanced Due Diligence

Higher-risk customers require deeper checks and stronger approval procedures. Enhanced due diligence can include obtaining additional information about source of funds, source of wealth, business activities, expected transaction patterns, complex ownership structures, high-risk jurisdictions, adverse media and politically exposed persons.

Higher-risk relationships should be subject to senior-management approval and more frequent monitoring.

6. Transaction Monitoring

Businesses should investigate transactions that appear inconsistent with the customer’s profile, business purpose or financial capacity. The use of artificial intelligence in the latest National Risk Assessment highlights the increasing importance of data analysis in detecting unusual financial patterns.

• Unexplained third-party payments.
• Payments from unrelated or unusual jurisdictions.
• Transactions without a clear commercial purpose.
• Unusual cash transactions.
• Repeated cancellations and refunds.
• Complex transactions without economic justification.
• Activity inconsistent with the customer’s financial capacity.
• Use of shell companies without an identifiable business purpose.

7. Policies, Records and Employee Training

AML policies must reflect the latest legislation, regulatory guidance and risks associated with the business. Companies should maintain complete records of customer-identification documents, beneficial-ownership verification, risk assessments, sanctions and PEP screening, transaction reviews, compliance approvals, internal escalations, suspicious-activity decisions and employee training.

Training should be practical and based on each employee’s role. A finance employee, client-onboarding officer, relationship manager and business owner may each need different levels of AML awareness.

Why Accounting Records Matter for AML Compliance

Reliable accounting records are essential for identifying unusual transactions and demonstrating the commercial purpose of payments. Incomplete or outdated bookkeeping can make it difficult to trace funds, match payments with invoices, identify third-party transfers, explain account movements or respond effectively to regulatory inspections.

A well-maintained accounting system gives management and compliance teams a clear audit trail. It also helps reconcile customer and supplier balances, identify exceptions early and support decisions with documentary evidence.

Businesses with incomplete records can strengthen their position through backlog accounting clean-up, management accounting, data entry services and accounts office digitisation.

Is Your Business Compliance-Ready?

A business should be able to demonstrate that its compliance framework is operating effectively, not simply that written policies exist. An effective AML framework should include:

• An updated business-wide risk assessment.
• Documented customer-risk classifications.
• Verified beneficial-ownership information.
• Current sanctions and PEP screening.
• Enhanced due diligence for high-risk customers.
• Transaction-monitoring procedures.
• Active goAML access where required.
• Internal suspicious-activity escalation procedures.
• Proper compliance records and employee training.
• Management oversight and periodic compliance reviews.

Related Business Support Resources

AML compliance often connects with business setup, auditing, tax, ownership documentation and closure decisions. Businesses reviewing their position may also find value in these related resources:

• AML/CFT services in the UAE for companies that need broader business compliance support.
• Business compliance services for entrepreneurs and UAE companies reviewing regulatory obligations.
• Business setup in Dubai for investors planning a compliant structure from day one.
• Internal audit and compliance services for businesses that need independent control reviews.
• Forensic audit services where unusual transactions, weak controls or suspected irregularities require specialist review.
• Mainland liquidation guidance for businesses closing operations while managing records, clearances and compliance obligations.

Official UAE Resources for Further Reading

Businesses can review official UAE resources to stay aligned with current AML/CFT expectations and reporting procedures:

• Emirates News Agency announcement on the third National Risk Assessment.
• Ministry of Economy AML/CFT guidance for DNFBPs.
• Ministry of Economy goAML registration guidance.
• UAE Financial Intelligence Unit SACM / goAML access portal.
• Central Bank of the UAE AML/CFT supervision resources.

How CZ Accounting Can Support Your Business

CZ Accounting assists UAE businesses with the accounting, documentation and compliance-readiness processes needed to maintain accurate and transparent financial records. We help companies organise their records, review risk-sensitive transactions and prepare practical documentation that supports regulatory readiness.

Our support can include:

• Accounting and bookkeeping.
• Backlog-accounting corrections.
• Transaction reconciliation and customer/supplier ledger reviews.
• Financial-record organisation and management reporting.
• Ultimate beneficial-owner documentation support.
• AML/CFT advisory support.
• goAML registration assistance.
• AML compliance-file reviews and business-wide risk-assessment support.
• Internal policy, procedure and compliance health-check support.

Prepare Before the Next Compliance Review

The UAE’s third National Risk Assessment demonstrates the country’s continuing commitment to using advanced technology, data analysis and risk-based supervision to prevent financial crime.

Businesses should use this opportunity to review their customer records, accounting systems, beneficial-ownership information, risk assessments and reporting procedures. Correcting compliance gaps before an inspection is always more effective than responding after a violation has been identified.