AML Compliance Software in the UAE: A Buyer's Guide for Financial Institutions, VASPs and DNFBPs (2026)
How to choose AML compliance software in the UAE under Federal Decree-Law No. 10 of 2025: goAML reporting to the FIU, DPMSR and REAR reports, targeted financial sanctions, provider types, evaluation criteria, cost drivers and red flags.
Short answer: Good anti-money laundering (AML) compliance software for a UAE reporting entity does five jobs well: it screens customers against targeted financial sanctions lists and PEP data, rates customer risk, monitors transactions across every channel you run, turns alerts into documented cases fast enough to report suspicions "immediately and without delay", and gets STRs, SARs and the UAE's own goAML report types, such as the DPMSR and the REAR, to the Financial Intelligence Unit (FIU). Choose on evidence from scripted demos on your own data, and compare three-year costs on the same basis.
This guide is for compliance officers, MLROs and procurement teams at UAE banks, exchange houses, finance companies, virtual asset service providers (VASPs) and designated non-financial businesses and professions (DNFBPs) such as dealers in precious metals and stones and real estate brokers. The rules changed in 2025: Federal Decree by Law No. (10) of 2025, issued on 30 September 2025, replaced Decree by Law No. (20) of 2018, and Cabinet Resolution No. (134) of 2025, issued on 29 October 2025, replaced the 2019 executive regulations. Systems configured for the old texts deserve a second look.
Creodata offers AML compliance software in the UAE, so we say plainly where we fit near the end. The criteria before that are the ones we would use to choose any vendor. This is a practical guide, not legal advice: confirm requirements against current law and guidance from the FIU and your supervisor.
What AML compliance software does
AML software turns your customer and transaction data into the decisions an AML programme has to make, and keeps the evidence of each one.
| Function | What it does | What matters in the UAE |
|---|---|---|
| Customer due diligence and risk rating | Scores each customer's money-laundering risk from factors such as geography, product, channel and PEP status | A model your compliance team can change, with every override approved and recorded, and CDD triggered at the regulations' thresholds |
| Sanctions and PEP screening | Checks names against sanctions lists, PEP data and adverse media, at onboarding and whenever lists change | UN and UAE targeted financial sanctions, matching that copes with Arabic and transliterated names, and proof of which list version was used |
| Transaction monitoring | Runs rules and models over transactions to raise alerts on suspicious patterns | Cash, wire, card and virtual asset coverage, and linked transactions that reach AED 55,000 |
| Case management | Turns alerts into owned cases with deadlines, evidence and approvals | A record of when suspicion arose, and MLRO approval without delay |
| Regulatory reporting | Prepares STRs, SARs and the UAE's other goAML reports | Files the FIU's goAML accepts, including DPMSRs and REARs for the sectors that owe them |
| Audit trail | Records every action and decision | An append-only log and five-year records that stand up to your supervisor |
The complete AML platform guide explains each function in depth.
Who needs AML software in the UAE
The 2025 law applies to financial institutions, DNFBPs and VASPs, and sends all suspicious transaction reports, exclusively, to the FIU, an independent unit within the Central Bank. The executive regulations bring DNFBPs in at defined points, including:
- Dealers in precious metals and stones, for single or linked cash transactions of AED 55,000 or more.
- Real estate brokers and agents, when they conclude purchases or sales for customers.
- Commercial gaming operators, for transactions of AED 11,000 or more.
- Lawyers, notaries, other legal professionals and independent accountants, when they carry out specified transactions for clients.
The law defines the supervisory authority as the body that supervises each sector or, where none is designated, the one that licenses the activity. The Ministry of Economy & Tourism lists the Central Bank of the UAE, the Securities and Commodities Authority, the Ministry of Justice, the Dubai Financial Services Authority and Abu Dhabi Global Market among the regulatory authorities, alongside itself. The Ministry of Economy & Tourism and the Ministry of Justice supervise DNFBPs (Cabinet Resolution No. 71 of 2024 sets the penalties for DNFBPs under the two ministries), and DNFBPs register on goAML through the Ministry of Economy & Tourism's service.
Not every institution needs the same system. A bank needs real-time monitoring across many channels, while a gold trader or a brokerage usually needs dependable screening, risk rating and reporting first, at a cost that fits its size.
The UAE requirements that shape the choice
Most vendor demos look alike until you test them against the rules you actually work under.
- Suspicious transactions, immediately and without delay. Where a reporting entity suspects, or has reasonable grounds to suspect, that a transaction or funds are linked to the crime, it must notify the FIU "immediately and without delay" through the FIU's electronic system, whatever the amount and including attempted transactions (Article 18 of the Decree by Law and of the Cabinet Resolution). There is no grace period to design around, so the case workflow has to move from alert to approved report quickly and record when suspicion arose.
- goAML. The goAML login runs through the FIU's eServices portal, services.uaefiu.gov.ae. Financial institutions file STRs and SARs directly through goAML, and DNFBPs must register on goAML before they can report. goAML also accepts XML files for batch filing, so ask whether the vendor generates them.
- DPMSR and REAR. Dealers in precious metals and stones record cash transactions of AED 55,000 or more in goAML as a Dealers in Precious Metals and Stones Report (DPMSR), under Ministry of Economy Circular 08/AML/2021. Real estate brokers and agents file a Real Estate Activity Report (REAR) for freehold sales paid with AED 55,000 or more in cash, or with virtual assets, under Circular 05/2022. Both circulars remain in force under the 2025 law where they are consistent with it.
- CDD thresholds. Financial institutions apply customer due diligence to occasional transactions of AED 55,000 or more and wire transfers of AED 3,500 or more; VASPs to occasional transactions of AED 3,500 or more (Article 7 of the Cabinet Resolution). The system should trigger CDD at those points, including for linked transactions.
- Targeted financial sanctions, forthwith. Reporting entities must implement "forthwith" the instructions of the Executive Office for Control and Non-Proliferation and other competent authorities on targeted financial sanctions (Article 19 of the Decree by Law). Screening has to run on current lists, and a confirmed match has to reach whoever can freeze without delay.
- Five-year records. Transaction records, CDD records, account files, correspondence, STRs and analysis results must be kept for at least five years from the end of the transaction or business relationship (Article 25 of the Cabinet Resolution).
The types of AML software provider in the UAE
A search for AML software or AML solutions in the UAE returns very different kinds of supplier. Knowing which kind you are talking to tells you what to test.
| Provider type | Typical strengths | Watch for |
|---|---|---|
| Global AML suites | Depth, large-bank references, mature analytics | Cost, long implementations, and whether the FIU's goAML reports, including DPMSR and REAR, work out of the box |
| Screening-only tools | Fast sanctions and PEP checks, often priced per search | Screening is one duty; ask what covers risk rating, monitoring, cases and goAML reporting |
| Compliance consultancies and goAML registration services | Policies, risk assessments, registration and filing help | Whose software it is, and whether you are buying a system or a service |
| Identity verification and KYC API providers | Fast digital onboarding and document checks | Onboarding checks are not transaction monitoring, case management or goAML reporting |
| Specialist AML vendors with goAML experience | goAML reporting built in, and a full case-to-report workflow | Support arrangements in the UAE, references of similar size, security assurance, and the roadmap behind each module |
| Spreadsheets and in-house builds | Low starting cost, full control | Key-person risk, no audit trail, and the cost of keeping pace with the 2025 rules |
Evaluation criteria
Score every vendor against the same requirements, weighted before the first demo.
| Area | What to test |
|---|---|
| Regulatory fit | goAML files the FIU accepts, including DPMSR and REAR where you owe them; CDD triggers at AED 55,000 and AED 3,500; configuration for the 2025 law and regulations |
| Sanctions | UN and UAE targeted financial sanctions lists; matching quality on your own sample of Arabic and transliterated names; list freshness you can prove; a freeze workflow |
| Risk rating | Compliance can change the model without code; overrides need four eyes; ratings explain themselves |
| Transaction monitoring | Cash, wire, card and virtual asset coverage; linked transactions; back-testing before rules go live |
| Case management | The time suspicion arose on every case; MLRO approval without delay; tipping-off controls; an append-only audit trail |
| Deployment and data | Where data is stored and processed; the same features in cloud and on-premises editions; security assurance |
| Commercials | Three-year cost; currency of the quote; implementation plan; references; exit terms; regulatory updates included |
How to run the evaluation
- Set priorities with compliance, risk, IT and procurement before meeting vendors.
- Long-list suppliers and drop those that fail your Must-have requirements.
- Issue an RFP with your questions and the evidence you expect. Our free AML vendor RFP checklist and scoring template was written for Kenya, but most requirements carry over once you swap in the FIU, the 2025 law and your supervisor.
- Run scripted demos on your own data: a PEP at onboarding, a near-match on a transliterated name against a sanctions list, two linked cash purchases of gold that together reach AED 55,000, and an alert taken to a filed STR with every step timestamped.
- Call references of similar size and sector, and ask what went wrong.
- Score independently, then calibrate as a panel, and file the scoring sheet with the decision papers.
What AML software costs in the UAE
Vendors price AML software in very different ways, so ask every shortlisted vendor to itemise the same lines over three years:
- Licence: per module or tier, per customer or account, per transaction or search, or a flat enterprise fee.
- List data: sanctions, PEP and adverse-media data is often a separate subscription.
- Implementation: data mapping, core-system integration, rule configuration and training.
- Hosting: cloud subscription and consumption, or servers and operations on-premises.
- Support, including whether changes to the FIU's goAML reports are covered.
- Currency: dirhams or US dollars.
- Internal effort: your analysts' and IT team's time during and after implementation.
A lower licence fee can hide higher data, integration or change-request costs, so compare three-year totals, not first-year quotes.
Red flags
- The vendor cannot show a goAML file the FIU accepts, or cannot explain how it will produce the DPMSR or REAR you owe.
- The product is still configured for Decree by Law No. (20) of 2018 and Cabinet Resolution No. (10) of 2019, with no plan for the 2025 texts.
- The STR workflow has no clock, or starts it at the end of the investigation rather than when suspicion arose.
- Screening is demonstrated only on the vendor's sample names, never on Arabic or transliterated names of yours.
- An administrator can edit or delete audit entries.
- Must-have requirements are answered with roadmap dates.
Where Creodata fits
Creodata is a Nairobi software company, and our AML compliance software is a specialist vendor's answer to the criteria above. It covers sanctions, PEP and adverse-media screening with multi-script matching and a false-positive workflow; customer risk rating across country, industry, product, channel, behaviour and PEP or sanctions exposure, with four-eyes overrides; batch and streaming transaction monitoring with back-testing; case management with enhanced due diligence; and an append-only audit log. Reports move through a draft, review, approve and submit lifecycle, and our separate goAML reporting software for the UAE generates and validates the file for the FIU's goAML, with a manual download if the portal is down, and can be configured to support DPMSR and REAR reports.
The cloud edition runs on Microsoft Azure as an Azure Managed Application, and Azure has regions in the UAE (UAE North in Dubai and UAE Central in Abu Dhabi); the on-premises edition runs on your own Kubernetes cluster with the same features. Modules are licensed separately in Starter, Growth and Enterprise tiers, so a dealer or brokerage can start with screening, risk rating and case basics and a bank can run the full suite. See AML compliance software in the UAE for how each duty maps to a module and the AML product overview for every module, or book a demo and bring your own scenarios.
Frequently asked questions
What is the best AML software in the UAE?
There is no single best system, only the best fit for your institution's size, channels and risks. Shortlist two or three vendors that meet your Must-have requirements, run the same scripted demos on your own data, and score them against one weighted checklist that includes the 2025 law and the goAML reports you owe.
How much does AML software cost in the UAE?
It varies because vendors price differently: by module or tier, by customer or account, by transaction or search volume, or as an enterprise licence, with list data, implementation and hosting often extra. Ask each shortlisted vendor to itemise licence, data, implementation, hosting and support costs over three years in the same currency, and compare the totals.
Which law governs AML in the UAE now?
Federal Decree by Law No. (10) of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing, issued on 30 September 2025, which replaced Decree by Law No. (20) of 2018. Its executive regulations are in Cabinet Resolution No. (134) of 2025, issued on 29 October 2025, which replaced Cabinet Resolution No. (10) of 2019.
Does AML software file reports with the FIU?
Reports reach the FIU through goAML, so what matters is whether the software produces goAML files the FIU accepts, for every report type you owe, and tracks each report to acknowledgement. Ask for a validated sample file. In Creodata's case, the AML software manages the report lifecycle and the separate Creodata goAML Reporting Platform generates and validates the file.
Do DNFBPs in the UAE need AML software?
Once volumes grow, usually. Dealers in precious metals and stones and real estate brokers carry reporting duties at AED 55,000, must register on goAML, and are supervised by the Ministry of Economy & Tourism. A small firm can work manually for a while, but proving that it screened every customer and reported without delay is hard without a system that timestamps each step.
Can AML software be hosted in the UAE?
Microsoft Azure has regions in the UAE, and on-premises deployment keeps data in your own data centre. Decide with your legal and risk teams where data should live, check what your supervisor expects of outsourcing, and ask each vendor where data is stored and processed and whether the cloud and on-premises options have the same features.
See how Creodata's AML compliance software in the UAE meets these criteria: book a demo and bring your own scenarios.
