AML for Corporate Service Providers, Accountants and Auditors in the UAE: DNFBP Duties, UBO Rules, goAML and Fines (2026)

Short answer: Corporate service providers, and accountants and auditors who carry out listed activities for clients, are designated non-financial businesses and professions (DNFBPs) under Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025. On the mainland and in commercial free zones the Ministry of Economy & Tourism (MoET) supervises them. They must register on goAML, appoint a compliance officer with MoET's prior approval, apply due diligence to every client relationship with no value threshold, verify beneficial owners at 25%, screen every customer against sanctions lists, and report suspicion to the Financial Intelligence Unit (FIU) without delay. In the first half of 2025 MoET imposed 95 penalties worth over AED 4 million on corporate service providers and auditors.

This guide is for owners, compliance officers and partners at company formation and corporate service firms and at accounting and audit practices in the UAE. It is a practical guide, not legal advice: the law, the regulations and MoET's guidance are the authoritative texts.

---

Are you a DNFBP?

Company and trust service providers are DNFBPs when they carry out a transaction for, or on behalf of, a customer in any of five activities (Article 3 of Cabinet Resolution No. 134):

• acting as an agent in the incorporation or establishment of legal persons;
• acting, or arranging for another person to act, as a director, secretary or partner;
• providing a registered office, business, correspondence or administrative address;
• acting, or arranging for another person to act, as a trustee of an express trust;
• acting, or arranging for another person to act, as a nominee shareholder.

Lawyers, notaries, other independent legal professionals and independent accountants are DNFBPs when they prepare, conduct or execute financial transactions for customers in relation to:

• buying and selling real estate;
• managing customers' funds;
• managing bank, savings or securities accounts;
• organising contributions for companies;
• establishing, operating or managing legal persons or arrangements, or buying and selling businesses.

Auditors. The law does not name auditors as a DNFBP category; it mentions them only in the professional-privilege exemption. MoET nonetheless supervises "Independent Accountants and Auditors" as one sector. Its 2026 guidance explains that accounting-profession licences cover both accounting and auditing, and that licensed firms often provide services that fall within the independent-accountant activities. In practice, an audit and accounting firm should assume it is in scope.

---

Who supervises you

Licensing authorities as gatekeepers. Under Ministerial Resolution No. (253) of 2025 (11 December 2025), mainland and non-financial free-zone licensing authorities:

• decide with MoET which activities count as DNFBP activities, and register those establishments for MoET's supervision;
• verify ownership layers and beneficial owners;
• screen names against UN and local lists;
• look for DNFBPs operating unregistered.

---

Why these sectors are watched

The UAE's 2024 National Risk Assessment rates corporate service providers Medium for money laundering, "due to the potential for concealing beneficial ownership and transferring funds offshore". It rates the audit and accounting sector Medium-Low, with no evidence of abuse. It rates legal persons and arrangements Medium-High residual risk: "The most observed typology is the possible abuse for ML purposes involving complex operations and transactions to conceal ultimate beneficial ownership and use of nominee arrangements."

About 97.2% of corporate service providers operate on the mainland or in commercial free zones, 70% of them in Dubai and Sharjah. MoET's sector review found "uneven compliance maturity" among accounting firms, especially small practices with limited compliance resources and manual processes.

---

The compliance programme

No AED 55,000 threshold for you. The 2025 regulations apply the AED 55,000 occasional-transaction trigger to financial institutions only (Article 7). DNFBPs verify the customer and beneficial owner at the start of every relationship and before any one-off transaction. MoET's guidance for accountants asks for "a risk-driven CDD and EDD measure as opposed to a threshold-driven measure".

For corporate service providers:

• "Nominee arrangements should not be accepted where the TCSP is unable to obtain sufficient information on the beneficial owner", or where their purpose is unclear.
• Relationships with unresolved uncertainties should be declined.
• Ownership chains should be mapped in diagrams.
• Reviews should be triggered by changes in shareholders, directors or jurisdictions.
• Inspections focus on "the effective implementation of AML/CFT/CPF measures, rather than the mere existence of policies or procedures".

For accountants and auditors:

• Assess, where relevant, whether a client's own due diligence is adequate.
• Accept fees only from known sources by traceable payment methods: not cash, cryptocurrencies, third parties or foreign accounts.

---

Beneficial ownership, nominees and trusts

Who is the beneficial owner (Cabinet Decision No. 109 of 2023): whoever owns or controls 25% or more of a legal person's capital or voting rights, directly or through a chain, or controls it by other means such as appointing most directors. Failing that, it is the natural person controlling by other means, and failing that, the senior management officer. The 2025 regulations use the same 25% test for due diligence.

What companies must keep and file:

• a beneficial owner register, and a register of partners or shareholders, filed with the Registrar within 60 days;
• changes recorded within 15 days of knowledge, and the Registrar's requests answered within 14 days;
• a UAE-resident natural person named as contact;
• under the 2025 regulations, beneficial-owner information updated within 15 working days of a change;
• nominee directors and nominee shareholders disclose their status and their nominator to the company within 15 working days;
• no bearer shares.

Trustees of legal arrangements established or managed in the UAE hold current beneficial-ownership information, update it within 15 working days, keep it for five years, and disclose their status to DNFBPs.

Penalties:

• Registrar fines under Cabinet Decision No. 132 of 2023: usually a written warning first, then fines such as AED 20,000 and AED 40,000 for failing to register beneficial-owner details properly, AED 50,000 and AED 100,000 for not keeping the register or not disclosing ownership layers, and AED 15,000 and AED 30,000 for not updating it. On a third violation the Registrar may suspend the licence.
• Criminal penalties: giving false or misleading beneficial-owner information to an authority or a DNFBP is punishable by imprisonment and a fine of at least AED 20,000, or either (Article 35 of the Decree-Law).

Companies in ADGM and the DIFC follow their own free zones' beneficial-ownership rules.

---

Compliance officer and goAML

• Compliance officer. Appointed at management level, with MoET's prior written approval. A third-party compliance officer is allowed under conditions, but accountability stays with senior management and the board.
• goAML. Registration is mandatory and must be kept active, with the compliance officer as the user. Have ready an authorisation letter, the applicant's passport, residence visa and Emirates ID, and the trade licence. The Executive Office for Control and Non-Proliferation (EOCN) adds that goAML also carries the sanctions reports (CNMR and PNMR), and that unregistered entities risk sanctions.
• What it costs not to. In August 2023 MoET suspended 50 DNFBPs for three months for failing to register on goAML.

Our goAML registration guide for the UAE walks through the SACM and entity-registration steps and the procedure for changing the MLRO.

---

Red flags and reporting

MoET's March 2026 guidance on suspicious transaction and activity reports has a red-flag list for each sector. For corporate service providers:

• pressure to expedite incorporation while discouraging due diligence;
• requests for nominee directors or shareholders "to hide ownership";
• an address linked to many unrelated companies;
• requests to backdate documents;
• splitting ownership to stay under screening thresholds;
• rapid dissolution or rebranding after sanctions announcements;
• frequently changing providers.

For accountants and auditors:

• ownership changes the accountant is not told about;
• refusing to provide audit information;
• requests to "simplify" or narrow the scope;
• unexplained "tax exempt" claims;
• rush jobs at unusually high fees;
• shareholder loans with no agreement;
• export claims with no manufacturing capacity.

Suspicion goes to the FIU through goAML without delay, whatever the amount, and the duty covers relationships you decline or exit. Lawyers, notaries, other legal professionals and independent auditors are exempt for information obtained in privileged circumstances, such as assessing a client's legal position or representing them in proceedings; that exemption does not cover ordinary corporate services. See our guide to goAML report types in the UAE.

---

Sanctions screening

MoET's Circular 3/2025 requires "screening sanctions and terrorist lists for all customers without exception", whatever the value. The EOCN's steps:

1. Register on its Notification Alert System.
2. Screen on every list update, before onboarding, at periodic reviews, and before processing a counterparty's transaction.
3. Freeze "without delay (within 24 hours)" on a confirmed match, including entities more than 50% owned or controlled by a listed person.
4. Report a Confirmed Name Match Report (CNMR) or Partial Name Match Report (PNMR) through goAML within five business days.

For a partial match on a prospective customer you have 10 business days to obtain identification; if you cannot, reject and file a PNMR. Breaching sanctions instructions is a crime punishable by imprisonment and a fine of at least AED 20,000, or either (Article 33).

---

Penalties and what MoET has fined

Cabinet Resolution No. (71) of 2024 lists the administrative fines MoET and the Ministry of Justice impose on DNFBPs. It was made under the 2018 law and stays in force where consistent with the 2025 law. Selected rows (AED, per violation):

MoET may double a fine for a repeat violation, and a grievance goes to the Minister within 30 working days. Under the Decree-Law, supervisors can also impose fines of AED 10,000 to AED 5,000,000 per violation, restrict or suspend the business, or revoke the licence (Article 17).

What MoET has done:

• Q1 2023: fined 20 corporate service providers AED 8.6 million and 12 audit firms AED 3.3 million, among AED 65.9 million on 137 DNFBPs.
• August 2023: suspended 50 DNFBPs for not registering on goAML.
• First half of 2025: imposed 95 penalties worth over AED 4 million on corporate service providers and auditors, out of 1,063 violations and more than AED 42 million across DNFBPs.

Fines arrive by e-mail with a payment link.

---

What changed in 2025 and 2026

Separately, the accounting profession law, Federal Decree-Law No. (41) of 2023, requires every accounting firm's internal control system to include procedures for complying with the AML laws.

---

Compliance checklist

1. Map your services to the five corporate-service and five accountant activities, and record the result.
2. Register on goAML and with the EOCN, and get MoET's approval for your compliance officer.
3. Refresh your risk assessment against the 2024 NRA, at least annually.
4. Run due diligence on every client relationship, with beneficial owners verified at 25% and ownership chains mapped.
5. Refuse nominee arrangements you cannot explain, and record nominee disclosures within 15 working days.
6. Screen every customer, beneficial owner and counterparty on onboarding and on every list update; freeze within 24 hours; file CNMR or PNMR within five business days.
7. Train staff on your sector's red flags, and file STRs without delay, including on declined relationships.
8. Keep records for at least five years, ready for an inspection that tests effectiveness.

---

Frequently asked questions

Are auditors DNFBPs in the UAE?

The law names independent accountants, not auditors, as DNFBPs when they carry out listed activities for clients. MoET supervises "Independent Accountants and Auditors" as one sector, because accounting-profession licences cover both, so audit and accounting firms on the mainland and in commercial free zones should assume they are in scope.

Who supervises corporate service providers in the UAE?

The Ministry of Economy & Tourism on the mainland and in commercial free zones, the DFSA in the DIFC, and in ADGM the ADGM Registration Authority under an agreement with the Financial Services Regulatory Authority.

What is the beneficial ownership threshold in the UAE?

25%: a beneficial owner is whoever owns or controls 25% or more of a company's capital or voting rights, directly or indirectly, or controls it by other means (Cabinet Decision No. 109 of 2023 and Cabinet Resolution No. 134 of 2025).

Do corporate service providers have to register on goAML?

Yes. goAML registration is mandatory for every DNFBP, with the compliance officer as the user. Not registering carries a fine of AED 50,000 to AED 200,000 under Cabinet Resolution No. (71) of 2024, and MoET has suspended firms for it.

Is there a value threshold for due diligence for corporate service providers and accountants?

No. Under the 2025 regulations the AED 55,000 occasional-transaction trigger applies to financial institutions. DNFBPs verify the customer and beneficial owner at the start of every relationship and before any one-off transaction.

---

See how Creodata's AML compliance software in the UAE handles screening, customer risk rating and goAML reporting for corporate service providers and audit firms: book a demo.