Among the founders we work with, one of the most consistent gaps we see is an underestimation of AML/CFT/CPF obligations in the early stages of operating a Designated Non-Financial Business or Profession (DNFBP). The UAE's framework for these businesses is now set out in Federal Decree-Law No. (10) of 2025 and its Executive Regulations under Cabinet Resolution No. (134) of 2025, supplemented by sector-specific guidance from competent supervisory authorities. DNFBPs in the UAE are supervised by the Ministry of Economy, and compliance is not discretionary.
The DNFBP category currently includes trust and company service providers, real estate brokers and agents, precious metals and stones dealers, auditing and accounting firms, and independent legal professionals engaged in specified activities. A point that often catches founders off guard: obligations are triggered by the activity the business carries out, not by the wording of its trade licence. A company undertaking activities that fall within the DNFBP definition is subject to Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 regardless of how its licence reads.
Three patterns tend to produce the most exposure for new businesses. First, competitive pressure in the UAE market creates an incentive to accelerate client onboarding and simplify due diligence — precisely where the highest regulatory risk accumulates. Second, the upfront costs of a compliance framework (a qualified compliance officer, screening database subscriptions, AML systems, staff training) are visible before their preventive value is. Third, some founders coming from unregulated sectors are simply not aware that these obligations apply to them at all.
On the cost side of non-compliance: administrative penalties for DNFBP-specific violations are set out in Cabinet Resolution No. (71) of 2024. Beyond financial penalties, regulatory findings typically require remediation programmes, and a loss of banking relationships is a realistic operational consequence — one that tends to cost considerably more than a proportionate control framework would have from the outset.
What this means for our clients
Founders setting up corporate service providers, real estate brokerages, accounting firms, or related businesses in the UAE should treat AML/CFT compliance as part of the initial operating structure — not a task to address once the client pipeline is established. The regulatory direction in the DNFBP sector is toward broader expectations, not lighter ones. Building a proportionate framework at the start is operationally and commercially more sustainable than retrofitting one after a regulatory engagement.
- Confirm whether your business activity — not just your licence category — falls within the UAE DNFBP definition under Federal Decree-Law No. 10 of 2025.
- Review Cabinet Resolution No. 134 of 2025 (Executive Regulations) and any sector-specific guidance issued by your competent supervisory authority.
- Appoint or designate a qualified compliance officer before commencing client-facing operations.
- Implement a documented AML/CFT/CPF risk assessment, customer due diligence procedures, and an employee training programme prior to onboarding clients.
- Subscribe to an appropriate sanctions and PEP screening database and integrate it into your onboarding workflow.
- Familiarise yourself with the administrative penalty schedule under Cabinet Resolution No. 71 of 2024 so that the cost of non-compliance is factored into your business plan.
- Review client risk profiles against your risk appetite before onboarding — turning away a high-risk client early is operationally far less costly than remediation later.
The original article, authored by IFZA AML & KYC Analyst Pamela Galang Garcia, is available at https://ifza.com/en/why-uae-businesses-overlook-dnfbp-compliance/. If you would like to discuss how these obligations apply to your specific activity and structure, speak with our team at Sirius Consulting.