Who Are DNFBPs in UAE? Definition, Full List & AML Obligations

DNFBPs in UAE are Designated Non-Financial Businesses and Professions — a legal classification that places certain non-financial businesses under the same core anti-money-laundering duties as banks. If your business falls inside it, the obligations under Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 are mandatory from day one of trading, not from your first inspection. This guide sets out who qualifies, who supervises each category, what a compliant file must contain, and where the UAE AML compliance requirements most often go wrong in practice.

What Does DNFBP Mean in the UAE?

DNFBP stands for Designated Non-Financial Business or Profession. It is a classification used in UAE law — and internationally under Financial Action Task Force (FATF) standards — for businesses outside the financial sector that are considered particularly vulnerable to being used for money laundering, terrorist financing or proliferation financing.

The logic is about function, not about size. A DNFBP is not a financial institution, but it sits at a point in the economy where value changes hands, ownership is recorded, or a structure is created — a property sale, a bullion purchase, a company formation, a set of signed accounts. That gatekeeper position is what brings the obligations: verify who you are dealing with, understand why, watch for what does not fit, and report it.

Which Businesses Are DNFBPs in UAE? The Four Ministry Categories

Four categories of DNFBP sit under the supervision of the Ministry of Economy and Tourism (MoET — formerly the Ministry of Economy, which is why registrations and auditor licences still reference “MoE”) across the UAE mainland and the commercial free zones. If your licensed activity appears below, you are in scope.

The TCSP category is the one businesses most often fail to recognise in themselves, because it is defined by specific activities rather than by a job title. You are a TCSP if you act as a formation agent for legal persons; act as, or arrange for another person to act as, a director, company secretary or partner; provide a registered office, business address or correspondence address; act as trustee of an express trust or perform an equivalent function; or act as, or arrange for another person to act as, a nominee shareholder. A firm that sets up companies and provides the registered address is a TCSP whether or not it calls itself one — a point worth checking if you also handle UAE company incorporation for clients.

Are Lawyers and Legal Professionals DNFBPs in UAE Too?

Yes — and this is where most published lists are incomplete. Independent legal professionals form a fifth DNFBP category, covering lawyers, notaries and legal consultancies, but they are supervised by the Ministry of Justice rather than the Ministry of Economy and Tourism, under the framework for regulating the legal profession in Federal Decree-Law No. 34 of 2022.

The distinction matters practically. A law firm and an audit firm carry substantively the same AML duties, but they register with, report to and are inspected by different supervisors, and the guidance and inspection questionnaires issued by each differ in emphasis. A multidisciplinary group holding both a legal consultancy licence and an accounting licence may therefore answer to two supervisors for what looks like one compliance programme — and needs its documentation to satisfy both.

Why Are DNFBPs Targeted by UAE AML Law?

Because these sectors are where illicit money most often re-enters the legitimate economy. The UAE's National Risk Assessment identifies DNFBPs as high-risk for a set of overlapping reasons, and understanding them is what turns a template policy into a defensible one.

Who Supervises DNFBPs in UAE?

Supervision is split by business type and jurisdiction, not by where you happen to bank. Four authorities matter, and the UAE Financial Intelligence Unit sits alongside them as the recipient of suspicious transaction reports through the goAML platform.

DIFC and ADGM are genuinely separate legal regimes with their own AML rulebooks, their own registration portals and their own inspection cycles — not a lighter version of the federal framework. A firm moving a licence into or out of either should assume its entire compliance file needs rebuilding to the new rulebook rather than transferring across. The same is true for audit appointments: see our DIFC approved audit services for how the DIFC requirements differ.

Do DNFBP Obligations Apply to Free Zone Companies?

Yes — in full. A DNFBP licensed in IFZA, DMCC, JAFZA, RAKEZ, Meydan, SAIF or any other commercial free zone is supervised by the Ministry of Economy and Tourism, not by the free zone authority. The zone issues your licence; the Ministry supervises your AML compliance. Only DIFC and ADGM sit outside that arrangement.

This is the single most common misconception we see, and it is an expensive one. Free zone companies routinely assume that because the zone did not ask for an AML file at licensing, no file is required — then discover otherwise during a Ministry inspection, by which point the absence of a risk assessment and training records is a documented finding rather than a fixable gap. If you are still choosing a jurisdiction, our UAE free zone comparison tool sets out which zones sit under which regime.

What AML Obligations Apply to a DNFBP in UAE?

Once you are in scope, a full set of AML/CFT obligations applies — and they apply regardless of business size, headcount or years of trading. A two-person brokerage carries the same core duties as a hundred-person firm; only the scale of the response changes.

Two of these are routinely half-done. Sanctions screening is not only a policy line — DNFBPs are required to register for the automatic sanctions-list notification service so that list updates reach them directly, and screening at onboarding alone is not enough when a list changes mid-relationship. And record keeping means retrievable, not merely stored: an inspector asking for the CDD file on a client onboarded four years ago expects it produced, not reconstructed.

What Is the AED 55,000 Threshold, and When Does It Apply?

AED 55,000 is the figure that triggers specific duties in two DNFBP categories. For dealers in precious metals and stones, customer due diligence is required on any single cash transaction — or series of linked cash transactions — of AED 55,000 or more. For real estate brokers and agents, a report must go to the Financial Intelligence Unit where a buyer of freehold property pays AED 55,000 or more in cash, pays in virtual assets, or funds the purchase with money derived from virtual assets.

The word doing the work is linked. Payments are aggregated where they form part of one transaction, which means structuring a purchase into instalments below the figure does not remove the obligation — and a pattern of just-under payments is itself a suspicion indicator worth reporting.

One point that catches people out: the AED 55,000 figure governs when those specific duties bite. It has never been a floor for the AML obligations generally. An accountant, auditor or corporate service provider is in scope from the first client, with no transaction threshold at all, and the duty to report suspicion applies at any value in every category.

How Do DNFBPs Differ From Financial Institutions?

Both are subject to AML obligations under UAE law, and the core duties are effectively identical. What differs is who regulates you, what triggers scope, and how much additional sector-specific rulemaking sits on top.

What Happens If a DNFBP Fails to Comply?

Non-compliance is enforced, and the consequences run further than a fine. Supervisors can impose administrative penalties per violation under Cabinet Decision No. 16 of 2021, issue warnings and binding corrective directives, require the replacement or restriction of managers, publish the violation, and suspend or withdraw the trade licence. Serious cases attract criminal liability under Federal Decree-Law No. 20 of 2018, extending to imprisonment and substantial fines for the business and for individual managers and employees personally.

Because fines are set per breach and the schedule is periodically updated, we do not publish a headline figure here — a single inspection identifying several failings is assessed on each one, and the cumulative exposure depends on the findings. Confirm the current amounts against the schedule your supervisor applies before relying on any number you read online, including in older versions of this guide.

The practical point is that almost every enforced failing is a documentation failing rather than a criminal one. Businesses are rarely penalised for laundering money; they are penalised for having no risk assessment, no approved officer, no training records and no evidence of screening. All of that is fixable in advance, and considerably cheaper than fixing it after a finding.

What Mistakes Do UAE DNFBPs Make Most Often?

Drawing on inspection findings and our own experience of the process as a regulated firm, the same failures recur across every category.

If more than two of those describe your business, treat it as a project rather than a to-do item. Fastlane builds and runs DNFBP compliance programmes end to end — supervisor registration, compliance officer appointment, goAML and sanctions-screening setup, a risk assessment written around your actual client base, tailored policies, staff training and ongoing monitoring — for firms in every category, including our own. We also handle the accounting and bookkeeping and audit obligations that sit alongside it.