DNFBP stands for Designated Non-Financial Business or Profession. It is a category created by the UAE’s anti-money-laundering framework to capture businesses that are not banks, but that sit close enough to the movement of money and ownership to be worth supervising.
If your business is in the category, you have obligations that begin with registration on the goAML portal and continue indefinitely. If it is not, you have none of them. The distinction is worth ten minutes of your attention, because the failure most often penalised is not a technical one — it is a business that never realised the framework applied to it.
The four categories
Under Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, four groups are DNFBPs:
1. Brokers and real estate agents. Anyone conducting transactions on behalf of a customer involving the purchase or sale of real property.
2. Dealers in precious metals and precious stones. Traders in gold, diamonds and comparable goods, above the prescribed transaction thresholds.
3. Independent auditors and accountants. Firms providing audit, accounting and related professional services.
4. Trust and company service providers. This is the category most often overlooked, and it is drawn broadly. It covers setting up companies or other legal persons; acting as, or arranging for another person to act as, a director, partner or nominee shareholder; and providing a registered office or business address as a service.
Read the fourth category carefully. A company formation agent is in scope. So is a firm that provides registered office or business-address services, and so is anyone supplying nominee directorships. So, for the avoidance of doubt, is Oznet Corp — we are a trust and company service provider, supervised for AML purposes by the Ministry of Economy and Tourism. We write about this from inside the obligation, not from outside it.
The test, in practice
Ask three questions about what your business actually does, not about what its licence is called.
Do you handle, arrange or advise on transactions in real property, precious metals or precious stones on behalf of someone else?
Do you provide audit or accounting services to third parties?
Do you form companies for other people, act as or arrange directors, partners or nominee shareholders, or provide a registered address as a service?
A yes to any of them puts you in scope. A licence that does not mention AML changes nothing — the category follows the activity.
What goAML registration actually obliges you to do
Registration is the gateway, not the obligation. It is very commonly presented as a one-off administrative step, and that framing is the reason businesses are penalised. The substantive duties are ongoing:
- Register the entity on the goAML portal operated by the UAE Financial Intelligence Unit, and keep the registration and the nominated officer’s details current.
- Appoint an AML/CFT compliance officer with the standing to actually perform the role.
- Report suspicious transactions and activity to the FIU through goAML — and do so without tipping off the customer. This is the core duty, and the one whose breach is most often penalised.
- Maintain written AML/CFT policies, carry out a business risk assessment, and keep both current as the business changes.
- Apply customer due diligence, with enhanced due diligence where the risk is higher, and screen customers and beneficial owners against UN and UAE sanctions lists.
- Keep records for the statutory retention period.
- Register on the Ministry of Economy and Tourism’s AML systems and respond to supervisory inspections.
Where businesses most often get this wrong
Assuming DNFBP status is only for gold and real estate. The trust and company service provider category is wide, and it catches a substantial number of consultancies that do not think of themselves as regulated.
Treating goAML as a certificate. It is a reporting channel. An account that exists but has never been used is not evidence of compliance; it is evidence of an unused account.
Delegating the compliance officer role to nobody in particular. The role needs a named person with access to the customer information and the authority to stop a transaction.
Writing a policy and filing it. A business risk assessment written at registration and never revisited will not survive an inspection, because the business it describes no longer exists.
If you are in scope
The practical sequence is: confirm the category, register on goAML, appoint the officer, write the risk assessment and the policies around how your business actually operates, put customer due diligence into the client onboarding you already run, and train the people who will encounter the red flags first.
None of it is unusually difficult. All of it is significantly easier to build once, deliberately, than to reconstruct in the week an inspection is announced.
We handle this for our own entity and for clients. Read more about accounting and compliance or the UAE compliance calendar.
FAQ
Is a company formation agent a DNFBP in the UAE?
Yes. Trust and company service providers are one of the four DNFBP categories, and the definition expressly covers company formation, providing directors or nominee shareholders, and providing a registered office or business address.
What happens if a DNFBP does not register on goAML?
Failure to register may result in penalties imposed by the Ministry of Economy and Tourism. In practice, the more frequently penalised failure is not reporting suspicious activity once registered.
Do I need an AML compliance officer if my company is small?
The obligation follows the category, not the headcount. A smaller business may combine the role with another, but it needs a named person who can actually perform it.
Is ESR the same thing as AML reporting?
No, and Economic Substance Regulations no longer apply in the way they once did — Cabinet Decision No. 98 of 2024 ended ESR obligations for financial years ending after 31 December 2022. AML and goAML obligations are entirely separate and remain fully in force.
