1. The licence came with homework
A UAE real-estate brokerage licence comes with federal AML/CFT obligations from the day it's issued. Not from your first closed deal. Not from your first cash buyer. From the date on the licence.
In the first half of 2025 alone, the Ministry of Economy and Tourism recorded 1,063 AML violations across UAE designated non-financial businesses, with fines exceeding AED 42 million. Real-estate brokerages accounted for 495 of those violations and AED 18.5 million of the fines — more violations than any other DNFBP sector (MoET H1 2025 inspection results). Whatever the average agent believes about AML being a banking problem, the Ministry's inspectors plainly disagree.
Most brokerage owners find out about their AML obligations when one of three things happens: their bank requests the firm's AML framework at account opening or review; their licence-renewal cycle surfaces a compliance question they can't answer; or MoET sends an inspection notice. By the time any of those moments arrives, the firm has weeks — not months — to retrofit a framework the law expected from the day of licensing.
This guide sets out what's actually required, by whom, by when, with the source instrument cited for each obligation. The intent is operational: if you own or run a brokerage — or you're its MLRO — you should be able to read it, understand exactly what the firm needs in place, and either confirm you're covered or list the gaps.
2. The framework — what laws apply to you
UAE AML/CFT regulation for real-estate brokerages is built from a small number of named instruments. Knowing which is which is the difference between an operator who can answer a regulator question and one who can't.
The primary law is Federal Decree-Law No. 10 of 2025 on Combating Money Laundering, the Financing of Terrorism and the Financing of Proliferation. It came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its executive regulations are Cabinet Resolution No. 134 of 2025, in force from 14 December 2025, converting the law's principles into operational duties.
Beneath those sit the instruments a brokerage deals with day to day:
- Cabinet Resolution No. 71 of 2024 — the unified DNFBP violations and administrative fines schedule: 41 violation categories, fines from AED 50,000 to AED 1,000,000 per violation, doublable on repeat (Article 5(2)).
- Ministry of Economy Circular No. 05/2022 — the Real Estate Activity Report (REAR) regime for brokers and agents — issued late June 2022, in effect from 1 July 2022. The sector's own mandatory report; Section 4(g) below. (The parallel Ministry of Justice Circular No. 14/2022 puts the same reporting on law offices handling qualifying transactions.)
- Cabinet Decision No. 109 of 2023 — the beneficial ownership regime. In force 6 November 2023; carries the 25% direct/indirect ownership-or-control threshold and the senior-managing-official fallback — the rule you apply when the "buyer" is a company.
- Cabinet Decision No. 74 of 2020 — sanctions implementation and the UAE Local Terrorist List; gives effect to UN Security Council resolutions in UAE law.
- The UAE FIU's goAML guides — the Report Types guide and the REAR filing guide — the operational manuals for the reporting duties.
Internationally, the framework is grounded in the FATF Recommendations — principally Recommendations 1 (risk-based approach), 10 (customer due diligence), 11 (record-keeping) and 22, which extends financial-sector CDD obligations to real-estate agents when they are involved in transactions for a client concerning the buying or selling of property. No value threshold softens that one: if you broker property deals, you're in.
The operator who knows the source for each obligation can answer any regulator question. Knowing the source list is the first competence.
3. Who supervises you
There are three layers of authority over a UAE brokerage.
The first is federal AML supervision, exercised by the Ministry of Economy and Tourism (MoET) — the federal AML supervisor for four DNFBP categories, including real-estate brokers and agents. MoET conducts the inspections, issues the findings, and imposes the administrative fines under Cabinet Resolution 71/2024. The H1 2025 numbers above are MoET's.
The second is your emirate-level licensing authority — in Dubai, the Dubai Land Department and RERA, which issue the brokerage licence and the broker cards and run the Trakheesi system. The land authority is not your federal AML supervisor, but licensing and AML expectations increasingly travel together: the licence is the thing ultimately at stake when compliance fails, and renewal cycles are when paperwork questions get asked.
The third is the UAE Financial Intelligence Unit (FIU) at the Central Bank, which operates the goAML portal. The FIU doesn't supervise you; it receives every Suspicious Transaction Report (STR), Suspicious Activity Report (SAR) and Real Estate Activity Report (REAR) you file. Failure to register or file is one of the violations MoET fines you for.
And hovering over all three: your bank. The CBUAE has issued dedicated guidance to financial institutions on servicing the real-estate sector — which is why brokerage accounts attract AML questions at opening and periodic review. The bank isn't a regulator, but it behaves like one, and it can act faster than one.
4. The ten things you actually need
The substance. Each item is a real obligation a regulator can fine you for; each cites the source instrument.
(a) A written AML/CFT Policy & Procedures Manual, approved by senior management. The firm's master document — your risk appetite, the rules every other procedure operates within, and the first thing a bank, auditor or inspector asks for. Reviewed at least annually. The internal compliance-programme requirement it implements sits in Article 21 of Cabinet Resolution 134/2025.
(b) An appointed Money Laundering Reporting Officer (MLRO) with the seniority to stop a deal. The named individual who receives internal escalations, files reports on goAML, and reports to senior management on the firm's AML posture — in a brokerage, emphatically not a job title bolted onto the top seller. The MLRO owes senior management a periodic written compliance report; semi-annual is the typical cadence, carried over from the prior regime. The appointment requirement sits in Article 21 of CR 134/2025 — the same article as the compliance programme and staff training — with the officer's periodic-reporting duty carried in Article 22.
(c) Active registration on goAML — and on the sanctions Automatic Reporting System. Two registrations, not one. goAML (via the SACM access layer) is where the REAR and STRs are filed; the sanctions ARS is how you learn when the UAE Local Terrorist List or UN Consolidated List changes. Registration is required whether or not the firm has ever had a reportable deal — failure to register is itself a fineable violation under CR 71/2024.
(d) Customer due diligence — on both sides of the deal. Real-estate CDD is dual-sided: the parties you identify and verify are the buyer and the seller, not just whoever pays your commission. Risk-based: standard CDD for ordinary parties, Enhanced Due Diligence when indicators trigger — politically-exposed persons, high-risk jurisdictions, complex corporate structures (apply the 25% beneficial-ownership rule from CD 109/2023), unexplained third-party payers. Written and operated, not improvised at the closing. The risk-based-approach and CDD requirements sit in Articles 5–9 of CR 134/2025.
(e) A documented business-wide risk assessment, reviewed at least annually. Not a per-deal score — a firm assessment across customer, geographic, product/service and channel risk, methodology documented, score reproducible, integrating the findings of the 2024 UAE National Risk Assessment. Inspectors ask for it first because its absence is the easiest violation to evidence: it exists or it doesn't.
(f) Staff training, with attendance records. Every agent who can touch a deal needs to know the firm's red flags, the escalation path, the REAR triggers, and the tipping-off prohibition — criminalised by Article 29 of FDL 10/2025. Delivered, dated, signed. An untrained agent who misses a reportable deal is a finding against the firm. The training duty sits in Article 21 of CR 134/2025.
(g) REAR identification and filing. The sector's own mandatory report, and it is not suspicion-based — a deal that matches a trigger is reportable even when everything about it is innocent. Per the FIU's own formulation: the purchase or sale of freehold property where payment includes cash of AED 55,000 or more (single or multiple payments — instalments accumulate), where payment is made in virtual assets at any value, or where the funds were converted from or to a virtual asset for any portion of the price. No express filing window is published — which an inspector reads as "show me your procedure," so your written REAR procedure fixes an internal deadline in days. The full walkthrough is here.
(h) Sanctions and PEP screening at onboarding, and ongoing. Both parties screened at onboarding against the UAE Local Terrorist List, the UN Consolidated List and the firm's chosen provider, re-screened when lists update — which is what the ARS registration in (c) is for. The Local Terrorist List regime sits in Cabinet Decision No. 74 of 2020.
(i) Heightened measures when virtual assets touch a deal. Crypto-funded property is a live feature of this market — and the moment virtual assets appear, the obligations stack: the REAR at any value, enhanced due diligence on the source of the virtual assets, and a hard boundary to respect — a brokerage that handles the conversion itself drifts toward licensed-VASP territory. If your firm courts crypto buyers, your procedures must cover this before the first such deal, not after.
(j) Record-keeping for at least five years. Every party file, every deal file, every screening log, every REAR acknowledgment, every MLRO report, every training record — at least five years under Article 25 of CR 134/2025, counted from the latest applicable trigger: the end of the relationship or completion of the transaction — and an ongoing inspection, investigation or court process extends the clock further.
That's the ten-item list a competent brokerage operates against. Eight are document-bound; two — (g) REAR identification and (h) screening — are transaction-time disciplines your agents have to live. Both kinds get inspected.
5. What it costs if you don't have it
Penalties operate at two layers. The statutory envelope is Article 17 of FDL 10/2025: administrative fines from AED 10,000 to AED 5,000,000 per violation, plus non-monetary measures up to suspension of senior managers and revocation of the licence.
Inside that envelope, the operating schedule is Cabinet Resolution No. 71 of 2024: 41 violation categories, AED 50,000–1,000,000 per violation, doublable on repeat. Indicative bands: AED 50,000–200,000 for customer-due-diligence failures; AED 100,000–500,000 for enhanced-due-diligence failures. (The schedule was drafted against the prior law and remains in force; expect a re-issue aligned to FDL 10/2025 in due course.)
Direction of travel: 495 violations and AED 18.5 million against brokerages in six months — the most violations of any DNFBP sector — and in February 2026, industry reports indicated MoET was signalling further tightening for real estate, precious metals and crypto-exposed DNFBPs ahead of this year's FATF evaluation. Enforcement is intensifying, not slowing. A single AED 500,000 EDD fine costs more than a hundred times the framework that prevents it.
6. When owners find out — and the cost of finding out late
Three discovery moments, in the order most brokerage owners meet their AML framework:
The bank. UAE banks operate under Central Bank guidance that singles out the real-estate sector. Account opening or periodic review triggers a request for the AML policy, the MLRO appointment, the risk assessment, the screening arrangements. A firm that hands over nothing — or generic internet templates — gets friction exactly where it hurts: the account that holds its commissions.
The renewal cycle. Brokerage licences and broker cards renew annually, and the renewal season is when compliance paperwork surfaces — whatever the precise documentary checklist in your emirate this year, renewal is the calendar moment when "where is our AML file?" gets asked, by someone with the power to delay you.
The inspector. A MoET inspection notice gives the firm days, not weeks, to produce the documents listed. The inspector arrives with the CR 71/2024 violations checklist and walks it line by line. Missing documents, missing sign-offs, missing REAR decisions — each becomes a documented violation with its own fine reference.
The pattern: firms find out about the framework when they have least time to build it. Compressing months of work into days produces the wrong kind of attention.
7. What good looks like — the operating rhythm
Compliance isn't a build, it's an operating practice — and a brokerage that has the framework but doesn't operate it is in worse shape than one with nothing, because the shelf-policy proves the firm knew.
Monthly — sanctions list refresh; transaction review (the MLRO walks the period's deals: any REAR triggers missed? any red flags raised and resolved?).
Semi-annually — the MLRO's written compliance report to senior management: REARs and STRs filed, screening hits resolved, training delivered, exceptions raised.
Annually — the business-wide risk assessment reviewed; the Manual reviewed; all-hands training refreshed (every agent, including the stars); an independent AML audit commissioned and its findings closed.
Every deal — CDD on both sides; beneficial ownership unwrapped on corporate parties; screening; the REAR decision made and recorded (yes/no and why); records filed.
A firm operating this rhythm produces the documentary evidence an inspector wants almost as a by-product. A firm not operating it produces nothing — the gap behind most of those 495 violations.
8. The trap most brokerages fall into
The missing REAR decision.
The published violation patterns say the most-cited failures aren't "no policy at all" — they're "policy on the shelf, no evidence of use." In a brokerage, that failure has a specific shape: deals close fast, the file gets assembled later or never, and nobody can show whether the REAR question was even asked. A firm whose policy says "we assess every deal against the REAR triggers" but whose deal files contain no trace of that assessment has documented its own non-compliance: the policy proves the firm knew, the files prove it didn't act.
The fix is small and unglamorous: a one-line REAR decision in every deal file — trigger matched or not, filed or not, by whom, when. Sign-offs dated. Training recorded. The MLRO report written. Boring discipline; outsized inspection value. A policy in use beats a policy on a shelf.
9. The international context
The UAE framework is grounded in the FATF Recommendations — Recommendation 22 is the one that catches real-estate agents explicitly, extending CDD obligations to property transactions with no value threshold. The UAE was placed on the FATF Grey List in March 2022 and removed in February 2024, after two years of intensified supervision that produced the framework now in force.
And the context for 2026 is sharper still: the FATF's mutual evaluation of the UAE is underway this year, under the new round's effectiveness-focused methodology — the assessors grade what supervision achieves, not what the statute book says. That is why inspections intensified through 2025 and why nobody should expect them to ease. Real estate is one of the most internationally scrutinised laundering channels there is; the UAE has a credibility position to defend, and your sector is where it gets defended.
10. Closing
The framework is operable. Knowing the source for each obligation, building the ten items, and running the rhythm gets a brokerage from licence to inspection-ready in days, not months.
That is why we built the Assay UAE Real Estate AML Starter Kit. Twenty-six documents — the Policy & Procedures Manual, the REAR identification and filing procedures, dual-sided due-diligence forms, the working risk-matrix workbook, the MLRO pack, the staff training deck, the inspection-readiness checklist — drafted against this exact framework, customised to your brokerage, ready in about 48 hours, €899.
Want to see where your firm stands today? The free 5-minute self-assessment scores your brokerage against the obligations above — 28 questions, score on the page, no email needed. And your front-line staff can certify their AML awareness, free.
Your brokerage licence came with AML homework. We did it for you.
Last updated 11 June 2026. Drafted against the UAE AML framework in force June 2026 — FDL 10/2025, CR 134/2025, CR 71/2024, CD 109/2023, CD 74/2020, MoE Circular No. 05/2022 and MoJ Circular No. 14/2022 — and the UAE FIU's goAML guides. Where the framework moves, this article is reviewed and dated forward. Not legal advice — for bespoke counsel on your firm's specific situation, consult a UAE-qualified compliance professional.