AML/CFT Compliance for Lawyers and Legal Professionals in the UAE
Lawyers and legal professionals in the UAE occupy a unique position in the country’s anti-money laundering framework. Unlike most regulated sectors, the legal profession carries both client confidentiality obligations and statutory AML/CFT duties, and understanding where one ends and the other begins is not optional. It is a regulatory requirement with real consequences for failing to get it right.
Since the introduction of Federal Decree-Law No. 10 of 2025 (FDL 10/2025) and Cabinet Resolution No. 134 of 2025 (CR 134/2025), the obligations placed on lawyers, notaries, and independent legal professionals operating in the UAE have been restated with greater precision and stronger enforcement teeth. Whether you are a partner in a law firm in DIFC, a sole practitioner on the UAE mainland, or a notary handling transactional work, the law applies to you when specific activities are undertaken on behalf of clients.
This article explains what those obligations are, when they are triggered, and what the consequences of non-compliance look like under current UAE AML law.
Who Are Lawyers and Legal Professionals Under UAE AML Law?
Classification as DNFBPs Under CR 134/2025
The UAE’s AML/CFT framework does not regulate all lawyers in all circumstances. Instead, it designates them as Designated Non-Financial Businesses and Professions, more commonly referred to as DNFBPs, a category that places specific obligations on professionals whose work can expose the financial system to money laundering and terrorism financing risks.
Under Article (3)(4) of CR 134/2025, the following are classified as DNFBPs subject to AML/CFT obligations:
- Lawyers
- Notaries
- Other independent legal professionals
- Independent accountants
This classification applies whether the individual practices alone, as a partner in a firm, or as a professional within a larger practice. The critical point is that the obligations are activity-based, not profession-based in the abstract. A lawyer advising on contract litigation is not automatically subject to DNFBP obligations. A lawyer managing client funds or facilitating the purchase of real estate is.
When Do AML Obligations Apply to Lawyers and Legal Professionals?
The Five Trigger Activities Under CR 134/2025
The obligations on lawyers and legal professionals are not continuous. They are triggered when preparing, conducting, or executing financial transactions on behalf of clients in connection with one or more of the following five activities:
- Buying and selling real estate on behalf of a client
- Managing funds owned by the client
- Managing bank accounts, savings accounts, or securities accounts
- Organising contributions for the establishment, operation, or management of companies
- Establishing, operating, or managing legal persons or legal arrangements, or selling or purchasing commercial entities
These trigger activities cover a broad range of commercial legal work. Real estate conveyancing, corporate structuring, trust administration, company incorporations, and fund management arrangements all fall squarely within scope. If your firm handles any of these, the AML/CFT compliance framework applies to the relevant engagements.
It is worth noting that the UAE’s definition of predicate offence is broad. Under FDL 10/2025, Article 1, predicate offences include evasion of direct and indirect taxes, which means legal professionals must be alert not just to traditional money laundering red flags but also to potential tax evasion activity in transactions they facilitate. The list of predicate offences reaches across the full range of serious criminal conduct punishable under UAE law.
Customer Due Diligence for Lawyers and Legal Professionals
Standard CDD Requirements
Customer due diligence, often abbreviated to CDD, sits at the heart of any AML compliance programme. For lawyers and legal professionals in the UAE, the CDD obligation is clear: before establishing a business relationship or carrying out a trigger-activity transaction, sufficient information about the client must be obtained, verified, and retained.
Under CR 134/2025, Articles 6 to 15, the standard CDD measures require the following steps. First, verify the client’s identity using reliable, independent source documents. For natural persons, this means a valid passport, UAE Emirates ID, or equivalent official identification. For legal persons, this means articles of association, trade licences, and proof of authorised signatories. Second, identify and verify the beneficial owner. This step is frequently underweighted in legal practice, but it is a standalone obligation under FDL 10/2025, Article 19(3) and CR 134/2025, Articles 37 to 41. Third, understand the purpose and intended nature of the business relationship. Fourth, conduct ongoing monitoring to ensure that transactions are consistent with the client’s profile and stated purpose.
In practical terms, this means that the Know Your Client process familiar to most law firms is now a statutory requirement rather than best practice. KYC in UAE legal practice is no longer discretionary.
Enhanced Due Diligence for Higher-Risk Clients
Where a client or transaction presents higher risk, standard CDD is not enough. CR 134/2025, Article 12 requires Enhanced Due Diligence (EDD) to be applied in circumstances where the risk level is elevated. Relevant EDD triggers for lawyers and legal professionals include:
- Clients who are Politically Exposed Persons (PEPs) or their close associates, requiring specific measures under CR 134/2025, Article 16
- Transactions involving clients from or connected to high-risk countries as identified by the UAE National Committee or FATF
- Complex or unusually large transactions with no apparent legitimate commercial rationale
- Clients whose source of wealth is unclear, inconsistent with their stated profile, or cannot be verified
- Legal arrangements or corporate structures that appear designed to obscure beneficial ownership
EDD is not a fixed checklist. It requires a proportionate, risk-based response. At minimum it means obtaining additional information about the client, the source of funds, the source of wealth, senior management approval for the relationship, and more intensive ongoing monitoring. The enhanced due diligence checklist a firm applies should be documented and reviewed periodically.
Suspicious Transaction Reporting and the Professional Secrecy Exception
The STR Obligation and goAML Platform
Where a lawyer or legal professional suspects, or has reasonable grounds to suspect, that a transaction or funds are connected to money laundering, terrorism financing, or proliferation financing, they are required to report this to the Financial Intelligence Unit (FIU) without delay. This is the Suspicious Transaction Report (STR) obligation under FDL 10/2025, Article 18(1) and CR 134/2025, Articles 17 to 19.
STRs are submitted through the goAML platform, which is the FIU’s electronic reporting system. goAML registration is mandatory for any DNFBP subject to STR obligations, including lawyers and legal professionals engaged in trigger activities. Reports must contain all available data and information about the transaction and the relevant parties.
Firms should also note that the tipping-off prohibition applies in full. Under FDL 10/2025, Article 29, notifying or warning a client that they are the subject of an STR, or that competent authorities are conducting inquiries, is a criminal offence.
When Professional Secrecy Limits the STR Obligation
FDL 10/2025 includes an important carve-out that reflects the legal profession’s core obligations. Under Article 18(2), the STR obligation does not apply to lawyers, notaries, other legal professionals, or independent legal auditors where the information relating to those transactions was obtained under circumstances subjecting them to professional secrecy.
This exception is narrow. It does not create a blanket exemption from STR obligations. It applies only where the specific information in question is protected by professional privilege in the circumstances in which it was received. Lawyers should take legal advice on the scope of privilege as it applies to their specific practice and jurisdiction, and should not use the professional secrecy exception as a default reason not to file an STR. Regulators scrutinise the application of this exception carefully.
Critically, CR 134/2025, Article 42 confirms that no secrecy obligation, whether arising from bank secrecy, professional secrecy, or contractual liability, can be invoked to justify non-compliance with AML obligations more broadly. The secrecy exception in Article 18(2) of FDL 10/2025 is for the STR filing obligation specifically, not for CDD, record-keeping, or other compliance requirements.
Beneficial Ownership Identification and Source of Wealth
Identifying the Ultimate Beneficial Owner
Beneficial ownership identification is one of the areas where the UAE’s AML framework has tightened most significantly under FDL 10/2025 and CR 134/2025. For lawyers and legal professionals handling corporate work, trust administration, or company formation, this is a high-priority obligation.
Under FDL 10/2025, Article 19(3) and CR 134/2025, Articles 37 to 41, firms must identify the natural persons who ultimately own or control the client entity. In the context of legal arrangements such as trusts, this includes verifying the identity of trustees, settlors, protectors, beneficiaries, and any person exercising ultimate effective control. In the context of legal persons, it means tracing ownership chains to the natural person who ultimately exercises control, whether directly or through a chain of ownership.
The Beneficial Owner (UBO) is defined under CR 134/2025, Article 1 as the natural person who owns or exercises ultimate effective control over the customer, or on whose behalf transactions are conducted. Nominee arrangements do not displace this obligation. A nominee director or nominee shareholder is not considered the beneficial owner by virtue of holding shares in a nominee capacity.
Source of Wealth and Source of Funds in Legal Practice
Understanding the source of wealth and the source of funds is distinct from identifying the client and their beneficial owner. Source of wealth refers to how the client accumulated their overall wealth. Source of funds refers to the specific origin of the money involved in the transaction at hand.
In legal practice, common source of wealth examples include business income, inheritance, real estate proceeds, investment returns, employment income, and the sale of assets. Each of these requires appropriate evidence. Where the explanation provided is inconsistent with the client’s known profile, or where documentation cannot be provided, this should be treated as a red flag requiring escalation and potentially an STR.
Tax evasion red flags are relevant here. The UAE’s AML framework explicitly includes tax evasion as a predicate offence. Unexplained wealth that cannot be reconciled with declared income, clients who are reluctant to explain the origin of large sums, or transactions structured in ways that appear designed to avoid disclosure to tax authorities should all prompt heightened scrutiny from lawyers and legal professionals.
Record-Keeping, Internal Controls, and Compliance Officer Requirements
Record-Keeping Obligations Under CR 134/2025
All records, documents, and data relating to client transactions, CDD measures, and STR filings must be retained in accordance with CR 134/2025, Article 25. Records must be kept for at least five years following the end of the business relationship or the completion of the transaction, and must be made immediately available to competent authorities upon request.
This is not an administrative formality. In the event of a regulatory inspection, the ability to produce complete, accurate, and accessible records is a direct indicator of whether the firm’s AML programme is functioning in practice or only on paper. Missing or incomplete records are both a compliance breach and an obstacle to demonstrating good faith.
Internal policies, controls, and procedures must be approved by senior management and reviewed on a continuous basis under FDL 10/2025, Article 19(1)(d). This includes policies covering CDD, STR filing, record-keeping, screening, and the risk-based approach. Where a firm has branches or majority-owned subsidiaries, the policies must extend to them as well.
For firms meeting the threshold requirements, appointment of a Compliance Officer is required under CR 134/2025, Article 22. The Compliance Officer carries responsibility for implementing the AML programme, coordinating with the FIU, and ensuring staff receive adequate AML training. AML training for legal professionals is not a one-off exercise. It must be tailored to the specific risks the firm faces and updated as the regulatory environment evolves.
Penalties for Non-Compliance
Administrative Penalties Under FDL 10/2025
The supervisory authorities responsible for overseeing lawyers and legal professionals in the UAE have a full range of administrative sanctions available to them under FDL 10/2025, Article 17. These penalties apply where any provision of the law, its executive regulations, or related decisions are violated.
Administrative penalties available include: a formal warning; an administrative fine of not less than AED 10,000 and not exceeding AED 5,000,000 for each violation; prohibition from engaging in the sector; restriction of the powers of responsible individuals, including the appointment of a temporary supervisor; suspension of directors or executive personnel; suspension or restriction of the firm’s activity; and revocation of the licence. The supervisory authority may also publish imposed penalties across various media. Incremental fines apply in cases of repeated violations within one year of a prior fine.
Criminal Penalties for STR Breach and Money Laundering
Beyond administrative sanctions, the criminal penalties for AML/CFT failures are severe. Under FDL 10/2025, Article 26, the offence of money laundering carries a minimum of one year imprisonment and a maximum of ten years, together with a fine of not less than AED 100,000 and not exceeding AED 5,000,000, or the value of the relevant criminal property, whichever is greater.
For lawyers and legal professionals who deliberately or through gross negligence fail to comply with the STR obligation under Article 18, the penalty under FDL 10/2025, Article 28 is imprisonment and a fine of not less than AED 100,000 and not exceeding AED 1,000,000, or either of these penalties. Tipping off a client about an STR or an ongoing investigation carries its own criminal penalty under Article 29. Providing false or misleading information about a beneficial owner carries a fine of not less than AED 20,000 under Article 35.
The criminal liability of legal persons is also engaged. Under FDL 10/2025, Article 4, criminal liability attaches to legal persons where the crime is committed in their name or for their benefit.
How GRC Advisors Supports Lawyers and Legal Firms
GRC Advisors works with law firms, notaries, and independent legal professionals across ADGM, DIFC, and the UAE mainland to build AML/CFT compliance programmes that are proportionate, defensible, and operationally sound.
Our support for lawyers and legal professionals covers the following areas:
- AML policy and procedures frameworks tailored to the specific activities and risk profile of the legal practice
- Client risk assessment methodologies and CDD frameworks, including EDD procedures for higher-risk engagements
- Beneficial ownership identification procedures and templates aligned with CR 134/2025
- goAML registration, STR drafting support, and FIU engagement guidance
- Enterprise-wide risk assessments and national risk assessment alignment
- AML training programmes designed specifically for legal professionals and support staff
- Regulatory inspection readiness, including mock inspections and gap analysis against current requirements under FDL 10/2025 and CR 134/2025
We are not a compliance rubber stamp. We are a genuine advisory practice that designs frameworks you can explain, defend, and rely on when the regulator comes to call.
If your firm is a DNFBP subject to UAE AML obligations and you want to understand your current compliance position, or if you need to build or refresh your programme in line with FDL 10/2025 and CR 134/2025, speak to a GRC Advisor.
Frequently Asked Questions
Are all lawyers in the UAE subject to AML/CFT obligations?
No. Lawyers and legal professionals in the UAE are only subject to AML/CFT obligations when they prepare, conduct, or execute financial transactions on behalf of clients in connection with specific trigger activities. These trigger activities include buying and selling real estate, managing client funds, managing bank or securities accounts, organising contributions for company establishment, and establishing or managing legal persons or legal arrangements. A lawyer providing purely advisory or litigation services is not automatically captured.
What is the professional secrecy exception under UAE AML law?
Under FDL 10/2025, Article 18(2), the STR obligation does not apply to lawyers, notaries, or other legal professionals where the relevant information was obtained under circumstances subjecting them to professional secrecy. However, this exception is narrow and applies only to the STR filing obligation. It does not exempt lawyers from CDD, record-keeping, beneficial ownership identification, or other AML compliance requirements. Professional secrecy cannot be invoked as a reason to refuse compliance with AML obligations more broadly, as confirmed under CR 134/2025, Article 42.
What is customer due diligence and what does it require for law firms?
Customer due diligence (CDD) is the process of identifying, verifying, and understanding the client before establishing a business relationship or executing a trigger-activity transaction. For law firms acting as DNFBPs under UAE AML law, CDD requires verifying client identity from reliable, independent sources; identifying and verifying the beneficial owner; understanding the purpose and nature of the relationship; and conducting ongoing monitoring. Where risk is elevated, enhanced due diligence applies, requiring additional information on source of funds, source of wealth, and senior management approval.
What penalties apply to lawyers who fail to comply with UAE AML regulations?
Failure to comply with UAE AML regulations can result in administrative penalties under FDL 10/2025, Article 17, including fines ranging from AED 10,000 to AED 5,000,000 per violation, suspension or restriction of activity, and licence revocation. Criminal penalties also apply. Deliberately or negligently failing to file a Suspicious Transaction Report carries a fine of AED 100,000 to AED 1,000,000 and potential imprisonment under Article 28. Tipping off a client about an STR or investigation is a separate criminal offence under Article 29. Money laundering itself carries imprisonment of one to ten years and fines of AED 100,000 to AED 5,000,000.
Do lawyers need to register on goAML in the UAE?
Yes. Lawyers and legal professionals who are subject to DNFBP obligations under UAE AML law are required to register on the goAML platform operated by the Financial Intelligence Unit. goAML is the designated electronic system for submitting Suspicious Transaction Reports. Registration must be completed to fulfil the STR filing obligation under FDL 10/2025, Article 18(1) and CR 134/2025, Articles 17 to 19.
What records do lawyers and legal professionals need to keep under UAE AML law?
Under CR 134/2025, Article 25, lawyers and legal professionals subject to DNFBP obligations must retain all records, documents, and data relating to transactions, CDD measures, and STR filings for at least five years following the end of the business relationship or the completion of the transaction. Records must be complete, accurate, and immediately accessible to competent authorities upon request. Incomplete or missing records are a compliance breach and can significantly prejudice a firm’s position during regulatory inspection.
