Quick Summary: AML Compliance for DIFC Firms
AML compliance for DIFC firms rests on two layers: UAE federal AML law and the DFSA AML Rulebook, both supervised by the Dubai Financial Services Authority.
This guide explains who the DIFC AML requirements apply to, what the DFSA AML Module asks firms to do (risk assessment, CDD, screening, monitoring, reporting, training and record keeping), how the MLRO role works, when the DFSA Annual AML Return is due, what changed in the 2026 amendments, and what happens if you get it wrong. It also includes a simple compliance calendar and a federal vs DIFC comparison table.
If your business sits in the Dubai International Financial Centre, you don’t follow one set of AML rules. You follow two. The UAE’s federal AML law applies to every business in the country, and the DIFC adds its own layer on top through the Dubai Financial Services Authority (DFSA). Most firms know one layer well. Inspections usually find the gaps in the other.
This guide explains AML compliance for DIFC firms. You’ll learn who the DIFC AML requirements apply to, what the DFSA AML Module asks you to do, how the MLRO role works, when the Annual AML Return is due, and what changed in 2026. No legal maze, just what you need to run a compliant firm.
What Does AML Compliance Mean for DIFC Firms?
AML compliance for DIFC firms means having the right people, policies and systems to spot and stop money laundering, terrorist financing and proliferation financing. It covers both UAE federal law and the DFSA AML Rulebook. In practice, you need to know your customers, watch what they do, report anything suspicious, and be able to prove all of it to the DFSA.
DIFC and Its AML Regulator, the DFSA
The DIFC is a financial free zone with its own laws, courts and regulator. The DFSA is that regulator. For AML, it supervises both licensed financial firms and registered non-financial businesses in the centre. It inspects them, asks for information and acts when things go wrong.
Why DIFC Has Two Layers of AML Rules
Think of it like a building. Federal law is the foundation everyone stands on. The DFSA rules are an extra floor built on top for firms in the DIFC. You need both to be solid. A breach of federal AML law can also count as a breach of DFSA rules, so treating them as two separate projects is a mistake.
Ready for the DFSA AML Changes?
Which DIFC Firms Need to Follow These AML Rules?
The DFSA calls every business covered by its AML rules a “Relevant Person”. If you fall into any group below, the DIFC AML requirements apply to you.
| Type of firm | Examples |
|---|---|
| Authorised Firms | Banks, private banks, asset managers, brokers, insurers |
| DNFBPs | Law firms, accountants, auditors, insolvency firms, real estate developers and agents, dealers in precious metals and stones |
| Single family offices | Family wealth structures registered in the DIFC |
| Token and virtual asset businesses | Firms dealing in crypto tokens or related services |
Financial Firms (Banks, Private Banks, Asset Managers, Brokers)
Firms licensed by the DFSA carry the full set of AML duties. That includes banks and private banks, plus asset managers and investment firms. These firms face the closest supervision, so their AML programme needs to be detailed and well evidenced.
DNFBPs in DIFC
Non-financial businesses also fall under AML for DIFC firms. This covers lawyers and legal professionals, accountants and auditors, real estate firms, insolvency firms and dealers in precious metals and stones. Every DNFBP must register with the DFSA and keep AML systems that fit its business. Single family offices follow a lighter version of the rules, but they still need due diligence, an MLRO and suspicious activity reporting.
Crypto and Token Businesses
The DIFC has its own crypto token regime, and AML rules apply to firms working in this space. Because the rules here keep changing, token businesses should check their exact category with the DFSA before assuming they are out of scope.
Which AML Laws Apply in DIFC?
UAE Federal AML Law
The base layer is Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025. These replaced the older 2018 and 2019 laws. They set the core duties for every reporting entity in the UAE, such as customer due diligence, suspicious transaction reporting and record keeping. Our guide to anti money laundering laws in UAE covers this layer in detail.
The DFSA AML Rulebook (AML Module)
The DFSA AML Rulebook, officially the AML Module of the DFSA Rulebook, puts all DIFC-specific AML, counter-terrorist financing and sanctions rules in one place. Think of it as the DIFC AML rulebook that explains how federal duties work inside the centre and adds a few extra demands. It sits alongside the Glossary Module, which defines the terms it uses.
If the Two Rules Differ, Follow the Stricter One
Where the federal law and the DFSA AML Module set different standards, the safe approach is to meet the stricter one. That way you are compliant under both.
Key DFSA AML Module Requirements for DIFC Firms
These are the core DIFC AML requirements in the DFSA AML Module, in roughly the order a supervisor would check them.
Take a Risk-Based Approach
AML compliance for DIFC firms starts with a risk-based approach. Your controls should match your risks. A private bank serving high-net-worth clients from many countries needs stronger checks than a small advisory firm with a few local clients. The DFSA expects you to show why your controls fit your risk, not just that they exist.
Assess Your Business Risk
A business risk assessment looks at your whole firm: your customers, products, delivery channels and the countries you deal with. It should consider the UAE National Risk Assessment and use a clear scoring method. The DFSA has criticised firms that couldn’t explain how they scored their risks. A proper ML/TF/PF risk assessment gives you that written logic.
Write AML Policies That Fit Your Business
Your policies must describe how your firm works. A group manual copied from head office won’t pass if it ignores DIFC AML requirements or your local processes. Senior management should approve the policies, and the MLRO should check them against both federal and DFSA rules. Clear AML policies and procedures are often the first thing an inspector asks to see.
Know Your Customer: CDD and EDD
Before you take on a customer, you need to know who they are and what they plan to do. That means:
- Giving every customer a risk rating through a documented customer risk assessment
- Identifying the real owner behind companies and trusts, looking at control and substance, not just ownership percentages
- Applying enhanced due diligence to high-risk customers, including politically exposed persons
- Using digital onboarding only with proper identity checks in place
A solid KYC and CDD framework ties these steps together so staff apply them the same way every time.
Screen Against Sanctions Lists
You must screen customers, owners and related parties against the UN Security Council list and the UAE Local Terrorist List. Screening happens at onboarding and again whenever the lists change. Freezing obligations kick in fast, so manual checks rarely keep up. Reliable sanctions screening is a must.
Monitor Transactions
Ongoing monitoring helps you spot activity that doesn’t match what you know about a customer. A common DFSA finding is firms that skipped monitoring because transactions were “booked overseas”. If the relationship is managed from the DIFC, the monitoring duty sits with you. The right AML software makes this far easier to evidence.
Report Suspicious Activity
When you suspect money laundering or terrorist financing, the MLRO must file a suspicious transaction report with the UAE Financial Intelligence Unit through goAML, without delay. Staff need a simple way to raise concerns with the MLRO first. And never let the customer know a report is coming. That is tipping off, and it is a serious offence. Our STR and goAML reporting support helps teams get this right.
Train Your Staff and Keep Records
Everyone who deals with customers’ needs regular, role based AML training. Keep records of who was trained and when. For record keeping, DIFC firms keep AML records for at least six years, which is longer than the five-year federal minimum.
Face Your Next DFSA Inspection with Confidence
DIFC MLRO Requirements: Who Can Be Your MLRO?
The MLRO sits at the centre of AML compliance for DIFC firms. The DFSA looks closely at who holds this role and whether they have the authority to do it properly.
What an MLRO Officer in DIFC Does
An MLRO officer in DIFC runs the day-to-day AML programme. They review internal suspicion reports, decide whether to file an STR, oversee training, keep policies current, deal with the DFSA, and prepare an annual report for senior management on how well the AML controls are working.
Seniority, UAE Residency and a Deputy MLRO
The DIFC MLRO requirements are stricter than the federal ones. Your MLRO must be resident in the UAE, senior enough to act independently, and have direct access to senior management. Authorised Firms also need a deputy MLRO to cover absences. There is no single mandatory DIFC compliance certification, but qualifications like CAMS or the ICA diplomas show the DFSA your MLRO has the right expertise.
Can You Outsource the MLRO Role?
Some firms use an outsourced or group MLRO, and the DFSA asks about this in the Annual AML Return. Even if you outsource, the responsibility stays with your firm. You need to show the MLRO has enough time, knowledge of your business and access to records.
DFSA Annual AML Return and Key Compliance Dates
What the Annual AML Return Is and When It’s Due
Every Relevant Person must file the DFSA Annual AML Return through the DFSA ePortal by the end of September each year. The return asks detailed questions about your MLRO, risk assessments, CDD, screening, training and reporting. It should be reviewed by senior management, not just the MLRO. Late filing is taken seriously. In 2022, the DFSA charged late fees to 42 firms and treated late filing as a sign of weaker overall compliance.
DIFC Compliance Calendar: Key AML Dates
| AML task | How often | When |
|---|---|---|
| DFSA Annual AML Return | Yearly | By end of September |
| MLRO annual report to senior management | Yearly | Set by your firm |
| Business risk assessment review | At least yearly | Plus, after major business changes |
| Staff AML training | Yearly | Plus, induction for new joiners |
| CDD reviews | Based on risk rating | High-risk customers most often |
| Sanctions list screening | Ongoing | Every time the lists update |
| Change notifications to DFSA (DNFBPs) | As needed | When MLRO, ownership or key details change |
Federal vs DIFC AML Rules: Key Differences
Most DIFC AML requirements mirror federal law, but a few points are stricter or simply different.
| Area | UAE federal rules | DIFC rules |
|---|---|---|
| Supervisor | Sector supervisor (e.g. CBUAE, Ministry of Economy) | DFSA |
| MLRO residency | No residency rule in federal law | MLRO must be UAE resident |
| Record keeping | At least 5 years | At least 6 years |
| Annual reporting | No federal annual AML return | DFSA Annual AML Return by end of September |
| DNFBP scope | Federal DNFBP list | Wider list, including real estate developers and insolvency firms |
| Registration | Registration with sector supervisor | DNFBPs register with the DFSA |
DFSA AML Amendments 2026: What Changed?
March 2026: DIFC Rules Aligned with the New Federal Law
The DFSA updated its AML and Glossary Modules, with the changes in force from 2 March 2026. The aim was to bring DIFC AML requirements in line with the new federal AML framework. Key points include proliferation financing becoming a core part of the AML regime, a risk-based approach to beneficial ownership instead of fixed thresholds, and a clear link between federal breaches and DFSA breaches. The DFSA also published FAQs on governance, risk assessments, digital onboarding, outsourcing and internal audit.
April 2026: New Notification Rules for DNFBPs
A second set of AML changes came into force on 1 April 2026. DNFBPs must now notify the DFSA through the ePortal of changes to their name, legal status, address, MLRO, senior management, beneficial ownership or main business activities.
What to Update in Your AML Program Now
- Add proliferation financing to your risk assessment and policies
- Review beneficial ownership checks so they look at control, not just percentages
- Ask your MLRO to map your framework against both federal and DFSA rules
- Check your digital onboarding and outsourcing arrangements against the new FAQs
- Set up a process to notify the DFSA of key changes on time
Private Banking Compliance Standards in DIFC: Lessons from DFSA Reviews
In 2024, the DFSA shared findings from its reviews of DIFC private banks. The lessons apply to AML compliance for DIFC firms of every size, not just banks. The most common weaknesses were:
- Unclear risk scoring. Firms could not explain how they rated business or customer risk. Fix: document the method and the weightings.
- Generic policies. AML procedures did not reflect how the firm really worked. Fix: tailor them to your products, clients and processes.
- Over-reliance on head office. Group policies ignored DIFC requirements. Fix: add a DIFC addendum and test it locally.
These private banking compliance standards in DIFC are now the benchmark the DFSA uses, so it makes sense to check your own firm against them.
What Happens If You Don’t Comply?
DFSA Inspections and Enforcement
DFSA compliance is tested through risk assessments, thematic reviews and on-site visits. When firms fall short, the DFSA can issue fines, public censures and restrictions. It has fined major banks for AML failings, including an $8.4 million fine on Deutsche Bank in 2015 that was partly linked to weak AML controls. Getting regulatory inspection readiness right before a visit is far cheaper than fixing things after one.
Federal Fines: AED 10,000 to AED 5 Million
Weak AML compliance for DIFC firms can also trigger federal penalties. Federal law lets supervisors impose fines of AED 10,000 to AED 5,000,000 for each violation. Other penalties include warnings, suspending managers, restricting the business and even revoking the licence. Repeat breaches within a year can lead to higher fines.
How GRC Advisors Supports DIFC Compliance Advisory
GRC Advisors helps banks, asset managers, DNFBPs and token businesses turn DIFC AML requirements into a framework that works day to day and stands up to DFSA review. Our AML/CFT compliance team designs risk assessments, policies, CDD frameworks and screening controls built for the DIFC, not copied from a group manual.
As a DIFC compliance advisory partner, we also support MLROs with Annual AML Return preparation, independent AML internal audit and inspection readiness. If you’re looking for compliance services in DIFC that make AML compliance for DIFC firms simpler, talk to our team.
Is Your AML Framework Built for the DIFC?
FAQs on AML Compliance for DIFC Firms
Who regulates AML compliance in DIFC?
The Dubai Financial Services Authority (DFSA) supervises AML compliance for DIFC firms. It enforces both its own AML Module and the UAE federal AML law for every Relevant Person in the centre, including financial firms and registered DNFBPs.
What is the DFSA AML Module?
The DFSA AML Module is the part of the DFSA Rulebook that holds all DIFC AML requirements, counter-terrorist financing and sanctions rules in one place. It explains how federal AML duties apply in the DIFC and adds extra rules, such as UAE residency for the MLRO.
When is the DFSA Annual AML Return due?
The DFSA Annual AML Return must be filed through the DFSA ePortal by the end of September each year. Late filing can lead to fees and may count against your firm in the DFSA’s view of your overall compliance.
Does a DIFC MLRO need to live in the UAE?
Yes. Under the DIFC MLRO requirements, the MLRO must be resident in the UAE, senior enough to act independently, and have direct access to senior management. Authorised Firms also need a deputy MLRO to cover absences.
How long must DIFC firms keep AML records?
DIFC firms keep AML records for at least six years. That is one year longer than the five-year federal minimum, so firms meeting DIFC AML requirements automatically meet the federal one too.
What changed in the DFSA AML rules in 2026?
The DFSA AML amendments 2026 brought DIFC rules in line with the new federal AML law from 2 March 2026, added proliferation financing to the core regime and changed the approach to beneficial ownership. From 1 April 2026, DNFBPs also have new duties to notify the DFSA of key changes.
