AML Compliance for Law Firms in the UAE: A Practical Guide

Law firms in the UAE can play an important role in preventing money laundering and terrorist financing because legal professionals may be involved in transactions involving property, companies, client funds, ownership structures, and other assets.

However, not every legal service automatically makes a law firm a Designated Non-Financial Business or Profession (DNFBP) for AML purposes. Under the UAE’s current AML framework, lawyers, notaries, other independent legal professionals, and independent accountants fall within the DNFBP definition when they prepare, conduct, or execute certain financial transactions on behalf of customers. These include real estate transactions, management of client assets or accounts, company incorporation and management, and the sale or purchase of commercial entities.

For affected law firms, AML compliance involves more than simply collecting a passport and Emirates ID. Firms need a risk-based framework covering customer due diligence (CDD), beneficial ownership, risk assessment, ongoing monitoring, suspicious transaction reporting, record keeping, and internal controls.

This guide explains the key AML compliance considerations for law firms operating in the UAE.

Are Law Firms Subject to AML Requirements in the UAE?

Yes, but the scope depends on the legal services being provided.

The current UAE Executive Regulations specifically include lawyers, notaries, other independent legal professionals, and independent accountants as DNFBPs when they carry out specified financial or transactional activities for customers. These activities include:

• Buying and selling real estate
• Managing customer funds
• Managing bank, savings, or securities accounts
• Organising contributions for establishing or managing companies
• Establishing, operating, or managing legal persons or legal arrangements
• Buying or selling commercial entities

This distinction is important.

A law firm should not assume that every legal service it provides has exactly the same AML obligations. The firm’s activities, customers, transactions, risk exposure, and applicable supervisory requirements should be assessed carefully.

What Does AML Compliance Mean for a UAE Law Firm?

AML compliance means establishing appropriate policies, procedures, controls, and processes to identify and manage money-laundering, terrorist-financing, and proliferation-financing risks.

For a law firm, this can involve:

• Customer identification
• Customer due diligence
• Beneficial owner identification
• Customer risk assessment
• Understanding the purpose and intended nature of the relationship
• Source of funds and source of wealth checks where appropriate
• Enhanced due diligence for higher-risk relationships
• Sanctions and targeted financial sanctions screening
• Ongoing monitoring
• Suspicious transaction reporting
• AML record keeping
• Employee training
• Internal AML policies and controls

The current UAE AML framework requires DNFBPs to understand the purpose and intended nature of the business relationship, the customer’s business, and its ownership and control structure. It also requires reasonable measures to identify and verify beneficial owners using reliable and independent information.

Customer Due Diligence for Law Firms

Customer Due Diligence, or CDD, is one of the foundations of an effective AML programme.

Before establishing certain business relationships or carrying out relevant transactions, a law firm should have appropriate processes for identifying and understanding the customer.

Depending on the circumstances, CDD can involve:

• Identifying the customer
• Verifying the customer’s identity
• Identifying persons acting on behalf of the customer
• Confirming the authority of representatives
• Identifying the beneficial owner
• Understanding the purpose of the relationship
• Understanding the nature of the customer’s business
• Assessing the customer’s AML/CFT risk

The UAE’s current AML regulations expressly require DNFBPs to verify that a person acting on behalf of a customer is authorised and to identify that person. They also require DNFBPs to understand the purpose and intended nature of the business relationship and the customer’s ownership and control structure.

Beneficial Ownership and Law Firms

Beneficial ownership is particularly important for legal professionals because law firms may establish or administer companies and legal structures.

A customer may be represented through:

• Holding companies
• Multiple corporate entities
• Partnerships
• Trust-like arrangements
• Nominee arrangements
• Complex ownership chains

The firm should understand who ultimately owns or controls the relevant legal person or arrangement.

The UAE AML framework requires DNFBPs to identify the beneficial owner and take reasonable measures to verify the identity using documents, data, or information from reliable and independent sources.

A complicated ownership structure does not automatically indicate criminal activity. However, unexplained complexity can increase the need for additional scrutiny depending on the overall risk.

Customer Risk Assessment for Law Firms

A risk-based approach is central to AML compliance.

A law firm should consider the risks associated with:

Customer Risk

Consider factors such as:

• Customer’s background
• Business activity
• Ownership structure
• Geographic connections
• Reputation
• Publicly available adverse information
• Whether the customer is a PEP

Service Risk

Some legal services can create greater exposure to financial crime risks than others.

For example, transactions involving:

• Property
• Company formation
• Corporate acquisitions
• Client funds
• Complex ownership structures

may require more detailed assessment depending on the circumstances.

Geographic Risk

International transactions and relationships involving higher-risk jurisdictions may require additional consideration.

Transaction Risk

Large, complex, unusual, or economically unexplained transactions can require additional review.

The UAE AML framework requires relevant entities to take customer and business-relationship risks into account when applying AML measures.

Enhanced Due Diligence for Higher-Risk Clients

Not every customer presents the same AML risk.

Where a relationship or transaction presents higher risk, a law firm may need to apply Enhanced Due Diligence (EDD) and obtain additional information.

Depending on the circumstances, this may include:

• Additional customer information
• More detailed beneficial ownership information
• Source of Funds
• Source of Wealth
• Additional information about the purpose of a transaction
• More frequent monitoring
• Independent verification of information

The goal is to understand the relationship and determine whether the activity is consistent with the customer’s profile.

Source of Funds and Source of Wealth

Law firms involved in high-value or higher-risk transactions may need to understand the origin of funds and, where relevant, the customer’s overall wealth.

These terms are not interchangeable.

Source of Funds asks:

Where did the money involved in this particular transaction come from?

Source of Wealth asks:

How did the customer accumulate their overall wealth?

For example, if a customer is purchasing a AED 10 million property using proceeds from the sale of another investment property, the source of funds may be the property-sale proceeds.

The customer’s broader source of wealth could include years of business ownership and investment activity.

The level of information and verification required should be determined according to the customer’s risk profile and applicable AML requirements.

PEP Screening for Law Firms

Politically Exposed Persons (PEPs) can present increased money-laundering risks because of their public positions and potential exposure to corruption or misuse of public funds.

Law firms should have appropriate procedures for identifying relevant PEP relationships and applying additional measures where required.

PEP status does not mean that a customer has committed a crime.

Instead, it is a risk factor that can require enhanced scrutiny under the applicable AML framework.

Where a customer presents additional risk factors, the firm should assess whether Enhanced Due Diligence and closer monitoring are appropriate.

Sanctions and Targeted Financial Sanctions Screening

Law firms should also consider applicable Targeted Financial Sanctions (TFS) and sanctions-screening requirements within their AML/CFT framework.

Screening may be relevant to:

• Customers
• Beneficial owners
• Directors
• Representatives
• Transaction counterparties
• Other relevant parties

A law firm’s procedures should ensure that potential sanctions matches are appropriately reviewed and escalated rather than automatically treated as confirmed matches.

Because sanctions requirements can change, firms should use current official lists and applicable UAE guidance.

Ongoing Monitoring

AML compliance does not necessarily end after client onboarding.

Law firms should maintain appropriate ongoing monitoring based on the customer’s risk and the nature of the relationship.

Monitoring can help identify:

• Unusual transactions
• Unexpected changes in ownership
• Unexplained third-party payments
• Activity inconsistent with the customer’s stated business
• Unusual property transactions
• Complex transactions without an apparent economic purpose
• Changes in customer risk

The purpose of monitoring is to identify activity that requires further review.

Suspicious Transaction Reporting for Law Firms

Where a reporting obligation arises, the relevant suspicious transaction or activity should be assessed and reported through the appropriate UAE FIU mechanism.

The UAE FIU’s goAML platform enables registered entities to submit Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs).

A law firm’s AML procedures should clearly establish:

• Who reviews potential suspicious activity
• Who makes the reporting decision
• Who is authorised to submit reports
• How internal escalations are documented
• How supporting information is maintained
• How FIU requests are handled

The current UAE AML framework requires relevant entities to promptly notify the FIU by submitting suspicious transaction reports through the Unit’s electronic system or another approved method.

Legal Professional Confidentiality and AML Reporting

This is an especially important issue for law firms.

The UAE AML framework contains an exemption concerning information obtained by lawyers, notaries, other independent legal professionals, and independent statutory auditors in certain circumstances involving professional secrecy.

The current regulation provides an exemption where information relating to transactions was obtained while assessing a customer’s legal position, defending or representing the customer in court, arbitration or mediation, or providing certain legal opinions connected with judicial proceedings.

This does not mean that every piece of information held by a law firm is automatically outside AML requirements.

Law firms should carefully distinguish between protected professional activities and transactional activities that fall within the DNFBP framework.

Where the legal position is unclear, firms should obtain appropriate professional and regulatory advice.

Tipping-Off Risk

Law firms also need to understand the restrictions around disclosing suspicious reporting.

The UAE AML regulations prohibit financial institutions, DNFBPs, and their directors, officers, and employees from disclosing to the customer or another person that a suspicious transaction report has been submitted or is about to be submitted, or that an investigation is being conducted, subject to the exceptions provided by law.

AML policies should therefore include clear internal procedures for handling potential STR matters confidentially.

Employees should know who can be informed and how information should be escalated.

AML Record Keeping

Law firms should maintain appropriate AML records in accordance with applicable UAE requirements.

Records may include:

• Customer identification information
• Beneficial ownership information
• Risk assessments
• CDD and EDD documentation
• Source of Funds information
• Source of Wealth information where applicable
• Transaction records
• Internal AML reviews
• Suspicious activity assessments
• STR-related records
• Employee training records
• AML policy updates

Good record keeping helps demonstrate that the firm’s AML controls are operating effectively.

AML Training for Law Firm Employees

An AML policy is only effective if employees understand how to apply it.

Training should cover topics such as:

• UAE AML obligations
• Customer identification
• Beneficial ownership
• Customer risk assessment
• Red flags
• PEP identification
• Sanctions screening
• Source of Funds and Source of Wealth
• Suspicious activity escalation
• STR procedures
• Confidentiality and tipping-off restrictions

Training should be relevant to employees’ actual responsibilities.

A lawyer handling property transactions may face different AML risks from an employee working primarily on litigation matters.

Common AML Mistakes Made by Law Firms

Treating AML as a One-Time KYC Check

Collecting identification documents at onboarding is not the same as operating an effective AML programme.

Failing to Identify the Real Beneficial Owner

Complex corporate structures can make ownership difficult to understand, but firms should not stop at the immediate shareholder where the ultimate ownership or control needs to be established.

Using the Same Risk Assessment for Every Client

A risk-based AML programme should distinguish between different customers, services, jurisdictions, and transactions.

Ignoring Source of Funds

A customer’s wealth may be legitimate, but the specific funds used in a transaction may come from a different source that needs to be understood.

Weak Internal Escalation

Employees should know how to escalate potential AML concerns to the appropriate compliance or reporting function.

Poor Documentation

An AML decision that is not properly documented can be difficult to demonstrate during a compliance review or inspection.

How to Build an Effective AML Framework for a UAE Law Firm

A practical AML programme should include:

1. AML Risk Assessment

Identify the firm’s exposure to customer, service, geographic, and transaction risks.

2. Written AML Policies

Document procedures for CDD, EDD, beneficial ownership, sanctions screening, monitoring, escalation, and reporting.

3. Customer Risk Rating

Classify customers according to relevant risk factors and apply proportionate controls.

4. Beneficial Ownership Procedures

Establish clear processes for identifying and verifying beneficial owners.

5. Transaction Monitoring

Implement appropriate monitoring based on the firm’s services and risk profile.

6. STR Escalation Process

Define how potential suspicious activity is reviewed and escalated.

7. Employee Training

Provide regular, role-specific AML training.

8. Periodic Review

Review AML policies and controls when there are material changes in the firm’s activities, risks, legislation, or regulatory expectations.

AML Inspections and Compliance Reviews

AML compliance should be treated as an ongoing operational responsibility.

Supervisory authorities can conduct risk-based supervision and inspections of DNFBPs. The current UAE AML framework provides for off-site and on-site supervision and allows supervisory authorities to request information necessary for their supervisory functions.

A law firm should therefore be able to demonstrate not only that it has an AML policy, but also that the policy is actually implemented.

A compliance review may examine areas such as the following:

• Customer files
• Beneficial ownership records
• Risk assessments
• CDD and EDD
• Transaction monitoring
• Sanctions screening
• AML training
• Internal controls
• Reporting procedures
• Record-keeping

Administrative Penalties for AML Violations

UAE AML compliance is not simply a best-practice exercise.

The UAE has an administrative-penalty framework for violations of AML/CFT measures applicable to entities under relevant supervisory oversight. Cabinet Resolution No. 71 of 2024 regulates violations and administrative penalties for measures under the supervision of the Ministry of Justice and Ministry of Economy.

The specific supervisory authority and applicable requirements can depend on the legal firm’s licensing and regulatory structure.

This is why firms should not wait until an inspection or regulatory issue arises before reviewing their AML framework.

Final Thoughts

AML compliance for law firms in the UAE requires a practical, risk-based approach.

Law firms that fall within the DNFBP framework need to understand their customers, identify beneficial owners, assess risk, conduct appropriate due diligence, monitor relevant relationships and transactions, maintain adequate records, and report suspicious matters when required.

At the same time, legal professionals must carefully consider the interaction between AML obligations and professional confidentiality. The UAE framework recognises specific circumstances involving legal advice, representation, and professional secrecy, so firms should avoid treating every client matter in exactly the same way.

The strongest AML programmes are not simply collections of documents. They are working systems supported by trained employees, clear escalation procedures, appropriate technology, accurate customer information, documented risk assessments, and regular reviews.

For UAE law firms, maintaining an AML framework that reflects the firm’s actual services and risk exposure is essential for effective compliance.

Frequently Asked Questions

Are law firms DNFBPs in the UAE?

Lawyers, notaries, other independent legal professionals, and independent accountants are included within the UAE’s DNFBP framework when they carry out specified financial or transactional activities for customers, such as certain real estate, client-fund, company-formation, legal-person, and commercial-entity transactions.

Do all legal services have the same AML requirements?

No. The scope of AML obligations depends on the activities performed, the firm’s regulatory status, the nature of the customer relationship, and applicable UAE requirements.

What AML checks should a UAE law firm perform?

Depending on the applicable requirements and risk, these can include customer identification and verification, beneficial-owner identification, customer risk assessment, understanding the purpose of the relationship, ongoing monitoring, sanctions/TFS screening, and enhanced due diligence.

Do UAE law firms need to identify beneficial owners?

Where the AML framework applies, DNFBPs are required to identify beneficial owners of legal persons and arrangements and take reasonable measures to verify their identity using reliable and independent information.

Do law firms need to conduct Enhanced Due Diligence?

EDD may be required or appropriate where a customer or relationship presents higher AML/CFT risk. The measures applied should be proportionate to the identified risk and applicable regulatory requirements.

Can law firms submit STRs through goAML?

Registered reporting entities use the UAE FIU’s goAML system to file suspicious transaction and suspicious activity reports where required.

Does legal professional confidentiality override AML requirements?

Not automatically. The UAE AML framework provides specific exemptions for information obtained in certain legal-assessment, defence, representation, and professional-secrecy circumstances. Law firms should assess the nature of the service and applicable legal requirements carefully.

What is ‘tipping off’ in AML compliance?

Tipping-off generally refers to improperly disclosing to a customer or another person that a suspicious transaction/activity report has been or may be submitted, or that an investigation is taking place. The UAE AML framework restricts such disclosure subject to the legal exceptions.

How often should a law firm’s AML policy be reviewed?

There is no single review frequency that applies identically to every law firm. Policies should be reviewed periodically and when material changes occur in the firm’s activities, risk exposure, legislation, or regulatory requirements.

What should a law firm’s AML policy include?

A comprehensive policy should address customer due diligence, beneficial ownership, risk assessment, enhanced due diligence, sanctions/TFS screening, ongoing monitoring, suspicious reporting, record-keeping, employee training, escalation, and governance.