Does Your UAE Free Zone Company Need AML Registration? A DNFBP Checklist

“I’m in a free zone, not a bank. Why would the AML law apply to me?” 

It’s one of the most common questions we get from free zone business owners in the UAE, and it usually comes up right after they’ve heard the term DNFBP for the first time, often from a bank, an auditor, or a compliance notice they weren’t expecting. 

The short answer is that DNFBP registration UAE requirements don’t care whether your company is onshore, in a free zone, or in a financial centre they care about what your licence actually lets you do. If your free zone activity falls into one of a specific set of categories, you’re required to register on the UAE’s goAML platform, appoint a compliance officer, and meet ongoing reporting obligations, regardless of your company’s size or how straightforward your business feels day to day.

This guide walks through exactly how to check whether your free zone company is a DNFBP, what registration actually involves, and what happens if you skip it.

What “DNFBP” Actually Means

DNFBP stands for Designated Non-Financial Business or Profession. It’s a category the UAE (in line with global Financial Action Task Force standards) uses for businesses that aren’t banks or financial institutions, but that handle transactions or activities regulators consider higher-risk for money laundering and terrorist financing. Under Cabinet Resolution No. 134 of 2025, the UAE currently designates six categories as DNFBPs.

Critically, this is a federal law. It applies across the whole UAE mainland, commercial free zones, and financial free zones alike. A free zone licence doesn’t exempt you; it just changes who supervises you (more on that below).

A free zone company handling DNFBP-triggering activity is usually also managing corporate tax and VAT obligations

Which Free Zone Activities Actually Trigger DNFBP Status

This is where most free zone founders get caught out, because “DNFBP” sounds like it belongs to a different industry entirely. In practice, a surprising number of common free zone licence activities fall directly into one of the categories above:

• Corporate service providers and business setup consultancies if your free zone company incorporates other companies, acts as a nominee director, provides registered office/agent services, or manages company administration on behalf of clients, you’re very likely a TCSP.
• Real estate brokerage and property management free zone-licensed brokers arranging property sales or purchases on a client’s behalf, even occasionally, fall under the real estate DNFBP category.
• Gold, diamond, and jewellery trading common in free zones like DMCC, this activity is squarely inside the DPMS category once transactions cross the AED 55,000 cash threshold.
• Accounting, bookkeeping, and audit firms free zone-based accounting and audit practices performing specified activities for clients (not just for their own books) generally fall under this category.
• Legal consultancy free zones free zone law firms and legal consultancies handling client transactions such as company formation, real estate, or fund management on a client’s behalf.

If your free zone licence doesn’t fall into one of these activities, say you run a marketing agency, an e-commerce store, or a software company you’re generally not a DNFBP. But it’s worth checking your exact licensed activity against the list above rather than assuming, since some multi-activity licences quietly include a DNFBP-triggering activity alongside the main business.

Our AML compliance services team reviews your exact free zone activity, handles DNFBP classification and goAML registration, and builds the policies and due diligence procedures that hold up under inspection

The Quick Self-Check: Are You a DNFBP?

Run through these questions before assuming either way:

1. Does your free zone licence include company formation, registered agent, nominee director, or trust services?
   If yes, you’re likely a TCSP.
2. Do you arrange property sales or purchases on behalf of clients, even as a side activity?
   If yes, you’re a real estate DNFBP.
3. Do you trade precious metals or stones, and do any client transactions involve AED 55,000 or more in cash (or linked transactions that add up to that)?
   If yes, you’re a DPMS.
4. Are you a lawyer, notary, accountant, or auditor performing financial or transactional services for clients not just internal work for your own company?
   If yes, you likely fall under the legal/accounting DNFBP categories.
5. Do you operate commercial gaming activities with transactions of AED 11,000 or more?
   If yes, you’re covered.

If you answered yes to any of these, registration isn’t optional, and it isn’t something to defer until a bank or free zone authority flags it self-identifying and registering proactively is treated far more favourably than being found unregistered during an inspection.

Who Supervises DNFBP Compliance in Your Free Zone

Supervision depends on where your free zone sits:

The underlying obligations are broadly consistent across all three registration, risk assessment, due diligence, and reporting but the specific portal, forms, and supervisory contact differ, so it’s worth confirming which regime applies to your exact free zone before you begin.

What DNFBP Registration Actually Involves

Once you’ve confirmed your company falls under a DNFBP category, registration happens through the UAE Financial Intelligence Unit’s goAML platform, in two stages:

1. Pre-registration – Access the goAML portal (via the FIU’s SACM system), select “Reporting Entity,” and submit your entity’s basic details to receive a temporary user ID and secret key.
2. Full registration – Set up two-factor authentication (typically via Google Authenticator using the secret key issued), then complete your entity profile and submit your appointed compliance officer’s details on the FIU services page.

Documents You’ll Typically Need

• A signed authorization letter naming the person registering on the company’s behalf
• Passport, visa, and Emirates ID copies for the applicant and the appointed compliance officer
• A copy of your free zone trade licence
• Your company’s Memorandum of Association or equivalent constitutional document
• Details of your ultimate beneficial owners (UBOs)

Check this AML Compliance for Real Estate Agents in Dubai

After Registration: What Ongoing Compliance Looks Like

Registering on goAML is the starting point, not the finish line. A properly compliant DNFBP needs:

• A designated compliance officer (MLRO) with real authority to act, not just a name on a form
• A written AML policy covering customer due diligence, risk assessment, and reporting procedures specific to how your business actually operates
• Customer due diligence (CDD) on every client identity verification, beneficial ownership checks for corporate clients, and source-of-funds understanding for higher-value transactions
• Enhanced due diligence (EDD) for politically exposed persons or clients from higher-risk jurisdictions
• Sanctions screening against UN, UAE, and Ministry lists
• Suspicious Transaction Reports (STRs) filed promptly whenever something genuinely looks off
• Record retention for a minimum of five years covering due diligence files, transaction records, and any reports filed
• Staff training so employees can actually recognize red flags, not just tick a box that training happened once

For company service providers specifically, this also means applying the same due diligence to the companies you’re helping form as you would to a direct financial client checking beneficial ownership, screening for sanctions exposure, and understanding why a client is structuring their business a particular way.

What Happens If You Skip Registration

The penalty structure under UAE AML law is steep, and it applies whether or not any actual money laundering is ever proven the failure to have the right systems in place is itself the violation.

Beyond the fines, an unregistered DNFBP also risks licence suspension, and for corporate service providers it is especially difficult to maintain banking relationships, since banks increasingly ask their own corporate clients to confirm DNFBP registration status as part of their own compliance checks.

A Practical Path Forward

If you’ve read through the checklist above and recognize your business in it, the sensible order of operations is: confirm your exact DNFBP category, register on goAML, appoint a compliance officer, and put a written AML policy and risk assessment in place before a bank, auditor, or regulator raises it for you. Retrofitting compliance after a gap has already been flagged is a far more difficult and costly conversation than building it in from the start.

This also connects to your wider financial compliance picture.  and needs accounting and bookkeeping that can stand up the same transaction records your AML programme relies on the two are rarely separable in practice, since inconsistent records tend to raise questions on both fronts at once.

Check Your Free Zone Company’s DNFBP Status Today

Between the six DNFBP categories, free zone-specific nuances, and the goAML registration process itself, working out whether your company needs to register isn’t always obvious from the outside and the cost of getting it wrong, whether that’s a missed registration or an incomplete compliance programme, is high enough that it’s worth confirming properly. 

 Talk to Helen & Sons to get your free zone company’s AML status properly checked.

Frequently Asked Questions

• Does every free zone company need to register as a DNFBP?
  No. Only companies whose licensed activity falls into one of the specific categories real estate brokerage, precious metals/stones dealing, company/trust services, legal, accounting/audit, or commercial gaming need to register. Most free zone businesses outside these activities are not DNFBPs.
• I run a business setup consultancy in a free zone. Am I automatically a DNFBP?
  If your services include company incorporation, nominee director/secretary services, registered office/agent services, or trust administration on behalf of clients, you almost certainly fall under the Trust and Company Service Provider (TCSP) category and need to register.
• What if my free zone company only occasionally does DNFBP-triggering work?
  The frequency doesn’t exempt you if your licence permits and you perform even occasional real estate, precious metals, or company service transactions on a client’s behalf, the obligation applies whenever that activity occurs.
• Can I register on goAML myself, or do I need a compliance consultant?
  You can register directly through the FIU’s SACM portal yourself. Many free zone businesses use a compliance consultant to make sure the risk assessment, policy, and due diligence procedures behind the registration are actually sound, since registration alone doesn’t satisfy the ongoing obligations.
• Is DIFC or ADGM different from mainland free zones for DNFBP purposes?
  The core AML obligations are similar, but DIFC companies are supervised by the DFSA and ADGM companies by the ADGM Registration Authority/FSRA, rather than the Ministry of Economy and Tourism so the registration channel and supervisory contact differ even though the underlying law is federal.
• What’s the first thing I should do if I think my company might be a DNFBP?
  Confirm your exact licensed activity against the DNFBP categories, and if it matches, register on goAML and appoint a compliance officer before anything else those two steps are the foundation everything else in your AML programme sits on.