AML & KYC Compliance Software in Dubai 2026: goAML, REAR and Cost
Dubai brokers and gold dealers were fined AED 42M+ in H1 2025. What goAML, REAR/DPMSR and KYC software really require in 2026 — and what it costs.
- PUBLISHED
- 16 SEPT 2026
- READ TIME
- 11 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: Every real estate broker, gold and jewellery dealer, corporate service provider and accountant in Dubai must register on the UAE FIU’s goAML portal and run a working AML/KYC programme behind it — customer due diligence, sanctions screening, REAR/DPMSR filings and five-year records. Off-the-shelf AML software runs from roughly USD 50 a month for basic screening to USD 10,000+ a month for enterprise platforms; a custom KYC workflow wired into your CRM or POS is a one-off build. The cost of skipping it is a fine of AED 10,000 to AED 5,000,000 per violation.
Most Dubai businesses get one thing wrong: they treat the goAML username as the finish line. Inspectors do not fine you for lacking a login. They fine you for the screening you cannot prove you ran, the AED 60,000 cash deposit nobody reported, and the client file with no source-of-funds note.
Why AML compliance became a software problem in 2026
The stakes for Dubai’s designated non-financial businesses and professions (DNFBPs) have climbed sharply in three steps:
- A new law. Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025, replacing Federal Decree-Law No. 20 of 2018, with Cabinet Resolution No. 134 of 2025 as its implementing regulation. Article 17 lets supervisors fine DNFBPs AED 10,000–5,000,000 per violation, suspend activity, revoke licences and publish the penalties. Criminal fines for legal persons reach AED 100,000,000.
- Real enforcement. In the first half of 2025 alone, the Ministry of Economy and Tourism found 1,063 AML violations and imposed more than AED 42 million in fines on DNFBPs. Real estate brokerages logged 495 violations (AED 18.5 million), precious metals and gemstone traders 473 (AED 20 million), and corporate service providers and auditors 95 (AED 4 million+).
- The grey-list memory. The UAE sat on the FATF grey list from March 2022 until its removal on 23 February 2024. Staying off it depends on DNFBP-level supervision — which is why inspections have not slowed down since.
When one Dubai brokerage can close dozens of off-plan deals a month and a Gold Souk trader can take hundreds of walk-in payments a week, spreadsheets and WhatsApp photos of Emirates IDs stop being an audit trail. That is the point where AML becomes a systems question.
Myth-bust: “We registered on goAML, so we’re compliant”
goAML is only the reporting pipe to the Financial Intelligence Unit. Registration proves you can file. It proves nothing about the controls inspectors actually test:
- A documented enterprise-wide risk assessment and AML policy.
- Customer due diligence (CDD) on every client, enhanced due diligence (EDD) for high-risk ones, and beneficial-ownership checks on companies.
- Screening against the UAE Local Terrorist List and the UN Consolidated List — at onboarding, and again whenever the lists change.
- Filed reports: STRs/SARs for suspicion, REAR or DPMSR for threshold transactions, and CNMR/PNMR for sanctions matches.
- Records kept for at least five years, retrievable on request.
The Dubai reporting rules your system must enforce
This is where manual processes break. Each rule below has a hard trigger or deadline — exactly the kind of thing software should catch automatically.
| Obligation | Who | Trigger | Deadline |
|---|---|---|---|
| REAR (Real Estate Activity Report) | Brokers, agents, law firms | Freehold sale/purchase paid in cash of AED 55,000+ (single or combined), or any part paid in virtual assets | Via goAML per FIU circular |
| DPMSR (Dealers in Precious Metals & Stones Report) | Gold, jewellery, gemstone dealers | Cash or wire transaction of AED 55,000+ with an individual or entity | Within two weeks |
| Sanctions freeze | All DNFBPs | Existing customer matches the UAE Local Terrorist List or UN list | Freeze within 24 hours |
| CNMR (Confirmed Name Match Report) | All DNFBPs | Confirmed match — customer or rejected prospect | Within 5 days on goAML |
| STR / SAR | All DNFBPs | Reasonable grounds to suspect ML/TF, whatever the amount | Without delay |
| Record keeping | All DNFBPs | Every CDD file and transaction record | Keep 5 years |
Sources: Federal Decree-Law No. 10 of 2025; Cabinet Resolution No. 74 of 2020 (targeted financial sanctions); UAE FIU REAR guidance and MoE Circular 05/2022; UAE FIU DPMS guidance.
Note the structuring trap in the REAR rule: the AED 55,000 threshold applies to single or multiple cash payments. A buyer who pays AED 30,000 twice has triggered it. A system that only checks each receipt individually will miss it; one that sums cash per deal will not.
Your options: spreadsheet, SaaS, consultant or custom build
There are four realistic ways a Dubai DNFBP runs AML in 2026. The right one depends on volume and on how many systems your client data already lives in.
| Approach | Typical 2026 cost | Strengths | Weak spots |
|---|---|---|---|
| Manual (Excel + list downloads) | Staff time only | No subscription | No re-screening when lists update, no audit trail, misses split cash payments |
| AML SaaS (screening + case management) | ~USD 50/month basic to USD 10,000+/month enterprise | Sanctions/PEP data maintained for you, fast start | Another login; client data re-keyed from your CRM or POS |
| Compliance consultant (goAML setup, policy, training) | Packages advertised from ~AED 2,500–4,500 | Policies, risk assessment and registration done properly | Paperwork, not software — daily screening still falls on your team |
| Custom KYC workflow integrated with your CRM/POS | One-off build (see below) | Checks run inside the tools staff already use; thresholds enforced automatically | Upfront cost; still needs a screening data source |
SaaS range: published 2026 UAE AML software pricing (azakaw). Consultant range: advertised Dubai AML service packages (Sky Sigma, Noble Core Ventures).
In practice, the strongest setups for mid-size Dubai brokerages and gold traders combine two of these: a screening API for sanctions and PEP data, plus a thin custom layer that makes it impossible to close a deal or print an invoice without a completed KYC file.
What good AML/KYC software actually does
1. Onboarding that cannot be skipped
Emirates ID or passport capture, trade licence and ownership documents for companies, source-of-funds questions, and a risk score — all attached to the client record in your CRM. The deal stage or sale simply cannot move forward until the file is complete.
2. Screening at onboarding and on every list change
Because existing customers must be frozen within 24 hours of a designation, one-time screening is not enough. The system should re-run the whole client base against the UAE Local Terrorist List and UN list whenever they update, and alert the compliance officer to potential matches.
3. Threshold detection
Cash and virtual-asset payments are summed per property deal or per customer, and an AED 55,000 breach raises a REAR or DPMSR task with the data already filled in — not a reminder someone has to remember.
4. goAML-ready output
goAML accepts web-form entry and XML uploads. Generating report data in the right structure from your own records removes most of the re-typing — and most of the typos inspectors flag.
5. An inspector-proof audit trail
Who screened whom, when, against which list version, and what was decided. Stored for five years, exportable in minutes. This is the part spreadsheets can never fake.
6. PDPL-safe data handling
KYC files are exactly the sensitive personal data the UAE PDPL cares about. Role-based access, encryption and sensible hosting matter — see our UAE PDPL compliance checklist.
What a custom AML/KYC build costs with Aquarius
Here is how we scope these projects for Dubai DNFBPs. These are Aquarius project ranges, fixed-quoted after a short discovery call, and exclude third-party screening-data subscriptions:
| Scope | What you get | Timeline |
|---|---|---|
| KYC module in an existing CRM | Onboarding forms, document upload, risk scoring, screening API hook, audit log | 3–5 weeks |
| Threshold & reporting engine | Cash/virtual-asset aggregation per deal, REAR/DPMSR task creation, goAML-structured export | 3–6 weeks |
| Full compliance portal | All of the above plus list-change re-screening, case management, compliance dashboard, five-year archive | 8–12 weeks |
See our pricing for how fixed-scope quotes work, or browse our services. If your brokerage runs on a property CRM already, our real estate CRM guide shows where a KYC layer plugs in.
The cost of inaction, in numbers
Do the arithmetic. One violation carries a minimum fine of AED 10,000 and a maximum of AED 5,000,000, and repeat violations within a year can attract escalating fines. The Ministry’s own H1 2025 figures work out to an average of roughly AED 40,000 per violation (AED 42 million across 1,063 violations) — and a single inspection rarely finds just one. Against that, a KYC module that enforces the rules every day is usually cheaper than the first fine.
And fines are not the worst case. Licence suspension stops a brokerage from trading, and published penalties are what developers, banks and high-net-worth buyers see when they do their own due diligence on you.
How Aquarius builds AML tooling
- Inside your workflow: we add KYC to the CRM, POS or booking system your team already uses, instead of adding another tab they will forget to open.
- Rules as code: AED 55,000 aggregation, 24-hour freeze alerts and 5-day CNMR clocks are enforced by the system, not by memory.
- Compliance-officer friendly: dashboards and exports built around what MoET inspectors ask for.
- Honest boundaries: we build the software; your MLRO and legal advisers own the policy and the reporting decisions. We will tell you where a consultant is the better first step.
Frequently asked questions
Who must register on goAML in Dubai?
All financial institutions, DNFBPs and virtual asset service providers. For DNFBPs that means real estate brokers and agents, dealers in precious metals and stones, corporate service providers, auditors and accountants, and lawyers and notaries when they carry out covered transactions — on the mainland and in commercial free zones.
What is the AED 55,000 rule in Dubai?
Real estate brokers must file a REAR on goAML when a freehold property deal is paid in cash of AED 55,000 or more (in one or several payments) or partly in virtual assets. Dealers in precious metals and stones must file a DPMSR within two weeks for cash or wire transactions of AED 55,000 or more.
How much are AML fines for DNFBPs in the UAE?
Under Article 17 of Federal Decree-Law No. 10 of 2025, administrative fines range from AED 10,000 to AED 5,000,000 per violation, alongside warnings, activity suspension and licence revocation. In H1 2025 the Ministry of Economy and Tourism imposed more than AED 42 million in fines over 1,063 violations.
Do I need AML software, or is a consultant enough?
A consultant sets up registration, policy, risk assessment and training. Software runs the daily controls — screening, re-screening on list updates, threshold detection and record keeping. Low-volume firms can start with a consultant plus a SaaS screening tool; higher-volume brokerages and gold traders usually need screening built into their CRM or POS.
How long must AML records be kept in the UAE?
At least five years. That includes customer due diligence documents, transaction records and screening results, and they must be retrievable when a supervisor asks.
Running a Dubai brokerage, gold business or corporate services firm? Talk to Aquarius about putting KYC, screening and goAML-ready reporting inside the systems you already use — before the next inspection, not after it.