8
Licence issuers
3
Jurisdictions
9
Sectors covered
1
FIU / goAML
02The regulatory landscape
02
There is no single UAE regulator
Where your programme answers depends on the activity and the jurisdiction you licence into: onshore (federal), or one of the two financial free zones, Abu Dhabi Global Market (ADGM) and Dubai International Financial Centre (DIFC).
- Each free zone (ADGM, DIFC) runs its own statutory financial regulator, rulebook and public register.
- Onshore, supervision splits across the Central Bank, the Capital Market Authority, the Ministry of Economy and Tourism, and dedicated bodies.
- The distinction that matters most: licensed to conduct an activity versus registered or supervised for AML. Many onshore DNFBPs hold no financial-services licence, yet still carry a full AML/CFT obligation and a goAML reporting duty.
VASP & crypto
VARACMAADGM FSRADIFC DFSA VARA (Virtual Assets Regulatory Authority) licenses virtual asset activity in the Emirate of Dubai, excluding the DIFC free zone. The CMA (Capital Market Authority, formerly the Securities and Commodities Authority) regulates federally. Inside the free zones, ADGM FSRA (Financial Services Regulatory Authority) and DIFC DFSA (Dubai Financial Services Authority) each run their own virtual-asset regime. The same firm can face a different regulator depending on where it books the activity.VARA public register →ADGM FSRA register →DFSA public register →
Payments & MSB
CBUAEADGM FSRADIFC DFSA The CBUAE (Central Bank of the UAE) licenses and supervises payment services, stored-value and exchange (money-changing and remittance) business federally, and maintains the register of licensed exchange houses and payment providers. The same activity inside a free zone answers to ADGM FSRA or DIFC DFSA instead.CBUAE exchange-business register →ADGM FSRA register →DFSA public register →
Banks & FIs
CBUAEADGM FSRADIFC DFSA The CBUAE supervises federally licensed banks and financial institutions and publishes the rulebook they are held to. Banks and FIs established in the free zones answer to ADGM FSRA or DIFC DFSA.CBUAE licensed institutions →ADGM FSRA register →DFSA public register →
Funds & CSP
CMAADGM FSRADIFC DFSAMoET The CMA regulates funds and fund managers federally; free-zone funds answer to ADGM FSRA or DIFC DFSA. Corporate and trust service providers (TCSPs) are supervised for AML by the MoET (Ministry of Economy and Tourism) as a DNFBP category, distinct from the financial-services licence the fund itself holds.ADGM FSRA register →DFSA public register →
Gold & DPMS
MoETDMCC Dealers in precious metals and stones are supervised for AML by the MoET as a DNFBP category. The DMCC (Dubai Multi Commodities Centre) is the free-zone registrar for much of the gold trade, but its members are still AML-supervised by the MoET. Free-zone registration and AML supervision are two different things.
Gaming
GCGRA The GCGRA (General Commercial Gaming Regulatory Authority) is the federal body that licenses and supervises commercial gaming, a regime built from a standing start.GCGRA licensees →
Real estate & DNFBP
MoETUAE FIU The MoET is the federal DNFBP AML supervisor for real-estate agents, brokers and the wider designated non-financial sector. AML registration and suspicious-transaction reporting run to the UAE FIU (Financial Intelligence Unit) through the goAML platform.
Defence & dual-use
EOCNMoD The EOCN (Executive Office for Control and Non-Proliferation) controls goods subject to import and export control and administers the national strategic-goods regime. Military items are licensed by the MoD (Ministry of Defence). This is export-control and proliferation-financing exposure, not classic AML supervision.
Art & high-value
MoETUAE FIU There is no dedicated regulator. Dealers in high-value goods, including art, are supervised as DNFBPs by the MoET and report to the UAE FIU via goAML. The absence of a bespoke supervisor does not reduce the obligation; it removes the guidance one would otherwise give.
Every regulator above is drawn from the verified UAE regulator matrix. Any specific rule change, transition date, threshold or penalty is verified with the named regulator before it is stated as fact.
03Who operates here, and what they build
Operators come to the UAE as a hub: a place to licence, hold assets, route payments and serve the Gulf, Africa, South Asia and beyond from one seat. That reach is why the supervisory bar is high, and why the UAE's financial-crime controls have drawn intense international scrutiny. An operator here, onshore or in a free zone, typically has to build and keep running:
01A documented enterprise-wide AML/CFT risk assessment that maps to the licensed or registered activity, the customer base and the jurisdiction it books into.
02A control framework: risk-based CDD and beneficial-ownership identification, sanctions and PEP screening, transaction monitoring, and record-keeping that survives an on-site inspection.
03A qualified MLRO, a governance line into senior management, and a working STR and SAR reporting channel into the UAE FIU through goAML, including registration on the platform.
04A sanctions and export-control posture that holds across counterparties, corridors and beneficial owners, and, for virtual-asset activity, a compliant FATF Travel Rule implementation.
Building it once is not the task. The task is running it, keeping it current as the rulebooks move, and evidencing it on the day a supervisor asks.
04By sector here
How we serve every sector here
Nine sectors. Even weight. No flagship. Each routes to the dedicated UAE programme page for that sector. If a sector is not the right fit for us, we say so before you engage.
VASP & cryptoVARA, CMA, ADGM FSRA and DIFC DFSA programmes, plus Travel Rule build and virtual-asset monitoring.
Payments & MSBCBUAE payment, stored-value and exchange-house programmes, plus free-zone equivalents: screening, monitoring and corridor risk.
Banks & FIsCBUAE and free-zone institution programmes, independent audit and post-finding remediation.
Funds & CSPCMA and free-zone fund programmes, plus MoET-supervised TCSP programmes for corporate and trust service providers.
Gold & DPMSMoET-supervised dealer programmes across the DMCC ecosystem, with goAML reporting.
GamingGCGRA-facing AML/CFT programme build and independent audit for a new regime.
Real estate & DNFBPMoET-supervised programmes with goAML registration and reporting into the UAE FIU.
Defence & dual-useEOCN and MoD export-control, strategic-goods and integrity due diligence.
Art & high-valueDNFBP programmes for dealers supervised by the MoET, reporting via goAML, where no dedicated supervisor gives guidance.
05The five service lines, in this market
01
Licensing and new-regime programme build. The compliance programme that sits behind a VARA, CBUAE, ADGM FSRA, DIFC DFSA, CMA, GCGRA or MoET registration, built to the standard that supervisor inspects to, ready before the first audit.
02
Remediation. Post-finding or post-enforcement rebuild of a UAE programme, on a fixed scope, with the evidence a supervisor will ask for and a defensible closure trail.
03
Outsourced and bridge MLRO plus managed FIU function. A senior MLRO and a working reporting line into the UAE FIU via goAML while you recruit, scale, or stabilise after a departure.
04
Independent AML audit. The independent review a UAE supervisor expects, run by a practitioner who did not build the thing being reviewed.
05
Sanctions, export-control and integrity due diligence. Counterparty, corridor, beneficial-owner and Travel Rule work, including EOCN and MoD-facing controls for dual-use and strategic-goods exposure.
06The operator-side value
Conflict-free
We sell no software, take no commissions and licence nothing ourselves. Our only interest is that your programme holds. Lawyers file. We build the compliance.
Senior-only
The person who scopes the work is the person who does it. No junior handover.
Fixed scope, fixed fee
No hourly billing. A costed plan within 48 hours of the first call. You know what you are buying before you commit.
Local partnersLocal legal standingLicensed local law-firm and compliance partners in our markets.Partners →
If you licence, hold, pay or report in the UAE, the programme is what gets inspected.
We build it, and we run it. Costed plan within 48 hours.