.jpg "AML Regulations for Real Estate Transactions in UAE 2026: Compliance Requirements & Penalties")
On 14 September 2026, the UAE Ministry of Economy and Tourism (MoET) issued Circular No. (2) of 2026 (MOET AML/002/2026). It replaces the March 2026 circular and resets how Designated Non-Financial Businesses and Professions (DNFBPs) must treat high risk jurisdictions. For real estate brokers, gold and diamond dealers, auditors, accountants and corporate service providers, high risk jurisdictions AML UAE obligations now sit on the FATF lists of 19 June 2026 and the new federal AML law. This article explains what changed, which laws apply, and how to bring your AML program in line.
High risk jurisdictions are countries whose AML, counter-terrorist financing (CFT) and proliferation financing controls have strategic weaknesses identified by the FATF or by the UAE National Committee.
FATF black list: officially "High-Risk Jurisdictions subject to a Call for Action". The FATF calls for enhanced due diligence and, in the most serious cases, countermeasures (FATF, 19 June 2026).
FATF grey list: officially “Jurisdictions under Increased Monitoring.” These jurisdictions have committed to address strategic deficiencies in their AML/CFT regimes within agreed timeframes (FATF, 19 June 2026). The FATF does not require enhanced due diligence (EDD) to be applied automatically solely because a jurisdiction is grey-listed. Instead, it asks firms to factor the listing into their risk analysis rather than de-risk entire customer classes. UAE DNFBPs, however, must apply the risk-proportionate measures required by the Ministry of Economy and Tourism (MoET) and UAE AML/CFT legislation. The current list update is set out in MoET Circular No. (2) of 2026 on Updating the List of High-Risk Countries (Black List) and Countries Subject to Increased Monitoring (Grey List), which updates the earlier Circular No. (1) of 2026 (MOET/AML/001/2026).
UAE national list: the National Committee for Combating Money Laundering, Countering the Financing of Terrorism and the Financing of the Proliferation of Weapons issued Resolution No. (15) of 2025, updating the lists of high-risk countries and countries subject to increased monitoring (MoET Circular No. (1) of 2026).
Why it matters for DNFBPs: high risk countries AML UAE exposure is a mandatory risk factor in every customer risk rating.
Circular No. (2) of 2026 does not invent new duties, but it changes the reference lists, the legal basis and the reporting route DNFBPs must follow from 14 September 2026.
It supersedes the March circular. It cancels and replaces Circular No. (1) of 2026 (MOET/AML/001/2026), issued 11 March 2026, and applies from its date of issue.
It moves you to the June 2026 FATF lists. The March circular linked to the February 2026 lists. The new one links to the FATF statements of 19 June 2026.
It cites the new law by article. The legal basis is Article 14 of Federal Decree-Law No. (10) of 2025 and Article 23 of Cabinet Resolution No. (134) of 2025.
It names the goAML templates. STRs linked to black-list countries go to the FIU using the High-Risk Jurisdiction (HRC) and High-Risk Jurisdiction Activity (HRCA) templates.
It requires re-evaluation after delisting. Firms must recalibrate due diligence for countries the FATF removes from its lists.
It puts management on notice. Executives and senior management are warned that administrative penalties follow non-implementation.
The circular applies the FATF high risk jurisdictions list as published after the 17–19 June 2026 Plenary, which is the current version as of October 2026.
FATF black list (3): Democratic People's Republic of Korea and Iran (countermeasures), and Myanmar (enhanced due diligence). The FATF said it will consider countermeasures on Myanmar if no further progress is made by October 2026 (FATF call for action).
FATF grey list 2026 (22): Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d'Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK) and Yemen (FATF increased monitoring).
Added in June 2026: Bosnia and Herzegovina, and Iraq.
Removed in June 2026: Algeria and Namibia. Under the circular, customers linked to these two countries need a fresh, proportionate risk review.
Close to exit: Bulgaria, Côte d'Ivoire, the DRC and Monaco have substantially completed their action plans and await on-site visits.
Next update: the FATF's October 2026 Plenary may change both lists, so monitor the FATF site and MoET circulars.
All laws below are current as of October 2026, and no amendments to the 2025 law or its executive regulations have been published on MoET's AML legislation page.
Federal Decree-Law No. (10) of 2025 on AML, CFT and proliferation financing. It repealed Federal Decree-Law No. (20) of 2018 and its 2021 amendment. Article 14 is the basis for the high risk country measures.
Cabinet Resolution No. (134) of 2025 (Executive Regulations), in force from 14 December 2025. It replaced Cabinet Decision No. (10) of 2019. Article 23 requires risk-proportionate EDD and countermeasures.
Cabinet Resolution No. (74) of 2020 on terrorism lists and targeted financial sanctions, which the circular expressly applies to black-list exposure.
Cabinet Resolution No. (71) of 2024 setting violations and administrative penalties for DNFBPs supervised by MoET and the Ministry of Justice.
Beneficial ownership: Cabinet Decision No. (109) of 2023 requires UAE companies to identify and record their beneficial owners. Where a beneficial owner is linked to a black-listed or grey-listed country, DNFBPs must apply enhanced due diligence under MoET Circular No. (1) of 2026.
Enhanced due diligence UAE rules differ by list: black-list exposure triggers mandatory EDD plus countermeasures, while grey-list exposure triggers EDD proportionate to risk.
Black list, all relationships: apply EDD to every business relationship and transaction involving a black-list country, including natural persons, legal entities and anyone acting on their behalf (Circular No. 2 of 2026).
No third-party reliance: you may not rely on third parties in black-listed countries to perform customer due diligence. This does not prohibit outsourced services generally, and responsibility for CDD always remains with your business.
Targeted financial sanctions: screen against UN Security Council lists and the UAE Local Terrorist List under Cabinet Resolution No. (74) of 2020.
Grey list, risk-based: apply EDD in proportion to the risk, and use FATF updates when reviewing relationships (Circular No. 1 of 2026).
Typical EDD measures: examples include verifying source of funds and wealth, obtaining senior management approval, and increasing ongoing monitoring, as set out in MoET’s CDD Implementation Guide. This is not an exhaustive checklist; measures should be proportionate to each customer’s risk.
Sector detail: MoET's 2026 Supplemental Guidance for real estate, precious metals and stones, corporate service providers and accountants and auditors explains how EDD applies in each sector.
The HRC HRCA report goAML templates are the reporting route the circular names for transactions and activities linked to black-list countries.
HRC (High-Risk Country Transaction Report): used for a transaction that originates from, is destined for, or passes through a black-list country.
HRCA (High-Risk Country Activity Report): used for business activity or a relationship linked to a black-list country where no transaction has yet taken place.
Internal reporting first: the circular requires internal reporting mechanisms to monitor black-list activity before reports reach the FIU.
Hold the transaction: industry guidance on FIU practice reports a three-working-day waiting period after filing a High Risk Country Transaction Report (HRC) or High Risk Country Activity Report (HRCA), unless the FIU objects. This applies only to transactions or activities covered by the applicable HRC/HRCA reporting requirements, not to every transaction involving a high-risk country. Confirm current instructions on the goAML portal.
Grey list is different: grey-list exposure does not trigger HRC/HRCA by itself; file an STR or SAR only where there is suspicion.
Registration: you need an active goAML account to file at all.
Updating your program means feeding the June 2026 lists into your AML risk assessment UAE, your customer due diligence UAE files and your policies, and documenting each step.
Refresh the enterprise-wide risk assessment: rescore country risk for Iraq and Bosnia and Herzegovina, and reassess Algeria and Namibia. Align with MoET's guide on the 2024 National Risk Assessment.
Re-rate existing customers: run the customer base against the new lists using MoET's Customer Risk Assessment guide, including nationality, residence, beneficial owners and fund flows.
Update CDD and EDD triggers: add the third-party reliance ban and the delisting review to your procedures.
Rewrite legal references: replace any mention of Federal Decree-Law No. (20) of 2018 with Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025.
Train staff and brief management: cover HRC/HRCA filing, red flags and the personal accountability message in the circular.
Keep evidence: inspectors look for dated records of each update.
Circular No. (2) of 2026 leaves little room for outdated country lists or legacy policies. AMCA helps DNFBPs turn each MoET update into documented, inspection-ready controls.
Gap review of your AML policy against Federal Decree-Law No. (10) of 2025, Cabinet Resolution No. (134) of 2025 and Circular No. (2) of 2026.
Risk assessment refresh covering enterprise-wide and customer-level scoring for the FATF grey list 2026 and black list.
EDD and CDD procedures built for your sector, including source of funds and wealth checks.
goAML support for registration and HRC, HRCA, STR and SAR filing.
Which law governs high-risk countries in the UAE? It is Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, read with its Executive Regulation, Cabinet Resolution No. 134 of 2025.
Who decides which countries are high-risk? The National Anti-Money Laundering Committee identifies them, taking into account the FATF lists.
What must a business do when a customer is linked to a high-risk country? It must apply enhanced due diligence proportionate to the risk, plus any countermeasures required by its supervisory authority.
What does enhanced due diligence involve? Typically senior management approval, source of funds and source of wealth checks, and closer ongoing monitoring.
Does dealing with a high-risk country automatically make a transaction suspicious? No. Country risk is one factor in a risk-based assessment. A suspicious transaction report is filed through goAML only where there are grounds for suspicion.
How often do the high-risk country lists change? The lists are updated after each FATF plenary, so businesses should check the latest version regularly.
The circular is addressed to four DNFBP sectors: real estate brokers and agents, dealers in precious metals and precious stones, auditing or accounting firms, and corporate service providers, where these businesses fall under MoET’s AML/CFT supervision.
Real estate brokers and agents.
Dealers in precious metals and precious stones.
Auditing and accounting firms.
Corporate service providers.
Their executives and senior management, who the circular warns directly.
It applies to both. The circular took effect on its issue date, 14 September 2026, and requires EDD on all business relationships involving black-list countries. Existing customers therefore need re-screening against the June 2026 lists, not just new onboarding.
Non-compliance exposes both the firm and its management to sanctions.
Administrative penalties under Cabinet Resolution No. (71) of 2024.
Sanctions that can extend to executives and senior management, as the circular states.
Separate liability under Federal Decree-Law No. (10) of 2025 for wider AML breaches.
Checks should follow every list update and every key customer event.
After every FATF Plenary, normally held in February, June and October.
Whenever MoET issues a new high risk country circular.
At onboarding and during ongoing monitoring of each customer.
Yes. The FATF states that its standards do not envisage de-risking or cutting off whole classes of customers. A grey-list link raises the risk rating and calls for proportionate EDD, but it is not a ban. Decisions should be documented case by case.
04 Nov 2026
.jpg "Why AML Policies Are Being Reviewed During Company Audits")