AML Compliance Officer in the UAE: Who Can Be One, Duties and Outsourcing
Every DNFBP in the UAE, real estate brokers included, has to appoint an AML Compliance Officer. The law sets three conditions for the person, lists five duties, and says nothing about whether they must be on your payroll. MoET’s guidance fills that gap and allows an external Compliance Officer only in limited cases.
This guide covers who can be your Compliance Officer, what the role involves under the 2025 rules, the difference between a Compliance Officer and an MLRO, what MoET says about outsourcing, and how the role works on goAML. At the end there is a free appointment resolution you can copy and adapt.
The rules come from Federal Decree-Law No. 10 of 2025 on anti-money laundering (FDL 10/2025), its Executive Regulations in Cabinet Resolution No. 134 of 2025 (CR 134/2025), and the Ministry of Economy and Tourism’s Guidelines for Designated Non-Financial Businesses and Professions (March 2026). The wider picture for brokers is in our AML guide for real estate agents.
What the law requires
CR 134/2025 deals with the Compliance Officer in two places. Article 21 lists what your internal AML controls must include, and one item is “appropriate anti-crime compliance management arrangements, including the appointment of a Compliance Officer at management level” (art. 21(3)). Article 22 then sets the conditions for the person. The Compliance Officer is appointed:
- at management level;
- under their responsibility (the English text can be read either way; MoET’s Guidelines read it as the Compliance Officer acting “under his or her own responsibility”);
- with independence in decision-making; and
- with appropriate competence and experience.
CR 134/2025 also gives supervisory authorities the power to keep a list of Compliance Officers and to require “prior approval before appointing their Compliance Officers” (art. 49(18)). MoET’s March 2026 Guidelines apply this to DNFBPs: the appointment “must receive the prior written approval of the relevant Supervisory Authority”. For brokers on the mainland and in commercial free zones, that authority is MoET. The Guidelines do not describe a separate approval form; in practice the Compliance Officer’s goAML registration also goes through MoET for approval (see goAML registration in the UAE).
Who can be your Compliance Officer?
Many websites say the Compliance Officer must be one of your employees. FDL 10/2025 and CR 134/2025 contain no such rule. They set the conditions above and leave the choice of person to you.
In practice, a small brokerage often appoints the owner or the general manager, who already sits at management level. MoET’s Guidelines allow for dual roles in small businesses but expect safeguards. The role should stay separate from sales and other revenue-generating work “to the extent practicable”. Where a dual role cannot be avoided because of the size of the business, MoET expects clear reporting lines, oversight by senior management or the board, and segregation of duties in high-risk processes (Guidelines, §7.1).
Before the appointment, MoET expects a fit and proper assessment of the candidate: AML experience, professional reputation, and no criminal or regulatory record. Keep a written record of that assessment and tell MoET about any later change to the role or its reporting lines (§7.1.1 and §7.1.3). The Guidelines also suggest naming a deputy where needed, checked in the same way, so that someone can cover when the Compliance Officer is away.
The Guidelines list what they look for in a candidate:
| Area | What MoET looks for (Guidelines §7.1.3) |
|---|---|
| Knowledge | UAE AML law, the Executive Regulations, MoET guidance, FATF Recommendations, typologies and red flags |
| Experience | Compliance, AML, internal audit, legal or risk work, ideally in the same or a similar industry, and dealing with MoET and the FIU |
| Position | Senior enough to influence decisions and to reach senior management, the board, data, systems and staff without obstruction |
| Personal | Integrity, sound judgment, no conflicts of interest, ability to work on their own |
Compliance Officer or MLRO: is there a difference?
For a UAE DNFBP, no. The law and the Executive Regulations use only “Compliance Officer”. MoET’s Guidelines say the Compliance Officer is “also referred to as the Money Laundering Reporting Officer (MLRO)” and use the two terms for the same role. The FIU’s SACM and goAML registration guide does the same and labels the Compliance Officer’s fields “MLRO”. When a goAML form asks for the MLRO, it means your Compliance Officer.
The Compliance Officer’s duties under CR 134/2025
Article 22 lists five duties:
| # | Duty (CR 134/2025, art. 22) | What it means for a broker |
|---|---|---|
| 1 | Monitoring transactions related to the crime | Watching deals and payments for red flags from first contact to closing |
| 2 | Reviewing records, receiving and assessing suspicious transaction information, and deciding whether to notify the FIU or keep the matter on file with reasons, in full confidentiality | Every escalation from an agent ends with a documented decision by the Compliance Officer: report or not, and why |
| 3 | Reviewing the AML/CFT/CPF systems and procedures, checking compliance with them, proposing updates, and reporting periodically to senior management, with a copy to the supervisor on request | Keeping the policy and risk assessment current, and writing regular reports to the owner or board |
| 4 | Developing, implementing and documenting training programmes for staff | A training plan and records showing who was trained and when |
| 5 | Cooperating with the supervisor and the FIU, providing data they request, and giving their officers access to records | Being the contact for MoET inspections and FIU requests |
MoET’s Guidelines add detail. The Compliance Officer files all applicable reports (STRs, SARs, CNMRs, PNMRs, DPMSRs and REARs), oversees the business risk assessment, follows up on inspection findings, and keeps senior management informed about reports filed, compliance gaps and changes in risk (§7.1.2). They must also make sure records are kept for at least five years, which matches CR 134/2025, art. 25.
Can you outsource the Compliance Officer?
The law does not ban it. FDL 10/2025 and CR 134/2025 do not mention outsourcing the Compliance Officer at all. The only reference to outsourcing in CR 134/2025 is in art. 20(3), and it concerns customer due diligence.
MoET’s March 2026 Guidelines address the question directly. Where a DNFBP “cannot appoint a suitably qualified and independent CO internally”, a third-party Compliance Officer may be permitted under these conditions (§7.1.1):
- the external Compliance Officer has the qualifications and experience and understands your business model, risk profile and regulatory obligations;
- you carry out the same fit and proper assessment as for an internal candidate;
- they are independent of operational and revenue-generating roles;
- they have unrestricted access to your information, records, systems and staff;
- a written contract sets out their responsibilities, scope, reporting lines and confidentiality; and
- you review their performance periodically.
The business stays accountable. The Guidelines say “the ultimate accountability for compliance remains with the DNFBP’s Senior management and board”, and an external appointment does not release the business from its obligations. Like any Compliance Officer, an external one needs MoET’s prior written approval.
The Guidelines also separate appointing an external Compliance Officer from getting outside help. A Compliance Officer “may receive support from a suitably qualified third-party compliance service provider”, with proper oversight by the business (§7.1.3). Where consultants or screening tools handle part of the AML programme, the Compliance Officer keeps responsibility for checking their work (§7.1.2).
The Guidelines say they are not legislation and that the law prevails if the two differ (§1.3). They still show what MoET, as your supervisor, expects. If you plan to appoint someone from outside your business, raise it with MoET before you rely on it.
The Compliance Officer on goAML
MoET’s Guidelines require the Compliance Officer to register as the user of goAML. The FIU’s registration guide makes the person who registers the organisation, normally the Compliance Officer, its administrator. The administrator approves other users who register under your Org ID and decides what each of them can do.
According to the FIU Reports FAQ, filing reports is “ideally” the Compliance Officer’s job. Busy firms can add more goAML users to raise reports, and the Compliance Officer decides their rights. The login codes and the authenticator are tied to the Compliance Officer’s own phone and email, so nobody else can hold them.
Changing the Compliance Officer needs MoET’s approval at several points. You appoint the new officer and ask MoET to approve them, the new officer completes SACM pre-registration, MoET asks the FIU to swap the accounts, and the new officer updates the contact person in goAML. Keep the old officer active until the new one is approved, or nobody can file reports in the gap. The full steps are in our goAML registration guide.
Why independence and access matter
The Compliance Officer decides whether a deal gets reported. MoET’s Guidelines are explicit: “No individual, including senior management, is permitted to interfere with or influence the CO’s decision to submit a report” (§7.1.2). If the Compliance Officer faces pressure, they are expected to tell MoET through official channels.
A suspicious transaction must be reported to the FIU “without delay”, whatever its value (FDL 10/2025, art. 18). Failing to report, deliberately or through gross negligence, carries imprisonment and/or a fine of AED 100,000 to AED 1,000,000 (art. 28). The FIU Reports FAQ warns that not reporting when there are red flags may lead to imprisonment of the Compliance Officer, fines, and suspension or cancellation of the company’s trade licence. The FAQ also says that whether to go ahead with a deal after an SAR is the Compliance Officer’s decision.
So the person you appoint has to be reachable, able to look at an escalated deal quickly, and senior enough that agents bring problems to them. The Guidelines expect them to have “direct and unrestricted access to senior management and/or the board” and to customer files, systems and staff. A Compliance Officer who exists only on paper cannot meet these requirements.
Compliance Officer appointment letter: free template
The resolution below is a starting point for a board or owner’s decision appointing a Compliance Officer. It also authorises the Compliance Officer to register the company on goAML, so it can double as the authorisation letter described in our goAML guide. Replace everything in square brackets, print it on company letterhead and have it signed. Adapt it to your company. It is not legal advice.
RESOLUTION OF THE [BOARD OF DIRECTORS / OWNER] OF [COMPANY NAME]
Trade licence no. [Trade licence no.], issued by [licensing authority]. Date of resolution: [date].
1. Appointment. [Company name] (the “Company”) appoints [Name], holder of Emirates ID no. [Emirates ID], currently [Position], as the Company’s Compliance Officer under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
2. Effective date. The appointment takes effect on [effective date], subject to the prior written approval of the Ministry of Economy and Tourism.
3. Duties. In line with Article 22 of Cabinet Resolution No. 134 of 2025, the Compliance Officer will: (a) monitor transactions for signs of money laundering, terrorist financing and proliferation financing; (b) review records, receive and assess information on suspicious transactions, and decide, in full confidentiality, whether to report to the Financial Intelligence Unit or to keep the matter on file with written reasons; (c) review the Company’s AML/CFT/CPF policies, systems and procedures, assess compliance with them, propose updates, and report periodically to [the Board / the Owner], with a copy to the Ministry of Economy and Tourism on request; (d) develop, implement and document ongoing AML/CFT/CPF training for staff; (e) cooperate with the Ministry of Economy and Tourism and the Financial Intelligence Unit, provide the information they request, and give their officers access to the Company’s records.
4. Independence and access. The Compliance Officer acts independently in deciding whether to report. No director, owner or employee may interfere with or influence that decision. The Compliance Officer reports directly to [the Board / the Owner] and has unrestricted access to customer files, transaction records, systems and staff.
5. goAML. The Compliance Officer is authorised to register the Company on the Financial Intelligence Unit’s SACM and goAML systems, to act as the Company’s goAML administrator, and to submit reports on the Company’s behalf.
6. Resources. The Company will give the Compliance Officer the time and resources needed to carry out these duties.
7. Deputy (optional). [Deputy name], holder of Emirates ID no. [Deputy Emirates ID], is appointed as Deputy Compliance Officer to act in the Compliance Officer’s absence, subject to the same approval.
Signed for the Company: Name [ ] · Title [ ] · Signature [ ] · Date [ ] · Company stamp
Accepted by the Compliance Officer: Name [ ] · Signature [ ] · Date [ ]
Keep the signed resolution in your AML file together with the record of the fit and proper assessment, which the Guidelines expect you to keep.
What we can do for you
Our AML subscription for brokers is built around a Compliance Officer from your own team. We never act as your Compliance Officer. We prepare the work, and your Compliance Officer reviews it, makes the decisions and submits. The subscription includes:
- goAML and EOCN registration, guided step by step with your Compliance Officer;
- the AML documentation set: policy and procedures manual, the Compliance Officer appointment letter, risk assessment and KYC forms written for your activity;
- screening of up to 100 clients for sanctions and PEPs, with a risk rating;
- deal checks before closing and ongoing monitoring of client files;
- up to 10 FIU reports a year prepared in goAML, ready for your Compliance Officer to review and submit;
- one personal manager for the whole year.
AML staff training is not included. The price is AED 12,000 + VAT per year, or AED 3,750 + VAT per quarter.
See what’s included and the price →
This guide is general information, not legal advice.
What this means for you
The Compliance Officer decides what your business reports to the FIU. Three things to get right:
Pick someone senior and independent
Article 22 of CR 134/2025 requires management level, independence in decision-making and the right competence. The law does not require an employee, but MoET’s Guidelines allow an external Compliance Officer only when you cannot appoint one internally.
Get MoET’s approval first
MoET’s Guidelines require prior written approval of the appointment. Record the fit and proper assessment and sign an appointment resolution.
Keep them reachable
Suspicious transactions go to the FIU without delay (FDL 10/2025, art. 18). Nobody, including the owner, may influence the Compliance Officer’s decision to report.
Frequently asked questions
Does the AML Compliance Officer have to be an employee?
No. Federal Decree-Law 10/2025 and Cabinet Resolution 134/2025 require a Compliance Officer at management level, with independence in decision-making and appropriate competence and experience (CR 134/2025, art. 22). They do not say the person must be on your payroll.
Can a real estate broker outsource its Compliance Officer?
The law does not ban it. MoET’s March 2026 Guidelines allow a third-party Compliance Officer where a DNFBP cannot appoint a suitably qualified and independent one internally, with a fit and proper check, a written contract and full access to records. Accountability stays with the business, and MoET’s prior written approval is still needed.
What is the difference between a Compliance Officer and an MLRO?
For a UAE DNFBP there is none. The law uses “Compliance Officer”, and MoET’s Guidelines and the FIU’s goAML guide also call the same person the MLRO (Money Laundering Reporting Officer).
What are the duties of an AML Compliance Officer in the UAE?
Article 22 of CR 134/2025 lists five: monitoring transactions, assessing suspicious transaction information and deciding whether to report to the FIU, reviewing AML systems and reporting to senior management, running staff training, and cooperating with MoET and the FIU.
Can the owner of a brokerage be its Compliance Officer?
Yes, and small brokerages often do this. MoET’s Guidelines accept dual roles where the size of the business makes them unavoidable, provided there are clear reporting lines, senior management or board oversight and segregation of duties in high-risk processes.
Does MoET have to approve the Compliance Officer?
Yes. CR 134/2025 lets supervisors require prior approval of Compliance Officers (art. 49(18)), and MoET’s Guidelines say the appointment must receive its prior written approval. Tell MoET about later changes to the role too.
How do I change the Compliance Officer on goAML?
Appoint the new officer and ask MoET to approve them, have them complete SACM pre-registration and register on goAML under your Org ID, then MoET asks the FIU to swap the accounts. Keep the old officer active until the new one is approved.
Can QuickTax act as our Compliance Officer?
No. We prepare the AML documents, client checks and FIU reports, and your own Compliance Officer reviews them, makes the decisions and submits on goAML.
