AML for real estate brokers in the UAE: KYC, goAML and cash payments

Real estate brokers and agents in the UAE fall under the anti-money laundering law whenever they act for clients buying or selling property. They must register on goAML, the Financial Intelligence Unit's reporting platform; check who each client is, who really owns any company behind them and where the money comes from; file a Real Estate Activity Report (REAR) when a freehold sale or purchase involves AED 55,000 or more in cash, or any virtual assets; report suspicions at once without tipping off the client; and keep the records for at least five years.

Why brokers are covered, and who supervises them

The UAE's anti-money laundering law is Federal Decree-Law No. 10 of 2025, which repealed the 2018 law. Its executive regulation, Cabinet Resolution No. 134 of 2025, names the businesses outside banking that must apply it, the designated non-financial businesses and professions. Real estate brokers and agents are on that list when they carry out transactions or settlements for clients buying or selling property. The Ministry of Economy and Tourism (MoET) supervises them in the mainland and the commercial free zones; brokers are licensed by the land department or municipality of their emirate.

The ministry's guidance for the sector, updated in March 2026, explains why property is in scope: deals are high in value, money often crosses borders, and companies and third parties are often involved. It expects every brokerage to run a risk-based programme: an assessment of its own risks, written policies approved by senior management, a compliance officer, due diligence on clients, reporting, record keeping, sanctions screening and regular training. Administrative penalties for breaches are set by Cabinet Resolution No. 71 of 2024. Circulars issued under the old law stay in force where they don't conflict with the new one, and the ministry still lists the 2022 REAR circular described below.

Registering on goAML

goAML is the platform the UAE Financial Intelligence Unit (FIU) uses to receive reports. MoET's goAML page says registration is mandatory for every designated non-financial business, real estate brokers included, and that failing to register may lead to severe penalties. To register, the ministry lists:

• an authorisation letter from the company you represent;
• a copy of your passport, residence visa and Emirates ID;
• a copy of the trade licence; and
• the Google Authenticator app on your phone, which supplies the changing password for goAML's SACM security system, where you get your username.

Who files? The FIU's answer is that reporting is ideally the compliance officer's job, and that firms with many clients can add more goAML users, with the compliance officer deciding their rights. goAML is also where the FIU sends requests for more information and its quarterly feedback, so someone must watch its message board.

Customer due diligence: who to check and what to keep

Due diligence starts when the business relationship does. MoET's guidance treats that as the moment you agree to act for a client: a signed brokerage contract or listing agreement, instructions to buy or sell, or a fee. The regulation also requires it whenever you suspect a crime or doubt the identity details you already hold. For each client, collect:

• Individuals: the name as on the ID or passport, nationality, address, date and place of birth, the employer where relevant, and a copy of a valid ID or passport (Article 9 of the regulation).
• Companies: the name, legal form, memorandum and articles of association, tax registration number where it applies, registered address and the names of senior managers, plus the people who own 25% or more of it or otherwise control it (Articles 9 and 10).
• Anyone acting for the client: proof that they are authorised, such as a power of attorney, and their own identity details.
• The money: where the funds come from, backed by documents such as bank statements, a loan or mortgage agreement, proof of savings or income, or papers from an earlier property sale.

Screen every client, beneficial owner and other party before you act, at a minimum against the UAE terrorist lists and the UN Security Council consolidated list. Foreign politically exposed persons, and domestic ones who pose a higher risk, need more: senior management approval, the source of their funds and wealth, and closer monitoring. If you cannot complete due diligence, the regulation says you must not start or continue the relationship or carry out the transaction, and should consider reporting it.

Cash, virtual assets and the REAR

The Real Estate Activity Report is a threshold report, separate from any suspicion. Under MoET's circular 5 of 2022, still listed on its AML page and repeated in its 2026 guidance, a broker files a REAR on goAML for the purchase or sale of freehold property when:

• any part of the price is paid in cash and the cash comes to AED 55,000 or more, in one payment or several;
• any part of the price is paid in virtual assets; or
• the money used was converted from or to a virtual asset.

With each REAR, the circular asks you to obtain and keep the parties' Emirates ID or passport copies and the receipts, invoices, contracts and sale and purchase agreement. For a company buyer or seller, add the trade licence, articles of association, register of beneficial owners and the IDs of all beneficial owners and shareholders or partners. A REAR is due even when due diligence is complete and nothing looks wrong, and it does not replace a suspicious transaction report: when cash or crypto above the threshold comes with a suspicion, file both.

Bank transfers on their own do not trigger a REAR: the FIU's FAQ says international transfers of more than AED 55,000 from individual clients or from other companies need none. Two other reports can apply to any deal. A high-risk country report is due when a transaction involves a country on the national committee's high-risk list, and the transaction can go ahead no sooner than three working days later, if the FIU does not object. And if a party matches the UAE terrorist list or the UN consolidated list, stop the transaction: a confirmed match means freezing any funds you hold and filing a funds freeze report, a partial match means suspending and filing a partial name match report, each within five days.

Third-party payers and other red flags

MoET's guidance lists dozens of red flags, and it is clear that one flag is not proof: it is a reason to look harder and, if the doubt remains, to escalate. A selection that agents meet in practice:

• Money from someone else: a buyer says a third party with no link to them will fund the escrow payments, or payments to the developer come from accounts not in the buyer's name.
• Cash or crypto with no clear source, or payments split into smaller amounts at short intervals.
• Reluctance to name the real owner, or a request to leave the ownership check until late in the deal.
• Intermediaries, nominees or layered companies with no clear business reason.
• A price well above or below market value, or a quick series of resales between the same people.
• Several off-plan units bought and then resold or assigned soon after booking, or cancellations with refunds requested to different accounts or countries.
• Little interest in the property itself, or pressure to close unusually fast.
• A client who withdraws as soon as enhanced checks are requested.

When a suspicion forms, the regulation is strict on two points. The report goes to the FIU immediately, through goAML, whatever the amount. And nobody at the brokerage may tell the client, or anyone else, that a report has been or is about to be filed. The decision to report rests with the compliance officer, and the FIU's FAQ warns that a compliance officer who fails to report clear red flags may face imprisonment and fines, and the company the suspension or cancellation of its trade licence.

Records, training and the compliance officer

Article 25 of the regulation sets the record-keeping floor. Keep transaction records, due diligence files, correspondence, ID copies and any reports for at least five years from the end of the deal or the business relationship, or longer if an inspection, investigation or court case ends later. Organise them so a transaction can be rebuilt, and hand them over promptly when the authorities ask. The REAR circular repeats the five years for reportable deals.

The same regulation asks for internal policies approved by senior management, a compliance officer at management level who can decide independently, screening when hiring, training programmes for staff and an independent audit of the controls. MoET's guidance adds that training should be regular, suit each role, and cover the sector's risks, new typologies and your own procedures.

Where a CRM helps, and where it stops

Software doesn't make a brokerage compliant: the compliance officer decides, and reports are filed on goAML. What a CRM can do is keep the evidence with the deal and make the triggers hard to miss. In Propfusion, each deal holds the buyer's and seller's KYC details and ID copies, an AML record with the payment method, risk rating, PEP status and the sanctions check you recorded, and a REAR-needed flag when the deal was paid with AED 55,000 or more in cash or with virtual assets, until the goAML filing is recorded. With off-plan sales switched on, EOI and booking payments in cash of AED 55,000 or more, or from someone other than the client, are flagged for your compliance team as well.

Propfusion files nothing with goAML and makes no compliance decision. See transactions and finance, deals and commissions and off-plan sales for how deals and bookings are recorded, document management for where ID copies live, and the RERA and DLD compliance checklist for the rest of a Dubai brokerage's duties.