AML Compliance in Sharjah 2026 — a DNFBP and goAML Guide for SMEs

AML compliance in Sharjah applies to every Designated Non-Financial Business and Profession (DNFBP) licensed by the Sharjah Department of Economic Development (SEDD) or any Sharjah free zone — SAIF Zone, Hamriyah, SRTI Park, Sharjah Publishing City, Sharjah Media City (Shams) and the rest.

The federal regulator is the Ministry of Economy and Tourism AML/CFT Supervision Department, running Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation Financing — which replaced the 2018 law from 14 October 2025 — plus its Executive Regulations, Cabinet Resolution No. 134 of 2025. If you are looking for the current anti-money laundering law in the UAE, this Decree-Law and its Executive Regulations are the texts that apply.

The translation for a Sharjah SME founder or compliance officer is straightforward. If you fall in one of the DNFBP categories — real-estate brokerage, dealers in precious metals and stones, auditors, accountants, tax advisors, corporate service providers, lawyers or notaries — you owe goAML registration, a Compliance Officer, customer due diligence, sanctions screening, ongoing monitoring, STR filing and annual AML/CFT returns. This guide covers the federal framework as it lands in Sharjah, the extra rules on real-estate and DPMS operators, and the compliance programme that keeps a Sharjah SME off the inspection list in 2026.

Why supervisors are knocking harder in 2026

A few forces are pulling AML supervision tighter across the UAE, Sharjah included. The first is the FATF action plan. The UAE came off the grey list in February 2024 after a multi-year effort that genuinely tightened DNFBP supervision, beneficial-ownership transparency and STR-filing culture, and staying off the list means emirate-level supervisors and the Ministry of Economy and Tourism have to keep inspecting — which lands as more inspections of SMEs.

Real-estate and precious metals draw the sharpest attention because they carry the highest perceived AML risk. The Sharjah Real Estate Registration Department, SEDD and the Ministry of Economy and Tourism run joint inspection cycles on brokers, and the published fine for failing to file an STR promptly is AED 100,000 to AED 500,000 per violation — item 22 of the annex to Cabinet Resolution No. 71 of 2024.

Beneficial ownership is the third. Here a lot of published UAE guidance is out of date: Cabinet Resolution No. 109 of 2023 on the Regulation of the Real Beneficiary Procedures cancelled Cabinet Decision No. 58 of 2020 outright, in its own Article 22. If a checklist or a template policy on your shelf still cites Decision 58, it is citing a repealed instrument.

The operative test now sits in Article 5(1) of Resolution 109. A real beneficiary is whoever ultimately owns or controls the legal person “through direct or indirect ownership shares of (25) twenty-five per cent or more” of its capital, or holds voting rights of 25% or more, or controls it by other means such as the right to appoint or remove a majority of the board. For a Sharjah CSP or accountant onboarding a client, that means UBO identification at the door — a much more rigorous KYC than a passport copy.

What a clean programme actually contains

A Sharjah DNFBP that survives an AML inspection has six things in place, documented and operating. Inspectors call them your AML policies and procedures; in practice they are the items below.

It starts with a written AML/CFT policy that management has actually approved, covering the risk assessment, customer due diligence, enhanced due diligence for high-risk customers, the ongoing monitoring framework, sanctions screening, STR and SAR filing, record retention (minimum 5 years from the end of the relationship), and the Compliance Officer’s role and reporting line. That Compliance Officer is a named UAE resident with enough authority to enforce the policy independently — in a small SME the owner-manager can hold the role, in a larger one it should be a senior employee without operational conflicts.

Then the operating parts. Customer due diligence at onboarding means collecting KYC documents — identity verification through Emirates ID or passport for individuals, trade-licence and beneficial-ownership documentation for entities — plus source-of-funds documentation for high-risk customers, and a low/medium/high risk rating. Sanctions screening covers customers and counterparties against the UAE Local Sanctions List, the UN Security Council Consolidated List and whatever else applies (OFAC, EU, UK), at onboarding and periodically after — usually monthly or quarterly depending on list updates.

Ongoing monitoring watches transactions against red-flag indicators like cash-heavy dealings, third-party payments, an unusual hurry to close or a refusal to provide documentation. The Executive Regulations do not fix a review interval by risk band — they require the monitoring to be ongoing and the documents and data to be kept up to date, and leave the cadence to your own risk-based policy. Set it, write it down, and then actually hold to it, because the interval an inspector tests you against is the one you wrote. And the annual AML/CFT return goes through goAML within the deadline the Ministry of Economy and Tourism sets each year, confirming ongoing compliance, listing active clients by risk band and refreshing the Compliance Officer details and policy version.

Registering on goAML (and why people get stuck)

goAML is the UAE Financial Intelligence Unit’s online portal for all AML reporting. Registration is the first compliance step for any Sharjah-licensed DNFBP.

The process:

1. Prepare documentation — trade licence, Compliance Officer Emirates ID copy, signed Compliance Officer appointment letter, signed AML policy declaration
2. Submit through goAML portal — the UAE FIU does not publish a guaranteed turnaround, so treat the lead time as unknown and register well before a renewal deadline rather than against one
3. Receive confirmation — must be displayed at business premises and referenced on annual SEDD or free-zone licence renewal applications
4. Maintain login credentials — the registered Compliance Officer accesses the portal to file STRs, SARs and the annual return

Operating as a DNFBP without goAML registration carries an administrative fine of AED 50,000 to AED 200,000 — item 23 of the list annexed to Cabinet Resolution No. 71 of 2024 — imposed by the Ministry of Economy and Tourism, usually with a follow-up demand to register within a fixed period. Continued non-compliance can result in SEDD trade-licence suspension.

If you broker property in Sharjah, the bar is higher

Real-estate brokerage is the most heavily-supervised DNFBP category in the UAE. Sharjah real-estate brokers licensed under SEDD face joint Ministry of Economy and Tourism and SEDD inspection cycles, plus coordination with the Sharjah Real Estate Registration Department.

Specific obligations beyond the federal DNFBP baseline:

• Enhanced KYC for every property transaction — including off-plan and rental, regardless of transaction value
• Source-of-funds documentation — for buyers where transaction value or aggregated linked transactions exceed AED 55,000 cash equivalent
• Sanctions screening — of buyer, seller and all parties to the transaction
• Beneficial-ownership verification — where the buyer is a corporate entity, the ultimate beneficial owners must be identified and verified
• Red-flag monitoring — against high-risk transaction patterns including cash-heavy purchases, third-party payments, unusual hurry to close, transactions inconsistent with buyer profile, refusal to provide documentation
• STR filing without notification — Suspicious Transaction Reports must be filed through goAML without delay and without notifying the customer

The Sharjah Real Estate Registration Department and SEDD coordinate inspection cycles, with the Ministry of Economy and Tourism leading the AML-specific review. The fines that attach to the brokerage failures above are published, not guesswork: failing to carry out customer due diligence is AED 50,000 to AED 200,000 (item 9), failing to verify the customer and the real beneficiary from a reliable independent source is AED 50,000 to AED 200,000 (item 11), failing to apply enhanced due diligence where high risk has been identified is AED 100,000 to AED 500,000 (item 15), and failing to file the STR promptly is AED 100,000 to AED 500,000 (item 22). Repeated findings can trigger trade-licence suspension.

What gold and jewellery operators have to do

Sharjah hosts a significant precious-metals and stones trade — Sharjah Gold Souk in central Sharjah, mainland jewellery retailers across the emirate, and Hamriyah-area precious-metals dealers serving regional B2B markets. All fall under DPMS supervision.

Specific obligations:

• Cash-transaction reporting threshold — single transaction or aggregated linked transactions at AED 55,000 trigger enhanced documentation and may require STR filing
• Source-of-funds documentation — for high-value customers regardless of payment method
• Provenance documentation — for precious-stone inventory, particularly diamonds, to confirm Kimberley Process compliance and conflict-free sourcing
• Sanctions screening — of customers and suppliers
• Red-flag monitoring — against indicators including large cash purchases, third-party payments, unusual specifications, refusal to provide identification, transactions inconsistent with customer profile

Sharjah Gold Souk operators face additional sector-specific inspections coordinated between SEDD, Sharjah Municipality and the Ministry of Economy and Tourism. The annual AML/CFT return must list inventory movements, large transactions and any STRs filed during the year.

CSPs and accountants: where the real risk sits

Corporate service providers operating across SAIF Zone, Hamriyah, SRTI Park, Sharjah Publishing City, Shams and SEDD mainland — and accountants, auditors and tax advisors — are full DNFBPs under the Ministry of Economy and Tourism framework.

The AML risk in this category sits almost entirely at the formation and onboarding stage. Do a sloppy KYC when you set up a new entity and you may have handed someone a vehicle they later use for something illicit — and that’s your exposure, not just theirs. It’s the kind of risk that feels abstract right up until an inspector pulls the file.

Specific obligations:

• Enhanced KYC at onboarding — including beneficial ownership identification against the 25% test in Article 5(1) of Cabinet Resolution No. 109 of 2023
• Source-of-funds documentation — for the entities being formed and their UBOs
• Sanctions screening — at onboarding and periodically thereafter
• Ongoing monitoring — of client activity against red-flag indicators
• STR filing — where suspicious activity is detected
• Annual AML/CFT return — listing active clients by risk band

The published fine for failing to take reasonable measures to identify and validate the beneficial owner of a legal person is AED 50,000 to AED 200,000, item 13 of the annex to Cabinet Resolution No. 71 of 2024. The number that should worry a CSP is not that range on its own but the arithmetic behind it: the fines in the annex are stated “for each violation”, so a firm that has formed twenty entities without a documented UBO check is not looking at one fine. Article 5(2) of the same Resolution also lets the Ministry double the fine where a violation is repeated.

“

The Sharjah DNFBP that survives an AML inspection is the one whose Compliance Officer can produce six documents in 30 minutes — written policy, goAML registration, sample KYC file, sanctions-screening log, STR register and last annual return — not the one that scrambles for two weeks to assemble what should have been routine.

Free zones don’t buy you an exemption

SAIF Zone, Hamriyah Free Zone, SRTI Park, Sharjah Publishing City and Shams all license DNFBP-category businesses alongside their other tenants. The federal AML/CFT framework applies identically — there is no free-zone exemption from goAML, Compliance Officer appointment, KYC, sanctions screening, STR filing or the annual return.

In practice, free-zone authorities coordinate with the Ministry of Economy and Tourism on AML supervision of DNFBP tenants. SAIF Zone hosts a significant tenant base of corporate service providers and accounting firms; Hamriyah hosts precious-metals dealers and trading-related DNFBPs; SRTI Park and Sharjah Publishing City host smaller DNFBP populations. Each zone’s compliance office runs periodic AML training for tenants and supports goAML registration at the time of licence issuance.

Free-zone DNFBPs that operate cross-emirate (typical for corporate service providers and accountants) face joint supervision — the licensing authority covers operational compliance, while the Ministry of Economy and Tourism covers AML supervision regardless of where the activity occurs.

The screening tool stack

Sanctions screening is the single most operationally-intensive component of AML compliance. The screening must cover:

• UAE Local Sanctions List — maintained by the UAE Cabinet, updated periodically
• UN Security Council Consolidated List — the global baseline
• OFAC, EU, UK lists — depending on customer base and counterparty exposure
• PEP (Politically Exposed Person) screening — for enhanced due diligence triggers
• Adverse media screening — for high-risk customer onboarding

For a small DNFBP, manual screening through publicly-available lists is technically possible but operationally fragile. Most Sharjah DNFBPs use a third-party screening tool — Refinitiv World-Check, Dow Jones Risk & Compliance, ComplyAdvantage, LSEG and similar — with subscription cost scaling by customer volume and the feature set selected. The tool produces an audit trail of every screening event, which is the inspection deliverable. Two practical notes: pick AML software that exports its logs (screenshots don’t survive inspection), and expect your bank to send its own AML questionnaire at account opening or periodic review — the answers should match your goAML registration and written policy.

The annual return, in plain English

Every Sharjah DNFBP files an annual AML/CFT return through goAML, typically before the deadline communicated by the Ministry of Economy each calendar year. The return confirms:

• Ongoing goAML registration status
• Compliance Officer details and any changes during the year
• Active client base by risk band (low, medium, high)
• KYC refresh activity during the year
• Sanctions screening activity and any positive matches
• STRs filed during the year
• SARs filed during the year
• Compliance Officer training completed during the year
• Material policy changes during the year

The annual return is one of the “instructions, regulations and forms concerning crime combating set by supervisory authorities” in item 32 of the list annexed to Cabinet Resolution No. 71 of 2024, where the fine starts at AED 50,000. Repeated failures can result in SEDD or free-zone trade-licence suspension.

Three fine regimes, and people keep blending them

Most AML write-ups quote one range and imply it covers everything. There are actually three separate regimes, set by three different instruments, and mixing them is how a page ends up overstating a ceiling by a factor of twenty.

The first is the fixed administrative fine list in the annex to Cabinet Resolution No. 71 of 2024 — 41 numbered violations, each with its own published minimum and maximum, applied per violation by the Ministry. Across the whole annex the figures run from AED 50,000 at the low end to AED 1,000,000 at the high end.

The second is the supervisor’s general power in Article 17(1)(b) of Federal Decree-Law No. 10 of 2025: “an administrative fine of not less than ten thousand dirhams (AED 10,000) and not exceeding five million dirhams (AED 5,000,000) for each violation.” Article 17 also lets a supervisor issue a warning, bar the violator from the sector, restrict or suspend responsible officers, suspend the activity, or revoke the licence outright.

The third is criminal, and it happens in a court, not at a ministry desk. Article 27(1) of the same Decree-Law punishes a legal person whose representatives committed money laundering, terrorist financing or proliferation financing with a fine “of not less than five million dirhams (AED 5,000,000) and not exceeding one hundred million dirhams (AED 100,000,000), or an amount equivalent to the value of the Criminal Property involved; whichever is greater.” That is not an inspection outcome for a paperwork gap.

Figures above are quoted from the instruments named, checked 5 August 2026.

The annex items a Sharjah DNFBP actually trips

These are the rows of the Cabinet Resolution No. 71 of 2024 annex that a Sharjah broker, DPMS operator, CSP or accountant is realistically assessed against. The Resolution remains in force under Article 41(3) of Federal Decree-Law No. 10 of 2025, which keeps regulations issued under the repealed 2018 law effective until superseding instruments are issued.

Source: list annexed to Cabinet Resolution No. 71 of 2024, read from the Ministry of Economy and Tourism’s own published copy, checked 5 August 2026. Item 32’s maximum is printed with an obvious typesetting error in the published English translation, so only its floor is quoted here.

What changed when the 2025 rulebook landed

The Executive Regulations moved as well as the law. Cabinet Resolution No. 134 of 2025, issued 29 October 2025, repealed Cabinet Decision No. 10 of 2019 in its Article 70 and, under Article 71, comes into force thirty days after publication in the Official Gazette. Article numbers moved with it, which matters if your policy document cross-references the old regulation by article.

Two of those deserve a flag for Sharjah SMEs. Article 21(6) puts an independent audit function in the same list as the policy itself and applies it to the same population as the rest of Article 21 — financial institutions, DNFBPs and virtual asset service providers alike. There is no small-firm carve-out in the article’s text, which is not how a lot of consultants describe it. And compliance-officer duties now sit in Article 22, not Article 21 as under the 2019 regulation, so a template policy that cites “Article 21” for the compliance officer is pointing at the wrong provision.

What drives the cost of a Sharjah AML programme

There is no flat price for AML compliance in Sharjah, and a per-tier grid quoted before anyone has seen your licence is a guess. What actually moves the number is the shape of the work, not a headline monthly rate.

The engagement covers policy maintenance, screening tooling, ongoing monitoring, monthly review, the annual goAML return, STR drafting support and inspection-readiness — plus a one-off initial setup and risk assessment for new programmes. It excludes penalty exposure, legal advisory costs and the time of the in-house Compliance Officer, whose role cannot be fully outsourced. Because these dimensions combine differently for every SME, we scope the work against your licence, transaction volume and risk assessment and quote a single fixed figure. Book a free discovery call and you leave with a fixed AML quote scoped to your licence rather than a tier off a grid.

Picking a provider without getting burned

Plenty of firms sell packaged AML compliance solutions; fewer can actually run one for your specific DNFBP category. There are three things worth digging into. Start with category fluency: a real-estate AML programme looks nothing like a DPMS one, which looks nothing like a corporate service provider one. Tell the provider you’re a Sharjah real-estate broker and listen for whether they describe the enhanced KYC and source-of-funds requirements correctly or reach for a generic DNFBP template.

Then their practical goAML experience — the portal has its quirks, and a provider who has filed 50+ STRs and annual returns through it moves faster, knows the common rejection reasons and troubleshoots quickly, so ask how many STRs they’ve drafted in the past 12 months. Last, their inspection-readiness track record: how many client AML inspections have they supported in the past 24 months, what were the findings, and how were they resolved? A provider with no inspection experience is untested at exactly the moment you most need them.

The discovery call should include a walk-through of your current AML state — policy in place yes/no, goAML registration yes/no, KYC documentation samples, sanctions screening status, STR history. The provider who comes back with two or three specific gap observations is the provider to engage.

How Velmont Crest fits in

Velmont Crest’s UAE compliance team is a DED-licensed accounting and advisory firm based in Dubai and provides AML compliance support to Sharjah-licensed DNFBPs across SAIF Zone, Hamriyah, SRTI Park, Sharjah Publishing City, Shams and SEDD mainland. Our typical Sharjah AML client is a real-estate broker, corporate service provider, accountant or DPMS operator with a need for ongoing compliance support alongside the in-house Compliance Officer.

The standard engagement includes AML risk assessment, written AML/CFT policy preparation, Compliance Officer training, customer KYC and onboarding workflow design, sanctions screening setup with a third-party screening tool, ongoing monitoring framework, STR drafting support, annual AML/CFT return preparation through goAML, and inspection-readiness support.

We work alongside the client’s Compliance Officer — we are not the Compliance Officer ourselves, and we do not file STRs on behalf of the client (the obligation sits with the licensed DNFBP). We are not a Ministry of Economy-licensed Compliance Officer service or a regulated AML auditor. We are not a Federal Tax Authority registered tax agent.

We put scope in writing and offer a free discovery call to test fit, then quote a single fixed figure against your licence and transaction volume.

Our take, after running these for Sharjah SMEs

The Sharjah brokers and CSPs we onboard usually fall into one of two buckets. Bucket one: they have a policy document from 2019, a Compliance Officer who hasn’t been trained since the appointment letter was signed, and a goAML login somebody has forgotten the password to. Bucket two: nothing. The inspection risk is identical — supervisors don’t grade you on intent.

What we’d push back on hardest is the assumption that AML is a once-a-year admin task that lives in the same drawer as the trade-licence copy. It isn’t. The annual return is the surface; what supervisors actually want to see is the year of decisions underneath it — every KYC refresh, every screening hit dismissed with a reason, every internal escalation that didn’t become an STR with a note saying why. Build the cadence monthly and the annual return writes itself. Skip the cadence and you’re reconstructing a year of evidence in the two weeks between the inspection notice and the on-site visit.

For a deeper view on the federal AML framework and the related compliance disciplines, see our AML compliance UAE guide, our AML compliance in Abu Dhabi guide, our Hamriyah Free Zone guide and our business setup in Sharjah guide.

Disclaimer: Velmont Crest is a DED-licensed accounting and advisory firm. We provide AML compliance advisory, policy preparation, training support and ongoing compliance support for UAE DNFBPs. We are not a Ministry of Economy-licensed Compliance Officer service, a Ministry of Economy-accredited audit firm, or a Federal Tax Authority registered tax agent. The Compliance Officer role and STR filing obligation sit with the licensed DNFBP, not with Velmont Crest. AML regulatory requirements, goAML procedures and Sharjah free-zone supervision rules change frequently — verify the current position with the relevant authority and take advice from a licensed professional for matters specific to your circumstances.

References

• Federal Decree-Law No. 10 of 2025 on AML, CFT and Proliferation Financing (replaced Federal Decree-Law No. 20 of 2018)
• Cabinet Resolution No. 134 of 2025 — Executive Regulations of Federal Decree-Law No. 10 of 2025
• Cabinet Resolution No. 71 of 2024 — Unified List of AML Violations and Administrative Fines, published by the Ministry of Economy and Tourism (repealed Cabinet Resolution No. 16 of 2021)
• Cabinet Resolution No. 109 of 2023 Regulating the Real Beneficiary Procedures — Article 5(1) sets the 25% test; Article 22 cancelled Cabinet Decision No. 58 of 2020
• UAE Ministry of Economy and Tourism — AML/CFT Supervision
• goAML Portal — UAE Financial Intelligence Unit
• Sharjah Department of Economic Development
• Sharjah Real Estate Registration Department
• Sharjah Airport International Free Zone (SAIF Zone)
• Hamriyah Free Zone Authority