AML Consulting Services UAE — What Providers Actually Do and What Drives the Cost

For years, UAE SMEs treated anti-money-laundering rules as a banking problem. Then the Ministry of Economy began inspecting real estate brokerages, gold traders and corporate service providers — the DNFBP categories — applying a published fine schedule that climbs into the millions of dirhams, and the market for AML consulting services grew up almost overnight. The demand is rational: the obligations are genuinely technical, the supervisors are genuinely checking, and most in-scope businesses have no compliance department. This guide, updated July 2026, maps what the law requires, what a competent AML/CFT consultant actually delivers, how engagements are priced, and the red flags that separate programme-builders from binder-sellers.

Who is in scope — the DNFBP surprise

The framework — Federal Decree-Law 20 of 2018 on AML/CFT, its executive regulations and the decisions built on them — covers financial institutions under the Central Bank, and Designated Non-Financial Businesses and Professions supervised largely by the Ministry of Economy (with financial free zone regulators covering their own patches):

• Real estate agents and brokers — for transactions in property purchase and sale.
• Dealers in precious metals and precious stones — the gold souk economy, above cash thresholds.
• Auditors and accountants — including firms like ours, which is partly why we know the regime from the inside.
• Trust and corporate service providers — company formation and administration businesses.

Lawyers and notaries face equivalent obligations in defined activities. If your licence puts you in these lanes, the full programme applies regardless of size: a two-person brokerage carries the same categories of obligation as a bank, scaled by risk. The sector-by-sector obligations are mapped in our AML compliance UAE overview.

The obligations a programme must cover

1. goAML registration — the UAE FIU’s reporting platform; registration is mandatory and its absence is independently finable. Portal mechanics are in the goAML registration guide, and the profile needs annual renewal.
2. A named compliance officer / MLRO — appointed, competent, senior enough to refuse business.
3. Enterprise-wide risk assessment (EWRA) — the documented map of where ML/TF risk enters your business, refreshed as it changes.
4. Risk-based CDD/EDD — identify customers and beneficial owners, screen against sanctions lists and PEP status, escalate the high-risk cases; the tiering logic is unpacked in EDD vs CDD vs SDD.
5. Ongoing monitoring and STR reporting — spot the unusual, document the decision, file through goAML where suspicion holds.
6. Targeted financial sanctions — screening against the UN and local lists with same-day freeze-and-report duties.
7. Records and training — five-year retention and a staff training cycle inspectors ask to see evidence of.

What a competent AML consultant actually delivers

Build-phase deliverables: a gap assessment against the regulations; the EWRA, built from your real customer and transaction data rather than a generic matrix; policies and procedures written to your operations (the document an inspector reads against what your staff actually do); goAML registration and profile setup; screening-tool selection and configuration — the vendor landscape is compared in our PEP screening tools review; CDD file templates and workflows; and role-based training with attendance evidence.

Run-phase support: periodic file testing and programme reviews, refresher training, EWRA updates, regulatory-change monitoring, and mock inspections — the single highest-value exercise for a DNFBP expecting the Ministry’s questionnaire, rehearsed in full in the MoE inspection preparation playbook.

What no consultant can deliver: the accountability. The law places the programme on the business and its named officer; outsourcing the routine work is legitimate and common, outsourcing the responsibility is neither. Any provider promising “full compliance guaranteed” or “inspection-proof” outcomes is selling something the framework does not permit anyone to sell.

How engagements are priced — the drivers

No honest flat rate exists, so compare quotes on drivers:

• Sector risk — a gold trader’s programme carries more screening and cash-control weight than a services CSP’s.
• Volumes and geography — customer counts, transaction values and exposure to higher-risk jurisdictions set the monitoring load.
• Entity count and structure — group programmes with shared functions price differently from single-licence builds.
• Existing maturity — a refresh of a real programme costs a fraction of a first build from nothing.
• Build vs run — one-off programme construction versus ongoing support (file reviews, training cycles, screening operation) are separate lines; get both quoted so year-two costs are not a surprise.

The buying discipline mirrors any professional service: written scope, named deliverables, the CVs of who does the work, and references from your own sector.

“

Inspectors do not read policies first — they pull five customer files and check whether the policy happened. The gap between the binder and the files is where every fine lives.

Red flags in the UAE’s AML consulting market

• Template mills — policies with another firm’s name in the metadata, EWRAs that never mention your actual customers.
• Guaranteed outcomes — nobody can guarantee an inspection result; the claim itself signals unseriousness.
• No sector footprint — DPMS, real estate and CSP programmes differ materially; ask what the provider has built in your category.
• Registration-only offers — goAML registration without the programme behind it satisfies one obligation of ten.
• No answer to “who runs it in month four?” — the programme is a routine, and routines need named owners; a consultant with no ongoing model is handing you a binder and a wave.

Where Velmont Crest fits in

We approach AML from an unusual seat: as accountants, we are DNFBPs under the same regime we advise on, inspected against the same standards — our own programme is not theoretical. Our AML compliance services cover the build (EWRA, tailored policies, goAML registration, CDD workflows, training) and the run (file reviews, screening routines, renewal cycles, mock inspections) for real estate, precious metals, CSP and professional-services businesses across the UAE. Because the same team often keeps the client’s books, the AML programme sits on transaction data we already reconcile monthly — which is exactly where unusual patterns actually surface. If an inspection notice has arrived, or you would rather build before one does, start through the contact page — scoped quote within one UAE business day.