UAE AML compliance: who signs, what fails, and the 2026 deadline

Free 5-minute check · UAEDirector's Risk Check for UAE portfoliosYour control score, the statutory deadlines at risk for your emirate, and a board-ready briefing. No sign-up to see your score.Run the 5-minute check →

Your name is on the duty-holder paperwork for a shopping centre in Dubai, and the person who actually holds the records sits two thousand miles away. When a regulator asks for the audit trail, the answer has to come from you, not from the facilities team on site. That is the gap most London and Singapore owners have not closed.

How can businesses ensure compliance with AML regulations in the UAE? The short answer is that the obligation sits with the licensed entity, not the building. The longer answer is that the evidence sits in the building, and the two are rarely in the same place.

The duty sits with the owner, not the operator

In the UAE, anti-money laundering obligations attach to the licensed entity. For a shopping centre, that means the owner or the entity holding the trade licence, not the facilities management contractor who runs the plant. The UAE Ministry of Economy and Tourism sets out the company registration framework that determines who that licensed entity is, and the answer is not always obvious when a portfolio is held through a branch, a free zone company or a foreign shareholder structure.

This matters because the regulator does not chase the facilities manager. It chases the licence holder. If your name is on the board resolution that appointed the local representative, the breach lands on your desk.

The practical check is simple: for each Gulf asset, can you name the licensed entity, the person who holds the AML records, and the date those records were last reviewed? If any of those three answers requires an email to Dubai, you have a gap.

Free 5-minute check · UAEDirector's Risk Check for UAE portfoliosYour control score, the statutory deadlines at risk for your emirate, and a board-ready briefing. No sign-up to see your score.Run the 5-minute check →

What the inspector actually asks for in a retail asset

An AML inspection of a shopping centre is not a review of the plant room. It is a review of the tenancy file. The inspector wants to see the customer due diligence records for each tenant, the source of funds documentation for any cash-intensive business, and the audit trail showing when those records were checked and by whom.

In a retail asset, the weak points are predictable. A kiosk operator who pays in cash. A short-term pop-up whose lease was signed by a centre manager rather than the owner. A tenant whose trade licence expired six months ago and nobody noticed because the rent kept arriving. Each of those is a finding, and each finding traces back to the licensed entity.

The Dubai Land Department company registration service shows how the ownership chain is recorded for real estate transactions, and that chain is what the inspector follows. If the company registration reference number cannot be produced, the tenancy file is incomplete before the inspector even opens it.

What this means for you: the AML file is not a document the facilities team can own. It is a legal record that requires the licensed entity to sign off. Your job is to make sure someone on site knows where it is and who signs it.

Oversight from London or Singapore: the three failures I see

The first failure is treating AML as a head office function. The compliance team in London or Singapore produces a group policy, the local team files it, and nobody checks whether the tenancy files actually match the policy. The policy is not the evidence.

The second failure is relying on the operator. A facilities management contractor can maintain the building, but it cannot hold the AML records because it is not the licensed entity. When the operator leaves, the records leave with them.

The third failure is the reporting line. The person who holds the AML records in Dubai often reports to a regional manager who reports to you. By the time the question reaches your desk, the answer has passed through three people and lost its precision.

The fix is not a new system. It is a named person, a fixed review date, and a single folder that the licensed entity can produce on demand. The Dubai Municipality integrated facilities management model, which covers around 2,000 buildings and more than 246,000 assets, shows the direction of travel: consolidated records, real-time dashboards, one system. That model is for public assets, but the principle applies to your retail portfolio. If the records are decentralised, the inspection finds the gap.

For a deeper look at how predictive maintenance data can support this kind of oversight, the gap between software promises and actual cost cuts is worth reading before you buy another dashboard.

The deadline that bites: 28 January 2026

The Dubai Municipality integrated facilities management model was adopted on 28 January 2026. It is not an AML regulation, but it signals how the emirate is consolidating asset records. The operational efficiency gain of over 15 per cent compared to the previous decentralised model comes from having one system, not many.

For an owner in London or Singapore, the lesson is that the regulator's expectation of a consolidated record is rising. If your AML file for a Dubai shopping centre is a spreadsheet held by a contractor, it will not meet the standard that the integrated model represents.

The penalty for an AML breach in the UAE is not a fixed fine you can budget for. It is a regulatory action against the licensed entity, which can include suspension of the trade licence. For a shopping centre, that means the asset stops trading. That is the consequence that reaches the board.

Your 60-second self-check

• Can you name the licensed entity for each Gulf retail asset, and the person who holds the AML records today?
• Could you produce the customer due diligence file for the last three tenancies signed, without emailing Dubai?
• Does the person who holds those records report to you through a line you can trace in one step?

If you want to know where your portfolio stands, send the free 5-minute Director's Risk Check to the colleague who holds the records. It gives a control score for the portfolio, the breach exposure with official sources attached, and a board-ready briefing. The briefing comes back to you, which is the point.

Herman's verdict

The AML file is not a compliance artefact. It is the tenancy record, and the tenancy record is the asset. If you cannot produce it from London or Singapore without a chase, you do not have oversight. You have a phone number.

— Herman