What the latest update means for accounting firms, corporate service providers, real estate businesses and precious-metal dealers in the UAE

For businesses operating in an increasingly international environment, compliance is no longer simply about knowing your client.

It is also about understanding where they operate, how their wealth is structured, where funds originate and how those funds move across borders.

On 14 September 2026, the UAE Ministry of Economy and Tourism issued Circular No. MOET AML/002/2026, introducing an updated country-risk watchlist for businesses subject to its anti-money laundering supervision.

Effective immediately, the circular replaces MOET AML/001/2026 and reflects the country classifications published by the Financial Action Task Force (FATF) on 19 June 2026.

For businesses operating in accounting, corporate services, real estate and precious metals, the update is more than a change to a list.

It is a reminder that effective AML compliance requires an active, documented and risk-based approach.

Who Is Affected?

The circular applies to Ministry-supervised Designated Non-Financial Businesses and Professions (DNFBPs), including:

• Accounting and audit firms;
• Corporate service providers;
• Real estate brokers and agents; and
• Dealers in precious metals and precious stones.

For these businesses, country risk forms an important part of the wider customer risk assessment.

The latest update means firms should review their existing country-risk classifications, identify affected customer relationships and determine whether additional controls are required.

Why Country Risk Matters

International business rarely operates within a single jurisdiction.

A client may live in one country, hold citizenship in another, own businesses across several markets, bank elsewhere and invest through international structures.

This complexity is entirely normal for globally active families and businesses.

From an AML perspective, however, it also means that risk cannot be assessed solely by looking at a passport or place of incorporation.

FATF evaluates jurisdictions according to the effectiveness of their frameworks for combating:

• Money laundering;
• Terrorist financing; and
• Proliferation financing.

The UAE’s updated watchlist incorporates the changes arising from FATF’s June 2026 review into the country’s compliance framework.

The Black List: The Highest Level of Scrutiny

The term “Black List” is commonly used to describe jurisdictions FATF classifies as high-risk jurisdictions subject to a call for action.

As of the June 2026 update, these are:

• Democratic People’s Republic of Korea – North Korea
• Iran
• Myanmar

Importantly, the required response is not identical across all three jurisdictions.

For North Korea, FATF calls for enhanced due diligence together with strong countermeasures, including restrictions on business and financial relationships.

For Iran, enhanced due diligence and effective countermeasures are required.

For Myanmar, enhanced due diligence proportionate to the risk currently applies. FATF may consider stronger measures if sufficient progress is not achieved by October 2026.

Looking Beyond Nationality

A connection to a high-risk jurisdiction can arise in many ways.

Businesses should consider not only nationality, but also:

• Residence;
• Place of incorporation;
• Beneficial ownership;
• Directors and authorized representatives;
• Business operations;
• Banking relationships;
• Source and destination of payments; and
• Intermediaries or other parties acting on the customer’s behalf.

Depending on the circumstances, enhanced controls may involve obtaining more information about the customer and beneficial owners, establishing source of funds and source of wealth, examining ownership structures and payment routes, increasing sanctions screening and transaction monitoring, and obtaining senior-management approval.

DNFBPs must also comply with applicable UAE and United Nations targeted financial sanctions requirements.

Where genuine suspicion arises, the matter should be escalated internally and, where required, reported to the UAE Financial Intelligence Unit through goAML.

A country connection alone, however, does not automatically make a transaction suspicious.

The assessment should always consider the complete facts, identified red flags and overall level of risk.

The Grey List: Increased Monitoring, Not Automatic Rejection

The Grey List covers jurisdictions with identified weaknesses in their AML frameworks that have committed to addressing them under FATF monitoring.

The June 2026 list contains 22 jurisdictions:

Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK) and Yemen.

The distinction here is important.

Grey List status does not mean that every individual, family or company connected to one of these jurisdictions should automatically be considered suspicious.

Nor does it create a general prohibition on doing business with that market.

The appropriate approach remains risk-based and proportionate.

What Changed in June 2026?

Two jurisdictions were newly added to the Grey List:

• Bosnia and Herzegovina
• Iraq

Businesses should therefore update their country-risk registers and identify existing customer relationships or transactions with relevant connections to these jurisdictions.

At the same time, two countries were removed:

• Algeria
• Namibia

Their removal reflects progress recognized by FATF in addressing previously identified AML deficiencies.

This does not mean that country risk disappears entirely. Rather, these jurisdictions should return to the business’s ordinary risk-assessment methodology instead of automatically receiving Grey List treatment.

FATF also determined that Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco had substantially completed their respective action plans.

They nevertheless remain on the Grey List pending FATF’s on-site assessments and formal confirmation of removal.

Until that happens, businesses should continue treating them accordingly.

What Does a Risk-Based Approach Look Like in Practice?

Consider a legitimate transaction involving a Grey List jurisdiction.

The country connection alone should not determine whether the transaction proceeds.

A business may be comfortable with the relationship where it has:

• Identified and verified the customer and beneficial owners;
• Established a clear commercial purpose;
• Reviewed appropriate contracts and invoices;
• Confirmed that payment originates from the customer’s own bank account;
• Determined that the transaction is consistent with the customer’s known activity; and
• Identified no sanctions concerns or other suspicious indicators.

The position becomes very different where ownership is unclear, funds arrive from unrelated third parties, payments move through multiple jurisdictions without a credible explanation, source of funds cannot be established or documentation is inconsistent.

The key principle is simple:

Country risk should inform the assessment. It should not replace it.

What Should UAE Businesses Do Now?

For affected DNFBPs, the immediate priority should be to ensure that internal AML frameworks reflect the latest classifications.

This includes:

1. Updating country-risk registers
Add Bosnia and Herzegovina and Iraq to the Grey List and remove Algeria and Namibia from automatic Grey List treatment.

2. Rescreening existing relationships
Review customers, beneficial owners, directors, authorized representatives and relevant counterparties against the updated country and sanctions lists.

3. Reviewing the full country connection
Consider nationality, residence, incorporation, operations, banking relationships, source of funds and payment destinations.

4. Reassessing customer risk ratings
Where relevant exposure is identified, determine whether the customer’s existing AML risk classification remains appropriate.

5. Strengthening due diligence where necessary
Apply enhanced due diligence to Black List relationships and proportionate additional measures to Grey List exposure based on the underlying risk.

6. Reviewing recent transactions
Pay particular attention to unexplained third-party payments, unusual payment routes, inconsistent documentation and activity that does not correspond with the customer’s known profile.

7. Updating AML policies and procedures
Ensure onboarding processes, customer risk-assessment methodologies and country-risk matrices reflect the latest classifications.

8. Documenting decisions
Maintain clear evidence of screening, supporting documentation, risk assessments, approvals and the rationale behind decisions.

9. Training relevant employees
Teams involved in onboarding, accounting, payments, compliance and client management should understand the updated classifications and escalation procedures.

10. Escalating genuine concerns
Potential suspicious activity should be referred promptly to the Compliance Officer or MLRO, with the appropriate goAML report submitted where required.

Compliance Must Be Demonstrable

One of the most important lessons from the UAE’s evolving regulatory environment is that having a compliance process is not enough.

Businesses must be able to demonstrate that the process was followed.

During a regulatory inspection, firms may need to show when screening took place, who was screened, which risks were identified, what documents were reviewed, how the customer was classified and why a relationship was accepted or continued.

Good compliance therefore depends not only on the decision itself, but also on the quality of the evidence supporting that decision.

What This Means for International Families and Businesses

For internationally active entrepreneurs, families and businesses, the update should not be interpreted as closing the UAE to legitimate cross-border activity.

Quite the opposite.

The UAE continues to serve as an important international business, investment and wealth-management centre.

But as its international role expands, so does the sophistication of its regulatory framework.

For clients with businesses, investments, banking relationships or family interests across several jurisdictions, this makes well-documented structures, transparent ownership, clear sources of wealth and funds, and credible commercial rationale increasingly important.

The objective is not to avoid international complexity.

It is to ensure that complexity can be properly understood, explained and documented.

Final Takeaway

The UAE’s updated AML country watchlist reinforces a broader direction in the country’s compliance environment: risk must be understood, managed and evidenced.

For businesses subject to the circular:

• Black List exposure requires enhanced due diligence, stronger monitoring, sanctions screening and applicable countermeasures.
• Grey List exposure requires reassessment and proportionate additional controls rather than automatic rejection.
• Suspicious activity should be escalated and reported through the appropriate channels where required.
• Countries removed from the Grey List should return to the organization’s normal risk-based assessment process.

Country classifications will continue to evolve.

For businesses serving internationally connected clients, maintaining current AML procedures is therefore not a one-time compliance exercise.

It is part of responsible, long-term business governance.

At Dawia Family Office, we work with internationally active families and entrepreneurs navigating the practical realities of establishing and managing their affairs in the UAE. As regulatory expectations continue to evolve, clear structures, robust documentation and coordinated professional advice remain essential to building arrangements designed for the long term.