AML and KYC software for UAE real estate brokers: what to buy and what a spreadsheet can do

Do you actually have to buy AML software as a Dubai brokerage?

Short version: no source I read says so. Real estate agents and brokers are DNFBPs when they conclude purchase or sale operations for customers. The Ministry of Economy and Tourism supervises them on the mainland and in commercial free zones under Federal Decree-Law 10 of 2025 and Cabinet Resolution 134 of 2025. Brokers inside financial free zones such as ADGM or DIFC answer to different supervisors, so confirm which applies to you.

What the Ministry's own 2026 guidance does say is useful. It lists, as good sector practice, a structured onboarding framework, technology-enabled solutions for screening, document management and record retention, clear escalation to the compliance officer, and periodic file testing. It adds that even smaller entities can benefit from scalable digital tools. That is encouragement, not a purchase order. For a yearly rhythm of these checks, see the annual AML review and compliance calendar. Several vendor pages (the ones selling AML platforms) imply software is mandatory. It is not, so discount that line.

One more thing before the options: software does not transfer the duty. The guidance says the compliance officer keeps responsibility for oversight even when screening is delegated to a tool or consultant. A tool that says "no match" has not made you compliant. It has given you one piece of evidence that a named person must review.

What the Ministry of Economy expects a broker to be able to show

Think of an inspection as a request: "show me the file for this deal." From the Ministry's supplemental guidance for real estate agents and brokers and its DNFBP Guidelines (March 2026), a good file shows:

• The customer's identity, and for a company the beneficial owners (the real people who own or control 25 percent or more, with lower stakes considered where control works another way).
• The source of funds, and source of wealth for higher-risk clients.
• Sanctions and politically exposed person (PEP) screening, with a dated result, before the relationship starts or a transaction is executed.
• A risk rating, and the reasoning for applying simplified, standard or enhanced due diligence.
• Approval by the right person, and for PEPs, senior management.
• Registration on goAML (the UAE Financial Intelligence Unit's online reporting system), kept active, with the compliance officer as the registered user.
• Records kept for at least five years, counted from the latest of the end of the relationship, the completed transaction, an inspection, an investigation or a final court judgment. Under the UAE anti-money-laundering rules this covers customer due diligence and transaction records, including business correspondence and customer communications. This comes from the federal AML framework (Cabinet Resolution 134 of 2025, Art. 25, and MoET's DNFBP Guidelines, section 11), not from a chat rule set by the Dubai Land Department (DLD, the emirate's property registry) or RERA (its Real Estate Regulatory Agency). Neither the law nor the guidance names WhatsApp, so client messages tied to a customer or deal are likely to count as business correspondence, which is an interpretation. Confirm with the relevant authority or a lawyer.

The business relationship starts when you sign a listing agreement, receive instructions or receive fees. That means the seller needs onboarding too, not only the buyer. The process side of this is covered in a step-by-step KYC onboarding workflow for a Dubai brokerage. This article is about the tool decision.

The three jobs: identify and verify, screen, keep proof

Every vendor brochure bundles these. Pull them apart and the buying question gets easier, because only some need software.

1. Identify and verify. Collect the ID, the company papers, the owner details and the source-of-funds evidence, and check them against the originals. This is mostly a form and a checklist. Software helps with consistency, not with judgment.
2. Screen. Check names against sanctions lists, PEP lists and adverse news. The Ministry says you need an internal system to tell whether a customer or beneficial owner is a PEP, and that it may be an automated screening tool against PEP databases, manual internet and database checks, or both. This is the job where a tool saves real time.
3. Keep proof. Store the documents, the screening result with its date, the approval and the filing receipts so you can produce them quickly. This is a storage and access problem. A well-organised shared space does it. A chat history does not.

The Ministry's guidance names the failure modes that tools should fix: fragmented information, reliance on informal communication channels, manual record-keeping gaps and commercial pressure that rushes deals past the checks. Notice that three of those four are habit problems. Buying a platform without fixing the habit just gives you an expensive place to forget things.

Option 1: a structured onboarding form plus CRM fields and stage gates

The cheapest defensible setup. One form per client type collects the same fields every time. The answers land in CRM fields. A stage gate stops a deal moving forward until a named person approves: no Contract B or Contract F created until onboarding shows "approved". Contracts A, B and F are the smart contracts that DLD expects brokers to use for listing, buyer and sale agreements.

It costs little and suits a brokerage that opens a few files a month. Its weakness is that it relies on people typing results in correctly. For my advisory view on size: under a few deals a month, this plus manual list checks is defensible. That is my opinion, not a regulation.

Option 2: add a screening tool or API

A screening API is a service your system calls with a name and gets back possible matches. The only vendor whose pricing page I could read directly was OpenSanctions, an open database of sanctions, PEP and watchlist data that also sells paid access. These are vendor figures, in euros, excluding VAT, checked on 2 November 2026:

Credit bundle	Price	Per check
500 credits	EUR 50	EUR 0.10
5,000 credits	EUR 400	EUR 0.08
30,000 credits	EUR 2,000	about EUR 0.07
500,000 credits	EUR 15,000	EUR 0.03

Credits last a year, and new business-email sign-ups get 2,000 free credits. The data is licensed for non-commercial use, so a brokerage using it commercially needs a separate screening licence, and its terms and price are not on that page. Ask before you plan around the per-check figure.

A made-up example for scale. A brokerage opens 20 deals a month, two parties each, plus owners behind any company buyers. That is roughly 60 checks a month. At the EUR 0.10 list price that is about EUR 6 a month in credits, against a sales call and an annual contract for enterprise tools. Your own count will differ. The point is that matching is cheap and the expensive part is a person reading the results.

The large commercial screening services, such as Refinitiv World-Check, Dow Jones, LexisNexis Bridger, ComplyAdvantage and Moody's Grid, are each a paid database and matching engine, and pricing is quoted on enquiry. One advisory firm's comparison reports some figures, but they are unverified and a single source, so get quotes yourself.

Option 3: an all-in AML platform

These bundle digital onboarding, owner mapping, sanctions and PEP checks, risk scoring, case management, goAML support, audit trails and dashboards. Citadel365, for example, sells AML software for UAE brokers and lists those features on its blog. That list is what the vendor says, not tested by me.

A platform is worth the contract when several agents each open files, you have repeat high-risk clients, and an owner cannot personally review every file. It is poor value when you open a handful of files a month and the main problem is that agents collect documents on chat. Check what it exports, because you must be able to get your records out for a minimum of five years, including if you leave the vendor.

Option 4: a custom onboarding workflow built around your own deal process

This ties the form, the secure document upload, the screening call, the risk score, the compliance officer's approval and the CRM stage gate into one flow that matches how your agents already work. It makes sense for a brokerage with a distinct process (off-plan launches, overseas buyers, several branches) where a ready-made tool needs workarounds. It costs more to start and is the most flexible. If this is where you land, I build this kind of thing, and it should still be priced against the first three options.

How software and AI help with AML checks, and where the compliance officer must stay in charge

Concrete tasks where software or AI genuinely helps a small brokerage:

• Reading documents. AI can read a passport, Emirates ID or trade licence and pull name, number and expiry into CRM fields, and flag an expired document or a name that does not match the contract. A person still checks it against the original.
• Re-screening. Sanctions lists change. A scheduled job can re-check existing clients and flag changes. A person decides what a new match means.
• Chasing. Automated reminders when an onboarding file is incomplete, and a block on moving the deal until it is.
• Summarising. A first-draft summary of a file for the compliance officer, with the missing items listed.

What stays human: deciding the risk rating, deciding whether something is suspicious, filing reports and avoiding tipping off the client. I would not buy a product that promises predictive risk scoring as a substitute for those decisions.

Try it yourself with Claude (an AI assistant). Take a made-up or fully redacted onboarding file (never real passport images, see whether it is safe to upload client documents to an AI tool). Paste in your checklist and the file's field values, and ask: "List every item on this checklist that is missing, expired or inconsistent, and give each a one-line reason. Do not rate the risk." You get a gap list. The risk decision stays with your compliance officer.

Arabic names, false positives and how to test a tool before you pay

Arabic names are written in Latin letters in many ways (Mohammed, Muhammad, Mohamed). A matching engine that handles transliteration poorly produces noisy results. One consultancy claims Arabic names cause high false-positive rates, but that claim is unsourced, so treat it as a caution to test rather than a fact. OpenSanctions says matching on secondary identifiers such as date of birth, nationality and ID number reduces false positives. The practical test:

1. Take 20 real client names from your own past files, with spelling variants, and screen them in a trial.
2. Count how many results you must clear by hand. If it is most of them, the tool is a poor fit for your client base.
3. Check whether you can enter date of birth and nationality, and whether the result is saved with a timestamp.

A buyer checklist: questions to ask any vendor

• Which lists and data sources are covered, and how often are they updated?
• How does it handle Arabic names and transliteration? Can I trial it with my own names?
• Does it re-screen existing clients automatically and tell me?
• Is every check saved with a date, a user name and the list version, and can I export it?
• Where is the data stored, and what happens to it if I cancel?
• Can it support goAML reporting files, or does it only help me prepare the data?
• What does it cost for 20, 100 and 500 checks a month, and is there a minimum term?
• Who can see what? Can agents see a client's screening result, or only the compliance officer?

The test that matters is the inspection test: can you produce a named deal file (ID, owners, source of funds, screening result with date, approval, REAR status) in minutes? REAR is the Real Estate Activity Report, covered in tracking REAR and cash payments across a deal.

What to buy at 1 agent, 5 agents and 20 agents

This is my view, not a rule:

• 1 to 2 agents. Option 1 plus a pay-per-check screening tool or careful manual checks. Spend your effort on habit and a dated record.
• About 5 agents. Option 1 with strict stage gates and a screening tool called from the form. The risk now is different agents doing it differently.
• 20 agents. Option 3 or 4. At this size the owner cannot review every file, and you need role-based access, escalation and reporting. Pair it with a tested document store, see secure document storage for a UAE brokerage.

What it costs to get it wrong

The published schedule under Cabinet Resolution 71 of 2024 lists administrative fines for the businesses MoET supervises, including brokers. From the official annex: failing to keep records or make them available, AED 50,000 to 200,000; failing to register on the Financial Intelligence Unit's goAML system, AED 50,000 to 200,000; failing to report suspicious transactions promptly or to give the Unit information it requests, AED 100,000 to 500,000. The Ministry may double a fine on repeat. A caution: newer instruments (Federal Decree-Law 10 of 2025 and Cabinet Resolution 134 of 2025) replaced the laws that Resolution 71 cites, and I could not confirm whether the schedule still operates unchanged. Confirm the current schedule with the Ministry of Economy.

Mistakes brokers make

• Collecting documents on WhatsApp and never filing them in the CRM.
• No dated screening evidence. A screenshot without a date, or a "checked" tick with no result, proves little.
• Nobody owns goAML. The compliance officer registers, and the account has to stay active.
• Relying on a developer's or bank's KYC without a documented assessment. Under the guidance you stay responsible and must be able to get those documents without delay.
• Believing the loose claims. You will read that REAR applies to "offshore buyers" or that "DLD requires REAR". Neither is in the Ministry's circular.

How I'd approach this

Fix the habit first: one onboarding form, one place for documents, one named person who approves. Run that for a month. Then see where it hurts. If screening is eating hours, add a pay-per-check tool. If agents keep skipping steps, add stage gates in your CRM (see CRM basics for real estate). Only talk to platform vendors once you can say what you need them to do. Confirm current rules with the Ministry of Economy and the FIU, and treat this article as a starting point, not legal advice.