Central Bank Reporting Obligations in the UAE: Who Must Report, What to File, Deadlines and Penalties (2027 Guide)

CBUAE Returns, Audited Statements and Auditor Duties, goAML Suspicious Transaction Reports, Sanctions Freeze Reports, Complaint Data, the New Central Bank and AML Laws, Penalty Ceilings and a Six-step Reporting Calendar

🚀 Introduction: Several Different Duties Share One Name

"Central Bank reporting obligations" is used for at least five different duties: periodic returns to the Central Bank of the UAE (CBUAE), audited financial statements and auditor reports, suspicious transaction reports to the Financial Intelligence Unit (FIU), sanctions freeze and name-match reports, and complaint data. Which ones apply to you depends on your licence, not on the size of your business, and mixing them up is how deadlines are missed.

Most ordinary trading and service companies have no CBUAE prudential reporting, because their regulators are the Federal Tax Authority, the Ministry of Economy and Tourism and their free zone. But banks, exchange houses, finance companies, insurers and payment providers do, and DNFBPs such as real estate agents, dealers in precious metals and stones, corporate service providers and, in some cases, accountants share one duty: they must report suspicious transactions to the FIU, an independent body within the CBUAE, through the goAML system. Two new laws since September and October 2025 have raised the stakes, with licensed institutions now facing administrative fines of up to AED 1 billion.

This guide maps each stream, gives the official schedules the CBUAE Rulebook publishes for exchange houses and banks, explains the goAML and sanctions rules, compares the penalty ceilings and ends with a six-step method for building a reporting calendar. For the accounting side, see our accounting & bookkeeping services and our checklist of documents needed for accounting services.

✅ Quick Answer: The Five Reporting Streams

🏛️ Who Has Central Bank Reporting Obligations

The CBUAE regulates licensed financial institutions (LFIs). Under the new Central Bank law this includes banks, finance companies, insurers, reinsurers, takaful operators, payment service providers, stored value facilities, open finance services, digital and virtual-asset payment operators and financial market infrastructure. Exchange houses and registered hawala providers are covered by their own CBUAE Rulebook sections.

⚖️ What Changed: The New Central Bank Law and AML Law

Two federal decree-laws now frame most reporting duties. The summaries below come from law-firm and consultancy commentary, not the statutes, so confirm each point against the official text.

📊 Stream 1: Prudential and Financial Returns

Licensed institutions send periodic returns to the CBUAE through its online reporting systems. The Rulebook publishes the full schedule for exchange houses, which is the clearest official example, and the CBUAE can change formats, add reports or discontinue them at any time.

Banks and other licence classes. Banks and other licence classes file returns under their own Rulebook sections and supervisor instructions, which we have not reproduced here. One audit-firm marketing page lists monthly liquidity reports and semi-annual ICAAP submissions for banks, but the official ICAAP notice sets an annual submission, so we use the official dates. Use the reporting calendar your supervisor issues, and treat provider lists as prompts for questions, not as a schedule.

🔍 Stream 2: Audited Financial Statements and Auditor Duties

For banks the Rulebook's financial reporting and external audit standards set out a clear annual sequence. The chart shows it for a 31 December year-end.

• Submission: audited statements with the external auditor's opinion go to the CBUAE at least three weeks before the general assembly and no more than three months after year-end (Article 2(7)).
• No-objection first: statements must not be presented to the general assembly or made public without the CBUAE's prior written no-objection (Article 2(9)).
• Publication: audited statements are published within four months of year-end (Article 2(10)).
• ICAAP: the internal capital adequacy assessment is annual, due 1 March for large banks, 31 March for other local banks plus HSBC, Standard Chartered, Citibank, Arab Bank and Bank of Baroda, and 15 April for other foreign banks (Notice 2940/2022).
• Approved auditors: the bank appoints a CBUAE-approved external auditor each year (Article 3(1)).
• Rotation: the audit firm rotates every six years with a three-year cooling-off period, and the engagement partner every three years.
• Auditor reporting duty: external auditors must promptly report violations of the Central Bank law to the CBUAE (Article 4(1)).
• Changes: banks must notify the CBUAE promptly of an auditor's resignation and obtain a no-objection for dismissal or change.

Exchange houses submit audited statements by 31 March, as the table above shows, and a calendar summary lists a May request for the CBUAE's no-objection to the external auditor. Our audit & assurance services team can help you prepare the books and working papers your approved auditor will need.

🛡️ Stream 3: Suspicious Transaction Reports Through goAML

Suspicion reporting is the stream that reaches the widest range of businesses, including many that have no other contact with the CBUAE. Reports go to the FIU through goAML, the UAE's electronic reporting platform.

Are accountants and auditors covered?

Commentary says independent accountants are DNFBPs when they handle listed client transactions, and that the Ministry of Economy and Tourism supervises them. One source notes that "auditor" does not appear in the article it reviewed, so sources are not fully aligned on auditors. Firms that handle client transactions or funds should assume they are covered and confirm their classification and supervisor with the Ministry of Economy and Tourism. Our VAT compliance audit services and the AML duties in this section are separate regimes, and a compliant VAT file does not satisfy goAML reporting.

🚫 Stream 4: Targeted Financial Sanctions Reports

Sanctions screening is a reporting duty as well as a control. When a customer or transaction matches a listed person, the institution must act first and report second.

• Freeze within 24 hours: on a confirmed match, freeze the funds without delay and within 24 hours, as the CBUAE Rulebook guidance and a consultancy summary describe it.
• Reports through goAML: a Fund Freeze Report (FFR) for a confirmed match and a Partial Name Match Report (PNMR) for a possible match, with supporting documents. Keep the suspension in place until goAML tells you to lift it or freeze.
• Reporting window differs by source: the CBUAE page for licensed institutions says five business days, the hawala guidance says two business days for an FFR, and another commentary says "promptly". Use the shortest window that applies to you.
• Subscribe to list changes: register with the Executive Office's notification system so you learn of listings and delistings in time to meet the 24-hour freeze.
• Keep screening evidence: record how you confirmed or ruled out each match, so you can show the supervisor what you did and when.
• Penalties: a commentary reports one to seven years' imprisonment and fines of AED 50,000 to AED 5 million for breaches of the sanctions framework, plus administrative penalties from supervisors.

📞 Stream 5: Consumer Complaints and Conduct Reporting

Consumer protection reporting is the least visible stream and the easiest to neglect. A 2026 regulatory calendar for exchange houses lists several recurring tasks.

• Monthly complaint data uploaded to the CBUAE complaint system, per a 2026 exchange house calendar.
• Semi-annual MLRO reports, and an annual consumer protection and conduct risk report.
• Annual fraud incident consolidation, listed with a 31 January date.
• Unified complaints route: under the new law, the Sanadak process makes rulings on disputes up to AED 100,000 final.
• Marketing rules: the Telemarketing Regulation (C3/2026) took effect on 31 March 2026 and tightens how financial products are marketed to customers.

That calendar summary is for exchange houses and does not give exact due dates for most items, so other licence classes should take their own requirements from the Rulebook and their supervisor.

💥 Penalties for Missed or Wrong Reporting

The Central Bank law raised the ceiling for licensed institutions sharply, and the AML law set fines and criminal penalties for reporting failures. The chart compares the ceilings on a logarithmic scale, because they span more than five orders of magnitude.

🗓️ Building Your Reporting Calendar

A reporting calendar turns scattered rules into dated tasks with an owner. Build it from three sources: the CBUAE Rulebook for your licence class, your licence conditions, and notices from your supervisor.

• Give every report a named owner and a named backup, so a holiday does not cause a late filing.
• Set internal deadlines several days before the regulatory date, to leave time for review.
• Keep a submission log with confirmation receipts for each filing.
• Review the calendar whenever the CBUAE issues a notice, because it can change formats and add or remove reports.

🧾 Where Accounting, Audit and Tax Fit In

Most regulatory returns are only as good as the books behind them. A clean monthly close, bank reconciliations and a fixed asset and loan register make the returns faster to produce and easier to defend.

• One set of numbers: the figures in your CBUAE returns, VAT returns and Corporate Tax return should reconcile to the same ledger. Our VAT compliance audit services and Corporate Tax compliance audit guide show how reviewers test this.
• Evidence: keep source documents for the AML retention period of at least five years, and for the seven-year Corporate Tax period where it applies. See our list of documents needed for accounting services.
• Audit readiness: approved auditors need clean working papers and timely access to staff, and the audited statements feed several of the filings above.
• Cost: smaller licensees often ask whether proper support is affordable. Our guide on professional accounting affordability for small businesses sets out reported price ranges and ways to keep fees down.
• Roles: if the difference between recording and reporting is unclear in your team, read our guide on the difference between accounting and bookkeeping.

🔎 Buying or Setting Up a Regulated Business: Reporting Checks

Reporting history is a due diligence item whenever a licensed or DNFBP business changes hands, and a design question whenever a new one is set up.

Our financial due diligence services in Dubai cover the financial side of this review, and our business setup team can help you decide the right licence and structure before you start.

⚠️ Common Mistakes to Avoid

• Assuming CBUAE reporting applies only to banks, when exchange houses, finance companies and payment providers have their own schedules.
• Treating goAML as a licensed-institution duty only, when DNFBPs must also register and report.
• Waiting for proof before filing an STR, when the test is suspicion.
• Telling a customer that a report has been filed, which is tipping off.
• Not subscribing to sanctions list notifications, then missing the 24-hour freeze.
• Filing returns from spreadsheets that do not reconcile to the ledger.
• Presenting audited statements to shareholders before the CBUAE's written no-objection.
• Relying on an old calendar after the CBUAE changed formats or added reports.

🪜 6 Steps to Build a Central Bank Reporting Framework

1. Confirm your licence class and regulator

   Identify whether you are a bank, exchange house, finance company, insurer, payment provider, DNFBP or other covered person, and who supervises you.

2. List every report you owe

   Build the list from the CBUAE Rulebook, your licence conditions, supervisor notices and the AML and sanctions rules.

3. Register for the systems

   Make sure you have access to the CBUAE reporting portals, goAML and the Executive Office's sanctions notification system.

4. Build the calendar with owners

   Turn each report into a dated task with an owner, a backup and an internal deadline ahead of the regulatory date.

5. Align books and data

   Run a monthly close, reconcile returns to the ledger and keep source documents for the required retention periods.

6. Test, log and review

   Dry-run key filings, keep a submission log and review the calendar every time a notice, regulation or law changes.

💼 How One Desk Solution Can Help

Regulatory reporting stays with your compliance officer and approved auditor, and we support the accounting, tax and audit-readiness side around it. Our accounting & bookkeeping services team provides the monthly close and reconciliations your returns depend on. Our tax services team keeps VAT and Corporate Tax filings consistent with your books, and our audit & assurance services team prepares working papers and reviews controls. Our advisory & consultancy services team helps you design a reporting calendar and policies, and our business setup team helps you choose the right licence. Browse everything on our services page.

❓ Frequently Asked Questions

🔗 Related Resources