Compliance training for a regulated business in the UAE

Start from the task, not the topic

Compliance training is often organised by topic: an hour on money laundering, an hour on data protection. The published rules are written around duties and tasks, and each task has an owner. A person who identifies customers has a different job from one who publishes advertisements, and a person who handles identity documents has different exposure again. A course built around the topic tends to be the same for everyone. A course built around the task can be shorter for each person and closer to their work.

This guide describes three regimes that a Dubai real estate brokerage meets, using the sources read for it, and then turns to how training can be put together. It is general information. Whether a particular business is covered by a rule, and what that rule requires of it, is a question for the relevant authority or a qualified adviser. Nothing here says that any training makes a business compliant.

Anti-money-laundering: what the current texts describe

The current anti-money-laundering law is Federal Decree-Law No. 10 of 2025, in force from 14 October 2025, with Cabinet Resolution No. 134 of 2025 as its executive regulation, in force from 14 December 2025. They replaced Federal Decree-Law No. 20 of 2018. A law-firm analysis of the 2025 executive regulations is among the sources describing the new framework.^[1] Many articles and guidance pages still cite the 2018 law, which is a reason to check the date of any training material before it is reused.^[2]

The Central Bank rulebook guidance on real estate professionals says that agents and brokers qualify as designated non-financial businesses and professions when they conclude operations for customers relating to the purchase and sale of real estate, and that they must then apply preventive measures including risk assessment, customer due diligence and suspicious transaction reporting.^[2] The Ministry of Economy and Tourism publishes a page on whether a company falls under the designation.^[3] The Ministry also publishes guidance on registering on goAML, the Financial Intelligence Unit's reporting platform, and warns that failure to register may bring severe penalties without stating amounts.^[4]

The sources describe the framework in terms of tasks that can be separated by role: assessing risk, identifying the customer and, for companies, the people behind them, reporting suspicious transactions, keeping records, and screening customers against sanctions lists. Secondary sources report a named compliance officer, reporting without a minimum value threshold and a five-year record period under the 2025 framework, and these should be read against the current texts before they are taught as rules.^[1] The extracts read for this guide do not say that the law requires a particular training course, so any claim about a mandatory course needs its own source.

Data protection: consent, rights and what is still open

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the UAE's general data protection law. Its English text states that processing personal data without the consent of its owner is prohibited, with listed exceptions, and sets rules on consent that can be proved and withdrawn, on limiting processing to what is necessary, on security, on notifying breaches and on individual rights to information, correction and erasure.^[5] Each of these becomes a task: recording when and how a person agreed, limiting who can open identity documents, routing a request about someone's data to the person who answers it, and reporting a suspected breach inside the firm.

Some of the detail is open. A practice guide from Chambers and Partners dated 10 March 2026 states that the executive regulations, which were to settle breach-notification deadlines, processor procedures and penalties, had not yet been issued.^[6] Some commercial pages say otherwise, and a training programme that quotes a deadline or a penalty should name the instrument it comes from. The federal law also excludes companies in free zones that have their own data protection legislation, such as the DIFC and ADGM, so which law applies depends on where an organisation is established.^[5]

Permits and registrations: the paperwork of the job

The Real Estate Regulatory Agency's Brokerage Practice Guide, second edition, November 2024, states that advertisements need a permit obtained through the Trakheesi system and that the permit number must appear on the advertisement. It also requires brokers to use the Dubai REST app and lists ethical duties, among them maintaining privacy and preserving documents.^[7] The card service page for brokers lists a pass in the annual test for the mediation profession among its terms, and renewal is handled through the same systems.^[8]

These are checkable tasks. A listing either carries a permit number or does not. A card either has a renewal date in a register or does not. Training for tasks like these can be tested with a realistic case, such as a draft advertisement with an item missing, and it can be backed by a simple register, because a lapse is usually a missing date and not a missing lesson.

Turning tasks into training

The research on how people retain material suggests several design choices. Questions that ask the person to recall the step, not recognise it from a list, and repetition spread over time, are better supported than a single briefing. The guide on training that sticks sets the studies out, and notes that they come mostly from students and not from workplace trials.^[9]

For compliance topics, a practical outline might separate three kinds of content. Rules that change, such as a new law or a new fee, need dated material and a way to retire the old version. Procedures that are used often are learned by use and benefit from a short recall question after a gap. Judgement calls, such as whether a transaction is unusual, are better taught with worked cases and feedback from someone experienced, because the answer is not a lookup. This division is a design suggestion and not a finding of the sources.

Assessing and recording

The quality-assurance sources used by training providers give some vocabulary. A test is useful only if it reflects what was taught (validity) and gives stable results (reliability), and the pass mark is a decision that should be justified and recorded, not assumed.^[10] The Quality Matters rubric treats meeting expectations at or above 85 percent as its threshold for certifying course quality, which concerns the quality of a course and is not a pass mark for learners.^[11] The CDC publishes a checklist for quality e-learning that a reviewer can use before a module goes live.^[12]

For records, the distinction between a certificate and a licence matters. In Dubai, a training certificate is defined as a document certifying that a learner completed or took part in a programme, and Dubai Land Department says its own training has no exam at the end, with broker exams held separately.^[13][14] A record of completion is useful evidence that someone was trained on a stated date, on a stated version of the material. It is not evidence that the person is licensed, that the rule was applied correctly, or that the business complies. The Works LMS, which we make, issues a certificate of completion with a reference and a link anyone can use to check it, and the certificate is not a licence. A spreadsheet of dates and signatures also serves a small team.

What the sources leave open

Several things could not be settled from the sources read. The extracts do not state whether any training course is mandatory under the anti-money-laundering or data protection laws. The detailed content of customer due diligence for a property transaction was not found. The executive regulations for the data protection law were reported as not issued in the March 2026 guide. Rules and fees are the authorities' to change. A business that wants to know what its staff must be taught should ask the authority that supervises it and keep a dated note of the answer.

Questions