Designated non financial businesses and professions, or DNFBPs, include real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants and corporate service providers. Many are small, owner managed businesses with a handful of staff. Some handle large amounts of cash. Others create the companies and trusts that move money across borders. Few look anything like a bank.
That is the challenge. A compliance program built for a bank, with layers of policy, technology and specialist staff, will overwhelm a gold trader or a two partner law firm. A program that is too light will leave the business exposed to criminal misuse and to supervisory sanctions. The risk based approach is meant to resolve this by matching controls to the risks each business actually faces.
Where DNFBPs stand today
The FATF's Report on the State of Effectiveness and Compliance (April 2022) found that DNFBPs in more than 70 percent of assessed countries were poorly implementing risk mitigation measures, and that most had below average to poor understanding of their risks. Only 3 percent of DNFBP supervisors applied a risk based approach to a large extent, compared with 17 percent of financial supervisors. Only 42 percent of countries were rated compliant or largely compliant with Recommendation 28 on DNFBP supervision, against 68 percent for the equivalent standard for financial institutions. The report also observed that both financial institutions and DNFBPs "still apply a tick-box approach" to preventive measures.
Since then the standard has moved firmly toward proportionality. In February 2025 the FATF amended its Standards, including Recommendation 1, to replace "commensurate" with "proportionate", to require countries to allow and encourage simplified measures in lower risk scenarios, and to require supervisors to take account of the mitigation businesses already apply. That gives DNFBPs a clear basis to scale their controls, provided they can show the analysis behind them.
How supervisors are responding
United Arab Emirates. The Ministry of Economy and Tourism supervises dealers in precious metals and stones, real estate brokers, corporate service providers and auditors. In the first half of 2025 it recorded 1,063 violations and imposed fines of more than AED 42 million, including 473 violations by precious metals and gemstone traders and 495 by real estate brokerages. Its supervision "combines desk-based reviews with targeted field inspections", and the Ministry has said the penalties are intended to improve compliance, particularly in due diligence, risk assessment methodologies and suspicious transaction reporting. Those three areas are a useful guide to where any DNFBP should look first. The revised DNFBP guidelines issued in 2025, as the UAE also enacted a new AML law, make the risk based approach their foundation, with simplified checks for lower risk engagements and stronger scrutiny for higher risk ones, according to Crowe.
Qatar. DNFBPs are supervised mainly by the Ministry of Commerce and Industry and the Ministry of Justice. Qatar's 2023 mutual evaluation highlighted the need to enhance supervision of non financial sectors, including real estate and precious metals. It recommended that both ministries fully implement a risk based approach and increase outreach to improve DNFBP compliance.
Saudi Arabia. The Ministry of Commerce's AML/CFT guidelines, issued in 2017, apply to dealers in precious metals and stones, real estate offices and chartered accountants, and state that enhanced due diligence measures "should be effective and proportionate to the risks". In late 2025 the Ministry held workshops with precious metals and gemstone traders in Madinah and Jeddah on suspicious transaction reporting and targeted financial sanctions.
European Union. In July 2026 the new EU Anti-Money Laundering Authority consulted on a harmonized methodology for supervisors to assess risk in the non financial sector, covering firms such as legal practices and estate agencies. To limit costs, "smaller entities will have to report fewer data points than their more complex counterparts." The methodology is proposed to apply from 31 December 2028.
United Kingdom. HM Treasury confirmed in June 2026 that AML supervision of legal and accountancy service providers and trust and company service providers will move to the FCA, which will become the single supervisor for these sectors. According to Lewis Silkin, implementation will take several years, and the FCA's approach is to be "underpinned by proportionality and a risk-based methodology". Respondents raised concerns about the cost for smaller firms and sole practitioners.
United States. The scope of DNFBP obligations remains contested. FinCEN's residential real estate reporting rule, delayed to 1 March 2026, was vacated nationwide by a federal court in Texas on 19 March 2026, which found that it exceeded FinCEN's authority. The government may still appeal.
Africa. South Africa was removed from the FATF grey list in October 2025 after reforms that included an expanded definition of accountable institutions and new beneficial ownership duties for accountants acting as trust and company service providers. Nigeria was removed on the same day, 24 October 2025.
The common thread is that supervisors are applying more pressure to DNFBPs and, at the same time, accepting that small businesses cannot be held to bank standards. What they will not accept is a program that is light because no one has assessed the risk.
What a proportionate program looks like
In our view a proportionate DNFBP program rests on six elements.
- A business risk assessment that describes the real business. It should cover customers, geographies, products and services, and delivery channels, and it should be specific. A gold dealer should know what share of its sales are in cash and to whom. A real estate broker should know how often buyers pay through third parties or from abroad. A corporate service provider should know which structures it creates and for whom. A generic template copied from the internet will not survive inspection.
- Controls that scale with risk. Simplified due diligence for genuinely lower risk customers, standard measures for most, and enhanced due diligence where the risk is higher, such as complex ownership, politically exposed persons, unexplained wealth or large cash payments. The reasons for each level should be recorded.
- Some obligations that do not scale. Screening against targeted financial sanctions lists and reporting suspicious transactions apply regardless of the size of the business. These are the areas where supervisors focus first, and where small firms most often fall short.
- A compliance officer with real authority. In a small business this may be a partner or senior manager with other duties. What matters is that the person has time, training and the standing to refuse a transaction.
- Simple procedures and practical training. Staff need to know what to check, what to record and when to escalate. Short procedures with examples from the business's own sector are more effective than long policies no one reads.
- Records that tell the story. Customer files, the reasons for risk ratings, decisions on whether to report, and the results of an independent review. When a supervisor visits, these records are the evidence that the program works.
Proportionality is not a discount. A small firm handling high risk business may need stronger controls than a larger firm with a low risk client base. The risk assessment decides, not the size of the compliance budget.
Questions for owners and partners
- Does our business risk assessment describe how our business actually works, with our own figures?
- Can we explain why each customer received the level of due diligence they did?
- Are we screening every customer and transaction against current sanctions lists, and can we prove it?
- Does our compliance officer have the time and authority to stop a transaction?
- If a supervisor arrived tomorrow, would our records show a program that works in practice?
DNFBPs sit at the points where criminals convert cash into assets and hide ownership behind companies and trusts. Supervisors across the Gulf and beyond are raising their expectations, and the penalties for failure are growing. A program that is proportionate, documented and grounded in a genuine understanding of the business is the most effective and affordable way to meet them. Kompass helps DNFBPs design and evidence compliance programs that fit their size and their risks.