AML history and legal framework in the UAE: which laws apply in 2026?
In the first half of 2025 the Ministry of Economy and Tourism (MoET) found 1,063 violations at designated non financial businesses and professions (DNFBPs) and fined them more than AED 42 million, as it reported on 24 July 2025. Within months the texts those inspectors enforced were repealed. The United Arab Emirates now works under two 2025 instruments.
UAE anti money laundering law previously rested on Federal Decree by Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019.
The FATF put the UAE under increased monitoring in 2022 and removed it on 23 February 2024, so the country no longer sits on the FATF's high risk and monitored country lists. FinCEN's note on the October 2026 plenary lists four removals and does not mention the UAE. Older guides call the reporting unit AMLSCU and the coordinating committee NAMLC; the 2025 law speaks of the Financial Intelligence Unit and the National Committee.
Federal Decree by Law No. 10 of 2025 on anti money laundering, combating the financing of terrorism (CFT, written CTF in some guides) and proliferation financing was issued on 30 September 2025 and took effect two weeks after its publication in the Official Gazette (art. 42). It repealed the 2018 law (art. 41(1)). Its executive regulations, Cabinet Resolution No. 134 of 2025, were issued on 29 October 2025, published in Official Gazette 811 on 14 November 2025 and took effect 30 days later (art. 71), repealing Cabinet Decision No. 10 of 2019 (art. 70).
Regulations, resolutions and circulars issued under the 2018 law and in force when the new law was issued stay effective where they do not conflict with it, until replacements are issued (art. 41(3)). The law states that money laundering is a crime in its own right, and no conviction for the predicate offense is needed (art. 2(2), (3)). Federal Law No. 7 of 2014 on terrorist crimes is left untouched (art. 37(3)). Below, "art." means the 2025 law and "CR 134" the Resolution.
Who regulates AML in the UAE? The role of government agencies
| Body | Who or what it covers (as of November 2026) | AML role |
|---|---|---|
| Central Bank of the UAE (CBUAE) | Banks, exchange houses, finance companies, stored value facilities, retail payment and card schemes, payment token service providers, registered hawala providers, insurers (CBUAE AML/CFT supervision page) | Supervisor through its AML/CFT Supervision Department; publishes its sanctions on licensed firms |
| Capital Market Authority (CMA), formerly the Securities and Commodities Authority (SCA) | Securities and commodities market firms; virtual asset activities under its Virtual Assets Framework of 13 April 2026 | Federal capital market regulator; the framework carries its own AML/CFT module |
| Ministry of Economy and Tourism (MoET) | Dealers in precious metals and stones, real estate brokers, corporate service providers, auditors (its four DNFBP categories, July 2025) | DNFBP supervisor; desk based reviews and field inspections |
| Ministry of Justice | Lawyers, notaries and other legal professionals (Ministerial Decision No. 533 of 2019) | Supervisor through the AML department it set up by Ministerial Decision No. 532 of 2019 |
| Virtual Assets Regulatory Authority (VARA) | Virtual assets across Dubai's mainland and free zones, except the DIFC | Licenses and supervises |
| Dubai Financial Services Authority (DFSA) | Firms in the Dubai International Financial Centre (DIFC) | Supervisor under its own AML module |
| Financial Services Regulatory Authority (FSRA) | Relevant Persons in Abu Dhabi Global Market (ADGM) | Supervisor under the ADGM AML Rulebook |
| Financial Intelligence Unit (FIU) | Every financial institution, DNFBP and VASP | Sole recipient of STRs; independent unit within the Central Bank (art. 11) |
| Executive Office | Any person in the UAE (art. 33) | The law's office for targeted financial sanctions; firms apply its instructions forthwith (arts. 1, 19(1)(e)) |
| National Committee | Chaired by the CBUAE Governor (art. 13) | National strategy, national risk assessment, high risk countries (art. 14) |
| Higher Committee | Affiliated with the Presidential Court | Oversees the National Committee and the mutual evaluation (art. 12) |
The license decides the supervisor: a bank answers to the CBUAE, a gold dealer to MoET, a DIFC firm to the DFSA. Reports never go to the supervisor. The FIU receives every STR, exclusively, and passes its analysis to the authorities concerned (art. 11). The CBUAE tells reporting entities to connect to the FIU's goAML platform to file STRs, SARs and other report types.
Supervisors assess risk in the sectors they oversee, inspect desk based or on site and keep statistics on the penalties they impose (art. 16). They also keep a list of compliance officers and approve each one before appointment (CR 134 art. 49(18)). Every regulated activity needs a license, registration or enrollment (art. 20), and running one without it carries prison and a fine of AED 200,000 to AED 10 million, or either (art. 32).
Who must comply with AML rules in the UAE?
Three groups carry the duties: financial institutions, DNFBPs and virtual asset service providers (VASPs) (art. 19(1)). Financial institutions run a listed financial activity as a business, from deposits and lending to money transfer and currency exchange (CR 134 art. 2). VASPs exchange, transfer or hold virtual assets, among the activities CR 134 art. 4 lists.
DNFBPs are commercial gaming operators from AED 11,000, real estate brokers and agents, dealers in precious metals and stones on cash from AED 55,000, lawyers, notaries, other independent legal professionals and independent accountants for named transactions, and company and trust service providers (CR 134 art. 3). Real estate brokers have no amount line: every purchase or sale they conclude for a customer is covered (CR 134 art. 3(2)).
Picture a Dubai gold trader selling a bracelet for AED 60,000 in cash. The sale crosses the CR 134 art. 3(3) line, so full CDD applies. Paid by bank transfer, the sale falls outside that cash line.
What does the ADGM AML Rule Book require in Abu Dhabi, and how do DIFC and VARA rules differ?
Abu Dhabi Global Market is Abu Dhabi's financial free zone, and its FSRA writes the AML rule book every Relevant Person there follows. The current version, VER11.210526, carries the amendments of 21 May 2026.
The general compliance requirements start with policy: controls that detect and report suspicious transactions, keep an audit trail and carry senior management approval (Rule 4.1.1(2)). To stay compliant in Abu Dhabi, a firm reviews them at least annually through internal audit, its compliance function, or independent auditors or compliance professionals (Rule 4.1.1(4), (5)), trains all employees at least annually (Rule 13.2.1) and appoints an MLRO resident in the UAE, with a deputy unless it is a representative office (Rules 12.1.1(2), 12.1.4).
Older guides said the MLRO must be a UAE citizen. The rulebook says resident, and its guidance lets the FSRA waive residence for a limited period.
The same rulebook says UAE criminal law applies in ADGM and asks for compliance with "Federal AML Legislation" (Rule 4.1.1(2)(a)). What changes is the supervisor and the detail. The DFSA writes AML rules for DIFC firms in its AML module, and VARA regulates virtual assets in Dubai outside the DIFC.
| Rule (in force, November 2026) | Onshore (2025 law and CR 134) | ADGM (FSRA AML Rulebook, VER11.210526) |
|---|---|---|
| Supervisor | CBUAE, CMA, MoET or Ministry of Justice by sector; VARA for virtual assets in Dubai outside the DIFC | FSRA |
| CDD on an occasional transaction | From AED 55,000 at a financial institution (CR 134 art. 7(2)(a)) | From USD 15,000 for authorized persons and recognized bodies (Rule 8.1.1(1)(b)) |
| Compliance officer | Management level, independent, approved in advance by the supervisor (CR 134 arts. 22, 49(18)) | MLRO resident in the UAE and approved by the FSRA, plus a deputy outside representative offices (Rules 12.1.1, 12.1.4) |
| Program review | An independent audit function (CR 134 art. 21(6)) | At least annual review (Rule 4.1.1(4), (5)) |
| Records | At least five years (CR 134 art. 25) | At least six years (Rule 4.5.1) |
| Training | Periodic programs and workshops (CR 134 art. 21(5)) | All employees at least annually, recorded (Rules 13.2.1, 13.3.1) |
What are the key points of AML compliance in the UAE, and how do firms stay compliant?
Twelve duties bind every financial institution, DNFBP and VASP in November 2026, and the table gives each its article. Its last column shows how complead, formerly Sanction Scanner, keeps the evidence for the duty. Sanction Scanner, the screening product, is part of complead. Four program duties frame the rows, each with the reason an inspector asks for it:
- Management approval (art. 19(1)(d)). Policies bind once senior management approves them, and they reach branches and majority owned subsidiaries.
- Compliance officer (CR 134 art. 22). One person at management level decides whether a case goes to the FIU and records why.
- Independent audit (CR 134 art. 21(6)). Someone outside the first line tests whether the controls work.
- Training (CR 134 arts. 21(5), 22(4)). The compliance officer plans, runs and documents it for the compliance staff and other relevant employees.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| Risk assessment | Art. 19(1)(a); CR 134 art. 5 | Assess customer, country, product, transaction and channel risk; document it, update it, give it to the supervisor on request. | Each rule carries a scope (a product, a segment or a jurisdiction), and every edit is versioned with its author, date and reason. |
| Customer due diligence | CR 134 arts. 6, 7, 9, 14(2) | Verify identity before or during onboarding (at low risk, as soon as possible after it, where the delay is needed to keep business running and the risk is controlled), on suspicion (unless there are reasonable grounds to believe CDD would alert the customer: then file an STR that says why), on doubt about earlier data, and at the occasional transaction lines. | Onboarding, screening and monitoring feed a single engine, which keeps one risk score per customer. |
| Beneficial owner | CR 134 art. 10 | Identify the natural person owning 25 percent or more; where that is in doubt or nobody controls through ownership, whoever controls by other means; failing both, the senior manager. | KYB and UBO verification traces owners, parents and controlling entities up to the natural persons at the top and labels any layer it cannot clear as unresolved. |
| Politically exposed persons | CR 134 art. 16(1)(a), (b) | Foreign PEPs: senior approval, source of funds and wealth, enhanced monitoring. Domestic and international organization PEPs: the same where the relationship is high risk. | A PEP hit changes that customer's one risk score. A named reviewer then decides, and the decision stays on record. |
| Enhanced due diligence | CR 134 arts. 5(2)(c), 23 | Apply enhanced measures to the higher risks the firm identifies, and to business with persons from countries the National Committee identifies as high risk or deficient, plus the countermeasures the supervisor or the National Committee requires. | Rules scoped to a jurisdiction give the listed countries their own conditions, thresholds and score effects. |
| Ongoing monitoring | Art. 19(1)(b); CR 134 art. 8 | Check transactions against the customer's profile and keep CDD data current, high risk customers first. | Each name can be added to or dropped from ongoing monitoring by an API trigger. |
| Suspicious transaction report | Art. 18; CR 134 art. 18 | Report to the FIU immediately and without delay, regardless of value, through goAML, the FIU's electronic system, or other means it approves. Lawyers, notaries, other independent legal professionals and independent statutory auditors are exempt for information obtained while assessing a client's legal position, representing a client in proceedings or otherwise under professional secrecy (CR 134 art. 18(2)). | Case management carries the reporting support, and an alert carries the fired rule and the matched signals with it. |
| No tipping off | CR 134 art. 19; art. 29(1) | Never tell the customer or anyone else that a report was or will be filed. Group sharing under CR 134 art. 32 is allowed, and a lawyer, notary, other independent legal professional or statutory auditor who dissuades a client from an unlawful act is not disclosing. | Alerts are worked in case management, and the record names the reviewer behind each decision. |
| Targeted financial sanctions | Arts. 1, 19(1)(e); CR 134 arts. 28(8), 36(3) | Apply Executive Office instructions forthwith for persons designated by the UN Security Council or listed by the Cabinet, freezing and blocking on wires and virtual asset transfers included. | Thresholds for fuzzy matching differ by list type or by single list, and a log entry is written for every search, matches or not. |
| Wire transfers | CR 134 arts. 28, 30 | Send originator and beneficiary data with every international wire; verify originator data from AED 3,500; the beneficiary financial institution verifies the beneficiary from AED 3,500 where it has not done so before. | Payment screening runs both parties of a wire, sender and receiver, through an API check during processing. |
| Virtual asset transfers | CR 134 art. 36(2), (4) | Send names, account or wallet addresses and the originator's address with each transfer, and keep them on receipt: the travel rule for VASPs, and for financial institutions that send or receive virtual assets for customers. | Both parties' names can be screened like any customer name, and each search is logged, matches or not. |
| Record keeping | CR 134 art. 25(1), (2) | Keep transaction records five years from completion or the end of the relationship; CDD files, CCTV and ATM recordings included, five years from the latest of the relationship's end, closure, inspection, investigation or final judgment. | Each check stays in the search audit trail with the searcher, the term, the time and the outcome, empty outcomes too. |
Which dirham thresholds apply in 2026?
| Line (in force, November 2026) | What it triggers | Basis |
|---|---|---|
| AED 55,000 | CDD on an occasional transaction at a financial institution, single or linked | CR 134 art. 7(2)(a) |
| AED 55,000 | Dealers in precious metals and stones covered for cash, single or linked | CR 134 art. 3(3) |
| AED 11,000 | Commercial gaming operators covered, single or linked | CR 134 art. 3(1) |
| AED 3,500 | CDD on an occasional wire at a financial institution | CR 134 art. 7(2)(b) |
| AED 3,500 | Originator data verified on international wires; beneficiary verified on receipt if not verified before | CR 134 arts. 28(1), 30(2) |
| AED 3,500 | CDD on an occasional VASP transaction, single or linked | CR 134 art. 7(3) |
| No amount | Real estate brokers and agents on any purchase or sale | CR 134 art. 3(2) |
| 25% | Ownership that makes a beneficial owner | CR 134 art. 10(1)(a) |
| Above AED 60,000 | Cash, negotiable instruments, precious metals or stones a traveler over 18 must disclose at the border | Art. 10; ICP notice, 7 February 2023 |
Linked transactions count together for the AED 55,000, AED 11,000 and VASP lines. International wires below AED 3,500 still carry full originator and beneficiary data; only the verification step drops away, unless crime is suspected (CR 134 art. 28(3)). Suspicion has no line at all: an STR is due regardless of value (art. 18(1)).
What are the money laundering risks in the UAE?
One illustrative path: a free zone trader buys gold from a Dubai dealer, pays suppliers abroad through an exchange house and puts the profit into an apartment.
- Gold and precious stones. MoET counted 473 violations at dealers in the first half of 2025, with AED 20 million in fines.
- Real estate. Brokers drew 495 violations and AED 18.5 million in the same period.
- Exchange houses and hawala. Exchange houses drew the two largest sanctions in the CBUAE's 2025 news feed, and registered hawala providers are among the firms the CBUAE supervises for AML.
- Free zones and trade. Company layers hide owners and invoices hide value, the core of trade based money laundering; CR 134 answers with the 25 percent owner rule and transaction scrutiny (CR 134 arts. 8, 10).
- Correspondent exposure. On 1 September 2026 FinCEN proposed a section 311 measure finding the five UAE branches of Banque Misr to be of primary money laundering concern (91 FR 56085).
What are the penalties for money laundering in the UAE?
| Breach or offense | Basis | Penalty (in force, November 2026) |
|---|---|---|
| Any breach, administrative | Art. 17(1) | Unless other legislation sets a more severe sanction: warning; AED 10,000 to AED 5,000,000 per violation; sector ban; limits on or suspension of managers; activity suspension; license revocation |
| Repeat within a year of the last fine | Art. 17(3) | Incremental administrative fine |
| Money laundering, person | Art. 26(1) | 1 to 10 years and AED 100,000 to AED 5,000,000 or the property's value, whichever is greater |
| Aggravated laundering (abuse of position, through a non profit or an organized group, named predicate crimes, repeat offense) | Art. 26(2) | Temporary imprisonment and AED 1,000,000 to AED 10,000,000 or twice the value, whichever is greater |
| Terrorist financing | Art. 26(3) | Life, or at least 10 years, and AED 1,000,000 to AED 10,000,000 or twice the value, whichever is greater |
| ML, TF or PF by a company | Art. 27(1), (3), (4) | Unless another law is more severe: AED 5,000,000 to AED 100,000,000 or the property's value, whichever is greater; dissolution mandatory for TF and PF, optional for ML |
| Other offenses by a company | Art. 27(2) | AED 200,000 to AED 10,000,000 |
| Not reporting, deliberately or through gross negligence | Art. 28 | Prison and AED 100,000 to AED 1,000,000, or either |
| Tipping off | Art. 29(1), (3) | Prison and a fine from AED 50,000, or either; at least one year and a fine equal to the proceeds, minimum AED 100,000, where the tip off leaves them impossible to seize, destroyed or devalued |
| Sanctions instructions breached | Art. 33 | Prison and a fine from AED 20,000, or either |
| Time limit | Art. 37(2) | None for ML, TF and PF proceedings or penalties |
Two tracks run side by side. Supervisors impose administrative penalties per violation themselves and may publish them (art. 17(4)). Courts impose the criminal penalties, and most fines carry "whichever is greater". AED 100 million is therefore the top fixed figure for a company, not a ceiling: the court can impose the value of the criminal property instead (art. 27(1)). A manager who knew of the crime, where it came from a breach of the duties of the post, faces prison and a fine, or either (art. 27(5)).
Recent enforcement by the CBUAE and the Ministry of Economy and Tourism
The two largest sanctions in the CBUAE's 2025 news feed fell on exchange houses: AED 200 million on 20 May and AED 100 million on 29 May. In 2026 its releases turned to foreign bank branches. Each CBUAE row repeats the title and date from the bank's news feed; the release names the breach.
| Date | Authority | Action (from the release title) | Source |
|---|---|---|---|
| 20 May 2025 | CBUAE | Financial sanction of AED 200 million on an exchange house | CBUAE release |
| 29 May 2025 | CBUAE | Financial sanction of AED 100 million on an exchange house | CBUAE release |
| 24 July 2025 | MoET | 1,063 violations at DNFBPs in the first half of 2025, fines above AED 42 million | MoET release |
| 23 December 2025 | CBUAE | License of Omda Exchange revoked and a financial sanction of AED 10 million | CBUAE release |
| 24 June 2026 | CBUAE | Financial penalty of AED 20,000,000 on a branch of a foreign bank | CBUAE release |
| 6 July 2026 | CBUAE | Financial sanction of AED 1,820,000 on a branch of a foreign bank | CBUAE release |
| 23 September 2026 | CBUAE | Strict sanctions on the branches of Bank Melli Iran operating in the UAE | CBUAE news feed |
How do screening and monitoring apply? AML solutions and software for the UAE
Inspectors from the CBUAE, MoET or the FSRA read records: which list a name went through, which rule fired, who signed off and on what date.
Client screening and ongoing monitoring looks for each customer name inside 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. A search that finds nothing is still logged, with the user, the term, the time and the result.
Take an illustrative Dubai exchange house. Its team runs sanctions lists at a lower fuzzy matching threshold than watchlists, because the platform lets thresholds differ by list type and by single list. In transaction monitoring it builds a rule for occasional transactions from AED 55,000 without writing code, then replays 30, 60 or 90 days of real transactions through it before switching it on. complead is AI native: its agents close the routine alerts and attach three things to each, the evidence, a written narrative and a work log. Every report to the FIU stays the compliance officer's decision, and the record names that officer.
What has changed since 2025, and what is the future of financial crime and AML in the UAE?
- 24 July 2025. MoET publishes its first half inspection results.
- 30 September 2025. Federal Decree by Law No. 10 of 2025 is issued.
- 14 December 2025. CR 134 takes effect, 30 days after Official Gazette 811.
- 13 April 2026. The CMA issues its Virtual Assets Framework, AML/CFT module included.
- 16 April 2026. The CBUAE updates its AML/CFT/CPF guidance for licensed financial institutions.
- 21 May 2026. The FSRA amends the ADGM AML framework.
- 23 September 2026. The CBUAE sanctions the UAE branches of Bank Melli Iran.
Next comes the back book. CR 134 art. 13 asks firms to apply CDD to existing customers when materiality and risk call for it and to check that older CDD data is still adequate. Policies citing the 2018 texts need new references.
One decision stays with you: which rulebook your license puts you under. An onshore license means the 2025 law, CR 134 and a sector supervisor; an ADGM or DIFC license brings the FSRA's or the DFSA's AML rules as well. In ADGM that moves the occasional transaction line from AED 55,000 to USD 15,000 and the record period from five years to six.
What the 16 page PDF adds. The form beside this guide sends the 2026 edition with three working files: a program checklist of 14 points, an illustrative template of customer risk factors for the UAE, and an STR decision record that has a field for the goAML reference.
