Summary
Many businesses in the UAE assume that anti-money laundering (AML) laws apply only to banks and financial institutions. This assumption is incorrect and potentially costly. The UAE has developed a comprehensive AML framework extending far beyond traditional financial services, with enforcement intensifying following the country’s removal from the Financial Action Task Force (FATF) grey list in February 2024.
Key points:
- Federal Decree-Law No. 10 of 2025 Concerning Combating Money Laundering, the Financing of Terrorism, and the Financing of Proliferation (AML Law) came into effect on 14 October 2025
- Three primary categories of regulated entities: financial institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs)
- DNFBPs include real estate agents, dealers in precious metals and stones, lawyers, accountants, and commercial gaming operators
- Administrative penalties range from AED 10,000 to AED 5 million; criminal penalties include imprisonment and fines up to AED 5,000,000 for individuals (potentially higher for aggravated offenses), or up to AED 100 million for entities.
- Cash transaction reporting threshold: AED 55,000 for real estate and precious metals transactions
- All reporting entities must register on the goAML platform
What is the Current AML Legal Framework?
The primary legislation governing AML in the UAE is Federal Decree-Law No. 10 of 2025 Concerning Combating Money Laundering, the Financing of Terrorism (CFT), and the Financing of Proliferation, which came into effect on 14 October 2025. This law repeals and replaces Federal Decree-Law No. 20 of 2018.
Cabinet Resolution No. 134 of 2025 provides implementing regulations and operational details, effective from 14 December 2025. This resolution replaced Cabinet Decision No. 10 of 2019 and offers guidance on compliance procedures, Customer Due Diligence (CDD) requirements, and reporting obligations.
Supporting regulations include Federal Law No. 7 of 2014 Combating Terrorism Crimes, Cabinet Decision No. 74 of 2020 on terrorism lists regulation, and Cabinet Decision No. 109 of 2023 on beneficial owner procedures.
Who Must Comply with Uae AML Laws?
The scope of UAE AML laws extends across three primary categories: financial institutions, DNFBPs, and VASPs.
Financial Institutions: This classification encompasses banks, insurance companies, money exchange houses, and entities involved in lending, money transfers, or investment management. The definition captures activities such as accepting deposits, issuing payment instruments, providing financial guarantees, underwriting life insurance, financial leasing, safekeeping and administration of cash or securities, participation in securities issuance, and currency exchange operations.
Designated Non-Financial Businesses and Professions (DNFBPs): This category includes real estate agents and brokers conducting transactions for clients, dealers in precious metals and stones, lawyers and notaries preparing or conducting financial transactions, independent accountants performing similar functions, company and trust service providers, and commercial gaming operators.
For lawyers and accountants, AML obligations are triggered when engaging in specific transactions: purchase and sale of real estate on behalf of clients, management of client funds, management of bank or securities accounts, organizing contributions for company formation or management, and creation or operation of legal persons or legal arrangements.
The December 2025 implementing regulations introduced a significant expansion by explicitly including operators of commercial games as DNFBPs. This addition brings gaming facilities and online gaming platforms under full AML supervision.
Virtual Asset Service Providers (VASPs): VASPs face comprehensive AML requirements when undertaking activities including exchange between virtual assets and traditional currencies, exchange between different types of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets, and providing financial services related to virtual asset offerings.
VASPs must implement the travel rule, requiring collection and transmission of originator and beneficiary information for all transfers. VASPs operating in Dubai fall under the supervision of the Virtual Assets Regulatory Authority. Those operating elsewhere in the UAE, excluding financial free zones, are supervised by the Capital Market Authority. The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) maintain their own regulatory frameworks while aligning with federal requirements.
What are the Core Compliance Obligations?
Customer Due Diligence (CDD): Regulated entities must verify customer identities using reliable documentation and identify beneficial owners (natural persons owning or controlling at least 25 percent of shares or voting rights).
Enhanced Due Diligence (EDD) applies to Politically Exposed Persons (PEPs), individuals from high-risk jurisdictions, or high-risk relationships. This requires additional documentation, understanding source of wealth, more frequent reviews, or senior management approval. Simplified due diligence may apply in low-risk scenarios with thorough documentation.
Ongoing Monitoring and Screening: Entities must maintain ongoing monitoring to detect unusual patterns and screen all customers and transactions against sanctions lists, including UAE, UN, EU, and other relevant jurisdictions. Systems must identify matches and freeze assets immediately.
Record Keeping: Records of all transactions and CDD must be maintained for at least five years from transaction completion or relationship end. Records must include all CDD documentation, transaction records, filed reports, and risk assessment documentation, readily retrievable for authorities.
Organizational Requirements: Entities must appoint a compliance officer responsible for overseeing the AML program, staff training, authority relationships, and report filing. Staff training must be regular, comprehensive, and role-specific. Annual independent audits of AML programs are mandatory for most entities.
What is a Risk Assessment?
The UAE AML framework is risk-based, requiring controls proportionate to money laundering and CFT risks.
Entities must conduct enterprise-wide risk assessments considering customer risk factors, product and service risks, delivery channels, and geographical risks. The current framework requires assessing proliferation financing risk, examining whether products, services, customers, or jurisdictions might be exploited to finance weapons of mass destruction.
Real estate transactions, particularly high-value or cash purchases, present significant money laundering risks. Real estate firms must scrutinize high-value deals, verify beneficial ownership, and report cash transactions exceeding AED 55,000. Precious metals dealers face the same threshold. Lawyers and accountants facilitating covered transactions must implement rigorous controls. Many businesses seek guidance from the best corporate Lawyers in UAE to structure compliant risk assessment frameworks and ensure their AML controls align with evolving regulatory expectations.
What are the Reporting Requirements?
Suspicious Transaction Reports (STRs): When an entity knows, suspects, or has reasonable grounds to suspect that funds are proceeds of crime or relate to money laundering or CFT, it must file an STR with the Financial Intelligence Unit (FIU) through the goAML platform, regardless of transaction amount. This includes attempted transactions.
The law prohibits tipping off; once an STR is filed or suspicion formed, the business must not inform the customer or others about the report.
Additional Reporting: Real estate firms and lawyers must report transactions where property value is settled in cash or virtual assets above AED 55,000. VASPs must report all suspicious activities involving virtual assets and implement additional monitoring for high-risk patterns. Gaming operators must report transactions exceeding AED 11,000.
What are the Penalties for Non-Compliance?
Administrative Penalties
Penalties range from AED 10,000 for minor infractions to AED 5 million per violation for serious breaches, considering deliberateness, repeat violations, and cooperation. Regulators may also suspend licenses, restrict activities, or require corrective action plans.
Criminal Liability
Individuals face imprisonment of 1 to 10 years and fines from AED 100,000 to AED 5 million (or the value of the funds, whichever is higher). For aggravated offenses, fines can reach AED 10 million. Corporate entities may face fines up to AED 100 million, with possible license suspension or dissolution. Managers and directors can be held personally liable if aware of breaches or negligent.
Reputational and Operational Impact
Enforcement actions are published, damaging reputations. Loss of correspondent banking relationships can fundamentally disrupt operations, as international banks increasingly scrutinize AML controls.
Key Takeaways
UAE AML laws extend far beyond traditional financial institutions to include real estate agents, dealers in precious metals and stones, lawyers, accountants, trust service providers, gaming operators, and VASPs. Understanding whether these laws apply to your business requires careful examination of specific activities.
Core compliance obligations include conducting CDD to verify customer identities and beneficial owners, implementing ongoing monitoring and sanctions screening, maintaining records for at least five years, appointing a compliance officer, providing regular staff training, and filing STRs promptly through the goAML platform.
Practical steps for businesses include conducting a comprehensive risk assessment to determine whether any activities trigger AML obligations, implementing appropriate controls proportionate to identified risks, registering with the goAML platform if subject to reporting requirements, appointing a qualified compliance officer with adequate authority and resources, and seeking expert guidance when needed through experienced legal advisors, compliance consultants, or technology providers.
Authors: Shantanu Mukherjee, Alan Baiju
