Anti-Money Laundering UAE: Laws, Requirements and Compliance Measures

The UAE’s anti-money laundering framework, under Federal Decree-Law No. 10 of 2025, establishes obligations relating to anti-money laundering (AML), counter-terrorist financing (CFT), and counter-proliferation financing (CPF). Businesses in regulated sectors, including financial services, real estate, precious metals, legal services, and relevant virtual asset activities, must comply with applicable registration, reporting, and due diligence requirements. Depending on the violation, penalties may include substantial fines and imprisonment. The UAE Financial Intelligence Unit (FIU) receives suspicious transaction reports through the goAML platform. Businesses should also maintain accurate accounting records and bookkeeping practices to support financial transparency, transaction monitoring, and regulatory compliance.

What the 2025 Law Actually Changes

The previous AML regime, Federal Decree-Law No. (20) of 2018 as amended, was repealed and replaced by Federal Decree by Law No. (10) of 2025. The new law does not fundamentally reinvent the UAE’s approach but sharpens it. Penalties are now explicitly tiered, with the most severe violations attracting corporate fines of up to AED 100 million. The removal of any limitation period for prosecution is significant: a suspicious transaction from a decade ago can still form the basis of an enforcement action today.

Supervisory oversight is divided among several UAE authorities. The Central Bank of the UAE (CBUAE) supervises banks, exchange houses, insurance companies, and other financial institutions. The Ministry of Economy oversees designated non-financial businesses and professions (DNFBPs), including real estate brokers, dealers in precious metals and stones, auditors, and corporate service providers. The Ministry of Justice oversees legal consultants, while the Dubai Financial Services Authority (DFSA) and the Financial Services Regulatory Authority (FSRA) regulate firms within their respective financial free zones. Businesses should identify the relevant supervisory authority based on their activities, licence, and jurisdiction to ensure compliance with applicable AML requirements.

Who Must Register and Comply

Covered entities fall into two broad groups. Financial institutions include banks, money service businesses, insurance firms, investment funds, and virtual asset service providers (VASPs). DNFBPs include real estate agents, dealers in precious metals and stones, lawyers, notaries, accountants, and trust and company service providers.

Registration obligations differ by sector and supervisory authority. Most regulated financial institutions are registered with the CBUAE or their respective financial free zone regulator, but they must also meet applicable AML-specific registration and compliance requirements. DNFBPs supervised by the Ministry of Economy, as well as relevant legal consultants overseen by the Ministry of Justice, must complete the applicable AML registration procedures and maintain documented AML policies, procedures, and controls. A common mistake is assuming that holding a trade licence automatically satisfies AML registration requirements. Businesses should confirm their specific obligations with the relevant supervisory authority.

Core Compliance Obligations

The day-to-day requirements are consistent across sectors and closely mirror FATF recommendations. The table below summarises the main obligations and where businesses most often fall short.

The goAML platform is the only accepted channel for filing suspicious transaction reports. Reports must be factual, timely, and free of speculation, but the threshold is “reasonable grounds to suspect”, not proof. Experienced compliance officers know that a defensible STR is often based on a pattern of indicators rather than a single smoking gun.

Is the UAE High Risk for AML?

The UAE was placed on the FATF grey list in March 2022 and removed in February 2024 after demonstrating significant reform, including increased investigations, prosecutions, and international cooperation. The current assessment is that the UAE has made substantial progress, but residual risks remain in sectors such as real estate, gold trading, and virtual assets, which are inherently exposed to cross-border flows and complex ownership structures. The 2025 law should be read partly as a continuation of that reform momentum rather than a response to a new crisis.  

Practical Steps to Get Compliant

A business should start by confirming which supervisory authority applies to its licence and completing aml registration if required.Next, conduct a documented business risk assessment that considers customer types, geographies, delivery channels, and products. Where applicable, businesses should also conduct an Enterprise-Wide Risk Assessment (EWRA) to identify, assess, and document money laundering and terrorist financing risks across the organisation 

That assessment should drive the AML Policy Framework, which must be approved by senior management and actually implemented, not filed away. 

Appoint a compliance officer with sufficient seniority and independence. For smaller DNFBPs, this is often a director or owner, but the role needs real authority. Provide aml training that is role-specific: front-line staff need to recognise red flags, while senior management needs to understand their personal liability exposure.

Test the reporting chain before it is needed. A dry run of a suspicious transaction report through goAML, with a sample scenario, reveals gaps in internal escalation that are far costlier to fix after an inspection or an actual suspicious event.

For businesses that need external support, firms such as ads auditors provide AML compliance services including policy documentation, health checks, and managed KYC. The decision to outsource should depend on internal capacity, regulatory exposure, and the complexity of the business model, not on a generic compliance checklist. If in doubt about how the law applies to a specific activity, contact the relevant supervisory authority or a qualified compliance adviser before assuming an exemption exists.