The Central Bank of the UAE's updated AML/CFT/CPF guidance, issued on 16 April 2026, is less a new rulebook than a statement of where supervisory expectations now sit: continuous, risk-based, technology-enabled compliance integrated across the customer lifecycle, rather than periodic checks bolted onto onboarding. For institutions that already understand the legal basis in Federal Decree-Law No. 10 of 2025, this article focuses specifically on what the guidance means for building or upgrading a real-time transaction monitoring capability.
The shift the guidance describes
CBUAE's guidance signals a stronger supervisory focus on proliferation financing risk assessment, trade-based money laundering, correspondent banking relationships and customer due diligence, aligned with the UAE's broader 2024-2027 national AML/CFT agenda and FATF expectations. Its central message is that compliance can no longer operate as a back-office checkpoint sitting apart from the rest of the business; it must be integrated into onboarding, periodic reviews, transaction monitoring, sanctions screening, trade finance and escalation workflows as connected parts of one system.
Institutions are expected to show active risk ownership: internal controls that are not just well designed on paper but actively tested and improved, with compliance, operations, relationship management and trade finance teams all trained on the specific red flags relevant to their roles rather than a single generic training module for everyone.
What 'real-time' actually requires operationally
Moving from periodic, batch-based transaction review to real-time monitoring is primarily an architecture change before it is a policy change. It requires transaction data to be evaluated against risk rules as it happens, or close to it, rather than reviewed in scheduled batches after the fact, and it requires the output of that evaluation to route automatically into a documented investigation and escalation workflow rather than accumulating in a queue for periodic manual review.
For trade finance specifically, which the guidance calls out directly, this means visibility into trade documentation and counterparty risk at the point a transaction is initiated, not only at post-transaction reconciliation, since trade-based money laundering typically relies on misrepresenting the underlying trade itself.
Dynamic customer due diligence as the other half of the equation
Real-time transaction monitoring is only as good as the customer risk profile it is measured against. CBUAE's guidance pushes toward dynamic, risk-based CDD, meaning a customer's risk classification should update in response to their actual behaviour and changing circumstances, not remain fixed at whatever level was assigned at onboarding. A customer whose transaction pattern changes meaningfully should trigger a review of their risk classification, which in turn should adjust the intensity of monitoring applied to them going forward.
This closes a common gap where monitoring rules are static and risk classification is static, and the two are never reconciled against each other even as the customer's actual activity evolves.
A practical build sequence
Institutions working through this shift typically get more value moving in this order: first, establish a single, current view of customer risk that updates on defined triggers rather than only at periodic review; second, connect real-time transaction screening to that current risk view, so monitoring intensity actually reflects current risk rather than a stale onboarding assessment; third, build the escalation and investigation workflow that automatically routes flagged activity to a documented decision, with the audit trail CBUAE's emphasis on active risk ownership implies; and fourth, extend the same discipline to trade finance and correspondent banking relationships specifically, given how directly the guidance calls those out.
Given how recently this guidance was issued, institutions should confirm current supervisory expectations directly with CBUAE, or with qualified local counsel, before finalising a monitoring redesign based on secondary analysis alone, including this article.
