The UAE replaced its principal AML statute on 30 September 2025. Federal Decree-Law No. 10 of 2025 repealed the 2018 decree-law, added proliferation financing as a standalone offence, named virtual asset service providers in the statutory perimeter, and raised the corporate criminal fine ceiling to AED 100 million.
Key takeaways
- Federal Decree-Law No. 20 of 2018 is repealed. Article 41 of the 2025 decree-law does it outright, though regulations and circulars made under the old law survive until superseded.
- Administrative fines now start at AED 10,000 rather than AED 50,000, still cap at AED 5 million per violation, and can be escalated where the same violation recurs within a year.
- A convicted legal person faces AED 5 million to AED 100 million, or the value of the criminal property if that is greater. The 2018 range was AED 500,000 to AED 50 million.
- FATF listed the UAE under increased monitoring in March 2022 and delisted it in February 2024, but the UK rule change that followed means your high-risk-country logic must now track FATF lists dynamically.
- Giving false beneficial ownership information to a bank, a DNFBP or a virtual asset service provider is now a criminal offence in its own right, not just a supervisory finding.
Which law governs AML/CTF in the UAE now?
Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing was issued in Abu Dhabi on 30 September 2025. Article 42 brings it into force two weeks after publication in the Official Gazette, and Article 41 repeals Federal Decree-Law No. 20 of 2018 outright.
Article 41(3) is the clause that matters most to a running compliance function. Executive regulations, resolutions and circulars issued under the 2018 law stay effective so far as they do not conflict with the new statute, until replacements are issued. Cabinet Decision No. 134 of 2025 supplies the new Executive Regulations, and the UAE Financial Intelligence Unit lists both instruments in its register of AML/CFT laws.
The practical consequence is unglamorous but real. Policy documents, outsourcing contracts, vendor questionnaires and counterparty attestations that cite "the AML Law of 2018" are now wrong on the instrument even where they remain right on the substance, and every one of them needs re-pointing.
What changed between the 2018 decree-law and the 2025 statute?
The 2025 law is a rewrite rather than an amendment, which is why a clause-by-clause read of your existing gap analysis will mislead you. The headline shifts are in scope, in who is named as a supervised entity, and in the size of corporate exposure.
| Item | Decree-Law 20 of 2018 | Decree-Law 10 of 2025 |
|---|---|---|
| Title scope | Money laundering, terrorism financing, financing of illegal organisations | Money laundering, terrorism financing, proliferation financing |
| Supervised entities named in the statute | Financial institutions, DNFBPs, non-profit organisations | Financial institutions, DNFBPs, virtual asset service providers, non-profit organisations |
| Administrative fine per violation | AED 50,000 to AED 5 million (Article 14) | AED 10,000 to AED 5 million, escalable on repeat within a year (Article 17) |
| Money laundering by a natural person | Up to 10 years, AED 100,000 to AED 5 million (Article 22) | 1 to 10 years, AED 100,000 to AED 5 million or the value of the criminal property, whichever is greater (Article 26) |
| Aggravated money laundering | AED 300,000 to AED 10 million | AED 1 million to AED 10 million, or twice the value of the criminal property (Article 26) |
| Convicted legal person | AED 500,000 to AED 50 million (Article 23) | AED 5 million to AED 100 million, or the value of the criminal property (Article 27) |
| Proliferation financing | Not a standalone offence | Standalone offence: temporary imprisonment and AED 1 million to AED 10 million (Article 26) |
Two changes deserve attention beyond the numbers. Fines are now value-linked, so the ceiling is no longer a cap when the laundered sum is large. And the lower administrative floor of AED 10,000 signals more frequent, smaller sanctions rather than leniency.
Who supervises AML compliance in the UAE, and where do reports go?
There is a division of labour that outsiders routinely collapse into one body. The FIU takes reports and does not supervise. Supervisory authorities inspect and fine. The committees set strategy and own the mutual evaluation relationship.
| Body | Role under the 2025 decree-law |
|---|---|
| UAE Financial Intelligence Unit, an independent unit within the Central Bank | Exclusive recipient of suspicious transaction reports; analyses and refers them to competent authorities (Article 11) |
| Supervisory authorities, by sector | Sectoral risk assessment, desk and field inspection, administrative penalties, statistics (Articles 16 and 17) |
| National Committee for Combating Money Laundering, the Financing of Terrorism, and Proliferation Financing, chaired by the Central Bank Governor | National strategy, national risk assessment, identifying high-risk countries and setting countermeasures (Articles 13 and 14) |
| Supreme Committee for the Supervision of the National Strategy, affiliated with the Presidential Court | Evaluates the National Committee's effectiveness, oversees the mutual evaluation process, proposes legislation (Article 12) |
| Executive Office | Issues the targeted financial sanctions instructions that Article 19 requires to be implemented forthwith; breach is an offence under Article 33 |
One naming point is worth correcting, because older summaries of the UAE regime get it wrong. The committee was not established in 2000. The Cabinet created the body now operating as the NAMLCFTC in September 2024, when it replaced the Executive Office of AML/CTF in all rights and obligations under Federal Decree-Law No. 7 of 2024, and the 2025 statute re-founded it with proliferation financing in its title.
Was the UAE grey-listed, and does that still affect onboarding?
Yes. FATF placed the UAE on its list of jurisdictions under increased monitoring in March 2022 and removed it in February 2024. The knock-on effect in other jurisdictions was immediate and is documented in their own statute books.
HM Treasury made the Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2022 at 11.10 a.m. on 28 March 2022, in force the following day, substituting a Schedule 3ZA list of 25 high-risk third countries that named the United Arab Emirates. Every UK-regulated firm owed mandatory enhanced due diligence on UAE customers from that date.
The 2024 instrument matters more for how you build controls. From 23 January 2024 the UK deleted Schedule 3ZA and redefined a high-risk third country as any country named on FATF's call-for-action or increased-monitoring lists as they have effect from time to time. UAE enhanced due diligence therefore ceased to be mandatory in the UK on delisting, with no further instrument. A static country list pasted into a policy annex no longer reflects the law.
What penalties does the 2025 statute actually carry?
Administrative and criminal exposure run on separate tracks, and the criminal track reaches individuals as well as the entity. Article 17 gives supervisors a graduated toolkit that starts with a warning and ends at licence revocation, with the fine as only one rung.
| Breach | Who is exposed | Exposure under the 2025 law |
|---|---|---|
| Any provision of the law or its regulations | Financial institution, DNFBP, VASP, non-profit organisation | AED 10,000 to AED 5 million per violation, plus sector prohibition, board restrictions, suspension of activity or licence revocation (Article 17) |
| Failure to file a suspicious transaction report, deliberately or by gross negligence | Any reporting entity or individual | Imprisonment and AED 100,000 to AED 1 million (Article 28) |
| Tipping off a customer or disclosing an enquiry | Any person | Imprisonment and a fine of at least AED 50,000 (Article 29) |
| Breaching targeted financial sanctions instructions | Any person | Imprisonment and a fine of at least AED 20,000 (Article 33) |
| False or misleading beneficial ownership information given to an authority, a financial institution, a DNFBP or a VASP | Any person | Imprisonment and a fine of at least AED 20,000 (Article 35) |
| Operating without a licence, registration or enrolment | Any natural or legal person | Imprisonment and AED 200,000 to AED 10 million (Articles 20 and 32) |
Article 17 also lets a supervisor publish the penalty and demand periodic remediation reports, and Article 36 requires deportation of a foreign national given a custodial sentence for money laundering.
Which sectors and entities are in scope?
Four populations carry obligations: financial institutions, designated non-financial businesses and professions, virtual asset service providers, and non-profit organisations. Article 20 makes it an offence for any natural or legal person to conduct any of those activities without a licence, registration or enrolment from the competent or supervisory authority, so perimeter breaches are prosecutable rather than merely irregular.
Two sectors deserve specific planning. Real estate is asset-intensive and recurs in integration-stage typologies, which is why UAE property professionals sit under the same reporting duty as banks. Virtual asset businesses are now named in the statute itself rather than reached by regulation, and Article 30 criminalises dealing in virtual assets characterised by total anonymity or that obstruct the tracing of a transaction, with at least three months' imprisonment and a fine of at least AED 50,000.
Legal professionals keep a narrow carve-out. Article 18(2) exempts lawyers, notaries, other legal professionals and independent legal auditors from the reporting duty where the information was obtained in circumstances attracting professional secrecy, and nothing else.
What do the preventive obligations require operationally?
Article 19 sets out what a supervisor will actually test. Reporting entities must identify, understand, manage, assess, document and continuously update their crime risks under a risk-based approach, and hand the assessment over on request. They must apply customer due diligence and continuous monitoring scaled to those risks and to the national risk assessment outcomes.
Three further duties are absolute rather than risk-scaled. No anonymous, fictitious, alias or numbered accounts may be opened or maintained. Internal policies and controls must be approved by senior management and extended to branches and majority-owned subsidiaries. Targeted financial sanctions instructions must be implemented forthwith, which in practice means a screening feed measured in hours, not a monthly refresh.
Reporting itself is threshold-free. Article 18 requires notification to the FIU without delay, regardless of the value of the transaction, filed through the electronic system the FIU designates. That system is goAML, launched in June 2019. Separately, Article 10 obliges travellers to disclose currency, bearer negotiable instruments, precious metals and valuable stones on entry and exit.
What should a firm entering the UAE market do first?
Sequence the work around the licence, because Article 20 makes activity without registration an offence before any AML failing is even assessed. Confirm which supervisory authority owns you, and remember that a Dubai International Financial Centre or Abu Dhabi Global Market entity answers to its own financial services regulator while the federal decree-law still applies to it.
Then rebuild three artefacts against the 2025 text rather than the 2018 one: the enterprise risk assessment required by Article 19(1)(a), the senior-management-approved policy set required by Article 19(1)(d), and the goAML registration and filing runbook. Old gap analyses mapped to repealed article numbers will not survive an inspection.
Finally, treat country risk as data rather than as a document. The UK example shows why: high-risk status can now change with a FATF plenary and take legal effect elsewhere without a new instrument. MemberCheck rescreens the stored customer record when a list changes, so a delisting or a fresh designation reaches existing customers rather than only new ones.
For the supervisory detail by country, see our UAE coverage page and our note on jurisdiction risk. The neighbouring analysis of AML in Saudi Arabia and the explainer on FATF mutual evaluations cover the regional and assessment context, with more under jurisdictions and regulation.
