The UAE's anti-money laundering framework rests on Federal Decree-Law No. 10 of 2025, published in the Official Gazette on 30 September 2025 and in force from 14 October 2025, which replaced the country's 2018 AML law. In April 2026, the Central Bank of the UAE built on that foundation with updated AML/CFT/CPF guidance pushing licensed financial institutions toward continuous, risk-based, technology-enabled compliance rather than periodic, point-in-time checks. This article separates what the law itself establishes from what the guidance now expects in practice.
What Federal Decree-Law No. 10 of 2025 establishes
The Decree-Law sets the core legal definitions for money laundering, terrorist financing and proliferation financing offences in the UAE, and it explicitly recognises offences committed through digital systems, virtual assets and cryptographic technologies. It defines the duties of financial institutions and designated non-financial businesses and professions, and confirms the powers of the Financial Intelligence Unit, housed within the Central Bank, as the sole recipient of suspicious transaction reports, with authority to request information and freeze suspect funds.
For institutions, the Decree-Law is the statutory layer beneath every subordinate regulation and guidance note. It does not, by itself, prescribe the technical detail of how a monitoring system must be built, that detail comes from the supervisory guidance issued under it.
What CBUAE's April 2026 guidance adds
The Central Bank's updated AML/CFT/CPF guidance, issued in April 2026, is where the practical expectations sharpen. It signals stronger supervisory focus on proliferation financing risk assessment, trade-based money laundering, correspondent banking and customer due diligence, and it makes clear that compliance can no longer function as a back-office checkpoint. The guidance expects institutions to integrate compliance into onboarding, periodic review, transaction monitoring, sanctions screening and escalation workflows, and to demonstrate that controls are actively tested and improved, not simply documented.
That is a meaningful shift in emphasis from earlier point-in-time verification toward monitoring that is continuous and evidenced. An institution that can show a monitoring rule was recalibrated after a new typology emerged is in a materially different position from one that can only show the rule exists.
Who the framework reaches
The law and its Executive Regulations (Cabinet Resolution No. 134 of 2025) apply across financial institutions, DNFBPs and virtual asset service providers throughout the UAE, with the Central Bank as primary supervisor for banks in mainland UAE and the commercial free zones. Institutions in the DIFC and ADGM answer to the DFSA and FSRA respectively and sit outside CBUAE's direct guidance, though the underlying federal law still applies.
Core duties are consistent across sectors: a documented risk assessment, customer due diligence and beneficial ownership identification, sanctions screening, an appointed Money Laundering Reporting Officer, and monitoring with reporting to the Financial Intelligence Unit via the goAML platform.
Building a monitoring programme that meets the current standard
In practice, meeting the current standard means moving away from monitoring that only reviews transactions after the fact in scheduled batches, toward monitoring that flags unusual activity as it happens and routes it to a documented investigation and disposition process. It also means being able to show, not just assert, that the institution's risk assessment drives its monitoring rules, rather than the two operating as separate exercises that were never reconciled.
Given how recently both the Decree-Law and the CBUAE guidance were issued, compliance teams should treat this as an active area and confirm current requirements directly with CBUAE or qualified local counsel before finalising a monitoring redesign, rather than relying solely on secondary summaries, including this one.
