UAE AML/CFT Laws and Guidelines: 2026 Compliance Guide

Quick answer: AML compliance in the UAE is governed by Federal Decree-Law No. 10 of 2025 on anti-money laundering, combating the financing of terrorism, and proliferation financing, and its implementing regulation, Cabinet Resolution No. 134 of 2025. Banks, exchange houses, insurers, virtual asset service providers, and designated non-financial businesses such as real estate brokers, precious metals dealers, lawyers, and accountants must assess their risks, verify customers and their beneficial owners, monitor activity, keep records, and report suspicious transactions to the UAE Financial Intelligence Unit through goAML.

This guide explains the legal framework, what each type of business must do, which regulator supervises it, and how reporting works.

UAE’s AML/CFT Legal Framework

The UAE's current AML law is Federal Decree-Law No. 10 of 2025, issued on September 30, 2025 and in force since October 14, 2025. It replaced Federal Decree-Law No. 20 of 2018, as amended in 2021, and extends the framework to proliferation financing. It sets out what financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers must do to prevent money laundering, terrorist financing, and proliferation financing.

Important parts of this law include:

• Required reporting of suspicious transactions
• Implementing customer due diligence measures
• Keeping records and having a dedicated compliance officer
• Setting up internal AML/CFT policies and procedures

The implementing regulation is Cabinet Resolution No. 134 of 2025, issued on October 29, 2025 and in force since December 14, 2025. It replaced Cabinet Resolution No. 10 of 2019 and its 2022 amendments, and sets out the detailed rules on risk assessment, customer due diligence, beneficial ownership, and reporting.

What Changed in 2025 and 2026

• New law: Federal Decree-Law No. 10 of 2025 replaced the 2018 law in October 2025 and explicitly covers proliferation financing alongside money laundering and terrorist financing.
• New implementing rules: Cabinet Resolution No. 134 of 2025 replaced the 2019 regulation in December 2025. Article 10 requires identifying any natural person who owns 25% or more of a legal person, or, failing that, the person who controls it or its senior managing official.
• Updated DNFBP guidance: the Ministry of Economy and Tourism issued revised DNFBP guidelines and supplemental guidance for real estate agents and precious metals dealers in March 2026.

Essential AML/CFT Guidelines for UAE Businesses

The UAE’s AML/CFT guidelines apply to a wide range of entities, but requirements can vary based on the type of business.

💡 Related Blog:

AML Watchlist Screening Guide

1. Financial Institutions (FIs)

Banks, exchange houses, and insurance companies fall under this category. These institutions serve as the first line of defense, and consequently, face the most rigorous AML compliance requirements across the UAE.

For these financial entities, Customer Due Diligence (CDD) is a thorough process of understanding their customers and their business purposes. This involves:

• Identity verification using official documents
• Finding beneficial owners of corporate structures
• Understanding each business relationship’s nature.

The process continues after customer onboarding. Financial institutions are required to monitor transactions for any strange activity. This ongoing monitoring is especially important for high-risk customers, where Enhanced Due Diligence (EDD) measures are necessary. Senior management approval might be necessary in certain situations, and the source of assets and wealth needs to be closely investigated.

2. Designated Non-Financial Businesses and Professions (DNFBPs)

This category includes real estate agents, precious metals dealers, lawyers, and accountants. While their requirements are similar to FIs, there are some differences:

• Financial institutions are mainly supervised by the Central Bank of the UAE (CBUAE), while most DNFBPs are supervised by the Ministry of Economy and Tourism, and lawyers by the Ministry of Justice.
• Some DNFBP sectors have extra threshold-based reports on top of suspicious transaction reporting, such as cash transactions of AED 55,000 or more.
• Every entity must report suspicious transactions, but the warning signs differ by sector, from trade-based schemes for dealers to property-based schemes for real estate.

For example, a gold or jewelry dealer must file a Dealers in Precious Metals and Stones Report (DPMSR) through goAML for cash transactions of AED 55,000 or more with individuals, and for transactions of that size paid in cash or by wire with companies. Real estate brokers and agents must file a Real Estate Activity Report (REAR) for freehold property purchases or sales involving AED 55,000 or more in cash, or paid with virtual assets. These reports are separate from suspicious transaction reports, which have no minimum value. Our guide to enhanced due diligence in the UAE explains when deeper checks apply.

Despite sector-specific differences, the main principle remains: know your customer and report suspicious activities. The definition of “suspicious” may vary by sector, but the reporting obligation is constant.

3. Virtual Asset Service Providers (VASPs)

With the rise of cryptocurrencies, the UAE has introduced specific guidelines for VASPs:

VASPs must be licensed before they start operating. In Dubai (outside the DIFC), that is the Virtual Assets Regulatory Authority (VARA); elsewhere in the mainland, the Securities and Commodities Authority (SCA); and in the financial free zones, the DFSA or the FSRA. Once licensed, they must apply the Travel Rule, which requires originator and beneficiary information to travel with virtual asset transfers, and manage risks such as unhosted wallets and fast-moving transfers.

4. Free Zone Companies

The UAE has two financial free zones with their own regulators: the Dubai International Financial Centre (DIFC), supervised by the Dubai Financial Services Authority (DFSA), and Abu Dhabi Global Market (ADGM), supervised by the Financial Services Regulatory Authority (FSRA).

• Firms in these zones follow the federal AML law plus their regulator's own AML rules.
• They file suspicious transaction reports with the UAE FIU through goAML, and DIFC firms must also notify the DFSA after filing.

Companies in other, non-financial free zones are generally supervised for AML purposes by the federal authorities that cover their sector.

Regardless of the entity type, all businesses subject to UAE AML regulations must:

• Appoint a compliance officer
• Maintain proper records for at least 5 years
• Conduct regular staff training on AML/CFT matters
• Implement internal controls and independent audit functions

Key Regulatory Bodies and Their Guidelines

The UAE’s AML/CFT regulation involves multiple supervisory bodies, each overseeing specific types of entities. Find which regulator governs your business:.

Reporting Requirements and Procedures

UAE AML laws ask you to report suspicious transactions.

The UAE Financial Intelligence Unit, an independent unit within the Central Bank, receives reports through the goAML system. Key points:

• All financial institutions, DNFBPs, and VASPs must register on goAML and keep their registration active. Our goAML registration guide walks through the steps.
• Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) must be filed immediately, without delay, when there is suspicion or reasonable grounds to suspect a crime, including for attempted transactions. There is no minimum amount.
• STRs should include detailed information about the suspicious activity, the parties involved, and the reasons for suspicion.
• The fact that an STR has been filed must be kept confidential from the subject of the report.
• It’s illegal to inform a customer or any third party that an STR has been or will be filed.
• All decisions related to filing or not filing an STR must be retained for a minimum 5 years.
• In addition to STRs, entities may need to file regular reports to their respective regulators on their AML/CFT efforts.

Failure to report suspicious activities can result in severe penalties under UAE AML regulations.

How to Comply with AML/CFT Laws and Guidelines in UAE

Financial institutions and DNFBPs should focus on creating a compliance program that addresses all aspects of the regulatory framework.

Key steps to ensure compliance are as follows:

1. Conduct regular risk assessments
2. Implement Customer Due Diligence (CDD) procedures
3. Detect and report suspicious activities promptly.
4. Maintain records for at least 5 years.

While these steps are crucial, implementing them manually can be resource-intensive. Many organizations are turning to technological solutions to enhance efficiency and accuracy in their compliance efforts.

Some examples include:

• Automated document verification that validates identity documents such as the Emirates ID
• Business verification that checks trade licenses and helps identify beneficial owners
• Screening against sanctions, PEP, and adverse media lists, with ongoing monitoring, through AML screening

Signzy provides these tools for businesses operating in the UAE. For the documents to collect from each type of customer, see our UAE KYC document list.