The UAE has entered a new era of financial crime compliance. In October 2025, Federal Decree-Law No. 10 of 2025 came into force, repealing and fully replacing the country’s previous AML legislation from 2018. Shortly after, Cabinet Resolution No. 134 of 2025 — the executive regulations operationalising the new law — entered into force in December 2025. Together, these two instruments represent the most comprehensive overhaul of the UAE’s Anti-Money Laundering, Counter-Terrorist Financing, and Counter-Proliferation Financing framework to date.
For compliance officers operating in or into the UAE, the message is unambiguous: the bar has been raised, the scope has been widened, and the cost of non-compliance has never been higher. Here is what you need to know.
From the Grey List to Gold Standard
The UAE’s regulatory drive did not happen overnight. In February 2024, the UAE was removed from the Financial Action Task Force (FATF) grey list — a milestone that reflected years of sustained reform efforts. In August 2025, the EU followed suit, removing the UAE from its list of high-risk third countries for AML purposes. Federal Decree-Law No. 10 of 2025 builds directly on this momentum, signalling the UAE’s intent to maintain and deepen its standing as one of the world’s leading financial centres.
With the next FATF mutual evaluation for the UAE anticipated in June, the new framework is not just a legislative upgrade — it is a strategic statement. In October 2025, the UAE National Strategy for AML/CFT/CPF Retreat brought together over 50 senior officials from federal and local authorities to review the National Strategy for 2024–2027, with commitments to accelerated delivery through enhanced inter-agency collaboration and robust data-sharing mechanisms.
The Three Principal Offences: AML, CTF, and Now CPF
The most significant structural change in the new law is the formal introduction of Proliferation Financing (PF) as a standalone criminal offence, on par with Money Laundering and Terrorist Financing. Financing the proliferation of weapons of mass destruction is now explicitly criminalised, and for the first time, the title of the legislation itself — and the executive regulations — reflects this third dimension.
In practice, this is a material new obligation. Under the new executive regulations, regulated entities must now integrate proliferation financing risk oversight into their enterprise-wide risk assessments (EWRA), customer due diligence (CDD) frameworks, and transaction monitoring programmes. PF can no longer be treated as a footnote within a broader AML programme — it requires dedicated controls, documented measures, and senior management accountability.
A Lower Evidentiary Threshold: The “Should Have Known” Standard
One of the most consequential shifts in the new law is the lowering of the criminal threshold for all three principal offences. Previously, establishing an AML offence required proof of actual knowledge. Under the new framework, knowledge can be inferred from objective circumstances — what a reasonable person in that position should have known.
This is a move from a subjective to an objective standard of proof. Conduct that may previously have been characterised as ancillary or negligent can now constitute a criminal offence in its own right. For compliance teams, this means that insufficient oversight of delegated functions, failures to implement adequate systems and controls, and compliance deficiencies that increase exposure to financial crime are no longer just regulatory failures — they may now give rise to direct criminal liability.
Wider Scope: Who Is Now Caught?
The new framework significantly expands the categories of entities subject to AML/CFT/CPF obligations.
- Commercial gaming operators: including casinos, online gaming platforms, sports betting operators, and lottery providers, are now formally recognised as Designated Non-Financial Businesses and Professions (DNFBPs) for the first time. The federal General Commercial Gaming Regulatory Authority (GCGRA) oversees this newly regulated sector. For online gaming transactions, a reporting threshold of AED 11,000 applies, whether in a single transaction or cumulatively across linked transactions.
- Virtual Asset Service Providers (VASPs): are also subject to a more comprehensive regime under the executive regulations, with tightened controls for virtual asset transfers, enhanced CDD requirements, and explicit coverage within the broader AML/CFT/CPF framework.
- Tax evasion: both direct and indirect, has been expressly included as a predicate offence, widening the base of underlying crimes from which illicit proceeds can be generated.
Enhanced Enforcement: Bigger Fines, Faster Freezes, and a Stronger FIU
The new law does not merely expand obligations — it dramatically strengthens the enforcement machinery.
- Financial penalties for legal persons whose representatives, directors, or agents commit offences now range from AED 5 million to AED 100 million, or an equivalent amount to the value of the proceeds involved. This represents a substantial increase in exposure for companies operating in the UAE.
- The Financial Intelligence Unit (FIU) has been vested with significant new powers. It can now suspend transactions for up to 10 days and freeze assets for up to 30 days, powers previously reserved for the Central Bank Governor. All Suspicious Transaction Reports must now be submitted exclusively to the FIU by financial institutions, DNFBPs, and VASPs, centralising the intelligence function and improving the effectiveness of financial crime detection. The Public Prosecution may also now seek the FIU’s opinion during investigations, reinforcing its advisory role in financial crime cases.
Enforcement across the UAE has already been ramping up in parallel. The UAE Central Bank issued over AED 370 million in fines in 2025, including a AED 200 million fine on a single exchange house for AML and CTF framework failures.
UBO Transparency, CDD, and the Operational Detail of the Executive Regulations
Comprising 71 articles and nearly 300 enforceable requirements, the executive regulations translate the new law into concrete, actionable obligations. Key operational areas include:
- Ultimate Beneficial Ownership (UBO): Enhanced requirements for UBO transparency mean that regulated entities must be able to produce accurate UBO information promptly, supported by clear ownership maps, data quality checks, and retrieval processes aligned to regulatory timelines.
- Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD): The executive regulations expand and tighten CDD, EDD, and PEP measures. Senior management is expected to personally approve internal policies and oversee high-risk relationships, particularly those involving proliferation financing.
- International cooperation: Mutual legal assistance procedures have been simplified, foreign confiscation orders are now executable without the need for separate national investigations, and tax matters no longer constitute grounds for refusing cooperation requests. This means cross-border transactions face greater scrutiny from multiple jurisdictions simultaneously.
What This Means for Your Compliance Programme
For compliance officers in the UAE — and those operating into it from elsewhere — the new framework requires more than a review of existing policies. It demands a fundamental recalibration of how risk is identified, assessed, and managed.
The critical actions are:
- Conduct a comprehensive gap assessment: Map your current AML framework against the new law and executive regulations. Priorities include proliferation financing integration, expanded CDD and EDD obligations, and UBO documentation.
- Embed perpetual monitoring: The move to an objective standard of proof places a premium on documented, ongoing oversight. Static, point-in-time compliance programmes are not sufficient; dynamic risk ratings and continuous monitoring are now the expectation.
- Prepare for faster regulatory engagement: With the FIU empowered to freeze assets in 30 days and suspend transactions in 10, the window between regulatory concern and enforcement action has narrowed significantly. Firms must ensure records of risk assessments, legal analyses, and actions taken in response to orders are readily available.
- Senior management must be personally engaged: The new framework places accountability squarely at the level of senior leadership. AML compliance is no longer a back-office function, it is a board-level obligation.
Looking Ahead
The UAE’s new AML framework is the result of years of deliberate reform, international dialogue, and hard-won progress. The next FATF mutual evaluation looms, and regulatory authorities have shown they are prepared to enforce. For businesses in the UAE, the cost of compliance is always lower than the cost of violation.
At norbloc, we work with regulated entities across the region to build dynamic, automated compliance platforms capable of meeting exactly these kinds of evolving requirements; from risk-based onboarding and perpetual KYC to real-time monitoring and audit-ready documentation. If your compliance process needs to keep pace with the UAE’s new framework, we are here to help.
