The New UAE Anti-Money Laundering Law: What Changed for Companies in 2026

The short answer. Since 14 October 2025 the United Arab Emirates has had a new primary statute on anti-money laundering, counter-terrorist financing and counter-proliferation financing — Federal Decree-Law No. 10 of 2025 — and since 14 December 2025 its executive regulations, Cabinet Resolution No. 134 of 2025. The previous statute, Federal Decree-Law No. 20 of 2018, and its regulations, Cabinet Resolution No. 10 of 2019, have been repealed in full. For an ordinary UAE company this translates into five practical changes: a new category of obliged person, a new AED 11,000 threshold, mandatory prior approval of the compliance officer by the supervisory authority, an express prohibition on bearer shares, and a new floor for administrative fines of AED 10,000 instead of AED 50,000.

Important. Repealing the 2018 statute did not wipe out the secondary instruments. Article 41(3) of the new decree-law expressly keeps in force the regulations, resolutions and circulars issued under the old statute, to the extent they do not conflict with the new one and until they are superseded. Cabinet Resolution No. 74 of 2020 on targeted financial sanctions, Cabinet Decision No. 109 of 2023 on beneficial owner procedures and Cabinet Resolution No. 71 of 2024 on DNFBP administrative penalties therefore continue to apply — even though several of them cross-refer to provisions that no longer exist. Cabinet Resolution No. 132 of 2023 survives on the same chain only indirectly: its preamble cites not the 2018 statute but Cabinet Decision No. 109 of 2023, which Article 41(3) preserves. This is not a drafting curiosity: these are the instruments under which fines are actually issued.

Nine facts to have in mind before reading the rest.

•          Federal Decree-Law No. 10 of 2025 was issued on 30 September 2025, published in Official Gazette No. 808 of 30 September 2025 and entered into force on 14 October 2025 — two weeks after publication, as its Article 42 requires.

•          Cabinet Resolution No. 134 of 2025 was issued on 29 October 2025, published in Official Gazette No. 811 of 14 November 2025 and entered into force on 14 December 2025 — thirty days after publication, under its Article 71.

•          The new statute runs to 42 articles against 35 numbered articles in the old one — 38 article units once the inserted Articles 16 BIS, 25 BIS and 26 BIS are counted; and the words “financing of illegal organizations” in the title have been replaced by “proliferation financing”.

•          The administrative fine is now AED 10,000 to AED 5,000,000 per violation (Article 17 of the new statute), against AED 50,000 to AED 5,000,000 before.

•          The fine on a legal person for money laundering, terrorist financing or proliferation financing has risen to AED 5,000,000–100,000,000, or the value of the criminal property if greater (Article 27), against AED 500,000–50,000,000 previously.

•          Commercial gaming operators enter the list of designated non-financial businesses and professions for the first time, with a threshold of AED 11,000 on a single or linked transactions (Article 3(1) of Resolution 134).

•          The AED 55,000 customer due diligence trigger for occasional transactions is now addressed to financial institutions, and the AED 3,500 threshold for virtual asset service providers has moved into the main due diligence article (Article 7(2) and 7(3) of Resolution 134); for them that threshold is not new in substance.

•          The ban on bearer instruments now reaches bearer shares themselves and any untraceable equivalent, and instruments already in issue had to be converted into registered shares within 30 working days of publication of the regulations (Article 38(4) of Resolution 134); bearer share warrants were already prohibited under the previous regulations.

•          The supervisory authority must require prior approval of the compliance officer (Article 49(18) of Resolution 134); under the previous regulations such approval was discretionary and ran through the Financial Intelligence Unit.

What follows is a block-by-block analysis of the obligations, with pinpoint references and a clear line between what genuinely changed and what merely moved from one instrument to another.

What exactly changed, and from when

The whole statutory pair changed: both the law and the executive regulations. The old construction — Federal Decree-Law No. 20 of 2018 plus Cabinet Resolution No. 10 of 2019 — has been replaced by Federal Decree-Law No. 10 of 2025 plus Cabinet Resolution No. 134 of 2025. This is not an amendment to an existing statute but a new statute that repeals the old one.

The two commencement dates differ, and the gap matters when assessing any 2025 transaction.

The statute itself applies from 14 October 2025. Article 42 provides for publication in the Official Gazette and entry into force two weeks later; publication took place on 30 September 2025 in Official Gazette No. 808.

The executive regulations apply from 14 December 2025. Article 71 of Resolution 134 provides for entry into force thirty days after publication; publication took place on 14 November 2025 in Official Gazette No. 811, even though the resolution itself was issued on 29 October 2025.

Between 14 October and 14 December 2025 there was a transitional window in which the new statute already applied while the detailed rules still came from the old Resolution 10 of 2019 — by virtue of Article 41(3) of the new statute, which kept the secondary instruments of the old law alive until superseded.

Both texts are published on the federal legislation portal: Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. The statute is mirrored in the CBUAE Rulebook with an “In-Force” status and the same 14 October 2025 date.

The English text on the portal is not the authoritative one. The portal’s own disclaimer states that reference must be made to the original Arabic text for interpretation and application, and that the Arabic prevails in the event of conflict. That matters wherever the English admits two readings — such places are flagged individually below.

What has been repealed, and what remains in force

Two instruments have been repealed in full: Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019. The first by Article 41(1) of the new statute, the second by Article 70 of Resolution 134. The rest of the perimeter does not survive unconditionally: Article 41(2) of the statute and Article 70 of the regulations repeal any provision that conflicts with the new rules, so the surviving instruments operate only to the extent they do not collide with Decree-Law No. 10 of 2025 and Resolution No. 134 of 2025.

The chain of change that produced the current position looks like this — and it matters, because a great deal of published material, including guidance from the regulators themselves, still describes intermediate links as live law.

The Higher Committee and the National Committee are not inventions of the 2025 statute — nor even of the 2024 amendments. The National Committee was created by Article 11 of Decree-Law No. 20 of 2018 itself, and that article already provided for it to be chaired by the Governor. The Higher Committee existed by November 2023 at the latest: Article 21(2) of Cabinet Decision No. 109 of 2023 requires the Minister to report to it by name. What Article 12 of Decree-Law No. 10 of 2025 adds is that the Higher Committee is now expressly affiliated with the Presidential Court, while Articles 13–15 describe the National Committee and its General Secretariat in more detail than the former Articles 11 and 12 did. The sequence is confirmed by the “Understanding the Law” page of the UAE Financial Intelligence Unit.

The list of live instruments is confirmed by the supervisor itself. The financial crimes legislation page of the UAE Ministry of Economy and Tourism names exactly six: Decree-Law No. 10 of 2025, Resolution No. 134 of 2025, Resolution No. 74 of 2020, Decision No. 109 of 2023, Resolution No. 132 of 2023 and Resolution No. 71 of 2024.

No new Cabinet resolution on violations and administrative penalties under Article 39 of the new statute appears on the federal legislation portal or in the Ministry of Economy and Tourism’s list of instruments in force, as at 15 September 2026. Article 39 directs the Cabinet to issue one on the proposal of the Minister of Finance and after coordination with the supervisory authority. Until it appears, Resolution No. 71 of 2024 governs — even though its Article 1 defines its terms by reference to the repealed Resolution No. 10 of 2019 and its annex cites that resolution’s article numbers. The practical consequence: the charging provisions still bite, while their cross-references have to be mapped onto the new numbering by hand.

Who the law applies to: four circles of obliged persons

The statute addresses four groups: financial institutions, designated non-financial businesses and professions (DNFBPs), virtual asset service providers (VASPs) and non-profit organisations. Three of the four are defined by reference to the executive regulations, and the operative activity lists sit in Articles 2, 3 and 4 of Resolution No. 134 of 2025. Non-profit organisations are defined differently — directly in Article 1 of the statute itself, as an organised group of a continuing nature, for a definite or indefinite duration, not aimed at profit, which collects, receives or disburses funds for charitable, religious, cultural, educational, social, solidarity and other benevolent purposes; their obligations sit in Article 34 of the regulations.

Financial institutions are thirteen named activities plus an open-ended item. Article 2 of Resolution 134 lists deposit-taking, lending, financial leasing (other than leasing of consumer products), money or value transfer services, issuing and managing means of payment, guarantees and financial commitments, trading in money-market and foreign exchange instruments and commodity futures, participation in securities issues, fund and portfolio management, safekeeping and administration of cash or liquid securities, other operations investing, managing or operating funds on behalf of others, life and investment-linked insurance, and currency exchange. The fourteenth item lets the supervisory authority, in coordination with the National Committee, add any other financial activity.

Designated non-financial businesses and professions are five named categories plus an open-ended item, and the composition has changed.

Virtual asset service providers are five activities. Article 4 of Resolution 134 names exchange between virtual assets and fiat currencies, exchange between types of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or of instruments enabling control over them, and provision of financial services or activities relating to an issuer’s offer or sale of virtual assets, or participation therein. The sixth item is again open-ended.

The governing practical rule: operating without a licence, registration or enrolment is prohibited. Article 20 of the statute bars any natural or legal person from conducting financial activities, DNFBP activities or VASP activities without a licence, registration or enrolment from the competent or the relevant supervisory authority. The sanction sits in Article 32: imprisonment and a fine of AED 200,000 to AED 10,000,000, or either of them.

Obligations attach to the activity, not to the corporate form. Neither the statute nor the regulations link DNFBP status to a licence type, a registration jurisdiction or a size test: what counts is the activity actually carried on. A free zone company providing corporate services and a mainland company doing the same thing are therefore equally obliged persons. Only the status coincides: their supervisor and their beneficial ownership regime differ, and for financial free zone companies that difference is material — it is set out below. The practical side of choosing a jurisdiction and a licence is covered separately in our guide to setting up a company in the UAE.

Commercial gaming operators: a new category and the AED 11,000 threshold

Article 3(1) of Cabinet Resolution No. 134 of 2025 brings commercial gaming operators into the designated non-financial businesses and professions for the first time. The trigger is a single financial transaction, or several transactions that appear to be linked, of AED 11,000 or more. The category expressly extends to gaming conducted on board vessels and other marine craft.

A transaction involving only gaming chips or gaming instruments is not a financial transaction. That carve-out sits in the text of the sub-paragraph itself and fixes the moment the obligation arises: it attaches to monetary turnover, not to play.

The definition captures four forms of activity. Article 1 of Resolution 134 defines commercial gaming operators as persons operating commercial gaming halls, internet gaming, sports betting or lottery gaming. Commercial gaming itself is defined more broadly — any game of chance, or any form of chance-based or skill-based practice, involving a monetary stake placed to win money or another item of value, including agreements under which the loser compensates the winner. The disjunction matters: the definition reaches practices that are purely skill-based, provided a monetary stake is placed.

Neither the statute nor the regulations expressly designate a supervisor for this sector. The name “General Commercial Gaming Regulatory Authority” appears exactly once in Resolution 134 — inside the definition of commercial gaming, as a reference to games “regulated by the General Commercial Gaming Regulatory Authority”. The supervisory authority is defined generically in Article 1 of the statute: the federal and local authorities entrusted by legislation with supervision, or, where none is designated, the competent authorities that grant approval to carry on the activity. The authority’s own website describes it as the federal executive agency with exclusive jurisdiction to regulate, license and supervise all commercial gaming activities in the UAE, and states that operating without its licence is illegal; its role follows from those two elements together, but the regulations do not appoint it in terms.

The precise number of the establishing decree is not publicly confirmed. The authority says it was established by federal decree-law, but no such instrument was published on the federal legislation portal as at 15 September 2026. This article therefore does not cite a number for it: it is not confirmed by a primary source.

Why this matters to adjacent sectors. The new category does more than change the position of operators themselves: banks, corporate service providers and accounting firms serving the gaming sector now face a client who is itself an obliged person, which feeds directly into the business relationship risk assessment under Article 5 of Resolution 134.

Due diligence thresholds: AED 55,000 and AED 3,500, and who they now address

The architecture of the thresholds has changed: the general triggers are separated from the monetary ones, and the monetary ones are split between financial institutions and virtual asset service providers. Article 6 of the old regulations addressed the AED 55,000 and AED 3,500 thresholds jointly to “financial institutions and DNFBPs”, while virtual asset service providers had a separate AED 3,500 trigger in Article 33 (BIS 3) of the same instrument. Article 7 of Resolution No. 134 of 2025 separates them into different clauses.

This does not mean the monetary thresholds have disappeared for DNFBPs. Their own triggers sit in Article 3: AED 11,000 for commercial gaming operators and AED 55,000 in cash for dealers in valuable metals and precious stones. On top of that, all three general triggers in Article 7(1) apply to DNFBPs in full, and the commencement of a business relationship is by itself a sufficient reason for complete customer identification.

The dealer threshold is drafted asymmetrically. The English text of Article 3(3) refers to “any single cash transaction or several transactions that appear to be linked” — the word “cash” is not repeated in the second limb, whereas the previous version referred to cash transactions in both. Whether this widens the trigger to non-cash linked transactions cannot be settled from the English; the Arabic original prevails, and the point should be checked with local counsel before thresholds are configured in an accounting system.

Identification must precede the transaction. Article 6(1) requires verification of the identity of the customer and the beneficial owner before or during the establishment of a business relationship or the opening of an account, or before carrying out a transaction for a customer with whom no relationship exists. Completion may be deferred only in low-risk cases and only on the three conditions in Article 6(2): completion as soon as possible, deferral necessary so as not to disrupt the normal course of business, and effective risk control measures in place.

Declining the transaction is mandatory where due diligence cannot be applied. Article 14(1) prohibits establishing or continuing a business relationship or executing a transaction where customer due diligence measures cannot be applied, and requires the firm to consider filing a suspicious transaction report. Article 14(2) allows the firm to refrain from applying those measures where there are reasonable grounds to believe they would tip the customer off — but then a report must be filed, stating the reasons.

Simplified due diligence is subject to four conditions at once. Article 5(3) allows simplified measures only upon fulfilling the requirements of Articles 5(1) and 5(2), only “in coordination with the Supervisory Authority”, only where low risk has been identified and only in the absence of suspicion. “In coordination with” is weaker than formal approval, but it still rules out moving to a simplified regime without the supervisor’s involvement; the precise reach of the requirement is set by the Arabic original.

The beneficial owner: the 25 per cent test and three parallel regimes

A beneficial owner is the natural person who ultimately owns, whether individually or jointly with another person, an actual controlling ownership interest or shares of 25 per cent or more. That is the wording of Article 10(1)(a) of Resolution No. 134 of 2025. The threshold reads “25 per cent or more”, not “more than 25 per cent” — the boundary is inside the test — and “individually or jointly” means joint holdings aggregate.

The three-step cascade applies strictly in order, and the second rung engages earlier than most firms assume.Paragraph (b) is triggered by any of three circumstances: doubt as to the identification of the person under paragraph (a); doubt that the holder of an ownership interest or controlling shares is truly the beneficial owner; or no natural person exercising control through an ownership interest. Doubt is enough — the first rung does not have to fail outright. The firm then identifies the natural person who exercises legal or actual control by any other means, directly or indirectly. Only where no person is identified under either paragraph (a) or paragraph (b) does the firm fall back to the relevant natural person holding a senior management position (paragraph c).

Legal arrangements carry their own set of roles. Article 10(2) requires identification of the trustee, settlor, trust protector, and beneficiaries or classes of beneficiaries together with the powers granted to them where no beneficiaries are identifiable when the trust is established; of any other natural person exercising ultimate effective control; the obtaining of adequate information on the beneficial owner sufficient to identify them at the time of payment or when they seek to exercise vested rights; and the identification of natural persons holding equivalent or similar positions in other legal arrangements. Where a legal person is a party to the arrangement, its own beneficial owner is identified under the same rules.

Listed companies are carved out. Article 11 permits a firm not to identify or verify shareholders or beneficial owners where the customer or the controlling owner is a company listed on a securities market subject to disclosure requirements ensuring sufficient transparency, or a controlled subsidiary of such a company.

Here lies the main practical difficulty: there are three regimes, and they do not align.

The two deadlines are easy to confuse, and the cost of confusing them is concrete. Resolution 134 speaks of 15 working days to update the company’s own registers and its nominee director and shareholder data. Decision No. 109 of 2023 speaks of 15 days to file the change with the Registrar. The shorter calendar clock governs the filing; the longer working-day clock governs internal records. Applying the longer period to the filing is a direct route to a penalty under Resolution No. 132 of 2023.

The fifteen working days are not a 2025 invention. Article 35(2) of the repealed Resolution No. 10 of 2019 already required basic information to be updated “every fifteen business days in case of making any amendments or changes thereto”. The new regulations keep that clock and extend it to nominee director and shareholder data and to beneficial owner information.

Nominee directors and shareholders must disclose themselves. Article 39 of Resolution 134 requires a nominee director or nominee shareholder to notify the company of that capacity, disclose information about the person they represent, and report any change within no more than 15 working days. Article 1 states expressly that a nominee shareholder is not to be treated as the beneficial owner merely by virtue of holding shares in a nominee capacity.

Retention runs for five years after the company ceases to exist. Article 40 obliges the Registrar, companies, the persons responsible for their management or liquidation and any other persons concerned with the dissolution of a company to keep the records and information referred to in Articles 37, 38 and 39 for not less than five years from the date of dissolution or cessation of existence, or from the date the company ceased to be a customer of a financial institution or professional intermediary.

Mapping an actual ownership structure and preparing correct registers belongs to legal support work, because an error in the Article 10 cascade then propagates through every reporting form the company files.

Bearer shares: an express prohibition and a 30-working-day conversion window

Article 38(4) of Resolution No. 134 of 2025 prohibits any company established and registered in the UAE from issuing bearer shares, bearer share warrants or any similar instruments that cannot be traced.

The prohibition itself is not new, and it is worth being precise about what is. Article 35(4) of the repealed Resolution No. 10 of 2019 already provided that “any company incorporated and registered in the State may not issue stock warranties for holder thereof” — the portal’s 2019 English rendered bearer share warrants that way, which is why searching the 2019 text for the word “bearer” returns nothing. Three things are new in 2025: the express extension to bearer shares themselves and to “any similar instruments that cannot be traced”; the conversion deadline for instruments already in issue; and the procedure that governs the conversion period.

Instruments already in issue had to be converted within 30 working days of the date of publication of the Resolution. Publication took place on 14 November 2025 in Official Gazette No. 811, so the window closed at the end of December 2025. Conversion is into registered shares in accordance with the legislation in force in the UAE.

A separate procedure governs the conversion period. The holder of bearer shares, bearer share warrants or similar instruments must notify the company of their capacity and status, and the company must register the holder’s identity before any rights attached to the instruments are exercised. In other words, during the transition an unregistered holder could neither vote nor receive distributions.

The provision reaches further than it first appears. Bearer instruments are rare in UAE mainland companies but turn up regularly higher in the ownership chain, inside foreign holding entities that sit in a local company’s structure. The Article 38(4) prohibition is addressed to companies registered in the UAE; but a bearer instrument in a foreign link makes it impossible to complete the beneficial ownership analysis under Article 10 correctly, and therefore creates an automatic breach of the duty in Article 38(1)(d) to hold accurate and up-to-date beneficial owner information.

The sanction for false beneficial ownership information is criminal. Article 35(1) of the statute imposes imprisonment and a fine of not less than AED 20,000, or either penalty, on any person who intentionally provides false or misleading information about the beneficial owner to any competent authority requesting such information, or to a financial institution, a DNFBP or a virtual asset service provider.

The compliance officer: prior approval is now mandatory

Article 49(18) of Resolution No. 134 of 2025 requires the supervisory authority to maintain an updated list of the compliance officers of supervised entities, to notify the Financial Intelligence Unit of it, and to require those entities to obtain prior approval before appointing their compliance officers. The obligation is drafted as a duty of the supervisory authority, but it operates against companies: appointing a compliance officer without prior approval becomes a breach.

The modality of the rule has changed, and that much is firm. Article 44(14) of the repealed Resolution No. 10 of 2019 provided that the supervisory authority retains and informs the Financial Intelligence Unit of an updated list of compliance officers and may oblige supervised institutions to obtain the Unit’s approval prior to appointment. In the new text the discretion has become a duty: the supervisory authority requires prior approval.

Who gives that approval is not settled by the English text. In the phrase “requiring such entities to obtain its prior approval”, the pronoun can grammatically attach either to the supervisory authority — the subject of Article 49 and of the verb “requiring” — or to the Financial Intelligence Unit, named immediately before it in the same item. The first reading is the more reliable one, because it follows the subject; the second draws support from the 2019 construction, where approval ran through the Unit. The Arabic original settles the point, and until it is checked the safe practice is to approach the supervisory authority, which in any event maintains the list and notifies the Unit of it.

The role itself is mandatory for all three categories. Article 21(3) requires internal policies to include appropriate compliance management arrangements, including the appointment of a compliance officer at management level. Article 22 adds requirements as to the person: appointment at management level and under the firm’s responsibility, independence in decision-making, and appropriate competence and experience.

The compliance officer’s duties are a closed list of five. Article 22 names: monitoring transactions related to the crime; reviewing records, receiving and assessing suspicious transaction data and deciding whether to notify the Unit or retain the matter with reasons stated, in full confidentiality; reviewing internal systems and procedures against the statute and the regulations, assessing the firm’s level of compliance, proposing updates, and preparing periodic reports submitted directly to senior management with a copy to the supervisory authority on request; developing, implementing and documenting ongoing training programmes and plans; and cooperating with the supervisory authority and the Unit, supplying any data they request and giving their assigned personnel access to the necessary records and documents. There is no open-ended sixth item in Article 22 — unlike Articles 2, 3 and 4, each of which carries one.

The compliance officer’s report goes straight to senior management. Article 22(3) requires periodic reports to be submitted directly to senior management, with a copy to the supervisory authority on request, and — importantly — including senior management’s observations and decisions. That turns the leadership’s response into a documented part of the compliance file rather than an internal matter.

“Senior management” is defined in the regulations. Article 1 of Resolution 134 covers the person or persons vested with authority to take strategic and executive decisions materially affecting risk management, compliance policies and operational governance, including chief executive officers, general managers, board members and any person able to influence directly the conduct of the business and its internal policies.

Internal policies, risk assessment and record keeping

A risk assessment is mandatory and must be documented. Article 5(1) of Resolution 134 requires firms to identify, understand, manage and assess their crime risks proportionately to the nature and size of the business, taking account of the risk-based approach and the results of the National Risk Assessment. Paragraph (a) requires all relevant risk factorsto be considered before the overall risk level is set, and names them only by way of example: customer risk, country and geographic risk, and product, service, transaction and delivery channel risk. The list is open-ended, and covering exactly those six is not compliance. Paragraph (b) requires the identification and assessment processes to be documented, the study retained and continuously updated, and made available to the authorities on request.

Internal policies are approved by senior management and must contain six mandatory blocks. Article 21 names: customer due diligence measures, including risk management for relationships before verification is complete; suspicious transaction reporting procedures; compliance management arrangements including the appointment of a compliance officer at management level; screening procedures to ensure high standards of fitness and propriety in hiring; periodic programmes and workshops to build the capacity of the compliance function and other relevant staff; and an independent audit function to test the effectiveness and adequacy of the internal framework.

Enhanced due diligence is spelled out through seven examples. Article 5(2)(c) lists: obtaining and verifying additional information on the customer’s identity and occupation, the beneficial owner and the amount of funds, including from public databases and open sources; obtaining additional information on the purpose of the relationship or the reasons for expected and executed transactions; updating customer information more regularly; taking reasonable measures to establish the source of funds and source of wealth; increasing the degree and level of ongoing monitoring; making the first payment through an account in the customer’s name at an institution subject to equivalent standards; and obtaining senior management approval to start or continue the relationship.

Politically exposed persons are split into two regimes. Article 16(1)(a) requires, for foreign PEPs and in every case, risk management systems to identify them, senior management approval, reasonable measures to establish source of funds and wealth, and enhanced ongoing monitoring. Article 16(1)(b) requires, for domestic PEPs and persons entrusted with prominent functions in international organisations, adequate measures to identify them — with the full enhanced package only where the relationship is high risk.

New technologies are assessed before launch. Article 24(2) requires firms to assess the risks of new products, new business practices, new service delivery mechanisms and new or developing technologies before launch or use, and to take appropriate measures to manage and mitigate them.

Retention is not less than five years, but the starting point floats. Article 25(1) requires all records, documents and data on domestic and international financial and cash transactions to be kept for not less than five years from completion of the transaction or termination of the business relationship. Article 25(2) adds a separate rule for due diligence material, account files, business correspondence, copies of identification documents, suspicious transaction reports, the results of any analysis, and closed-circuit television and automated teller machine recordings and any other recordings: five years measured from the most recent of relationship termination, account closure, completion of an occasional transaction, completion of a supervisory inspection, completion of an investigation, or the issue of a final court judgment.

The five-year period is not itself new: the repealed Resolution No. 10 of 2019 used the same duration. What is new is the list of items caught — the express reference to CCTV and ATM recordings — and the “most recent of” construction, which in practice lengthens actual retention in any matter touched by an inspection or an investigation.

Configuring the record layer and primary document storage belongs to accounting support: that is usually where a firm discovers that documents were destroyed on the general tax cycle rather than the anti-money laundering one.

Suspicious transaction reports and the goAML system

Reports are filed immediately and without delay, regardless of amount. Article 18(1) of the statute requires financial institutions, DNFBPs and virtual asset service providers to notify the Financial Intelligence Unit where they suspect, or have reasonable grounds to suspect, that a transaction or funds represent proceeds in whole or in part, are related to the crime or are intended to be used in it — “regardless of their value”. Article 18(1) of Resolution 134 adds attempted transactions and expressly removes banking secrecy, professional secrecy and contractual liability as objections.

The Financial Intelligence Unit is the sole recipient. Article 11 of the statute establishes an independent Financial Intelligence Unit within the Central Bank and provides that all suspicious transaction reports and related information are submitted to it exclusively. Reports go through the Unit’s electronic system or any other means it approves.

Tipping off is prohibited. Article 19(1) of Resolution 134 prohibits the firm, its directors, officers and employees from disclosing, directly or indirectly, to the customer or any other person that a report has been or is about to be submitted, or any related data, or that an investigation is under way. The exception is information sharing inside a financial group under Article 32. Article 19(2) confirms that an attempt by a lawyer, notary, other independent legal professional or independent statutory auditor to dissuade a client from an unlawful act is not disclosure.

Professional privilege is carved out of the reporting duty, and the list of circumstances is not closed. Article 18(2) of the statute exempts lawyers, notaries, other legal professionals and independent legal auditors where the information was obtained in circumstances subject to professional secrecy. Article 18(2) of Resolution 134 lists the circumstances: assessing the client’s legal position, defending or representing the client before courts or in arbitration or mediation, or providing a legal opinion relating to judicial proceedings, including advice on initiating or avoiding them — whether before, during or after the proceedings. The list closes with the words “or in other circumstances subject to professional secrecy”, so it remains open-ended, and reading the exemption as confined to the enumerated cases is wrong.

Filing happens through goAML in practice. The system was developed by the UN Office on Drugs and Crime; the UAE Financial Intelligence Unit states that the platform went live in June 2019 and is the national reporting system. It carries more report types than most firms realise.

The scale of the system is measurable. According to the UAE Financial Intelligence Unit’s 2025 annual report, published on 19 August 2026, the registered reporting entity base reached 6,870 by the end of 2025 — up 49 per cent on 2024 and 104.44 per cent cumulatively since 2023. During 2025 the Unit disseminated 428 intelligence products domestically, issued 383 reactive technical reports (up 33 per cent), made 156 freeze recommendations (up 36 per cent), answered 6,028 domestic requests, received 1,478 inbound requests from foreign counterparts and sent 249 spontaneous disclosures to 83 counterpart units. The goAML platform was upgraded from version 4.4 to version 5.6, with go-live planned for the first quarter of 2026.

Some sectors carry threshold reports of their own, and this is routinely missed. DPMSR and REAR filings are not triggered by suspicion but by the threshold itself: a cash settlement of AED 55,000 or more at a dealer, or the same amount in cash or a virtual asset settlement in a freehold property transaction. The absence of suspicion does not excuse the filing.

A material caveat on the source of that taxonomy. The table reflects the Financial Intelligence Unit’s operational classification of reports, version 1.2 of 29 April 2024. As at 15 September 2026 that document no longer opens at its former address on the Unit’s website: the site has been reorganised, and the reporting section now publishes only the goAML registration guide. None of the threshold reports in the table is created by the text of the regulations: Article 3(3) of Resolution No. 134 of 2025 uses the AED 55,000 figure only to bring a dealer within the DNFBP definition and to trigger due diligence, not to trigger a filing, and it contains no foreign-currency equivalence clause. The list, the thresholds and the forms should be confirmed inside the goAML portal itself before processes are built around them.

The practical consequence for companies that are not obliged persons at all: their own transactions still pass through these filters at the bank, and this is the single most common reason an account is refused — the mechanics are set out in our analysis of why banks reject UAE companies.

Targeted financial sanctions: a separate perimeter with its own clocks

Targeted financial sanctions are governed not by the new statute but by Cabinet Resolution No. 74 of 2020, which remains in force. It was issued on 27 October 2020, published in Official Gazette No. 689 (supplement) of 28 October 2020 and entered into force on 29 October 2020. It repealed the earlier Resolution No. 20 of 2019 and survives by virtue of Article 41(3) of the new statute.

The new statute defines targeted financial sanctions and criminalises breaches of them. Article 1 defines them as the freezing of funds and the prohibition on making them available, directly or indirectly, for the benefit of any person or organisation designated by Cabinet resolutions on terrorist lists or by the UN Security Council under Chapter VII of the UN Charter. Article 19(1)(e) requires firms to implement forthwith the instructions issued by the Executive Office or any other competent authorities concerning targeted financial sanctions. Article 33 imposes imprisonment and a fine of not less than AED 20,000, or either penalty, for breaching those instructions.

The Executive Office for Control and Non-Proliferation is identified in the statute as the body responsible for applying targeted financial sanctions. Its status rests on Cabinet Resolution No. 15 of 2022, issued on 9 March 2022, published in Official Gazette No. 723 of 14 March 2022 and in force from 15 March 2022.

Eight concrete obligations sit in Article 21 of Resolution No. 74 of 2020. Registration on the Executive Office website to receive designation, re-designation, updating and de-listing notifications. Continuous screening of databases and transactions against the Security Council, Sanctions Committee and local lists, including searches of the customer database, of the parties to any transaction, of potential clients, of beneficial owners, of persons and organisations with whom there is a direct or indirect relationship, and a standing search of the customer database before any operation is performed or any business relationship entered into. Freezing without delay and without prior notice on any match. Implementing an unfreezing decision without delay. Immediate reporting to the supervisory authority in six listed cases. Establishing and effectively implementing internal controls. Policies prohibiting staff from telling a customer that a freeze will be applied. Cooperating with the Executive Office and the supervisory authority on the accuracy of information provided.

Registration on the Executive Office website is a standalone duty. It is neither replaced by nor derived from goAML registration: different systems, different bodies, different legal bases. For designated non-financial businesses and professions supervised by the Ministry of Justice and the Ministry of Economy and Tourism, failing it is a charged violation — row 33 of the annex to Resolution No. 71 of 2024; financial institutions and virtual asset service providers answer under their own supervisors’ regimes, since that annex is expressed by its own title to cover only entities under the control of those two ministries.

There is a divergence over who must be notified, and it is material. Article 21(5) of Resolution No. 74 of 2020, in the text published on the federal legislation portal, requires immediate reporting to the supervisory authority. Rows 37–40 of the annex to Resolution No. 71 of 2024 describe the same violations by reference to the sub-paragraphs of Article 21(5) of that same resolution, but name the Executive Office for Control and Non-Proliferation as the recipient. The English texts do not resolve the point: Resolution 74 is built on a two-step relay (firm to supervisor, supervisor to Executive Office), while the 2024 penalty schedule assumes direct notification of the Executive Office. Until the point is settled the safe practice is to notify both; the Arabic original governs interpretation.

Supervisors pass the information on to the Executive Office within five working days. Article 22(1) of Resolution No. 74 of 2020 requires supervisory authorities to receive all information from supervised entities on frozen funds and measures taken and to send it to the Executive Office within five working days of receipt, and Article 22(5) requires at least semi-annual reports to the Executive Office on supervision outcomes.

A separate discipline applies when executing transfers. Article 28(8) of Resolution No. 134 of 2025 requires financial institutions processing wire transfers to apply freezing and transaction-prohibition measures in accordance with instructions from the Executive Office and other competent authorities. For virtual asset service providers, Article 36(3) extends to them all obligations applicable to financial institutions on targeted financial sanctions.

Who supervises whom: the regulator map

There is no single anti-money laundering regulator in the UAE: the supervisor is determined by activity and place of registration. Article 1 of the statute defines the supervisory authority as the federal and local authorities entrusted by legislation with supervising financial institutions, DNFBPs, virtual asset service providers and non-profit organisations — or, where no specific supervisor is designated, the competent authorities responsible for granting approval to carry on the activity or profession.

The Capital Market Authority replaced the Securities and Commodities Authority on 1 January 2026. Federal Decree-Law No. 32 of 2025 was issued on 1 October 2025, published in Official Gazette No. 809 of 14 October 2025 and entered into force on 1 January 2026. Any reference to the former designation in pre-2026 documents therefore reads as a reference to the new authority.

The Central Bank operates under a new statute of its own. Federal Decree-Law No. 6 of 2025 was issued on 8 September 2025, published in Official Gazette No. 807 of 15 September 2025 and entered into force on 16 September 2025 — barely a month before the new anti-money laundering statute.

Supervisory powers have been expanded to nineteen items. Article 49 of Resolution No. 134 of 2025 lists, among others: identifying and assessing the risks of new products and technologies; applying a risk-based approach; issuing instructions, regulations and forms; setting fitness and propriety systems to keep criminals and their associates from holding significant or controlling interests or from participating in management; coordinating with the Financial Intelligence Unit on suspicion indicators and on the quality of reports; off-site and on-site inspections on a risk basis; setting inspection frequency by reference to the National Risk Assessment and to each firm’s own risk profile; and ensuring full and immediate compliance with targeted financial sanctions instructions, with effective, proportionate and dissuasive penalties where there is not.

The supervisor may publish the penalties it imposes. Article 17(4) of the statute expressly permits publication of administrative penalties through various media outlets, and in practice the Ministry of Economy and Tourism regularly discloses fine totals and the number of offenders by sector. The jurisdiction profile and the split of supervisory powers across the emirates are set out on our UAE country page.

Administrative fines: from AED 10,000 to AED 5,000,000

The floor of the administrative fine has been cut fivefold, from AED 50,000 to AED 10,000; the ceiling is unchanged. Article 17(1)(b) of the statute sets an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation. The predecessor, Article 14(1)(b) of Decree-Law No. 20 of 2018, ran from AED 50,000 to AED 5,000,000.

The fine is only one of seven measures. Article 17(1) lists: a warning; an administrative fine; prohibiting the violator from working in the relevant sector for a period set by the supervisory authority; restricting the powers of board members, executive, supervisory or managerial personnel and owners proven responsible, including the appointment of a temporary supervisor; suspending or requiring the replacement of directors, board members and executive or supervisory personnel; suspending or restricting the activity or profession; and revoking the licence.

Two elements are new, not three, and the point is worth checking against the text. Article 17(3) allows an incremental fine where the same violation recurs within one year of the previous fine for it, and Article 17(5) directs the Cabinet, on the recommendation of the Minister of Finance, to set the mechanism for sharing fines imposed by local supervisory authorities. The power to publish is not new: the closing sentence of Article 14(2) of Decree-Law No. 20 of 2018 already provided that “in all cases, the Regulatory Authority is entitled to publish whatever administrative sanctions in different publication media”. Article 17(4) carries that rule across unchanged in substance.

The actual amounts sit not in the statute but in the schedules. For DNFBPs supervised by the Ministry of Justice and the Ministry of Economy and Tourism the instrument is Cabinet Resolution No. 71 of 2024, issued on 8 July 2024, published in Official Gazette No. 779 of 15 July 2024 and in force from 16 July 2024; it repealed Resolution No. 16 of 2021. Its annex contains 41 charged violations.

The appeal route: 20 working days to notify, 30 working days to complain, 40 working days for an answer.Article 4(1) of Resolution No. 71 of 2024 requires the ministry to notify the violator of the fine decision within 20 working days. The English text runs that period “as of the date of issuing the notice”, which is circular on its face: the period for giving notice cannot start from the notice itself. In practice it runs from the date of the decision; the Arabic original governs. Article 4(2) gives any person with a capacity or interest 30 working days from the notice, or from becoming aware of the penalty, to file a reasoned grievance with the minister or a delegate. Article 4(4) provides that failure to reply within 40 working days of submission counts as rejection, and that the decision on the grievance is final. Article 4(5) bars any court appeal before a grievance has been filed or the reply period has expired.

The fine can be doubled on repetition, and that rule sits in the secondary instrument. Article 5(2) of Resolution No. 71 of 2024 permits the ministry to double the fine where the violation is repeated, and Article 5(3) confirms that imposing a fine does not prevent other administrative sanctions.

Beneficial ownership breaches are punished under a separate schedule. Cabinet Resolution No. 132 of 2023 was issued on 15 December 2023, published in Official Gazette No. 766 of 29 December 2023 and entered into force on 30 December 2023. Its annex contains 15 charged violations on a three-step scale: a written notice to comply, then a fine, then a doubled fine. The highest values are AED 50,000 on the second occasion and AED 100,000 on the third for failing to create a beneficial owner register or a partners and shareholders register, and for failing to disclose classes of beneficial owner in complex structures. A liquidator who fails to keep the records for five years faces a flat AED 100,000.

The scale of enforcement is measurable. On 24 July 2025 the Ministry of Economy and Tourism reported the first-half 2025 results: 1,063 violations and more than AED 42 million in fines, of which dealers in valuable metals and precious stones accounted for 473 violations and AED 20 million, real estate brokerages for 495 violations and AED 18.5 million, and corporate service providers and auditors for 95 penalties and more than AED 4 million.

Criminal liability: what changed in the sentencing bands

Money laundering now carries imprisonment of not less than one and not more than ten years together with a fine, whereas the old statute set no lower limit on the term and allowed one penalty instead of both. Article 26(1) provides for imprisonment of one to ten years together with a fine of AED 100,000 to AED 5,000,000, or the value of the relevant criminal property if that is greater. Its predecessor, Article 22(1) of Decree-Law No. 20 of 2018, provided for imprisonment not exceeding ten years and/or a fine of AED 100,000 to AED 5,000,000.

Only proliferation financing is described inside the anti-money laundering statute for the first time. Terrorist financing was already set out directly in Article 3(1) of Decree-Law No. 20 of 2018 — the Article 1 definition additionally cross-referred to Articles 29 and 30 of Federal Law No. 7 of 2014, but the offence itself sat in the statute. What Article 3 of Decree-Law No. 10 of 2025 adds is a free-standing proliferation financing offence, which the old statute did not contain at all. Note too that Article 22(4) of the old statute punished the use of proceeds in terrorist financing rather than terrorist financing as such, so that row of the table compares provisions that are close but not identical.

Watch the conjunction: several offences still allow one penalty instead of two. Articles 28, 29, 30, 32, 33, 34 and 35 each carry the words “or by either of these two penalties”, while Articles 26(1)–(4) and 27(1)–(2) carry no such option. That, rather than the size of the fine, is where the tightening on the principal offences lies: for money laundering a court can no longer confine itself to a fine.

On three offences the new statute is in fact lighter, and that deserves to be seen. For tipping off, the old Article 25 imposed imprisonment of not less than one year and/or a fine of AED 100,000 to AED 500,000, whereas Article 29(1) of the new statute imposes imprisonment with no minimum term and a fine of not less than AED 50,000. For breaching targeted financial sanctions instructions, the old Article 28 gave one to seven years and/or AED 50,000 to AED 5,000,000, while the new Article 33 gives imprisonment with no minimum and a fine of not less than AED 20,000 with no ceiling. For a legal person on offences other than laundering and financing, the old single band in Article 23 started at AED 500,000, where the new Article 27(2) starts at AED 200,000. The tightening in the 2025 statute is concentrated on the principal offences, not spread across the whole scale.

Five circumstances turn laundering into the aggravated offence. Article 26(2) names: exploiting influence or authority conferred by a position or professional activity; committing the act through a non-profit organisation; committing it through an organised criminal group; a predicate offence drawn from Chapter Seven of Part One or Chapter One of Part Two of Book Two of Federal Decree-Law No. 31 of 2021, or from Federal Decree-Law No. 30 of 2021; and recidivism.

Legal persons face two separate bands and a mandatory dissolution. Article 27(1) sets a fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property if greater, for laundering and terrorist or proliferation financing. Article 27(2) sets AED 200,000 to AED 10,000,000 for offences under Articles 28, 29, 30, 32, 33, 34 and 35. Article 27(3) requires the court, on conviction of a legal person for terrorist or proliferation financing, to order its dissolution and the closure of the premises where the activity is conducted; Article 27(4) gives the court the same power on a laundering conviction or a breach of Article 10. Article 27(5) separately provides imprisonment and a fine, or either penalty, for the person responsible for the actual management of the legal person where it is proven that they knew and that the offence resulted from a breach of the duties of their position.

The absence of prescription is not new. Article 37(2) provides that criminal proceedings for laundering and terrorist or proliferation financing do not lapse by prescription, that imposed penalties do not extinguish by lapse of time, and that related civil actions do not lapse either. The same rule sat in Article 29(3) of the repealed Decree-Law No. 20 of 2018; it is frequently presented as a 2025 innovation, which is wrong.

Good-faith reporting is protected. Article 37(1) removes criminal, civil and administrative liability from supervisory authorities, the Financial Intelligence Unit, law enforcement authorities, financial institutions, DNFBPs, virtual asset service providers and the members of their boards, employees and legally authorised representatives, for furnishing required information or breaching any statutory, contractual or administrative confidentiality restriction — even where they were not fully aware of the nature or the actual occurrence of the crime. There is one exception: proven bad faith with intent to harm.

Deportation of a convicted foreigner is mandatory for laundering. Article 36(1) requires the judgment to include a deportation order where a foreigner receives a custodial sentence for money laundering or any of the felonies under the statute. For other misdemeanours, Article 36(2) gives the court a discretion to order deportation or to impose it in lieu of the custodial penalty.

Suspending a transaction, freezing funds and managing assets

The Chief of the Financial Intelligence Unit may suspend a transaction for up to ten working days and freeze funds for up to thirty days. Article 5(1) of the statute confers the power, without prior notice, to order the cessation or temporary suspension of any transaction suspected of being related to the crime for a period not exceeding ten working days. Article 5(2) allows the freezing of funds held with financial institutions, DNFBPs or virtual asset service providers for up to thirty days, with extension by the Attorney General or a delegate.

The regulations add procedural steps that the statute does not contain. Article 51(4) of Resolution 134 requires the Unit to notify the institution to implement the freeze without prior notice to the customer, and to notify the Attorney General or a delegate of the decision and the grounds of suspicion; that officer may amend or revoke the decision or issue directions. Article 51(6) requires the Chief of the Unit to propose cancelling an extension once the grounds for it cease.

The institution must notify the owner of the frozen funds. Article 51(7) requires the financial institution, DNFBP or virtual asset service provider holding the funds to notify the owner of the freezing order and of the authority that issued it, to request the documents needed to prove the integrity of the transaction and the legitimacy of the source of funds, and to refer them to the Unit. This duty sits against the general “without prior notice” principle: notice follows the measure rather than preceding it.

Frozen funds go into interest-bearing accounts. Article 54(2) requires financial institutions and virtual asset service providers to transfer frozen funds into interest-bearing or profit-generating deposit accounts at prevailing market rates where the freeze follows a decision of a competent authority. Article 54(3) provides that accrued interest and profits form an integral part of the criminal property if a confiscation judgment is issued, and Article 54(4) that funds are returned together with accrued interest and profits where the order is lifted.

Administrative fines imposed earlier can still be collected out of frozen funds. Article 54(6) provides that a seizure or freezing order does not prevent the enforcement of administrative fines imposed by the supervisory authority before the order was issued; the route is to request release of an amount equivalent to those fines, at the discretion of the competent authorities.

Frozen funds may not be applied even to prior obligations. Article 54(5) prohibits this outright, except where the institution coordinates with the supervisory authority and obtains authorisation from the Public Prosecution or the competent court.

A percentage-based fee for managing seized assets is capped at ten per cent; a lump sum is not bound by that ceiling. Article 53(3) of Resolution 134 provides for a committee formed by the Attorney General to assess management fees and expenses, and states that the fee is paid either as a lump sum or as a percentage not exceeding ten per cent of the value of the managed funds.

Grievances against prosecution measures are decided by the criminal court in fourteen working days. Article 6(4) of the statute allows any interested party to file a grievance against prosecution decisions on seizure, freezing or prohibition of dealing, and against an extension of a freeze by the Attorney General. Article 6(5) requires the court to decide within not more than fourteen working days of submission. Article 6(6) makes the decision final and not subject to appeal, and bars a fresh grievance for three months after a rejection unless a serious and substantial reason arises sooner.

Free zones, the DIFC and the ADGM: where the boundaries actually run

The federal anti-money laundering statute applies across the whole of the UAE, including financial and commercial free zones. Neither Decree-Law No. 10 of 2025 nor Resolution No. 134 of 2025 contains a territorial carve-out: the phrase “free zone” does not appear in the regulations at all, and the definition of companies covers “companies, regardless of their type or activity, that are subject to the provisions of the legislation in force in the State”. The supervisor says the same: the Ministry of Economy and Tourism guidelines for DNFBPs apply expressly to DNFBPs established or operating in the UAE “and respective Financial and Commercial Free Zones”.

A carve-out exists under one instrument only — Decision No. 109 of 2023 on beneficial ownership. Article 3(2) of that decision excludes companies wholly owned by the federal or local government and their wholly owned subsidiaries, financial free zones, and companies with a Government Partner. The ministry’s guidelines name the zones concerned: the Abu Dhabi Global Market and the Dubai International Financial Centre, and state that entities incorporated there are subject to the beneficial ownership regulations issued by their own free zone authorities.

That produces the distinction most often confused. A DIFC or ADGM company is outside Decision No. 109 of 2023 and therefore outside the penalty schedule in Resolution No. 132 of 2023. It nonetheless remains fully inside Decree-Law No. 10 of 2025 and Resolution No. 134 of 2025, including Chapter Three of the regulations on transparency and beneficial ownership, the prohibition on bearer shares, and the duty to update information within fifteen working days. The carve-out concerns the filing mechanism with the Registrar, not the substance of the obligation.

Commercial free zones have no carve-out at all. A company registered in a commercial free zone falls under both the federal statute and Decision No. 109 of 2023, with the zone authority acting as its Registrar for the purposes of that decision.

A free zone company’s supervisor is determined by its activity, not by its zone. A DIFC company providing corporate services is supervised by the DIFC regulator; a commercial free zone company providing the same services is supervised by the Ministry of Economy and Tourism. The distinction matters when working out whose prior approval is needed to appoint a compliance officer under Article 49(18) of Resolution 134.

Virtual assets add a third layer. For a virtual asset service provider the supervisor depends on the emirate and the zone — from the Virtual Assets Regulatory Authority in Dubai to the financial free zone regulators — while the obligations under Article 36 of Resolution 134 are identical in every case. The individual licensing tracks are set out in our analysis of crypto business in the UAE, and the jurisdictions themselves are compared in our ADGM review.

The “Know Your Customer” platform: a new federal layer that went live in 2026

A national digital customer-verification layer has been built alongside the anti-money laundering statute. Federal Decree-Law No. 30 of 2024 on the “Know Your Customer” digital platform was issued on 1 October 2024, published in Official Gazette No. 785 (supplement) of 14 October 2024 and entered into force on 14 October 2024. Its executive regulations are Cabinet Resolution No. 55 of 2026, and the schedule of violations and administrative sanctions is Cabinet Resolution No. 56 of 2026; both were issued on 20 April 2026 and published in Official Gazette No. 822 of 30 April 2026.

There is a date divergence here, and it should be accounted for. The federal legislation portal records an effective date of 21 April 2026 for both resolutions, whereas Article 16 of Resolution 55 and Article 9 of Resolution 56 provide for entry into force on the day following publication, that is 1 May 2026. The portal’s field and the text of the instruments do not agree; deadlines should be run from the text, and the Arabic original governs interpretation.

The statute creates an operating company chaired by an assistant to the Central Bank Governor. Article 4(1) of Federal Decree-Law No. 30 of 2024 directs the incorporation of a company to build and manage the platform; Article 4(2) sets a board of seven to eleven members chaired by one of the assistants to the Central Bank Governor. The Central Bank prepares the articles of association in coordination with the Ministry of Finance, and the Cabinet issues them.

Data providers fall into three classes, and the third expressly includes free zone companies. Article 9 of Resolution No. 55 of 2026 divides them into government entities; entities affiliated with the federal or local government; and private sector providers — “private sector establishments operating in the State or in Free Zones, Financial Institutions, insurance companies, and insurance-related professions licensed by the Central Bank, or any other entity deemed by the Company to be a potential Data Provider”.

The data set for a legal person tracks what the anti-money laundering regulations already require. Article 3(2) of Resolution 55 lists the name in Arabic and English and the legal form, the official email address, telephone numbers, head office and branch addresses, a statement of whether the entity is established inside or outside the State, the trade register extract, the trade licence, constitutional documents, all licences issued by competent authorities, the names of senior management, the names of the beneficial owners with all related documents, the amount of capital, sources of funding and income, the number and nominal value of shares, and the tax registration number. Article 3(4) refers the definitions of politically exposed person, legal arrangement, beneficial owner and financial institution straight back to the anti-money laundering legislation.

Users of a report carry ten obligations, and two of them change group practice. Article 13(2)(b) of Resolution 55 prohibits transferring a Know Your Customer report or any data in it outside the State or sharing it with any entity outside the State. Article 13(2)(d) requires copies of every report received to be kept for not less than five years from issuance and produced to the competent authorities on request; Article 13(2)(e) requires secure disposal immediately once the purpose is met, but not before that five-year period has run.

The Central Bank imposes the sanctions, and most are fixed amounts. The annex to Resolution No. 56 of 2026 contains 31 charged violations. Most carry a flat AED 50,000; the more serious ones carry AED 100,000; and only one — breach of the Central Bank’s codes of conduct and controls by a data provider, a user or the company — is expressed as a range of AED 10,000 to AED 100,000.

A warning may precede the sanction, but it is no shield. Article 4 of Resolution 56 allows the Central Bank to issue a written notice to rectify within not more than 30 days, and states expressly that neither the notice nor rectification within that period prevents the sanction being imposed, unless the Central Bank decides otherwise. Article 3(2) lets the Central Bank suspend dealings with any violator, and the operating company must give effect to that decision.

The appeal clocks are shorter than in the anti-money laundering perimeter. Article 5(1) of Resolution 56 gives the Central Bank 15 days to notify a sanction from the date it is issued; Article 5(2) gives the violator 30 days to file a reasoned grievance; Article 5(3) allows 30 days for it to be decided, with expiry counting as rejection; Article 5(4) makes that decision final. All of these run in calendar days, not working days, unlike Resolution No. 71 of 2024.

The link to the anti-money laundering regime is made in terms. The preamble to Resolution No. 56 of 2026 cites Federal Decree-Law No. 10 of 2025 and Federal Decree-Law No. 6 of 2025 on the Central Bank among its bases, and Article 13(1)(a) of Resolution 55 defines the user’s right to obtain a report “to the extent necessary to perform its duties and discharge its obligations relating to applying due diligence requirements and compliance with relevant legislation”. The platform is, in other words, designed as the delivery infrastructure for exactly the duties set out above.

The step-by-step algorithm: what a UAE company should do

The sequence below is written both for a company unsure whether it is an obliged person and for one that already knows it is. The first four steps apply to everyone; the rest apply only to obliged persons.

1.        Map your actual activity against Articles 2, 3 and 4 of Resolution No. 134 of 2025. Start from what you do, not from the wording on the licence: DNFBP status attaches to activity. Pay particular attention to ancillary services: providing a registered address, supplying a director or secretary, or acting as a nominee shareholder all fall under Article 3(5) even when done as a sideline.

2.        Check that the beneficial owner register and the partners or shareholders register are current. The duty applies whether or not you are an obliged person: Articles 38 and 39 of Resolution 134 address companies, Article 40 binds the Registrar and companies alike, and Article 37 is addressed to the Registrar only, and Decision No. 109 of 2023 addresses all legal persons other than the listed exclusions.

3.        Trace the whole ownership chain for bearer instruments. A bearer instrument found in a foreign link makes it impossible to complete the Article 10 analysis correctly.

4.        Reconcile the two clocks: 15 days to notify the Registrar and 15 working days to update your own registers.Build the internal procedure around the shorter one so the two never diverge.

5.        Register on goAML if you are an obliged person. Registration runs in two stages — the access control system first, then the platform itself — and requires supporting documents and an authorised person.

6.        Register separately on the website of the Executive Office for Control and Non-Proliferation. This is a standalone duty under Article 21(1) of Resolution No. 74 of 2020 and is not satisfied by goAML registration.

7.        Carry out and document the risk assessment required by Article 5(1) of Resolution 134. The document must cover all relevant risk factors, including those the provision names by way of example — customer, country, product, service, transaction and delivery channel risk — and must be produced to the supervisor on request.

8.        Adopt internal policies at senior management level containing the six mandatory blocks of Article 21. The absence of policies approved by senior management is the first row in the annex to Resolution No. 71 of 2024, carrying AED 100,000 to AED 200,000.

9.        Appoint a compliance officer only after obtaining the supervisory authority’s prior approval. The prior approval requirement sits in Article 49(18) of Resolution 134; appointing first creates a breach.

10.    Set up continuous screening of the client base against the UN Security Council, Sanctions Committee and local lists. Article 21(2) of Resolution No. 74 of 2020 requires searches of customers, parties to transactions, potential clients, beneficial owners, connected persons and, as a separate limb, a standing search before every operation and before entering any business relationship.

11.    Identify the threshold reports that apply to your sector. For dealers in valuable metals and precious stones that is the DPMSR at AED 55,000 in cash; for real estate brokers, the REAR at AED 55,000 in cash or on any virtual asset settlement.

12.    Configure the archive on the “most recent of” rule. Article 25(2) of Resolution 134 counts five years from the latest of several events, including completion of a supervisory inspection and the issue of a final court judgment.

13.    Audit your contractual documentation for references to repealed instruments. References to Decree-Law No. 20 of 2018 and Resolution No. 10 of 2019 in policies, onboarding forms and contracts need to be replaced.

14.    Prepare a response procedure for a freeze under Article 51(7) of Resolution 134. The firm must notify the owner of the funds, request source-of-funds documents and pass them to the Financial Intelligence Unit.

15.    Align the banking layer with the updated policies. A mismatch between a company’s internal policies and its answers on a bank questionnaire is a standard cause of service suspension; the practical side of banking support is best settled before an application, not after.

16.    Fix the date of the next review. The risk assessment and the policies are subject to continuous updating under Article 5(1)(b) and Article 5(2)(a) of Resolution 134, not to one-off approval.

Typical mistakes and what they cost

Mistake one: assuming that repealing the 2018 statute also repealed the secondary instruments. Article 41(3) of Decree-Law No. 10 of 2025 kept them alive until superseded. A company that dropped its obligations under Resolution No. 74 of 2020 because “the old law is gone” walks straight into rows 33–41 of the annex to Resolution No. 71 of 2024 — nine charged violations that cite Article 21 of Resolution No. 74 of 2020 directly. Most of them top out at AED 1,000,000; the rows on failing to implement an unfreezing decision and on failing to report freezing measures to the Executive Office cap at AED 100,000. Breaching the targeted financial sanctions instructions themselves is a criminal offence under Article 33 of the statute.

Mistake two: treating regulators’ public pages as a statement of the law in force. As at 15 September 2026 the Ministry of Economy and Tourism pages on DNFBP criteria and on goAML registration still read “Under Federal Decree Law No (20) of 2018 and Article 20(2) of Cabinet Decision No (10) of 2019” — both repealed. The ministry’s 77-page DNFBP guidelines dated September 2025 are likewise built on the repealed pair. The cost is a compliance framework wired to article numbers that no longer exist, and cross-references that stop matching during an inspection.

Mistake three: confusing fifteen days with fifteen working days. Decision No. 109 of 2023 gives fifteen calendar days to file a change with the Registrar; Resolution No. 134 of 2025 gives fifteen working days to update the company’s own registers. Applying the longer period to the filing produces a violation under Resolution No. 132 of 2023: AED 15,000 on the second occasion and AED 30,000 on the third for an out-of-date register, and AED 50,000 and AED 100,000 where no register exists.

Mistake four: believing the AED 55,000 and AED 3,500 thresholds no longer touch non-financial business.Article 7(2) of Resolution 134 is indeed addressed to financial institutions, but Article 3(3) keeps the AED 55,000 cash threshold for dealers in valuable metals and precious stones, Article 3(1) introduces AED 11,000 for commercial gaming operators, and Article 7(1) requires due diligence on the commencement of any business relationship regardless of amount. Failing to apply due diligence on a transaction of AED 55,000 or more is its own row in the annex to Resolution No. 71 of 2024, at AED 50,000 to AED 200,000.

Mistake five: appointing the compliance officer and seeking approval afterwards. Article 49(18) of Resolution 134 requires the supervisory authority’s prior approval. The “appoint then notify” sequence creates a breach that, unlike most procedural defects, cannot be cured retrospectively: the date of appointment is fixed.

Mistake six: treating goAML registration as discharging the sanctions obligations. These are different systems run by different bodies: goAML belongs to the Financial Intelligence Unit, while designations and notifications belong to the Executive Office for Control and Non-Proliferation. Failure to register on the Executive Office website is a violation in its own right, at AED 50,000 to AED 1,000,000.

Mistake seven: assuming a DIFC or ADGM company is outside the federal regime altogether. The carve-out in Article 3(2) of Decision No. 109 of 2023 concerns that decision only. Decree-Law No. 10 of 2025 and Resolution No. 134 of 2025 apply to such companies in full, including the bearer share prohibition and the duties in Chapter Three of the regulations.

Mistake eight: destroying documents on the general retention cycle. Article 25(2) of Resolution 134 counts five years from the most recent of several events, including completion of a supervisory inspection, completion of an investigation and the issue of a final judgment. Records destroyed five years after an account closed but before an inspection ended count as not retained.

Mistake nine: lowering the standard of customer checks unilaterally. Article 5(3) of Resolution 134 permits simplified due diligence only where low risk has been identified, only in the absence of suspicion, and only in coordination with the supervisory authority. Moving to a simplified regime on one’s own initiative is a breach, not a risk-based decision.

Mistake ten: telling the customer they are being reviewed. Article 19(1) of Resolution 134 prohibits disclosing, directly or indirectly, to the customer or any third party that a report has been or will be filed, any information or data related to it, or that an investigation is under way. The sanction sits in Article 29(1) of the statute: imprisonment and a fine of not less than AED 50,000, or either penalty, rising under Article 29(3) to imprisonment of not less than one year and a fine equal to the value of the proceeds, and not less than AED 100,000, where the acts result in the inability to seize the proceeds, or in their destruction or loss of value.

Who this affects directly, who indirectly, and when professional review is needed

The regime applies directly to the five categories of non-financial business named in Article 3 of the regulations, to all financial institutions, to virtual asset service providers and to non-profit organisations. A company providing corporate or trust services, dealing in valuable metals and precious stones, broking real estate, providing independent accounting or audit services, providing the legal services listed in Article 3(4) or operating commercial gaming is an obliged person and must meet the full set of requirements.

Indirectly, the regime touches every company in the UAE. The duties on beneficial ownership, the partners and shareholders register, nominee directors and bearer shares are addressed to all companies subject to UAE legislation, not only to obliged persons. Beyond that, a bank and a corporate service provider apply the same procedures to the company itself, and a refused account is far more often caused by the impossibility of satisfying Articles 9 and 10 of Resolution 134 than by any view the bank takes of the business.

Three categories fall outside the regime under Decision No. 109 of 2023 only. Companies wholly owned by the federal or local government and their wholly owned subsidiaries, financial free zone companies, and companies with a Government Partner. The carve-out concerns the Registrar’s procedures, not the federal statute.

Professional review is warranted in five situations. First, where the ownership chain includes foreign structures, trusts or foundations — the Article 10 cascade is not obvious there, and the cost of error is criminal under Article 35(1). Second, where the company carries on several activities and at least one falls inside Article 3 — obliged-person status attaches to the activity, not to the principal licence. Third, where the company is registered in the DIFC or the ADGM and also operates outside them. Fourth, where the company has received notice of an inspection or of an administrative fine — the appeal periods under Resolution No. 71 of 2024 run in working days and expire quickly. Fifth, where a restructuring or redomiciliation is planned that changes the Registrar and with it the applicable beneficial ownership regime.

Where the whole structure needs bringing into line. Aligning a corporate structure, its registers and its compliance documentation with the current regime is a project in its own right, and one better started alongside setting up or restructuring a UAE company than after a first inspection: most of the charged violations in the annex to Resolution No. 71 of 2024 punish the absence of a procedure rather than a bad outcome.

Frequently asked questions

When exactly did the new UAE anti-money laundering law come into force?

Federal Decree-Law No. 10 of 2025 entered into force on 14 October 2025 — two weeks after publication in Official Gazette No. 808 of 30 September 2025. Its executive regulations, Cabinet Resolution No. 134 of 2025, entered into force on 14 December 2025 — thirty days after publication in Official Gazette No. 811 of 14 November 2025.

Is Federal Decree-Law No. 20 of 2018 still in force?

No. It was repealed by Article 41(1) of Decree-Law No. 10 of 2025. Cabinet Resolution No. 10 of 2019 was repealed as well, by Article 70 of Resolution No. 134 of 2025. Article 41(3) nonetheless kept the other secondary instruments issued under the 2018 statute alive until they are superseded.

What fine does a company face for an anti-money laundering breach in the UAE?

The administrative fine runs from AED 10,000 to AED 5,000,000 per violation under Article 17(1)(b) of the statute. The specific amounts for non-financial business supervised by the Ministry of Justice and the Ministry of Economy and Tourism sit in the annex to Cabinet Resolution No. 71 of 2024 and run from AED 50,000 to AED 1,000,000 across 41 charged violations.

Who counts as the beneficial owner of a UAE company?

The natural person who ultimately owns, individually or jointly with another person, an actual controlling ownership interest or shares of 25 per cent or more, under Article 10(1)(a) of Resolution No. 134 of 2025. The second rung is reached not only where no such person is identified but also where there is doubt as to the identification, or doubt that the holder of the interest is truly the beneficial owner, or where nobody controls the company through an ownership interest: the firm then identifies the person exercising control by other means. Only where neither rung produces a person does the firm fall back to the relevant person holding a senior management position.

Does a company outside financial services need to register on goAML?

Registration is mandatory only for obliged persons: financial institutions, designated non-financial businesses and professions, and virtual asset service providers. An ordinary trading or manufacturing company does not register on goAML, but must still maintain a beneficial owner register and a partners or shareholders register under Articles 38–40 of Resolution No. 134 of 2025.

Does the new law apply to free zone companies?

Yes. Neither Decree-Law No. 10 of 2025 nor Resolution No. 134 of 2025 contains a territorial carve-out, and the Ministry of Economy and Tourism guidelines apply the regime expressly to financial and commercial free zones. The only carve-out sits in Decision No. 109 of 2023 on beneficial ownership, which excludes DIFC and ADGM companies because they apply their own regulators’ rules.

What changed for crypto businesses?

Less changed for crypto businesses than is usually assumed. The AED 3,500 occasional-transaction due diligence threshold, the absence of any de minimis in the travel rule and its extension to financial institutions all sat in Article 33 (BIS 3) of the repealed Resolution No. 10 of 2019; the new regulations move them into Article 7(3) and Article 36 and spell them out more fully. Under Article 36(2)(a) of Resolution 134 the travel rule still carries no de minimis: every transfer must carry the originator’s name, account number or wallet address and residential or business address, together with the beneficiary’s name and account number or wallet address. Article 36(4) extends the same requirements to financial institutions sending or receiving virtual asset transfers.

How long must records be kept?

Not less than five years. Article 25(1) of Resolution 134 runs the period from completion of the transaction or termination of the business relationship. Article 25(2), for due diligence material, account files, correspondence, copies of identity documents, suspicious transaction reports and CCTV and ATM recordings, runs five years from the most recent of several events, including completion of a supervisory inspection and the issue of a final court judgment.

Does the compliance officer have to be approved in advance?

Yes. Article 49(18) of Resolution No. 134 of 2025 requires the supervisory authority to demand prior approval before a compliance officer is appointed. Under the repealed Resolution No. 10 of 2019 that approval was a discretion of the supervisor rather than a duty, and ran through the Financial Intelligence Unit. Whose approval is required now is not settled by the English text of Article 49(18): the pronoun in “its prior approval” can refer to the supervisory authority or to the Financial Intelligence Unit named in the same item; the Arabic original governs.

Are bearer shares prohibited in the UAE?

Yes. Article 38(4) of Resolution No. 134 of 2025 prohibits companies established and registered in the UAE from issuing bearer shares, bearer share warrants or similar untraceable instruments. Those already in issue had to be converted into registered shares within 30 working days of the date of publication of the Resolution, that is by the end of December 2025.

Is the UAE on the FATF grey list?

No. The UAE was removed from the list of jurisdictions under increased monitoring on 23 February 2024. The FATF assessment calendar places the UAE in the fifth round of mutual evaluations with a possible on-site in June 2026 and a possible Plenary discussion in February 2027; the calendar itself notes that all dates are subject to change.

What is the Know Your Customer platform, and who does it reach?

It is a national digital customer-verification layer created by Federal Decree-Law No. 30 of 2024, with executive regulations in Cabinet Resolution No. 55 of 2026 and a sanctions schedule in Cabinet Resolution No. 56 of 2026. Data providers expressly include private sector establishments operating in the UAE or in free zones. A user of a report may not transfer it outside the State, must keep copies for not less than five years, and answers to the Central Bank with fines of AED 50,000 or AED 100,000 under a 31-item annex.

Can ministry guidance be relied on as a statement of the law?

With caution. As at 15 September 2026 the Ministry of Economy and Tourism’s public pages on DNFBP criteria and goAML registration, and its September 2025 DNFBP guidelines, still cite the repealed Decree-Law No. 20 of 2018 and Resolution No. 10 of 2019. The guidelines themselves state that where they diverge from the legal framework in force, the latter prevails.

Key points to remember

•          The live statutory pair is Federal Decree-Law No. 10 of 2025 (in force from 14 October 2025) and Cabinet Resolution No. 134 of 2025 (in force from 14 December 2025). Decree-Law No. 20 of 2018 and Resolution No. 10 of 2019 are repealed.

•          Repealing the statute did not repeal the secondary instruments. Resolutions No. 74 of 2020, No. 132 of 2023 and No. 71 of 2024, and Decision No. 109 of 2023, remain in force under Article 41(3) of the new statute.

•          The administrative fine is now AED 10,000 to AED 5,000,000 per violation, and the fine on a legal person for laundering or terrorist or proliferation financing is AED 5,000,000 to AED 100,000,000, or the value of the criminal property.

•          Commercial gaming operators have become obliged persons, with an AED 11,000 threshold.

•          The AED 55,000 occasional transaction threshold addresses financial institutions; virtual asset service providers have their own AED 3,500 threshold.

•          The beneficial owner test is 25 per cent or more, with a three-step cascade and a separate set of roles for trusts.

•          The two beneficial ownership clocks do not match: 15 days to notify the Registrar and 15 working days to update the company’s own registers.

•          Bearer shares are prohibited; the conversion window for existing ones closed at the end of December 2025.

•          A compliance officer may be appointed only after the supervisory authority’s prior approval.

•          The five-year retention period runs from the most recent of several events, including completion of an inspection and a final court judgment.

•          Free zones are not carved out of the federal regime; the only carve-out is under Decision No. 109 of 2023, and among free zones it reaches only the financial ones.

•          A separate layer now runs alongside it from 2026: the Know Your Customer platform under Federal Decree-Law No. 30 of 2024 with Cabinet Resolutions No. 55 and No. 56 of 2026 — no transfer of a report outside the UAE, five-year retention, and Central Bank fines of AED 50,000 and AED 100,000.

•          Regulators’ public guidance was partly out of date as at 15 September 2026 and cites repealed instruments — check against the primary text.

Summary

Since 14 October 2025 the UAE anti-money laundering regime has rested on Federal Decree-Law No. 10 of 2025 (issued 30 September 2025, Official Gazette No. 808, 42 articles) and, since 14 December 2025, on its executive regulations, Cabinet Resolution No. 134 of 2025 (issued 29 October 2025, Official Gazette No. 811, 71 articles). The former Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019 are repealed, but Article 41(3) of the new statute keeps in force Resolution No. 74 of 2020 on targeted financial sanctions, Decision No. 109 of 2023 on beneficial ownership, and Resolutions No. 132 of 2023 and No. 71 of 2024 on administrative penalties. The obliged persons are financial institutions (13 activities under Article 2 of the regulations), designated non-financial businesses and professions (five named categories plus an open-ended item under Article 3, including commercial gaming operators for the first time at an AED 11,000 threshold and dealers in valuable metals and precious stones at AED 55,000 in cash), virtual asset service providers (5 activities under Article 4) and non-profit organisations. Customer due diligence is mandatory on commencement of a business relationship, on suspicion and on doubts about previously obtained data for all three categories; the AED 55,000 occasional transaction and AED 3,500 occasional wire transfer thresholds address financial institutions, and the AED 3,500 threshold addresses virtual asset service providers. A beneficial owner is a natural person holding 25 per cent or more. Companies must update their own registers within 15 working days and notify the Registrar under Decision No. 109 of 2023 within 15 days. Bearer shares are prohibited by Article 38(4) of the regulations, with a 30-working-day conversion window from publication on 14 November 2025. A compliance officer may be appointed only with the supervisory authority’s prior approval (Article 49(18)). Records are kept for not less than five years, and for due diligence material the period runs from the most recent of several events. The administrative fine is AED 10,000 to AED 5,000,000 per violation; the criminal fine on a legal person for laundering or terrorist or proliferation financing is AED 5,000,000 to AED 100,000,000. Supervision is split between the Central Bank, the Capital Market Authority, the Ministry of Economy and Tourism, the Ministry of Justice, the General Commercial Gaming Regulatory Authority, the Virtual Assets Regulatory Authority and the DIFC and ADGM regulators; targeted financial sanctions are administered by the Executive Office for Control and Non-Proliferation. A separate customer-verification layer has run alongside it since 2026: Federal Decree-Law No. 30 of 2024 on the Know Your Customer digital platform, with executive regulations in Cabinet Resolution No. 55 of 2026 and a 31-item schedule of violations in Cabinet Resolution No. 56 of 2026, where Central Bank fines are AED 50,000 or AED 100,000, a report may not be transferred outside the State, and copies are kept for not less than five years. The UAE was removed from the FATF list of jurisdictions under increased monitoring on 23 February 2024. Information is current as at 15 September 2026.

Sources

Primary instruments, UAE federal legislation portal:

1.        Federal Decree-Law No. 10 of 2025 on anti-money laundering, counter-terrorist financing and counter-proliferation financing

2.        Cabinet Resolution No. 134 of 2025 on the executive regulations of Federal Decree-Law No. 10 of 2025

3.        List of legislation related to Federal Decree-Law No. 10 of 2025

4.        Cabinet Resolution No. 74 of 2020 on terrorist lists and implementation of UN Security Council resolutions

5.        Cabinet Decision No. 109 of 2023 regulating beneficial owner procedures

6.        Cabinet Resolution No. 132 of 2023 on administrative penalties for breaches of Decision No. 109 of 2023

7.        Annex to Cabinet Resolution No. 132 of 2023 with the penalty scale

8.        Cabinet Resolution No. 71 of 2024 on violations and administrative penalties for DNFBPs

9.        Annex to Cabinet Resolution No. 71 of 2024 with 41 charged violations

10.    Cabinet Resolution No. 15 of 2022 on the Executive Office for Control and Non-Proliferation

11.    Federal Decree-Law No. 6 of 2025 on the Central Bank and the regulation of financial institutions and insurance business

12.    Federal Decree-Law No. 32 of 2025 on the Capital Market Authority

13.    Federal Decree-Law No. 30 of 2024 on the “Know Your Customer” digital platform

14.    Cabinet Resolution No. 55 of 2026 on the executive regulations of Federal Decree-Law No. 30 of 2024

15.    Cabinet Resolution No. 56 of 2026 on violations and administrative sanctions under the Know Your Customer platform

16.    Annex to Cabinet Resolution No. 56 of 2026 with 31 charged violations

Repealed instruments, used solely to compare versions:

17.    Federal Decree-Law No. 20 of 2018, repealed on 14 October 2025

18.    Cabinet Resolution No. 10 of 2019, repealed on 14 December 2025

Regulators and supervisory authorities:

19.    Text of Federal Decree-Law No. 10 of 2025 in the CBUAE Rulebook

20.    UAE Financial Intelligence Unit, “Understanding the Law”

21.    UAE Financial Intelligence Unit, policies and guidance

22.    UAE Financial Intelligence Unit, how to submit a report and the goAML registration guide

23.    UAE Financial Intelligence Unit Annual Report 2025

24.    UAE Financial Intelligence Unit publications

25.    National Risk Assessment Report 2024

26.    UAE Ministry of Economy and Tourism, financial crimes legislation

27.    UAE Ministry of Economy and Tourism, DNFBP criteria

28.    UAE Ministry of Economy and Tourism, registering companies in goAML

29.    UAE Ministry of Economy and Tourism, DNFBP guidelines, September 2025 edition

30.    UAE Ministry of Economy and Tourism, H1 2025 inspection results

31.    General Commercial Gaming Regulatory Authority

International organisations:

32.    FATF, United Arab Emirates country page

33.    FATF, mutual evaluation assessment calendar

A note on method

Every rule here was checked against the primary text on the UAE federal legislation portal rather than against commentary. Issue dates, publication dates, Official Gazette numbers and commencement dates are taken from the portal’s own records and stated separately, because anything from a few days to three months separates them: Resolution No. 134 of 2025 took 46 days from issue to commencement, Federal Decree-Law No. 32 of 2025 took three months. Version comparisons were made against the full texts of the repealed instruments — Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019 — which appear here solely to establish what changed and are not presented as law in force.

Six divergences are recorded and deliberately left unresolved. First, the English text of Article 3(3) of Resolution 134 does not repeat the word “cash” in the second limb of the dealer threshold; the Arabic original prevails. Second, the Financial Intelligence Unit’s 2025 annual report refers in the leadership message to 165 freeze actions supported, while the body twice states 156 freeze recommendations with a 36 per cent increase; this article uses 156, as the figure the body of the report states twice. Third, the instrument establishing the General Commercial Gaming Regulatory Authority is not published on the legislation portal, so no number is cited for it. Fourth, Article 21(5) of Resolution No. 74 of 2020 names the supervisory authority as the recipient of immediate reports, while rows 37–40 of the annex to Resolution No. 71 of 2024, citing the same sub-paragraphs, name the Executive Office for Control and Non-Proliferation. Fifth, in Article 49(18) of Resolution 134 the pronoun in “to obtain its prior approval” can refer on the English text either to the supervisory authority or to the Financial Intelligence Unit; the first reading is the more reliable, because the supervisory authority is the subject of the article and of the verb “requiring”, but the point is settled by the Arabic original. Sixth, the portal records an effective date of 21 April 2026 for Cabinet Resolutions No. 55 and No. 56 of 2026, while Article 16 of the first and Article 9 of the second provide for entry into force on the day after publication, which took place on 30 April 2026.

Two source defects are recorded separately. The Ministry of Economy and Tourism’s public pages on DNFBP criteria and goAML registration, and the ministry’s September 2025 DNFBP guidelines, cite the repealed Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019. The Financial Intelligence Unit’s operational classification of report types, version 1.2 of 29 April 2024, no longer opens at its former address following the reorganisation of the Unit’s website.

All 33 links in the source list were checked and resolved on 15 September 2026.

Disclaimer

This material is for information purposes only and does not constitute legal, tax, financial, investment or consulting advice. Before taking any decision, individual professional advice should be obtained that takes into account the specific situation, the jurisdiction, the status of the company and the current requirements of the regulators.

Last updated: September 2026.