The UAE’s AML/CFT regime is built on Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing, which replaced the 2018 law in October 2025, and its executive regulations, Cabinet Resolution No. 134 of 2025. Terrorist financing is also an offence under Federal Law No. 7 of 2014 on Combating Terrorism Crimes, and UN and domestic terrorist lists are implemented under Cabinet Resolution No. 74 of 2020. The UAE is a federation with two financial free zones, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), each with its own financial regulator.

How the regime is organised

• Policy and coordination. A Higher Committee attached to the Presidential Court, chaired by the Deputy Prime Minister and Minister of Foreign Affairs, oversees the national strategy. The National Committee for Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations (NAMLCFTC), chaired by the Governor of the Central Bank, coordinates policy and the national risk assessment. Its General Secretariat replaced the Executive Office of AML/CTF in September 2024.
• Financial intelligence. The UAE Financial Intelligence Unit (UAE FIU) is an independent unit within the Central Bank and the only body that receives suspicious transaction reports. Reports are filed through goAML, in use since June 2019.
• Supervision. Supervision is split by sector and location: the Central Bank of the UAE (CBUAE) for banks, exchange houses, insurers and other financial institutions; the Capital Market Authority (CMA), which replaced the Securities and Commodities Authority (SCA) on 1 January 2026; the Dubai Financial Services Authority (DFSA) in the DIFC; the Financial Services Regulatory Authority (FSRA) in ADGM; the Virtual Assets Regulatory Authority (VARA) in Dubai; and, for DNFBPs, the Ministry of Economy and Tourism, the Ministry of Justice and the General Commercial Gaming Regulatory Authority (GCGRA).
• Sanctions. The Executive Office for Control and Non-Proliferation (EOCN) coordinates targeted financial sanctions against people and entities on UN lists and on the UAE’s Local Terrorist List, which the Cabinet issues.
• Prosecution and courts. Specialised money laundering courts opened in Abu Dhabi and in the federal courts of Sharjah, Ajman, Umm Al Quwain and Fujairah in 2020, and in Dubai in 2021. Federal prosecution offices dedicated to economic crimes and money laundering followed in 2023.

Key milestones

1. 2018

   Federal Decree-Law No. 20 of 2018 replaces the 2002 AML law. Its executive regulations, Cabinet Decision No. 10 of 2019, follow in 2019.

2. June and July 2019

   goAML reporting goes live in June. In July, FATF and MENAFATF assessors carry out the on-site visit for the UAE’s mutual evaluation.

3. April 2020

   The mutual evaluation report is published. It rates four of the eleven effectiveness areas low and only one substantial.

4. 2020 and 2021

   Cabinet Resolution No. 74 of 2020 sets out how sanctions lists are implemented, specialised money laundering courts open, and an Executive Office of AML/CTF is created in February 2021.

5. March 2022

   The FATF places the UAE under increased monitoring (the “grey list”) with a seven-item action plan.

6. November 2023

   Cabinet Resolution No. 109 of 2023 updates the beneficial ownership rules.

7. February 2024

   The FATF removes the UAE from increased monitoring.

8. 2024

   New administrative fines for DNFBPs take effect in July. In September the Cabinet approves the National AML/CFT/CPF Strategy 2024–2027, and the NAMLCFTC General Secretariat replaces the Executive Office.

9. 2025

   The public edition of the National Risk Assessment 2024 is released, and the EU removes the UAE from its list of high-risk third countries in August. A new Central Bank law takes effect in September, the new AML law in October and its executive regulations in December.

10. 2026

    The CMA replaces the SCA in January, and the national proliferation financing risk assessment is approved in February. The FATF calendar scheduled a possible on-site period in June for the UAE’s next mutual evaluation, and work on a third national risk assessment begins. A scheduled date alone does not confirm completion of the visit.

What has changed most for firms

• Tougher penalties. Money laundering carries one to ten years’ imprisonment and a fine of AED 100,000 to AED 5 million. Fines for legal persons rose to AED 5 million to AED 100 million, managers whose failures allowed an offence can be held personally liable, and there is no limitation period for prosecutions.
• Wider offences. Proliferation financing is now a standalone offence, tax evasion is expressly a predicate offence, and promoting anonymity-enhancing virtual assets is a crime.
• Stronger FIU powers. The FIU can suspend a transaction for up to 10 working days and freeze funds for up to 30 days.
• New sectors. Commercial gaming operators are now DNFBPs, covered for transactions of AED 11,000 or more.
• Active enforcement. In 2025, supervisors carried out 781 inspections of financial institutions and VASPs, imposing AED 384 million in penalties, and 8,900 inspections of DNFBPs, imposing AED 160.33 million. They included a CBUAE fine of AED 200 million on an exchange house in May 2025.

The framework has three layers: federal laws, Cabinet resolutions that set out detailed obligations, and rules and guidance from each supervisor. The federal AML law applies across the country, including the financial free zones, which have their own regulators and rulebooks.

Primary laws and Cabinet resolutions

Sector rules

Key guidance

• CBUAE guidance for licensed financial institutions, including suspicious transaction reporting with UAE-specific red flags, trade-based money laundering (November 2025) and virtual asset risks (2023)
• EOCN guidance on targeted financial sanctions, updated in July 2025. It renamed the Funds Freeze Report the Confirmed Name Match Report
• Joint guidance from the UAE supervisors on the compliance officer and MLRO function (April 2026)
• The National Risk Assessment 2024 and the National AML/CFT/CPF Strategy 2024–2027

Responsibility is split between sector supervisors, the FIU, law enforcement and a dedicated sanctions office. In the UAE, where a firm is licensed also matters: the same activity can have a different supervisor on the mainland, in Dubai or in one of the two financial free zones.

Supervisors by sector

The UAE Financial Intelligence Unit (UAE FIU)

• Status. An independent unit within the Central Bank, set up under Article 11 of Federal Decree-Law No. 10 of 2025. It has operational independence, and its head is appointed by the Central Bank’s Board of Directors.
• Reports it receives. The FIU is the only body that receives suspicious transaction reports. Firms also file threshold and sanctions reports to it, listed below.
• How reports are filed. Through goAML, the reporting system developed by the UN Office on Drugs and Crime. Web reporting went live on 27 June 2019, and firms must register before they can file.
• Powers. Under the 2025 law, the head of the FIU can suspend a transaction for up to 10 working days and freeze funds for up to 30 days. The Attorney General can extend a freeze.
• What it does with reports. Analyses them, passes financial intelligence to law enforcement, and exchanges information with foreign FIUs.
• Volume. The FIU received about 80,000 suspicious transaction reports in 2025, 28% more than in 2024.

Main goAML report types

Who investigates and prosecutes

• Police and law enforcement agencies in each emirate investigate money laundering and the crimes behind it
• The Public Prosecution prosecutes cases, with federal prosecution offices dedicated to economic crimes and money laundering since 2023
• Specialised money laundering courts sit in Abu Dhabi (2020), in the federal courts of Sharjah, Ajman, Umm Al Quwain and Fujairah (2020), and in Dubai (2021)
• The Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) runs the cross-border declaration system for cash and valuables with the Central Bank

In 2025 the UAE received 516 incoming requests for mutual legal assistance and opened 56 terrorist financing investigations.

Targeted financial sanctions

• “Without delay” means within 24 hours. Freeze the funds of a listed person within 24 hours of the listing, without prior notice to them, and do not make funds or services available to them.
• Register for notifications. Firms must subscribe to the EOCN notification system so they receive list updates as they happen.
• Report through goAML. File a Confirmed Name Match Report (CNMR) for a confirmed match and a Partial Name Match Report (PNMR) for a possible match, and notify a freeze within five working days. For partial matches, follow your supervisor’s current guidance: some expect a report within 24 hours.
• Serious consequences. Breaching targeted financial sanctions is a crime under the 2025 AML law. For DNFBPs, failing to freeze promptly carries the highest administrative fine band, AED 500,000 to AED 1 million.

AML/CFT obligations apply to three groups: financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers (VASPs). Cabinet Resolution No. 134 of 2025 defines each group by the activity carried out, so coverage follows what a business does, not just its licence or name.

Financial institutions

Article 2 of the executive regulations lists the financial activities that make a business a financial institution. They include:

• Taking deposits and lending, including financial leasing
• Money or value transfer, and issuing and managing means of payment, including electronic money
• Financial guarantees and commitments
• Trading in money market instruments, foreign exchange and derivatives, and taking part in securities issues
• Portfolio and fund management, safekeeping of cash or securities, and investing or managing funds for others
• Life insurance and investment-linked insurance
• Money and currency exchange

In practice this covers banks, finance companies, exchange houses, insurers, payment providers and hawala providers (supervised by the CBUAE); securities firms and fund managers (CMA); and authorised firms in the DIFC and ADGM (DFSA and FSRA).

DNFBPs and when they are covered

Extra reports for two sectors

• Precious metals and stones (DPMSR). Since June 2021, dealers file a report through goAML for cash transactions of AED 55,000 or more with individuals, and for cash or wire transactions of AED 55,000 or more with companies. Regulators expect it within two weeks of the transaction.
• Real estate (REAR). Since July 2022, brokers and agents file a report for every freehold purchase or sale paid with AED 55,000 or more in cash, or paid in any amount with virtual assets or with funds converted from virtual assets.

Enforcement is active. In the first half of 2025 the Ministry of Economy and Tourism imposed more than AED 42 million in fines for 1,063 violations, mostly by dealers in precious metals and stones (about AED 20 million) and real estate brokers (about AED 18.5 million).

Virtual asset service providers (VASPs)

• Licensing. Anyone carrying out virtual asset activities in or from the UAE must be licensed, registered or listed by the relevant authority. Operating without a licence is a crime carrying imprisonment and a fine of AED 200,000 to AED 10 million.
• Who licenses. VARA in Dubai (except the DIFC); the CMA at federal level, under rules that replaced the SCA’s regime in 2026; the FSRA in ADGM; the DFSA in the DIFC; and the CBUAE for payment tokens, such as dirham-backed stablecoins, under its Payment Token Services Regulation (2024).
• Same duties as financial institutions. VASPs must meet the same AML/CFT obligations as financial institutions, including customer due diligence for occasional transactions of AED 3,500 or more and the Travel Rule.
• Anonymity. Providing or promoting anonymity-enhancing virtual assets that stop transactions being traced is a crime under the 2025 law.

Hawala providers

Informal money transfer is allowed only for providers registered with the CBUAE under its Registered Hawala Providers Regulation. Registered providers must register on goAML, appoint a compliance officer, carry out customer due diligence on every transaction and keep records for five years. They may not take deposits or exchange currency.

Quick check: is your business covered?

1. Do you carry out any of the financial activities listed above as a business? If so, you are a financial institution.
2. Are you in a DNFBP category, and do you carry out the trigger activity, such as a cash sale of AED 55,000 or more in precious metals, a property sale or purchase, or forming a company for a client? If so, DNFBP obligations apply.
3. Do you provide virtual asset services in or from the UAE? If so, you need a licence and must meet the same obligations as a financial institution.
4. Where are you licensed: the mainland, a commercial free zone, Dubai, the DIFC or ADGM? The answer decides your supervisor.

If you are covered, register with your supervisor and on goAML before you need to file a report.

These are the core obligations for financial institutions, DNFBPs and VASPs under Federal Decree-Law No. 10 of 2025 and its executive regulations, Cabinet Resolution No. 134 of 2025. Each supervisor adds sector-specific rules and guidance, so always read them alongside your supervisor’s requirements.

Key numbers and qualifications

Read these summaries with the detailed duties below and the rules for your sector. The linked provisions explain their scope.

What you must do

The UAE is a member of the Middle East and North Africa Financial Action Task Force (MENAFATF), not of the FATF itself, and has been an observer at the Asia/Pacific Group since 2023. Its mutual evaluations are carried out jointly by the FATF and MENAFATF. The last full evaluation was published in 2020, and progress has since been tracked through follow-up reports.

Current status

The 2020 mutual evaluation

• Process. A joint FATF and MENAFATF assessment, with an on-site visit from 1 to 18 July 2019. The report was adopted at the FATF plenary in February 2020 and published on 30 April 2020.
• Effectiveness. No Immediate Outcome was rated high. One was rated substantial (IO.9, terrorist financing investigation and prosecution), six moderate and four low: international cooperation (IO.2), legal persons and arrangements (IO.5), money laundering investigation and prosecution (IO.7) and proliferation financing sanctions (IO.11).
• Technical compliance. 34 of the 40 Recommendations were rated compliant or largely compliant: 11 compliant and 23 largely compliant. Six were partially compliant (R.1, R.6, R.7, R.19, R.25 and R.29), and none non-compliant.
• Main gaps. The assessors found a limited understanding of the risk of laundering foreign proceeds and of trade-based money laundering, few money laundering prosecutions for the UAE’s risk profile, fragmented company registries that made beneficial ownership hard to establish, limited use of mutual legal assistance, and very little effective supervision of high-risk DNFBPs such as precious metals dealers and real estate agents.
• Result. The UAE was placed in enhanced follow-up.

Progress since 2020

1. November 2021: first follow-up report

   R.6 and R.7 (targeted financial sanctions) were upgraded to compliant and R.25 (legal arrangements) to largely compliant. R.15 (new technologies) fell to partially compliant because the FATF Standard on virtual assets had changed. The UAE reached 36 of 40.

2. March 2022

   The FATF placed the UAE under increased monitoring with a seven-item action plan.

3. May 2022: second follow-up report

   No re-ratings were requested.

4. May 2023: third follow-up report

   R.1 (assessing risk) was upgraded to largely compliant, and R.19 (higher-risk countries) and R.29 (financial intelligence units) to compliant. The UAE reached 39 of 40: 15 compliant and 24 largely compliant. Only R.15 remains partially compliant.

5. February 2024

   The FATF removed the UAE from increased monitoring after it completed its action plan.

The 2022 to 2024 grey listing

The UAE was under FATF increased monitoring from March 2022 to February 2024. Its action plan required:

• A sustained increase in outbound mutual legal assistance requests for money laundering, terrorist financing and high-risk predicate offences
• A shared understanding of money laundering and terrorist financing risks across DNFBP sectors
• More, and better quality, suspicious transaction reports from financial institutions and DNFBPs
• A better understanding of how legal persons and arrangements are misused
• More FIU resources and wider use of financial intelligence, including against foreign predicate offences, trade-based money laundering and third-party laundering
• A sustained increase in money laundering investigations and prosecutions in line with the UAE’s risk profile
• Proactive action against sanctions evasion, including private sector awareness of targeted financial sanctions

In October 2023 the FATF agreed to an on-site visit to verify progress, and it removed the UAE from the list in February 2024. The EU, which had added the UAE to its list of high-risk third countries in March 2023, removed it with effect from 5 August 2025.

What comes next

• The UAE’s next mutual evaluation is again a joint FATF and MENAFATF assessment, under the new round of evaluations. The FATF’s calendar lists a possible June 2026 on-site period and February 2027 plenary discussion. These dates are indicative and do not themselves confirm completion of either stage.
• The Higher Committee reviewed preparations for the visit in February 2026 and the progress of the joint evaluation in June 2026. If the timetable holds, the report would follow the February 2027 plenary.
• The new round puts even more weight on effectiveness. Because effectiveness has not been reassessed since 2020, it will be the first full test of whether the reforms since then, including the 2025 law, produce results.

The UAE’s National Risk Assessment 2024 (NRA) is its second national assessment. It used the World Bank methodology and data from 2019 to 2023, with input from more than 84 authorities and private sector bodies, and rates risks on a five-level scale: high, medium-high, medium, medium-low and low. It rates the overall money laundering threat as medium-high and the residual terrorist financing risk as medium-high. Your own risk assessment should reflect these findings.

As an international financial, trade and transport hub, the UAE is especially exposed to the laundering of proceeds of crimes committed abroad. The NRA highlights trade-based money laundering, professional and third-party laundering, misuse of companies, real estate and virtual assets.

Money laundering threats

Threats in the lower row were rated medium-low or low.

Sector risk

In the financial free zones, the DIFC banking sector was rated medium and ADGM medium to medium-high.

Terrorist and proliferation financing

• Channels. Terrorist financing involves donations sent abroad, commercial enterprises, real estate and informal financial networks.
• Non-profit organisations. Of 1,024 licensed non-profit organisations, 154 form the subset more exposed to terrorist financing. The sector’s threat and vulnerability are both rated medium.
• Proliferation financing. A separate national proliferation financing risk assessment was approved in February 2026. Official guidance points to sanctions evasion through trade, transshipment and complex company structures.

Common typologies

• Trade-based money laundering. Over- and under-invoicing, multiple invoicing, phantom shipments and misdescribed goods, often through shell or front companies, free zone entities and payments from unrelated third parties. The CBUAE issued detailed guidance on trade-based money laundering and transshipment in November 2025.
• Real estate. Property bought with cash, virtual assets or structured payments, often through companies or several related buyers. The FIU studied 976 real estate activity reports filed between mid-2020 and mid-2023.
• Hawala and unlicensed remittance. Remittance businesses run under general trading licences, with frequent cash deposits from many people pooled in one account and paid out to others.
• Fraud and money mules. Small cash deposits at machines across several emirates, followed by rapid withdrawals or transfers abroad, with growing use of synthetic identities and deepfakes to pass onboarding checks.
• Virtual assets. Mixers, privacy coins, peer-to-peer platforms and unlicensed providers used to break the audit trail.

Red flags for front-line staff

These are drawn from official UAE guidance and FIU studies. One red flag on its own is not proof of wrongdoing, but several together call for closer review and, where suspicion remains, an STR.

Eight scenarios for a self-check. Choose your answer mentally or note it down, then reveal the explanation. Count your own correct answers; no score or learning progress is saved.