All About Key Changes In The New Anti-Money Laundering UAE Law

Anti-Money Laundering law in the UAE was rewritten in October 2025 — and the rewrite is substantial. Federal Decree-Law No. 10 of 2025 is not a routine amendment to the 2018 framework it replaced. This is not a routine legislative update; it represents a fundamental reset. The New AML Law modernises investigative powers, significantly broadens the scope of regulated activities, and imposes substantially harsher penalties.

For UAE businesses, this reset arrived at a specific moment, they follow the country’s removal from the FATF grey list in March 2024 and the EU high-risk countries list in July 2025, reinforcing its alignment with FATF standards and international best practices. As the UAE prepares for the FATF’s next mutual evaluation in 2026, this legislation signals a proactive approach.

The combination of a new law with higher penalties, a FATF review underway in 2026, and active enforcement already generating over AED 42 million in fines in the first half of 2025 alone means that treating AML compliance as a paperwork exercise is no longer viable for any UAE business within the law’s scope.

This guide covers all eight key changes in the new Anti-Money Laundering UAE law — what each change means, why it matters for your business, which sectors face the most significant new exposure, and what practical steps are required right now.

Anti-Money Laundering UAE: The Legal Framework Behind the 2025 Reform

Before examining the key changes, it helps to understand the full legislative package that now governs AML in the UAE.

The UAE has enacted Federal Law No. 10 of 2025, Concerning Combating Money Laundering, Terrorism Financing, and the Financing of Proliferation, (the “New AML Law”), which repeals and replaces Federal Law No. 20 of 2018. The New AML Law introduces some significant amendments and a series of refinements which are designed to further strengthen the UAE’s existing Anti-Money Laundering and Counter-Terrorist Financing regime.

Federal Decree-Law No. 10 of 2025 was issued in October 2025 and effective 14 October 2025. The Cabinet Resolution No. 134 of 2025 came into force on 14 December 2025, replacing the previous Cabinet Resolution No. 10 of 2019. This Resolution implements the executive regulations of Federal Decree-Law No. 10.

Together, these two instruments create the complete 2025/2026 AML framework. The law defines the offences, the regulated entities, and the enforcement powers. The Cabinet Resolution sets the detailed implementation requirements — what “adequate due diligence” means in practice, how risk assessments must be structured, what goAML reporting requires, and how staff training must be organised.

The UAE’s AML supervisory architecture operates through several authorities: the Central Bank of the UAE (CBUAE) for financial institutions; the Ministry of Economy and Tourism (MoET) for DNFBPs; the Securities and Commodities Authority (SCA) for investment businesses; and the Financial Services Regulatory Authority (FSRA) in ADGM and the Dubai Financial Services Authority (DFSA) in DIFC for their respective free zones.

Key Change 1 — Proliferation Financing Is Now a Standalone Criminal Offence

For the first time, the title of the legislation explicitly includes Countering Proliferation Financing, replacing the earlier reference to illegal organisations. The law now introduces standalone offences for financing the proliferation of arms and weapons of mass destruction, supported by new statutory definitions. Proliferation Financing is now officially on par with Anti-Money Laundering and Counter-Terrorist Financing under the country’s revamped financial crime framework.

Proliferation financing — providing funds, assets, or financial services that support the development or acquisition of weapons of mass destruction — was referenced in the 2018 law but was not treated as a primary criminal offence in its own right. It is now.

This extends far beyond the defence industry — manufacturers, logistics companies, and trade-finance providers could all fall within scope if their transactions involve materials that could be repurposed for weapons use. Failure to conduct enhanced due diligence or report suspicious activity could expose businesses to fines of up to AED 100 million and criminal prosecution.

For businesses in chemicals, electronics, dual-use technology, logistics, and trade finance, this change requires a formal proliferation financing risk assessment to be incorporated into their Business-Wide Risk Assessment (BWRA) — a step that is now mandatory under Cabinet Resolution No. 134 of 2025.

Key Change 2 — The “Should Have Known” Liability Standard

This is the change with the broadest day-to-day impact on the widest range of UAE businesses.

The mental element for money laundering crimes has shifted. The law now captures situations where someone “knew or should have known” that funds derived from criminal activity, lowering the evidentiary bar from the previous standard.

Under the old 2018 law, establishing criminal liability for money laundering required demonstrating that the accused actually knew the funds were connected to criminal activity. Under the 2025 law, the test is objective — would a reasonable professional in the same position have identified the red flags?

Under the new AML UAE framework, liability applies if you should have known based on the circumstances. If a reasonable professional in your position suspects money laundering, your failure to act can expose you to criminal liability.

What this means in practice across different roles:

For a finance manager approving an unusual wire transfer to a high-risk jurisdiction where the stated business purpose is vague: under the old law, the manager would need to have known the funds were illicit. Under the new law, if reasonable red flags were present and the manager did not investigate, the manager faces personal liability.

For a real estate agent closing a high-value cash or crypto-funded property transaction without conducting enhanced due diligence: ignorance of the buyer’s source of funds is not a defence if a reasonable agent would have investigated further.

For an accountant processing a client’s unusual intercompany transfers without asking about their purpose: the constructive knowledge standard requires that they asked — and documented that they asked.

This raises the bar for what constitutes “reasonable steps” and makes a robust, well-evidenced compliance programme all the more critical.

Key Change 3 — Tax Evasion Is Now a Predicate Offence

This change is underemphasised in competitor content but has far-reaching implications for any UAE business operating in the corporate tax and VAT space.Tax evasion is expressly listed as a predicate offence, closing a long-standing ambiguity and bringing the UAE in line with international AML standards.

A predicate offence is a criminal act that generates the illicit funds that are subsequently “laundered.” By making tax evasion a predicate offence, the 2025 law creates a legal connection between the UAE’s tax enforcement regime (the FTA) and the AML enforcement regime (the FIU and supervisory authorities).

The practical consequence: a business that evades UAE corporate tax by under-declaring income and then uses those funds in commercial transactions could face both a corporate tax assessment with penalties from the FTA under the tax procedures law, and a money laundering investigation under the new AML law. These are now two parallel enforcement pathways for the same underlying conduct.

This also means that a business which files accurate tax returns and cooperates with the FTA has a significantly lower AML risk profile — because accurate tax compliance removes the predicate offence risk from the equation. The UAE’s corporate tax, VAT, and AML compliance obligations are now formally interconnected in a way they were not before October 2025.

Key Change 4 — Substantially Higher Penalties With No Upper Time Limit

Penalties for AML violations have significantly increased under the new law. Legal persons face fines tied to the value of criminal property or up to AED 100 million for offences related to money laundering, terrorist financing, or proliferation financing.

This AED 100 million figure is not an abstract maximum — it is the primary penalty provision for corporate violations of the law’s principal offences. For administrative violations (less serious non-compliance), regulators are empowered to impose fines ranging from AED 10,000 to AED 5 million per violation.

Criminal liability extends to managers, directors, and beneficial owners of legal entities when violations occur with their knowledge or due to gross negligence. The law mandates stronger enforcement and personal liability for senior management.

Imprisonment of up to 10 years applies to individuals. Foreign nationals convicted of money laundering face deportation after serving their sentence.

The removal of all limitation periods: The UAE’s 2025 AML law introduces no statute of limitations for money laundering offences.This means transactions from any historical period can now be investigated and prosecuted — there is no point at which historical exposure is extinguished by the passage of time.

The enforcement data makes the penalty framework concrete. The Ministry of Economy and Tourism has announced that its inspection campaigns in the first half of 2025 detected 1,063 violations and imposed administrative penalties exceeding AED 42 million. This was under the 2018 law. Under the 2025 law with higher penalty thresholds and broader offence scope, enforcement outcomes are expected to be more severe.

Key Change 5 — Virtual Assets Are Fully Brought Within the AML Regime

Virtual assets and service providers (VASPs) are now subject to the full AML/CFT regime. Article 30 prohibits anonymity-enhanced virtual assets that prevent transaction traceability, while Article 32 criminalises unlicensed VASP activity, punishable by imprisonment and fines of up to AED 10 million. Crypto exchanges, wallet providers, and DeFi platforms must now be licensed and implement AML controls equivalent to those applied by banks.

The previous 2018 AML framework was created before virtual assets became a mainstream financial instrument in the UAE. The 2025 law addresses this directly and comprehensively. Every cryptocurrency exchange, wallet provider, DeFi platform, NFT marketplace with financial functionality, and stablecoin operator must:

• Hold a UAE licence from the appropriate regulatory authority
• Implement full KYC and CDD on all users
• Register on goAML and file STRs for suspicious activity
• Conduct transaction monitoring with appropriate technology
• Apply the Travel Rule for transfers above specified thresholds
• Exclude from operations any anonymity-enhanced assets (privacy coins) that cannot be traced

For UAE businesses that accept cryptocurrency as payment, or that hold virtual assets as part of their treasury function, the law also expands due diligence obligations — including requiring enhanced scrutiny of payments received from VASPs that are not licensed or that are based in high-risk jurisdictions.

Key Change 6 — Expanded FIU Enforcement Powers Including 30-Day Asset Freezes

The UAE Financial Intelligence Unit and law enforcement agencies receive expanded powers, including rapid freezing of funds for up to 30 days and broader information-sharing abilities.

Under the previous law, the FIU’s power to freeze assets without court authorisation was limited to seven days. The 2025 law extends this to 30 days — a quadrupling of the suspension window that the FIU can impose on a business’s bank accounts and assets while investigating a suspicious transaction report.

For any business subjected to a 30-day asset freeze, the operational consequences are immediate and severe: trade finance facilities cannot be drawn, supplier payments are suspended, payroll may be delayed, and the business’s ability to conduct any financial transaction is effectively paused. The reputational consequences — including bank notifications of the freeze — create additional long-term damage even if the investigation concludes without charges.

Financial institutions should expect heightened regulatory attention throughout 2026. Supervisory authorities will want to demonstrate effective oversight to FATF assessors. Update your Enterprise-Wide Risk Assessment to include proliferation financing. Review CDD procedures for high-risk categories including VASPs, correspondent banks, and PEPs. Check beneficial ownership records for accuracy. False or incomplete information is now a specific offence with personal liability implications.

Key Change 7 — Expanded DNFBP Obligations Under Cabinet Resolution No. 134 of 2025

Cabinet Resolution No. 134 of 2025 requires banks, financial institutions, virtual asset providers, and other regulated entities to spot, assess, and curb proliferation financing risks across their entire operations.

For DNFBPs — the category that includes real estate agents, accountants, auditors, lawyers, company formation service providers, and dealers in precious metals and stones — the 2025 law and its implementing regulations create a comprehensive compliance programme that goes well beyond what the 2018 framework required.

Under Cabinet Resolution No. 134 of 2025, DNFBPs must:

Maintain a current Business-Wide Risk Assessment (BWRA) that formally assesses money laundering, terrorist financing, AND proliferation financing risks across all products, customers, delivery channels, and geographic markets. The BWRA must be updated whenever there is a significant change in the business’s activities or risk environment.

Appoint a UAE-resident MLRO (Money Laundering Reporting Officer) with appropriate seniority, independence, and direct access to the board or senior management. The MLRO must have sufficient resources and authority to discharge their function effectively — a titular appointment with no actual authority does not satisfy this requirement.

Conduct Customer Due Diligence (CDD) on all new clients before entering business relationships, and Enhanced Due Diligence (EDD) on high-risk clients, PEPs, and clients from high-risk jurisdictions.

Implement ongoing transaction monitoring — not just point-of-entry CDD. Existing client relationships must be reviewed on a risk-based schedule, and unusual transactions must trigger enhanced review regardless of when the customer relationship was established.

Screen all clients and transactions against the UAE Local Terrorist Designation (LTD) list and the UN Consolidated Sanctions List. These lists are updated regularly — screening must be dynamic, not a one-time check at onboarding.

Register on goAML and file STRs promptly when suspicious indicators are identified — without tipping off the subject of the report.

Key Change 8 — Role-Based Training Replaces Uniform Training

This change, introduced through the CBUAE’s updated October 2025 AML/CFT guidance, applies across all regulated entities and represents a significant shift in how compliance training must be structured.

Under the previous standard, uniform AML training delivered to all staff was generally considered compliant. Under the 2025 framework and the CBUAE’s updated guidance, training must be role-based — designed specifically for each employee’s function and exposure:

• A relationship manager who onboards clients needs training focused on CDD red flags, PEP identification, and the triggers for escalation to the MLRO
• A trade finance officer who processes documentary credits needs training on trade-based money laundering typologies and dual-use goods
• A settlements clerk who processes wire transfers needs training on correspondent banking risks and the Travel Rule
• A senior manager who approves CDD exceptions needs training on governance obligations and personal liability under the 2025 law

A single annual AML e-learning module completed by all staff uniformly no longer meets the standard. Firms need to map each role’s AML exposure and design training content accordingly — with completion records maintained for inspector review.

What Your Business Must Do Right Now

Based on all eight changes above, here is a practical compliance checklist for UAE businesses under the new AML framework:

For all regulated entities (FIs and DNFBPs):

• Confirm goAML registration is current and active
• Update your Business-Wide Risk Assessment to include proliferation financing risk
• Review your MLRO appointment for seniority, independence, and resourcing adequacy
• Upgrade CDD procedures to meet the “should have known” evidentiary standard — document your risk assessment for every client relationship
• Implement dynamic sanctions screening against the LTD list and UN list
• Review and upgrade staff training to role-based format

For DNFBP-category businesses specifically:

• Real estate agents: implement EDD on all high-value cash or crypto-funded transactions
• Accountants and auditors: assess whether your client base includes any tax evasion risk (now a predicate offence) and update your STR filing procedures accordingly
• Company formation agents: verify beneficial ownership for all existing and new clients against the accurate statutory standard — false BO information is now a specific offence with personal liability

For virtual asset businesses:

• Confirm UAE licensing status with the appropriate regulatory authority
• Implement full AML controls equivalent to those of banks
• Remove any anonymity-enhanced assets from your platform

For all businesses as part of annual compliance review:

• Update your Enterprise-Wide Risk Assessment
• Ensure board-level engagement with AML compliance — personal director liability under the 2025 law requires board awareness
• Review transaction monitoring technology for real-time capability

Conclusion

Anti-Money Laundering compliance in the UAE in 2026 is not a future concern or a theoretical risk. Federal Decree-Law No. 10 of 2025 has been in force since October 14, 2025. Cabinet Resolution No. 134 of 2025 has been in force since December 14, 2025. The enforcement infrastructure — MoET inspection teams, CBUAE supervisory reviews, FIU goAML monitoring — was already active and producing results before the new law took effect.

With the FATF’s fifth-round mutual evaluation of the UAE scheduled for 2026, regulators are under pressure to demonstrate real-world enforcement outcomes. That pressure translates directly into inspection activity, penalty assessments, and escalated scrutiny of both financial institutions and DNFBPs across every emirate.

The eight changes covered in this guide are not abstract regulatory updates. They are specific, enforceable, penalty-backed obligations that apply to your business today. The businesses that respond promptly — updating risk assessments, implementing role-based training, reviewing CDD procedures, and confirming goAML compliance — are the ones that will be in the strongest position when the inspector arrives.

Why My Taxman Is the Best Choice for AML Compliance in UAE

Navigating the new UAE Anti-Money Laundering law requires more than awareness of what has changed. It requires a partner who can translate the regulatory requirements into practical, documented compliance programmes that hold up under supervisory inspection.

Here is why My Taxman is the right partner for your AML obligations:

We connect AML compliance to your tax compliance position. With tax evasion now a predicate offence for money laundering, the connection between your FTA compliance record and your AML risk profile is direct and consequential. My Taxman manages your corporate tax, VAT, and AML compliance as an integrated picture — ensuring your tax filings are accurate, your FTA record is clean, and your AML risk from the predicate offence angle is minimised.

We support full DNFBP compliance from BWRA to goAML. For accountants, real estate businesses, company formation agents, and professional services firms, our team helps update your Business-Wide Risk Assessment to include proliferation financing, review your MLRO appointment, design your role-based training programme, and ensure your STR filing procedures meet the 2025 law’s “without delay” standard.

We design CDD procedures built for the “should have known” standard. Our compliance team builds customer due diligence frameworks that document risk assessment at every step — creating the evidence trail that demonstrates your business met the reasonable professional standard under the constructive knowledge test.

We integrate your complete compliance stack. My Taxman covers corporate tax, VAT, excise tax, transfer pricing, accounting and bookkeeping, outsourced CFO services, due diligence, fundraising, and valuation — all under one roof. Your AML compliance is managed in the context of your complete financial and regulatory picture, not as an isolated function.

We are a 4.9-star rated UAE tax and financial advisory firm trusted across Dubai, Sharjah, and the Emirates. Our clients stay with us because our compliance work is accurate, proactive, and produces documented, inspection-ready results.

Whether you need an AML compliance review, a Business-Wide Risk Assessment update, MLRO advisory support, or a complete DNFBP compliance programme under the new law — talk to My Taxman today. We make the new UAE Anti-Money Laundering requirements manageable for your business.

FAQS FOR ANTI-MONEY LAUNDERING