Since 14 October 2025 the UAE has had a different anti-money laundering (AML) law. Federal Decree-Law No. 20 of 2018 — the act most websites, bank onboarding forms and in-house AML policies still cite — has been repealed in full. The new UAE AML law is Federal Decree-Law No. 10 of 2025, and since 14 December 2025 it has been accompanied by new Implementing Regulations, Cabinet Resolution No. 134 of 2025, which replaced Cabinet Resolution No. 10 of 2019.
For a company this is not a formality. If your AML policy still refers to the repealed acts, the document looks out of date the moment a Ministry of Economy inspector or a bank compliance officer opens it — and so does every procedure built on it. Below: exactly what changed, a before-and-after table, the new threshold amounts and a checklist of what a UAE company should do right now.
The new UAE AML law: key dates and status of the acts
In 2025 both pillars of UAE AML regulation changed — the law itself and the regulations issued under it. The dates matter: the law and the regulations entered into force two months apart.
| Act | Published | In force from | What it repealed |
|---|---|---|---|
| Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and the Financing of Proliferation of Weapons of Mass Destruction | Official Gazette, 30 September 2025 | 14 October 2025 | Federal Decree-Law No. 20 of 2018 — in full (Article 41) |
| Cabinet Resolution No. 134 of 2025 on the Implementing Regulations | Issued 29 October 2025, Gazette No. 811 of 15 November 2025 | 14 December 2025 | Cabinet Resolution No. 10 of 2019 (Article 70) |
Why citing Federal Decree-Law 20 of 2018 is a risk
Most English-language guides to AML in the UAE still quote the repealed law, and companies copy those references into their own documents: the AML policy, KYC questionnaires, the business risk assessment. An inspector who sees “Cabinet Resolution No. 10 of 2019” in a policy draws a simple conclusion: the document has not been reviewed since the new law took effect, so it is missing the mandatory new elements — for example, an assessment of proliferation financing risk.
What replaced Federal Decree-Law 20 of 2018: before-and-after table
| Topic | Before (Decree-Law 20 of 2018, Resolution 10 of 2019) | After (Decree-Law 10 of 2025, Resolution 134 of 2025) |
|---|---|---|
| Proliferation financing (CPF) | Handled mainly through sanctions mechanisms | Stand-alone criminal offence (Article 3): weapons of mass destruction, their means of delivery, dual-use goods |
| Standard of proof | The prosecution had to prove the person knew the funds were proceeds of crime | Enough to prove the person knew or should have known; circumstantial evidence admissible |
| Administrative fines | AED 50,000 to AED 5,000,000 per violation | AED 10,000 to AED 5,000,000 per violation (Article 17) + the right to publish sanctions |
| Court fines for legal entities | Up to AED 50 million | AED 5 million to AED 100 million (Article 27(1)) |
| Limitation period | Not expressly excluded | None for money laundering, terrorist financing and proliferation financing (Article 37(2)) |
| Freezing of funds | Up to 7 working days, by decision of the Central Bank Governor | Up to 30 days by decision of the head of the FIU; extension via the Attorney General |
| FIU (Financial Intelligence Unit) | Analytical role; freezing powers sat with the Central Bank Governor | Operational independence and its own powers to suspend transactions and freeze funds |
| VASPs (virtual assets) | Added to the Regulations by the 2022 amendments | Fully fledged category with obligations at financial-institution level; anonymity-enhancing tokens banned |
| Non-profit organisations | Regulated piecemeal | Express obligations set out in the law (Article 34) |
| DNFBPs | Five categories | Six categories: commercial gaming operators added |
| Company management | Liability framed in general terms | Explicit personal accountability of senior management for AML controls |
What changed in Federal Decree-Law No. 10 of 2025 itself
Proliferation financing: a new criminal offence
The biggest change for business is that financing the proliferation of weapons of mass destruction (CPF, proliferation financing) is now a stand-alone criminal offence on a par with money laundering and terrorist financing. The offence covers not only the weapons themselves but their means of delivery and dual-use goods and technologies.
In practice, a trading or re-export company that lawfully supplies electronics, machine tools, chemicals or components can find itself exposed if the end recipient or the shipping route is linked to a sanctioned jurisdiction. The penalty for CPF is up to 15 years’ imprisonment and a fine of AED 1 million to AED 10 million, or twice the value of the property if that is higher. We cover this in detail in our guide to proliferation financing (CPF) in the UAE.
A lower standard of proof: “knew or should have known”
Previously the prosecution had to prove that a person actually knew the money came from crime. Now sufficient indications or circumstantial evidence are enough — an unusual payment pattern, documents that do not match, a multi-layered structure with no economic rationale. Knowledge can be inferred from objective circumstances. For companies, the argument “we did not know” no longer works without documented customer due diligence to back it up.
AML fines and penalties: up to AED 5 million administratively and AED 100 million on conviction
The new scale of sanctions looks like this:
- Administrative fines imposed by the supervisor — AED 10,000 to AED 5,000,000 for each violation (Article 17). On top of the fine: a ban on operating in the sector, restrictions on management powers, suspension or revocation of the licence.
- Publication of sanctions — the supervisor may announce the measures it has imposed publicly, including in the media. For a company that depends on banks and counterparties, this often costs more than the fine itself.
- Fines for legal entities on conviction by a court — AED 5 million to AED 100 million (Article 27(1)); under the old law the range was AED 500,000 to AED 50 million.
- False information about the UBO — a stand-alone offence (Article 35(1)): imprisonment and/or a fine of no less than AED 20,000.
The full table of AML fines and penalties in the UAE, broken down by type of violation, is in our separate article.
The limitation period no longer protects anyone
Article 37(2) states expressly that criminal proceedings for money laundering, terrorist financing and proliferation financing are not time-barred. A transaction carried out many years ago can become the subject of an investigation at any time. Hence the practical importance of keeping customer and transaction records.
Personal accountability of senior management
The law and the Regulations place a direct duty on senior management — directors, general managers, board members — to approve the AML policy, sign off on high-risk customer relationships and oversee how procedures are followed. A manager may be held personally liable if they knew about a violation or if it was made possible by their failure to perform their duties.
New powers for the FIU
The Financial Intelligence Unit (FIU) has gained operational independence and powers of its own. The head of the FIU can now, without prior notice, suspend a transaction for up to 10 working days and freeze funds for up to 30 days (previously up to 7 working days, and only by decision of the Central Bank Governor). Any extension of a freeze goes through the Attorney General.
Virtual assets, non-profits and new offences
- VASPs — virtual asset service providers are now fully equated with financial institutions for AML purposes. Products that completely conceal the parties to a transaction are banned (Article 30), and operating without a licence is a criminal offence carrying a fine of up to AED 10 million (Article 32).
- Non-profit organisations — their obligations are set out expressly in the law for the first time (Article 34).
- Third-party use of accounts — it is a criminal offence to let another person use your bank account or VASP account for unlawful transactions.
- Failure to comply with UAE targeted financial sanctions instructions — a separate violation.
What Cabinet Resolution No. 134 of 2025 changed in the Implementing Regulations
The Regulations are the document companies build their procedures on. They run to 71 articles, and they are what inspectors test against. The key changes:
- Three pillars instead of two. Risk assessment, customer due diligence (CDD) and transaction monitoring must now address not only money laundering and terrorist financing but also proliferation financing (ML/TF/PF).
- STRs without delay. A suspicious transaction report is filed through goAML immediately, and warning the customer that a report has been filed (tipping-off) is a criminal offence.
- Gaming is a new DNFBP category. Commercial gaming operators, including online gaming, are licensed by the GCGRA (General Commercial Gaming Regulatory Authority).
- Record-keeping — at least 5 years from the latest of: the end of the business relationship, closure of the account, completion of the due diligence check or investigation, or the date a court judgment takes effect (Article 25(2)).
UAE AML thresholds: AED 55,000 and other amounts
The specific amounts that must be hard-wired into a company’s CDD procedures:
| Situation | Threshold | What it means |
|---|---|---|
| Occasional transactions at financial institutions | AED 55,000 and above | Mandatory customer due diligence (CDD) for a single transaction or a series of linked transactions |
| Cash transactions with dealers in precious metals and stones (DPMS) | AED 55,000 and above | CDD and reporting through goAML |
| Occasional wire transfers | AED 3,500 and above | Full originator and beneficiary details |
| VASP transactions | AED 3,500 and above | Travel Rule: originator and beneficiary details |
| Gaming sector | AED 11,000 and above | CDD for transactions and linked transactions |
| Beneficial ownership (UBO) | 25% | Ownership or control of 25% or more makes a person a UBO |
The AED 55,000 and AED 3,500 figures largely carried over from the previous regime; what is new is the gaming threshold and the fact that VASP obligations now sit in the main text of the Regulations. For a detailed breakdown, see our article on AML thresholds in the UAE.
UBO requirements and ownership transparency
- The UBO threshold is 25% ownership or control; if no such person exists, the beneficial owner is whoever controls the company by other means, and failing that, the senior managing official.
- Nominee shareholders and nominee directors are defined separately and are not treated as beneficial owners — they must be disclosed, and the real owner behind them must be identified
- Beneficial owner and nominee director details must be updated within 15 working days of any change.
- Registers of shareholders and partners must be kept in the UAE.
- Bearer shares are prohibited; existing ones must be converted within 30 working days.
This directly affects holding structures, family businesses, foundations and trusts. Read more in our guide to UBO requirements in the UAE.
Who the new UAE AML requirements apply to
Direct AML obligations (goAML registration, an AML policy, an appointed compliance officer, staff training) fall on three groups:
- Financial institutions — banks, exchange houses, insurers, payment and investment companies.
- DNFBPs (Designated Non-Financial Businesses and Professions) — six categories: real estate agents and brokers; dealers in precious metals and precious stones (DPMS); lawyers and notaries; independent accountants and auditors; corporate service providers (CSPs); commercial gaming operators.
- VASPs — companies dealing in virtual assets.
The law also sets out separate obligations for non-profit organisations. To check whether your company counts as a DNFBP, see our article on DNFBPs in the UAE.
“We are in a free zone” — AML still applies
The federal AML law applies throughout the UAE, including every free zone — DMCC, IFZA, RAKEZ, Meydan, SHAMS and others. A free zone licence does not exempt a real estate agency or a gold trader from registering in goAML. In the financial free zones DIFC and ADGM, supervision is carried out by their own regulators (the DFSA and the FSRA), but the federal law and criminal liability apply there too.
What if the company is not a DNFBP?
An ordinary trading or consulting company does not have to register in goAML unless it falls into one of the listed categories. But the criminal provisions of the new law — CPF, third-party use of accounts, false UBO information, “should have known” — apply to everyone. On top of that, UAE banks themselves now operate under the new Regulations and increasingly ask customers for an AML policy, UBO details and information on counterparties when opening a bank account in the UAE and during the relationship.
What your company should do now: an 8-step checklist
- Replace the legal references in your documents. In every internal document — AML policy, procedures, KYC questionnaires — replace Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019 with Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
- Update the risk assessment. Add proliferation financing risks: dual-use goods, destination countries, end recipients.
- Check the thresholds in your CDD procedures. AED 55,000, AED 3,500 and AED 11,000, plus the 25% UBO threshold.
- Bring UBO data up to date. Disclose nominee shareholders and directors, and make sure changes are recorded within the 15-working-day deadline.
- Check your goAML registration and the appointment of a compliance officer (MLRO) if the company is a DNFBP — see our page on goAML registration.
- Set up counterparty screening against the UAE and UN sanctions lists — and record the results.
- Have management approve the policy by board minutes or a director’s resolution; this is now a matter of personal accountability for senior management.
- Train your staff and keep a training log; retain records for at least 5 years.
“What we see most often is not the absence of AML documents but a 2019–2021 policy downloaded from a template: no CPF, no new thresholds, and references to repealed acts. On paper the document exists, but it fails at inspection. Updating it for Federal Decree-Law No. 10 of 2025 is not a rewrite from scratch — it is targeted revision, and it is far better done before the regulator or the bank asks.” — Lead Lawyer, Dynasty Business Adviser
Practical scenarios: where to look first
| Type of company | Main risk under the new law | Priority |
|---|---|---|
| Trading / re-export company in a free zone | CPF and dual-use goods; bank queries about counterparties | Screening of counterparties and shipping routes |
| Real estate agency in Dubai | DNFBP: goAML, cash transaction reports, fines up to AED 5 million | goAML registration, MLRO, policy |
| Gold trader and jeweller (DPMS) | AED 55,000 cash threshold, reporting through goAML | CDD procedures and reporting |
| Crypto company (VASP) | Bank-level obligations, Travel Rule from AED 3,500 | Licence, policy, transaction monitoring |
| Holding, family business, foundation | UBO 25%, nominee owners, 15 working days | Keeping UBO data current |
| Accountant, CSP, lawyer | DNFBP: personal accountability of management | Policy, training, MLRO |
Common mistakes in coverage of the new AML law
- Mixing up the dates. The law took effect on 14 October 2025, the Regulations on 14 December 2025. These are different dates.
- “A new national UBO register has been created.” There is no confirmation of this: the changes concern company-level registers and the deadlines for updating data.
- “AML only concerns banks.” DNFBPs and VASPs carry the obligations, and the criminal provisions apply to every company and individual.
- “The UAE is on the FATF grey list.” The UAE was removed from the FATF grey list in February 2024; the new law is part of the effort to keep it that way — see our article on the UAE and the FATF grey list.
Conclusion
The new UAE AML law keeps the risk-based approach but makes the consequences noticeably harsher: CPF is a stand-alone offence, the standard of proof has dropped to “should have known”, fines for legal entities have risen to AED 100 million, the limitation period has gone, and management is personally accountable. For most companies this means not a new system built from scratch but a review of the documents they already have — replacing the legal references, adding PF risks and verifying UBO data.
If you are not sure whether the changes affect your company, or you want your AML policy checked against Federal Decree-Law No. 10 of 2025, the specialists at Dynasty Business Adviser will audit your documents and prepare a plan of revisions. You can read more about what we offer on our «AML compliance in the UAE» page. Get in touch: +971 52 634 1022.
Get a consultation
Information is current as at 12 October 2026. This article is based on the provisions of Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 and does not constitute a legal opinion. Before making any decisions, confirm the requirements for your company with a specialist.
