Financial Crime Compliance in the UAE: AML/CFT Guide

Financial Crime Compliance in the UAE: Prevention and Defence

The United Arab Emirates (UAE) has established itself as a global financial and commercial hub, attracting trillions in investment and facilitating international trade. That growth brings a greater responsibility to protect the financial system from financial crime, including money laundering (ML), terrorism financing (TF) and proliferation financing (PF). For the UAE, strong financial crime compliance is not only an international obligation but also a way to protect its reputation and economic stability.

Related: Explore our real estate law advisory services in the UAE.

The UAE has recently overhauled its anti-financial crime framework. The main changes are the introduction of Federal Decree Law No. 10 of 2025 and the launch of the 2024-2027 National Strategy for Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT). Together they mark a stricter era of compliance, and they require prompt and thorough action from every business operating in the Emirates.

This guide covers the core of the UAE's financial crime compliance landscape: the key legislative changes, the strategic focus areas, and the prevention and defence measures every business must put in place to stay resilient and avoid severe penalties.

Why the UAE Is Strengthening Financial Crime Compliance

The UAE's proactive stance responds to global regulatory pressure and to increasingly sophisticated financial criminals. For years, the UAE has worked closely with international bodies such as the Financial Action Task Force (FATF) to align its legal and regulatory structures with global standards. The recent legislation is designed to address emerging risks and close remaining gaps, so that the UAE remains a trusted jurisdiction for global commerce.

Related: Explore our labour and employment law advisory services in the UAE.

The new framework recognises that financial crime is no longer confined to traditional banking. It now reaches virtual assets, real estate, precious metals and stones, and a range of designated non-financial businesses and professions (DNFBPs). The legislative updates are tailored to extend compliance obligations to these high-risk areas.

Related: Explore our real estate dispute resolution services in the UAE.

The overarching goal of the 2024-2027 National Strategy is to make the UAE resilient against these emerging threats. The strategy rests on four core pillars:

• enhancing the legal and regulatory framework;
• strengthening institutional capacity;
• increasing national and international cooperation; and
• using technology for better detection and reporting.

Related: Explore our financial crime legal defence and advisory services in the UAE.

Federal Decree Law No. 10 of 2025: The Cornerstone of Compliance

Federal Decree Law No. 10 of 2025, which came into effect in late 2025, is the most significant legislative update to the UAE's AML/CFT regime. It repeals and replaces previous laws and establishes a unified, more robust and significantly more punitive framework.

Key Provisions and Broader Scope

The new law introduces several critical changes that expand the definition of financial crime and the range of entities subject to compliance obligations:

1. Expanded definition of money laundering: The law clarifies and broadens the definition of money laundering so that all stages of the process (placement, layering and integration) are explicitly covered. It also explicitly includes self-laundering, where a person launders the proceeds of their own criminal activity.
2. Inclusion of new sectors: The scope of "Relevant Persons" and "Designated Non-Financial Businesses and Professions (DNFBPs)" has been significantly widened. It now includes, but is not limited to, virtual asset service providers (VASPs), real estate developers and brokers, dealers in precious metals and stones, and legal and accounting professionals when they carry out specific financial transactions for clients.
3. Enhanced corporate accountability: The law places a greater burden of responsibility on companies and their senior management. It makes it easier to hold legal entities accountable for financial crimes committed by their representatives, managers or agents.

Increased Penalties and Enforcement

The most significant change may be the sharp increase in penalties, which shows how seriously the UAE government views non-compliance. Comparing the previous maximum fine (approximate) with the new position under Federal Decree Law No. 10 of 2025:

• Legal entities (corporate): previously AED 50 Million; now up to AED 100 Million.
• Individuals (criminal): previously varied; now imprisonment and a fine of not less than AED 200,000.
• Administrative fines: previously varied; now significantly increased and more strictly enforced by supervisory authorities.

The Central Bank of the UAE (CBUAE), the Securities and Commodities Authority (SCA), the Insurance Authority and the Ministry of Economy (MoET) are all empowered to impose these administrative and financial sanctions. The new law also gives UAE courts broader powers to implement foreign orders for asset freezing, seizure and confiscation, reflecting a commitment to international cooperation.

For businesses, non-compliance is no longer just a regulatory hurdle; it is a threat to the business itself. Understanding this new legislative environment is essential for sound corporate governance and operational integrity.

For professional legal guidance, see our financial crime services in Dubai and the UAE.

Preventing Financial Crime: Essential Compliance Pillars for Businesses

Effective financial crime compliance is not a one-time task but a continuous, risk-based process. Businesses must move beyond a check-the-box mentality and build a culture of compliance into their operations. The following pillars form the foundation of a robust prevention strategy in the UAE.

1. The Risk-Based Approach (RBA)

The RBA is the cornerstone of the UAE's AML/CFT framework. It requires businesses to identify, assess and understand the money laundering and terrorism financing risks they face, and then to apply controls proportionate to those risks.

• National Risk Assessment (NRA): Businesses must consider the findings of the UAE's National Risk Assessment, which identifies high-risk sectors and vulnerabilities.
• Business Risk Assessment (BRA): Every entity must conduct its own comprehensive Business Risk Assessment, covering risks related to its customers, geographical areas of operation, products and services, and delivery channels. This assessment must be documented, regularly updated and approved by senior management.

2. Know Your Customer (KYC) and Customer Due Diligence (CDD)

Rigorous KYC and CDD procedures are the first line of defence. They ensure the business knows the true identity of its customers and the nature of their business activities.

• Standard CDD: collecting and verifying identity documents, understanding the purpose and intended nature of the business relationship, and identifying the ultimate beneficial owner (UBO).
• Enhanced Due Diligence (EDD): required for high-risk customers, such as Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, or those involved in complex, unusual transactions. EDD involves obtaining additional information, monitoring more frequently and requiring senior management approval for the relationship.

3. Transaction Monitoring and Reporting

Businesses must implement systems to monitor transactions for suspicious activity. This means setting rules and thresholds that flag unusual patterns deviating from a customer's normal behaviour or the business's risk profile.

• Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs): Any transaction or attempted transaction suspected to be related to money laundering, terrorism financing or criminal activity must be reported immediately to the UAE's Financial Intelligence Unit (FIU) through the goAML platform. Failure to report is a serious offence.

4. Governance, Training and Technology

Compliance is a top-down responsibility. Senior management must appoint a dedicated Compliance Officer (MLRO/AMLCO) with sufficient authority and resources.

• Internal controls: clear, written policies and procedures for all compliance functions.
• Training: mandatory, ongoing training for all relevant employees (especially front-line staff and management) so they understand their obligations and can recognise red flags.
• Technology: using RegTech (regulatory technology) tools for automated KYC, transaction monitoring and record-keeping is increasingly essential to manage the volume and complexity of data.

Meeting these requirements calls for specialised knowledge and a proactive approach to regulatory compliance.

Defence: Handling Investigations and Enforcement

Even with the best prevention efforts, a business may face regulatory inquiries, audits or full criminal investigations. A robust defence strategy is crucial to limit legal exposure and reputational damage.

1. Internal Investigations and Remediation

When a potential compliance breach is discovered or a regulatory inquiry arrives, the first step is a swift and thorough internal investigation.

• Scope and independence: The investigation must be independent, comprehensive and led by experienced legal counsel to maintain privilege where possible.
• Fact-finding: gathering and preserving all relevant documents, electronic data and communications.
• Remediation: If a breach is confirmed, immediate remedial action is necessary. This includes strengthening internal controls, disciplining responsible employees and, critically, deciding whether and how to self-report the findings to the relevant authorities.

2. Dealing with Regulatory Authorities

Dealing with bodies such as the CBUAE, MoET or the Public Prosecution requires a careful, measured approach.

• Cooperation and rights: Cooperation is generally encouraged and can lead to leniency, but businesses must also be mindful of their legal rights and ensure that any information they provide is accurate and carefully managed.
• Document production: Responses to information requests (subpoenas) must be handled meticulously. Legal counsel can help narrow the scope of requests and ensure compliance without over-disclosing.

3. The Role of Legal Counsel in Defence

In an investigation, specialised legal counsel is indispensable. Counsel provides protection and a clear strategy, helping to:

• Assess liability: determine the potential criminal and administrative liability under Federal Decree Law No. 10 of 2025.
• Negotiate settlements: where appropriate, negotiate with regulators to reach a settlement that minimises fines and avoids criminal prosecution.
• Support litigation: provide robust litigation and dispute resolution services if the matter proceeds to court.

The legal landscape in the UAE is dynamic. A well-prepared defence, built on a foundation of proactive compliance, is the only way to protect the business and its leadership.

Conclusion: Building Resilience Through Financial Crime Compliance

The UAE's commitment to combating financial crime is unequivocal. Federal Decree Law No. 10 of 2025 and the 2024-2027 National Strategy significantly raise compliance standards and move the Emirates into the top tier of global financial integrity.

For businesses, this is a call to action. Compliance is no longer a peripheral function; it is a core business requirement that demands investment, attention and expert guidance. By taking a rigorous, risk-based approach to prevention and having a robust legal defence strategy in place, companies can meet their regulatory obligations and build the trust and resilience that long-term success in the UAE's economy requires.

Related Services: Explore our corporate governance and compliance advisory and financial crime lawyers in the UAE for practical legal support in this area.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• VAT Compliance in the UAE: A Complete Guide for Businesses
• Fraud and Financial Crime in the UAE: Types, Penalties and Legal Defence
• Resolving Annual Corporate Compliance and Maintenance Disputes Effectively
• Blockchain and Smart Contracts in the UAE: Legal Recognition and Enforcement