UAE AML Law 2025: What Decree-Law No. 10 Changed for Your Business
The UAE replaced its anti-money laundering law in 2025. Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025. Its executive regulation, Cabinet Resolution No. 134 of 2025, applied from 14 December 2025. Together they replace the 2018 framework that most UAE businesses built their AML policies on.
If your AML manual, risk assessment or onboarding forms still quote Federal Decree-Law No. 20 of 2018, they are out of date. This guide explains what the new law says, who it covers, and what to update. For the full picture, see our UAE AML Compliance Guide 2026.
Key takeaways
The new law repeals Federal Decree-Law No. 20 of 2018 (Article 41).
The law now names proliferation financing alongside money laundering and terrorist financing.
Covered businesses must assess risk, run due diligence, appoint a compliance officer, report suspicious transactions, apply sanctions immediately and keep records for at least five years.
Administrative fines run from AED 10,000 to AED 5,000,000 per violation, and supervisors may publish the penalties they impose.
Criminal proceedings for money laundering, terrorist financing and proliferation financing do not lapse with time.
The two texts you need to know
Federal Decree-Law No. 10 of 2025 is the main law. It was issued on 30 September 2025 and entered into force two weeks after publication, on 14 October 2025. It sets out the crimes, the powers of the Financial Intelligence Unit (FIU), the duties of covered businesses and the penalties.
Cabinet Resolution No. 134 of 2025 is the executive regulation. It was issued on 29 October 2025 and took effect on 14 December 2025. It contains the practical detail: who counts as a covered business, the thresholds, how to identify a beneficial owner, and what your compliance officer must do.
One transition point matters. Regulations, resolutions and circulars issued under the 2018 law stay in force as long as they do not conflict with the new law, until replacements are issued (Article 41). So older guidance from your supervisor may still apply in places.
Who the law covers
The duties apply to three groups: financial institutions, virtual asset service providers (VASPs) and designated non-financial businesses and professions (DNFBPs). Non-profit organisations also fall under supervision.
Cabinet Resolution No. 134 of 2025 lists the DNFBPs (Article 3):
Business | When the rules apply |
|---|---|
Real estate brokers and agents | When they conclude purchase or sale transactions for customers |
Dealers in precious metals and stones | Cash transactions of AED 55,000 or more, single or linked |
Lawyers, notaries, other independent legal professionals and independent accountants | When they prepare or carry out transactions for clients involving real estate, managing client funds or accounts, company contributions, or creating, running, buying or selling companies and legal arrangements |
Company and trust service providers | When they form companies, act as or arrange directors, nominees or trustees, or provide a registered office |
Commercial gaming operators | Transactions of AED 11,000 or more, single or linked |
Commercial gaming operators, including lotteries and sports betting, now appear by name. The supervisory authority can add other businesses by resolution.
For mainland and commercial free zone businesses, the Ministry of Economy and Tourism supervises four DNFBP sectors: real estate agents and brokers, dealers in precious metals and stones, independent accountants and auditors, and trust and company service providers.
The core duties under the new law
Article 19 of the law and Cabinet Resolution No. 134 of 2025 set out what covered businesses must do.
Assess your risk. Identify, assess, document and keep updating your money laundering, terrorist financing and proliferation financing risks. Consider customers, countries, products, services, transactions and delivery channels. Keep the study and give it to your supervisor on request.
Run customer due diligence (CDD). Verify who your customer is, who owns and controls them, what their business is and why they want the relationship. Then keep monitoring. Apply enhanced due diligence where risk is higher, for example with customers from high-risk countries.
Identify the beneficial owner. For companies, start with any natural person who owns 25% or more. If that does not settle it, look for whoever has control by other means. If nobody qualifies, record the senior manager. Nominee shareholders and nominee directors are not beneficial owners.
Never deal anonymously. No accounts or transactions under anonymous, fictitious or numbered names.
Write policies approved by senior management. They must cover CDD, suspicious transaction reporting, staff screening, training and an independent audit function that tests whether your controls work.
Appoint a compliance officer at management level. This person must have independence and the right experience. They monitor transactions, decide on suspicious transaction reports, review your systems and train staff.
Apply targeted financial sanctions immediately. Follow instructions from the Executive Office for Control and Non-Proliferation without delay.
Report suspicious transactions. If you suspect, or have reasonable grounds to suspect, a link to crime, report to the FIU without delay through its electronic system. This applies regardless of the amount. Never warn the customer.
Keep records for at least five years. This covers transaction records and CDD files. The clock runs from the end of the relationship or the latest relevant event, such as an inspection or investigation.
Be licensed. Nobody may carry on a covered activity without the required licence or registration (Article 20).
Penalties: what is at stake
The law separates administrative penalties, which supervisors impose, from criminal penalties, which courts impose.
Administrative penalties (Article 17). A supervisor can:
issue a warning
impose a fine of AED 10,000 to AED 5,000,000 for each violation
ban you from the sector, or suspend or restrict your activity
restrict or suspend responsible managers
revoke your licence
Repeat violations within a year can attract increasing fines, and the supervisor may publish the penalties it imposes.
Selected criminal penalties
Offence | Penalty under Decree-Law No. 10 of 2025 |
|---|---|
Failing to report a suspicious transaction, deliberately or through gross negligence (Art. 28) | Imprisonment and/or a fine of AED 100,000 to AED 1,000,000 |
Tipping off a customer about a report or investigation (Art. 29) | Imprisonment and/or a fine of at least AED 50,000 |
Carrying on a covered activity without a licence or registration (Art. 32) | Imprisonment and/or a fine of AED 200,000 to AED 10,000,000 |
Breaching targeted financial sanctions instructions (Art. 33) | Imprisonment and/or a fine of at least AED 20,000 |
Giving false or misleading beneficial owner information (Art. 35) | Imprisonment and/or a fine of at least AED 20,000 |
A company whose representatives commit money laundering on its behalf (Art. 27) | A fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property if higher |
Two more points stand out. Money laundering, terrorist financing and proliferation financing cases do not lapse with time (Article 37). And a manager can be personally punished if they knew about an offence and it happened because they breached their duties (Article 27).
Points that affect ordinary businesses too
You may not be a DNFBP, but parts of the law still reach you.
Holding or moving suspicious funds is an offence. Possessing, concealing or dealing in funds where there are sufficient indications that the source is illegitimate, or that the true owner is being hidden, is punishable (Article 30).
Anonymous crypto is targeted. Promoting or dealing in virtual assets built for total anonymity, or in tools that block tracing, is a named offence (Article 30).
The FIU can freeze funds quickly. The head of the FIU can order funds frozen for up to 30 days without prior notice, based on its analysis. The Attorney General can extend that (Article 5).
Your bank will ask more. Banks are covered as financial institutions, so they must run CDD on you, identify your beneficial owners and understand your source of funds. Clear records make onboarding and reviews faster.
A national "Know Your Customer" digital platform is also being built under Federal Decree-Law No. 30 of 2024. Its executive regulation took effect on 21 April 2026 and lists the customer data the platform will hold, including beneficial owners and sources of income for companies. Expect banks and other institutions to rely on shared KYC data more over time.
What to update now: a short checklist
Replace references to Federal Decree-Law No. 20 of 2018 in your AML policy with Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
Re-run and document your business risk assessment.
Check whether any of your activities fall under the DNFBP list, including the AED 55,000 and AED 11,000 thresholds.
Confirm your compliance officer sits at management level and has real independence.
Make sure your CDD forms capture beneficial owners using the 25% test, then control, then senior management.
Set up a process to apply sanctions list updates immediately.
Confirm your FIU reporting access is active and staff know how to escalate a suspicion.
Review record retention: at least five years.
Book staff training and an independent review of your AML controls.
How GTAG can help
Gulf Tax Accounting Group works with businesses, family offices and private clients across the UAE. We can review your current AML framework against the new law and help you put the gaps right before a supervisor or your bank asks.
Frequently asked questions
When did the new UAE AML law take effect?
Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025. Its executive regulation, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025.
Does the 2018 AML law still apply?
No. Federal Decree-Law No. 20 of 2018 is repealed. Regulations issued under it stay in force only where they do not conflict with the new law, until they are replaced.
What is the maximum administrative fine?
Supervisors can impose AED 10,000 to AED 5,000,000 for each violation, plus other measures such as suspension or licence revocation.
Are accountants covered by the AML law?
Yes, independent accountants are DNFBPs when they prepare or carry out certain transactions for clients. These include real estate deals, managing client funds or accounts, and forming, running, buying or selling companies.
What is the beneficial ownership threshold in the UAE?
For companies, start with any natural person owning 25% or more. If that is unclear or nobody qualifies, identify whoever controls the company by other means. Failing that, record the senior manager.
How long must AML records be kept?
At least five years from the end of the business relationship or the latest relevant event, such as an inspection, investigation or final court judgment.
Official sources
Federal Decree-Law No. 10 of 2025 on AML, CFT and CPF, UAE Legislation portal
Cabinet Resolution No. 134 of 2025, executive regulation, UAE Legislation portal
Executive regulation of the "Know Your Customer" Digital Platform law, UAE Legislation portal
AML/CFT/CPF supervision of DNFBPs, Ministry of Economy and Tourism
This article is general information, not legal advice. The English texts on the UAE Legislation portal are translations; the Arabic text prevails. Last reviewed 2 November 2026.
Comments