Why 2025 Was a Turning Point for UAE AML Law
The UAE’s Anti-Money Laundering and Counter-Terrorist Financing framework underwent its most substantial overhaul since the system was first built in 2018. Two new pieces of legislation replaced the laws that had governed UAE AML compliance for seven years — and they changed the framework not just at the level of procedure but at the level of legal liability itself. Understanding what changed, and what it means in practice, is now essential for any business operating under AML obligations in the UAE.
The changes arrived in two stages. Federal Decree-Law No. 10 of 2025, issued 30 September 2025 and effective from 14 October 2025, repealed Federal Decree-Law No. 20 of 2018 and its 2021 amendment entirely. The implementing regulation followed: Cabinet Resolution No. 134 of 2025, effective from 14 December 2025, replaced Cabinet Decision No. 10 of 2019. Both instruments together now form the operative legal foundation of UAE AML/CFT compliance.
The Four Most Significant Changes in Federal Decree-Law No. 10 of 2025
1. A Lower Evidentiary Threshold for Liability
Under the 2018 law, establishing money laundering liability required proof of actual knowledge that funds derived from a criminal predicate offence. The 2025 law changes this fundamentally: knowledge can now be inferred from objective circumstances. A business whose processes failed to detect clear warning signs — red flags that a properly designed compliance program would have caught — can face criminal and civil liability under the new standard even where direct proof of actual knowledge is absent.
This is the single most consequential change for businesses and their compliance officers. The gap between “we didn’t know” and “we should have known” has been closed as a defence. AML programs that were adequate under the older, higher evidentiary bar may no longer be sufficient under the current law.
2. Substantially Higher Penalties
The maximum penalty ceiling for legal persons under the 2025 law has increased to AED 100 million. Article 20 of the law — covering operation of financial activities or DNFBP activities without proper licensing, registration, or authorisation — carries both imprisonment and a fine of between AED 200,000 and AED 10,000,000. Administrative fines for specific AML violations under Ministry of Economy supervision range from AED 50,000 to AED 1,000,000 per violation, with cumulative fines where multiple violations are identified in a single inspection.
3. An Expanded Tipping-Off Offence
The 2018 law’s tipping-off offence required intentional disclosure of a suspicious transaction report or investigation. Article 29 of the 2025 law extends this significantly. The offence now covers:
- Intentional disclosure — as before
- Grossly negligent disclosures — disclosure that occurs through reckless disregard for whether a communication would compromise an investigation
- A broader category of conduct, not limited to STRs or formal investigations
- Aggravated penalties where a tipping-off offence results in the loss of criminal proceeds
For DNFBPs — particularly law firms, accounting firms, and real estate brokers where professional communication with clients is frequent — this expanded scope requires more careful internal protocols around what can be communicated once a suspicious transaction report has been filed or is being considered.
4. Proliferation Financing as a Standalone Offence
Proliferation financing — the financing of the proliferation of weapons of mass destruction — is now a third, standalone principal offence under UAE AML law, alongside money laundering and terrorism financing. Under the 2018 framework, proliferation financing was addressed primarily through targeted financial sanctions requirements rather than as an independent criminal category. The 2025 law gives it the same legal weight as the other two, which affects both the compliance obligations and the potential liability of businesses that fail to screen for proliferation financing risk.
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
What Cabinet Resolution No. 134 of 2025 Added
The implementing regulation introduced two further significant changes at the category level:
- Gaming operators — operators of commercial gaming activities are newly classified as DNFBPs under the 2025 resolution, bringing them within the full scope of AML/CFT obligations for the first time
- Virtual asset service providers (VASPs) — their obligations under the AML framework have been reinforced and clarified, reflecting the rapid growth of the digital assets sector in the UAE
For all existing DNFBPs, the resolution also harmonised several procedural requirements with FATF’s updated Recommendations, particularly around beneficial ownership verification, enhanced due diligence triggers, and the minimum content required in suspicious transaction reports.
The Ongoing Legal Framework — Laws That Remain in Force
Several pieces of legislation that existed alongside the 2018 law remain in force and continue to apply alongside the 2025 framework:
- Cabinet Decision No. 58 of 2020 — requires every UAE company to identify and declare its Ultimate Beneficial Owner (UBO), with real estate brokers expected to verify UBO information for every corporate buyer
- Cabinet Decision No. 74 of 2020 — governs Targeted Financial Sanctions (TFS), requiring brokers and other obligated parties to screen clients against the UAE Local Terrorist List and applicable international sanctions lists before and during business relationships
The supervisory structure also remains unchanged: the Ministry of Economy supervises most DNFBPs including real estate brokers, accountants, and corporate service providers, while the UAE Financial Intelligence Unit (FIU) receives reports through the goAML platform and the Financial Action Task Force (FATF) continues to set the international standards the UAE’s regime is benchmarked against.
What DNFBPs Must Do Under the Current Framework
The core compliance obligations for DNFBPs remain structured around the same pillars as before, but the consequences of inadequate performance against each have increased materially under the new law.
Know Your Customer (KYC) and Customer Due Diligence (CDD)
CDD must be completed before any business relationship is established or any transaction is executed above applicable thresholds. For individuals, this covers identity verification, proof of address, and source of funds. For corporate clients, it extends to Ultimate Beneficial Owner identification, the corporate structure, and the purpose and nature of the business relationship.
Records of CDD must be retained for a minimum of 5 years following the end of the business relationship or the completion of a transaction.
Enhanced Due Diligence (EDD)
EDD applies in higher-risk situations — politically exposed persons, clients from high-risk jurisdictions, complex or opaque ownership structures, and large cash or near-cash transactions. EDD requires deeper verification, explicit senior management approval before the relationship proceeds, and continuous monitoring rather than periodic review. The 2025 law’s lowered evidentiary threshold makes inadequate EDD more consequential — applying standard CDD where EDD was warranted can now more directly contribute to liability.
Suspicious Transaction Reporting Through goAML
Every DNFBP must be registered on the FIU’s goAML platform. Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and sector-specific reports such as Real Estate Activity Reports (REARs) must be filed promptly — and failure to file a required report is one of the most commonly enforced violations, currently carrying fines of AED 300,000 to AED 5,000,000 per violation.
Internal Policies and Controls
A written AML/CFT policy manual is a legal requirement, not a best-practice aspiration. It must cover internal procedures, customer verification standards, transaction monitoring, escalation steps, and the reporting process. The designated AML Compliance Officer carries personal accountability for the firm’s compliance posture under the 2025 framework — institutional liability no longer fully shields the individual responsible.
The Enforcement Context — What the Numbers Say
The trajectory of enforcement against DNFBPs gives concrete context to why the 2025 legal changes matter:
- The Ministry of Economy has imposed more than AED 130 million in cumulative administrative fines on DNFBPs since late 2022
- AED 22.6 million was imposed across 29 DNFBP organizations in 2024
- AED 42 million was imposed in the first half of 2025 alone — nearly double the 2024 annual total
These figures reflect deliberate intent: the UAE is building a documented track record of effective enforcement ahead of the FATF’s 2026 mutual evaluation, which assesses whether the country’s AML/CFT framework produces real outcomes rather than merely having the right rules on paper. Businesses that treated light enforcement as a proxy for low compliance risk were operating on an assumption the data no longer supports.
The Special Case of Real Estate — Additional Obligations
Real estate brokers, developers, and agents operate as DNFBPs specifically because the sector carries structural characteristics that make it particularly useful for money laundering: high-value transactions, international buyers, cross-border capital flows, and the frequent involvement of corporate structures that add layers of ownership complexity. Beyond the standard DNFBP obligations above, the real estate sector carries additional specific requirements.
The Dubai Land Department (DLD) requires real estate brokers to file a Real Estate Activity Report (REAR) through the FIU when transactions exceed the applicable AML reporting threshold, involve cash payments, include offshore buyers, or present other high-risk indicators. Brokers must also verify UBO information for every corporate buyer under Cabinet Decision No. 58 of 2020 and confirm that no party to the transaction appears on applicable sanctions lists before proceeding.
Practical Compliance Steps for 2026
- Update internal AML policies to reflect the 2025 legislation — any policy that still references Federal Decree-Law No. 20 of 2018 or Cabinet Decision No. 10 of 2019 as the governing law is now referencing repealed legislation
- Review CDD and EDD workflows against the new evidentiary standard — confirm that the “should have known” bar is being met, not just the old “actually knew” standard
- Brief the AML Compliance Officer on personal liability implications under the 2025 framework, and confirm they have adequate authority and resources to act independently
- Conduct a gap assessment against the updated FATF-aligned requirements in Cabinet Resolution No. 134 of 2025
- Commission an independent AML audit before the FATF 2026 mutual evaluation creates heightened regulatory scrutiny
- Screen for proliferation financing risk as a standalone category, not just as a subset of terrorism financing
Frequently Asked Questions (FAQs)
What are the new AML laws in the UAE that took effect in 2025?
Federal Decree-Law No. 10 of 2025, effective 14 October 2025, replaced Federal Decree-Law No. 20 of 2018 as the primary UAE AML/CFT law. Cabinet Resolution No. 134 of 2025, effective 14 December 2025, replaced Cabinet Decision No. 10 of 2019 as the implementing regulation.
What is the most significant change in UAE AML law under the 2025 framework?
The evidentiary threshold for liability has been lowered — knowledge that funds are of criminal origin can now be inferred from objective circumstances rather than requiring direct proof of actual knowledge. This directly increases the compliance risk for businesses whose AML programs fail to catch red flags that a properly designed system would have identified.
What is the maximum AML penalty for a legal person in the UAE under the 2025 law?
The maximum penalty ceiling for legal persons has increased to AED 100 million. Operating without proper AML authorisation or licensing under Article 20 carries fines of AED 200,000 to AED 10,000,000 plus potential imprisonment for responsible individuals.
What is the tipping-off offence under the new UAE AML law?
Under Article 29 of Federal Decree-Law No. 10 of 2025, tipping-off now covers not only intentional disclosure of an STR or investigation but also grossly negligent disclosures and a broader category of conduct, with aggravated penalties where the offence results in loss of criminal proceeds.
Are gaming operators now DNFBPs under UAE AML law?
Yes. Cabinet Resolution No. 134 of 2025 added operators of commercial gaming activities to the DNFBP category, bringing them within the full scope of UAE AML/CFT compliance obligations for the first time.
Do the same CDD and goAML reporting obligations still apply under the new law?
Yes — the core obligations (CDD, EDD, goAML registration, STR filing, record retention for 5 years, written AML policies, designated Compliance Officer) remain in force. What has changed is the evidentiary standard for liability, the penalty ceiling, the scope of the tipping-off offence, and the addition of proliferation financing as a standalone offence.
Why is UAE AML enforcement increasing in 2026?
The UAE is building a documented record of effective enforcement ahead of the FATF’s 2026 mutual evaluation, which focuses on demonstrated outcomes rather than simply confirming that correct rules exist. AED 42 million in DNFBP fines in H1 2025 alone illustrates that enforcement has already accelerated substantially in preparation for that assessment.
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
How Farahat & Co. Can Help
Farahat & Co. supports DNFBPs across the UAE in reviewing and updating AML compliance frameworks to reflect the 2025 legislation, conducting independent AML audits, providing AML Compliance Officer support, assisting with goAML registration and STR filing, and preparing businesses for Ministry of Economy inspections under the current enforcement environment.
Contact Farahat & Co. today to discuss your AML compliance requirements under the current UAE framework.
