8 Critical Steps for AML Compliance in the UAE Under New 2025 Law

Anti-Money Laundering (AML) compliance in the UAE has undergone a seismic shift. The introduction of Federal Decree-Law No. (10) of 2025 regarding Anti-Money Laundering, Combating the Financing of Terrorism, and Financing of Proliferation (the "2025 AML Law") has completely overhauled the regulatory framework . This replaces the previous 2018 legislation and signals the UAE's determination to meet the highest international standards.
For businesses operating in the UAE, this is not just another regulatory update. It is a fundamental change that expands liability, introduces new offences, and strengthens supervisory powers significantly . This guide will walk you through the critical steps to ensure your business remains compliant and protected.

1. Understand the Expanded Scope of AML Compliance

The 2025 AML Law has broadened the definition of "predicate offences" to include terrorist financing, proliferation financing, and both direct and indirect tax evasion . This means regulators can now enforce against a much wider range of conduct.

Proliferation Financing Is Now a Separate Offence

For the first time, proliferation financing (the financing of weapons of mass destruction) is a standalone criminal offence alongside money laundering and terrorist financing . This is a significant change given the UAE's strategic role in international trade and logistics .
The Executive Regulations (Cabinet Decision No. 134 of 2025) now require all in-scope entities to identify, mitigate, and document proliferation financing risks . Businesses must implement targeted financial sanctions controls as part of their AML compliance framework.

2. Know Who Must Comply With AML Compliance

The scope of entities subject to AML compliance has expanded significantly. Financial Institutions (FIs), Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs) are all now explicitly covered .

New Categories of DNFBPs

DNFBPs now include commercial gaming operators, online gaming platforms, sports betting operators, and lottery operators . This is a newly introduced category that must comply with a host of legal obligations. Even commercial gaming conducted on vessels in UAE waters when transactions reach AED 11,000 is now within scope .

VASPs Now Face Full AML Obligations

Virtual Asset Service Providers are now subject to the full suite of AML obligations for the first time . This includes compliance with wire transfer rules, specific CDD requirements, record keeping, and sanctions compliance. For instance, VASPs must conduct Customer Due Diligence (CDD) at the lower threshold of AED 3,500 or more, indicating they are viewed as higher risk .

3. Strengthen Your Customer Due Diligence (CDD) Processes

The 2025 AML Law and its Executive Regulations have tightened CDD requirements significantly. This is a critical area of AML compliance.

Enhanced Due Diligence (EDD) Now Requires Source of Wealth

The Executive Regulations now specify what constitutes acceptable Enhanced Due Diligence (EDD) . This includes identifying the source of wealth (not just source of funds, as previously required). First payments must be made from an account in the customer's name at a comparable institution, and senior management approval is now required for the relationship .

Ultimate Beneficial Ownership (UBO) Obligations

UBO requirements are now more prescriptive. Registrars must verify and publish core company data, companies must update UBO details within 15 working days, and bearer shares are expressly prohibited (with a 30-day conversion period) . AML compliance demands that firms review and update their CDD information requirements for UBOs.

4. Adopt a Risk-Based Approach to AML Compliance

The new framework mandates a risk-based approach to AML compliance. Regulated entities must identify, assess, and understand the money laundering and terrorist financing risks to which they are exposed .

Enterprise-Wide Risk Assessments

FIs, DNFBPs, and VASPs are required to conduct Enterprise-Wide Risk Assessments (EWRA) to determine the nature and extent of AML resources needed . This includes evaluating customer, product, channel, and geographic risks. The risk assessment should inform the development of policies, procedures, and controls.

5. Implement Robust Transaction Monitoring and Reporting

Transaction monitoring is a cornerstone of AML compliance. The Executive Regulations clarify obligations to monitor clients' activities and report suspicious transactions .

Understanding Structuring Risks

Structuring (or smurfing) is the deliberate breaking down of larger amounts into smaller transactions to avoid reporting thresholds . This is treated as a serious financial crime risk. AML compliance requires monitoring for patterns like repeated cash deposits just below thresholds, use of multiple third parties, or rapid onward movement of funds .

Suspicious Transaction Reporting (STR)

Firms must establish and update indicators of suspicion, report promptly to the Financial Intelligence Unit (FIU) via the goAML platform, and cooperate with follow-up requests . Tipping off remains prohibited, although there is a limited carve-out allowing legal professionals to attempt to dissuade a client from unlawful conduct .

6. Meet Record-Keeping and Documentation Requirements

Record-keeping remains a minimum five-year retention period, but the scope has expanded . The Executive Regulations now include CCTV and ATM recordings and analysis results. The retention clock starts from the "most recent event" to avoid premature destruction.

Why Documentation Matters

Strong documentation is critical to defend AML compliance decisions, especially in structuring cases . Supervisors and auditors focus on what was known at the time and how it was assessed. A clear audit trail, including customer profiles, transaction records, investigation notes, and escalation decisions, is essential.

7. Prepare for Expanded Supervisory Powers and Penalties

The 2025 AML Law grants significantly stronger powers to supervisory authorities and the FIU . The Public Prosecution also has wide powers and can request the FIU's analytical input during investigations .

Increased Penalties for Non-Compliance

Both individuals and legal persons face increased penalties, with fines for legal persons ranging from AED 5 million to AED 100 million or more . In serious cases, the FIU may order dissolution, closure, or asset freezing for up to 30 days without prior notice .

Personal Criminal Liability

Senior management, including directors, board members, and executive officers, are now subject to personal criminal liability if they have knowledge of a predicate offence and participated in or facilitated it . Knowledge can be inferred from factual and objective circumstances.

8. Our Expertise in AML Compliance Services

We have deep expertise in AML compliance in the UAE. Our team stays current with the latest regulatory developments, including the 2025 AML Law and its Executive Regulations. We help businesses navigate these complex requirements effectively.
We assist with developing and updating AML compliance policies, procedures, and controls. We conduct risk assessments and provide training for staff and compliance teams. We support goAML registration and suspicious transaction reporting obligations. We also provide independent AML audits to ensure controls operate as designed.

Client Testimonials on Our AML Compliance Services

Our clients value our reliable and professional service. Here is what some of them have to say.

Feedback From Our Clients

"The new AML law was overwhelming. The team guided us through the changes and updated our policies. They helped us register on goAML and trained our staff. We feel confident in our compliance now." - Mohammed S., Compliance Officer
"We needed to ensure our free zone company was compliant with the new UBO requirements. Their experts reviewed our procedures and helped us meet the 15-day update deadline. Their support was invaluable." - Aisha R., Legal Counsel
"The FIU requested additional information during a review, and the team handled everything. They ensured our documentation was in order and responded promptly. I highly recommend their AML compliance services." - Khaled A., CEO

Frequently Asked Questions (FAQs)

1. What Is the New AML Law in the UAE?

Federal Decree-Law No. (10) of 2025 is the new AML law that replaced the 2018 framework. It expands the scope of offences, introduces proliferation financing as a separate crime, strengthens penalties, and modernises definitions to include virtual assets .

2. Who Needs to Comply With AML Compliance in the UAE?

Financial Institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs) must comply. DNFBPs now include gaming operators .

3. What Are the Penalties for Non-Compliance With AML Regulations?

Fines for legal persons range from AED 5 million to AED 100 million or more. The FIU may also order dissolution, closure, or asset freezing for up to 30 days without prior notice. Senior management can face personal criminal liability .

4. What Are the Record-Keeping Requirements Under the New AML Law?

Records must be retained for a minimum of five years. The scope now includes CCTV and ATM recordings. The retention clock starts from the most recent event .

5. Why Should I Use Professional Services for AML Compliance?

Professional AML compliance services ensure your policies and procedures meet regulatory standards. They help with risk assessments, training, goAML registration, and audits. This protects your business from penalties and reputational damage.