5 min read
The UAE's new AML law: what changed under Federal Decree-Law No. 10 of 2025
On 30 September 2025 the UAE issued a new federal AML decree-law, which replaced the 2018 law in full from 14 October 2025. If your compliance framework cites the old text, it now rests on a repealed law.
Many businesses in the UAE still hold policy manuals that open with the words “pursuant to Federal Decree-Law No. 20 of 2018”. That sentence is no longer accurate. On 30 September 2025 a new federal decree-law was issued, No. 10 of 2025, which entered into force on 14 October 2025 and replaced the 2018 law in full — repealing with it Decree-Law No. 26 of 2021, which had amended the 2018 text.
The change did not stop at the primary law: the old implementing regulation, Cabinet Resolution No. 10 of 2019, was replaced by Cabinet Resolution No. 134 of 2025, in force since 14 December 2025.
Why a new law at all?
The UAE came off the FATF grey list after intensive legislative and supervisory work, but leaving the list is the start of the road rather than the end of it. The new law continues aligning UAE legislation with international standards and addresses gaps the last few years exposed — most visibly around virtual assets and the financing of weapons proliferation.
The five changes that reach your business
1 — Proliferation financing is now a standalone offence
Under the old law, financing the proliferation of weapons of mass destruction was treated as an adjunct to terrorist financing. The new law sets it out as an offence in its own right, criminalising the financing of weapons of mass destruction and the related dual-use goods.
What this means in practice: a risk assessment that covers only money laundering and terrorist financing is no longer sufficient. You need to add a proliferation-financing dimension, particularly if your activity involves trading, shipping or cross-border dealings.
2 — Virtual assets are inside the law, not outside it
Virtual assets and their service providers used to be handled by reference to secondary legislation. The definition of virtual assets now sits inside the federal law itself, and virtual asset service providers fall explicitly under Financial Intelligence Unit oversight, required to hold a licence, registration or authorisation from the competent authority.
The definition of money laundering was also widened to cover its commission “through digital systems, virtual assets, or encryption technologies”.
3 — The knowledge threshold dropped
This is one of the most consequential changes and one of the least discussed. Proving money laundering previously required proving the accused's actual knowledge. The new text allows knowledge to be inferred “from objective circumstances”, meaning prosecutors no longer need to establish criminal intent in the traditional sense.
In practice: pleading ignorance became a far weaker position. That raises the value of documentation. If you ran proper due diligence and documented it, you are building your own evidence. If you did not document it, objective circumstances may be read against you.
4 — Cross-border cash disclosure moved into the statute
Disclosure of cross-border currency movements used to sit in the implementing regulation. It now sits in the body of the law, with responsibility moved to the Federal Authority for Identity and Citizenship, Customs and Ports Security.
5 — Broader powers, tougher penalties
The Financial Intelligence Unit's powers were extended to coordinating with foreign FIUs and digital platforms, and to leading national risk assessments covering emerging technologies and cyber-enabled financial crime. A Supreme Committee was also established to oversee the national strategy.
On international cooperation, requests can no longer be refused on grounds of banking secrecy or tax or financial considerations, with the exception of legal professional privilege. Foreign court orders freezing assets may also be executed without requiring a local investigation first.
Fines: what do we know?
Under the previous framework, administrative fines for AML violations ranged from AED 50,000 to AED 5,000,000 per violation, and in some cases could reach substantially higher figures or the equivalent of the laundered amount, whichever was higher. The new law brought tougher sanctions.
Sanctions are not only financial. A supervisory authority may ban a violator from working in the relevant sector for a period it determines, and may constrain the powers of board members, executive management, managers or owners found responsible.
What should your business do now?
If your compliance framework was written before October 2025, it rests on a repealed text. This is not a formality: a supervisor who opens your policy manual and finds a citation to a superseded law reads that as a signal that the framework is not being managed.
- Review every legal citation in your policy manual and replace it with Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025
- Add proliferation financing to your risk assessment as its own dimension, not an annex to terrorist financing
- Check whether any of your activities or customers touch virtual assets, since the perimeter has widened
- Strengthen documentation: with the knowledge threshold lowered, your written record is your first line of defence
- Train your team on the changes and record their attendance and assessment
- Confirm your goAML registration is complete and your compliance officer's details are current
Who carries these obligations?
Alongside financial institutions, the Designated Non-Financial Businesses and Professions (DNFBPs) are in scope. In the UAE framework these are:
| Category | Basis of scope |
|---|---|
| Real estate brokers and agents | When brokering the purchase or sale of property for clients |
| Dealers in precious metals and stones | On a single cash transaction, or linked transactions, of AED 55,000 or more |
| Auditors and accountants | When providing defined services to clients |
| Company and trust service providers | Company formation, and nominee agent, director or shareholder services |
| Lawyers, notaries and independent legal professionals | When carrying out defined activities such as managing funds and assets or forming companies |
Note that scope in most of these categories attaches to carrying out defined activities, not to simply holding the licence. This is widely misunderstood: a lawyer or accountant does not carry every AML obligation by virtue of their profession, but when they undertake particular activities for clients.
The goAML platform
goAML is a platform developed by the United Nations Office on Drugs and Crime, used by the UAE Financial Intelligence Unit to receive Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). Registering on it is an obligation for businesses in scope, not an option.
The Ministry of Economy has previously suspended the operations of dozens of DNFBP establishments for three months over failure to register on the platform — a clear signal that this obligation in particular is monitored and enforced.
The practical bottom line
The new law does not turn the framework upside down so much as tighten it: it widens the perimeter (virtual assets), adds a dimension (proliferation financing), lowers the evidentiary threshold and raises the ceiling on penalties. A business whose framework was real and applied needs an update and fresh documentation. A business whose framework existed only on paper has far less room to move than it used to.
