AML/CFT is the UAE's combined framework against money laundering and terrorist financing. How it works under the 2025 law.
- AML/CFT is a single regulatory framework that requires UAE businesses to detect, prevent and report money laundering and terrorist financing.
- Federal Decree-Law No. 10 of 2025 is the UAE's principal AML/CFT statute, with penalties reaching AED 100 million for legal persons.
- Obligations apply to banks, exchange houses, real estate agents, lawyers, accountants, precious metals dealers and virtual asset service providers.
- The UAE was removed from the FATF grey list in February 2024 after a comprehensive programme of enforcement and regulatory reform.
The UAE's AML/CFT Framework and the Financial Intelligence Unit
Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) is the regulatory backbone of financial crime prevention in the UAE. Governed by Federal Decree-Law No. 10 of 2025 and enforced through a network that includes the Financial Intelligence Unit (FIU), the Executive Office of AML/CFT and five sector regulators, the framework extends well beyond banking. Designated Non-Financial Businesses and Professions (DNFBPs) - from real estate brokers to accountants - carry the same core obligations as licensed financial institutions.
The UAE's removal from the FATF grey list in February 2024 marked the end of a two-year reform effort that reshaped how regulated entities handle customer due diligence, suspicious transaction reporting and beneficial ownership disclosure. That effort continues under a national AML/CFT strategy running to 2027, with the next FATF mutual evaluation due in 2026.
AML/CFT Explained in Plain English
AML stands for Anti-Money Laundering and CFT stands for Combating the Financing of Terrorism. Together, they form a single framework requiring businesses and professions to detect, prevent and report financial crime. Money laundering involves disguising proceeds of crime so they appear legitimate. Terrorist financing is distinct because it targets funds used to support terrorist acts or organisations, whether the money comes from legal or illegal sources.
Globally, AML and CFT are paired because both exploit the same financial channels and require the same preventive tools: customer identification, transaction monitoring and suspicious activity reporting. The Financial Action Task Force (FATF) sets international AML/CFT standards through its 40 Recommendations, which more than 200 jurisdictions have committed to adopt.
How AML/CFT Works in the UAE
Federal Decree-Law No. 10 of 2025 is the UAE's principal AML/CFT statute. It replaced Federal Decree-Law No. 20 of 2018 and took effect on 14 October 2025, alongside Cabinet Resolution No. 134 of 2025 as the implementing regulation. The 2025 law broadens the framework to include Combating Proliferation Financing (CPF), lowers the evidentiary threshold for money laundering offences and brings virtual asset service providers directly under regulation.
Multiple bodies enforce the framework. The CBUAE supervises banks, exchange houses and payment providers. The CMA regulates federal capital markets, while the DFSA and FSRA oversee firms in DIFC and ADGM respectively. VARA regulates virtual asset firms in Dubai, and the FIU receives Suspicious Transaction Reports (STRs) through the goAML platform. At the national level, the Executive Office of AML/CFT coordinates strategy across all these bodies.
That coordination proved decisive during the UAE's time on the FATF grey list from March 2022 to February 2024, when intensified enforcement and risk-based supervision led to delisting. In practice, all regulated entities must conduct Know Your Customer (KYC) checks, monitor transactions, maintain records for at least five years and file STRs. This applies equally to banks, real estate agents, lawyers, accountants and VASPs. Penalties under the 2025 law reach up to AED 100 million for legal persons.
Practical Example
Consider a Dubai-based exchange house processing remittances for a small trading company. During routine monitoring, the compliance team notices a pattern: the company sends weekly transfers to three beneficiaries in a high-risk jurisdiction, but its declared turnover does not match the outflow volume.
Under AML/CFT rules, the exchange house must investigate. It requests updated KYC documents, asks for trade invoices to verify the business relationship and runs the beneficiaries against sanctions lists. The discrepancies remain unexplained, so the compliance officer files an STR through the goAML platform. The FIU analyses the report and may share the intelligence with law enforcement or foreign counterparts for further investigation.
Common Misconceptions About AML/CFT
A widespread misconception is that AML/CFT applies only to banks. In the UAE, the framework covers all DNFBPs, including real estate brokers, dealers in precious metals and stones, lawyers, accountants and corporate service providers. These professions carry the same obligation to conduct due diligence, monitor for red flags and file STRs as any licensed financial institution.
Another common assumption is that only large or international transactions attract scrutiny. The UAE's regime is suspicion-based, meaning any transaction can trigger a report regardless of size. Patterns of smaller transfers - such as structuring payments to stay below detection thresholds - are themselves a red flag that compliance teams are trained to identify.
People Also Asked
What is the difference between AML and CFT?
AML targets the proceeds of crime by requiring businesses to detect and report transactions that disguise illicit funds. CFT targets the financing of terrorism, regardless of whether the money itself is legal or illegal. In the UAE, both are governed by a single law and enforced through the same compliance obligations.
Who needs to comply with AML/CFT rules in the UAE?
Every licensed financial institution and every designated non-financial business or profession (DNFBP) operating in the UAE. This includes banks, exchange houses, insurance companies, real estate brokers, precious metals dealers, lawyers, accountants and virtual asset service providers.
Is the UAE still on the FATF grey list?
No. The UAE was on the FATF grey list from March 2022 to February 2024. FATF removed the UAE after the country completed a comprehensive reform programme covering enforcement, beneficial ownership transparency and risk-based supervision. The EU also removed the UAE from its high-risk list in 2025.
Related on UAE Advisor Guide
Who Regulates Your Money in the UAE? A Plain-English Guide to CBUAE, CMA, DFSA, FSRA and VARAWhat Is UBO? Ultimate Beneficial Owner Explained for the UAE
UAE Tightens AML Rules for Real Estate, Precious Metals and Crypto DNFBPs