What is the UAE’s AML law? The 2025 overhaul, the regulators, and what it means for fintechs.

The UAE’s anti-money-laundering regime is built on a federal law that every regulated firm in the country has to follow, whoever supervises it. As of late 2025 that law is new: Federal Decree-Law No. 10 of 2025 replaced the long-standing 2018 law, and a fresh executive regulation replaced the 2019 rules underneath it. Any firm relying on the old framework is now working from repealed law.

The rewrite didn’t come from nowhere. In March 2022 the Financial Action Task Force placed the UAE on its grey list of jurisdictions under increased monitoring. The country spent the next two years overhauling how it fights financial crime, better resourcing its Financial Intelligence Unit and pursuing more investigations and prosecutions, and in February 2024 the FATF removed it from the list. The 2025 law is the codified end of that reform, and it raises the bar for everyone licensed in the Emirates.

What the UAE AML law requires

The UAE regime asks regulated firms to do what any FATF-aligned anti money laundering system asks: know your customers, understand your risk, watch what flows through your accounts, and report anything suspicious. In practice that means a risk-based approach, customer due diligence and enhanced due diligence for higher-risk relationships, ongoing monitoring, record-keeping, a designated compliance officer, and suspicious-transaction reporting.

Those obligations aren’t a paperwork exercise. A firm has to assess the money-laundering risk of each customer and product, apply deeper checks where the risk is higher, keep records for the periods the law sets, appoint a compliance officer with real authority, train its staff, and submit the whole programme to independent review. The supervisor expects to see all of it working, not just written down.

 What makes the UAE distinctive is the structure that enforces those obligations. The country runs a single federal law across the mainland and both financial free zones, but three different regulators supervise it depending on where a firm is licensed. Getting that map right is the first thing a firm operating in the Emirates has to understand. 

Who the law covers

The regime reaches well beyond banks. It binds financial institutions, from banks and exchange houses to insurers and payment firms, and it binds designated non-financial businesses and professions, the category regulators call DNFBPs. That group includes real-estate agents, dealers in precious metals and stones, auditors and accountants, and corporate service providers, all of them businesses that can be used to move or hide illicit funds. 

The 2025 law widens the net by naming virtual-asset service providers, so crypto exchanges, custodians and brokers now sit inside the same framework as a bank. For a firm working out whether it is caught, the safe assumption is that if it handles other people’s money, or helps build the structures that hold it, the UAE AML regime applies.

The 2025 overhaul: what actually changed

The headline is the instruments. Federal Decree-Law No. 10 of 2025, which took effect on 14 October 2025, repealed and replaced Federal Decree-Law No. 20 of 2018. Cabinet Resolution No. 134 of 2025, effective 14 December 2025, replaced the 2019 executive regulation. Together they are the current basis of AML compliance in the UAE. 

The substance moved as well, and three changes matter most for a fintech audience. The law brings virtual assets and virtual-asset service providers explicitly into scope, confirming that crypto firms sit squarely inside the AML regime. It creates a standalone offence for the financing of proliferation, alongside money laundering and terrorist financing. And it widens the list of predicate offences to include tax evasion, so tax crimes can now underpin a money-laundering charge.

The governance also tightened. The 2025 framework adds a Supreme Committee overseeing the national AML strategy, working alongside the National Committee chaired by the Central Bank governor. For a compliance team, the practical message is that the regime is more coordinated and more assertive than the one it replaced.

Who supervises AML in the UAE: the three-regulator map

This is the point that trips firms up most often, and it is the single most useful thing to get straight. The UAE has one federal AML law, but three supervisors, split by where a firm is licensed.

The rule that ties it together is that the free-zone regimes sit on top of the federal law, not instead of it. A firm in the DIFC follows the DFSA rulebook and the federal Decree-Law, because DIFC law itself requires compliance with the federal AML legislation. The same holds in the ADGM under the FSRA. The clean way to hold it in your head: one federal law, three supervisors depending on where you are licensed, and, as the next section shows, one national channel for reporting.

Reporting: goAML and the Financial Intelligence Unit

Whichever regulator supervises a firm, suspicious transactions all flow to the same place. The UAE routes reporting through the goAML portal, the reporting system of the UAE Financial Intelligence Unit, which sits within the Central Bank.

 The obligations are strict. Every regulated entity has to register on goAML and keep the registration active, with the compliance officer as the registered user. Suspicious transactions must be reported regardless of value, including attempted transactions, so there is no threshold to hide behind.

Once a report is filed, the FIU has powers to act on it, including suspending a transaction for up to 10 days or freezing funds for up to 30 days while it investigates. Mainland firms, DIFC firms and ADGM firms all report into this one national unit, even though their supervisors differ.

The penalties 

The 2025 law carries the kind of penalties that make AML a board-level concern rather than a compliance-desk one. For an individual convicted of money laundering, the law provides for imprisonment and fines, with reported fine ranges from AED 100,000 to AED 5 million, or the value of the laundered property where that is greater. For legal persons the fines run far higher, into the tens of millions of dirhams. Tipping off a customer that a report has been made is itself an offence carrying a fine and possible imprisonment. 

Those numbers are the statutory maximums, and the day-to-day risk for most firms is less a single catastrophic fine than the supervisory consequence of weak controls: enforcement action, remediation orders, and the reputational cost of being named. After two years of proving itself to the FATF, the UAE has little appetite for firms treating AML as a formality.

What it means for fintechs and virtual-asset firms

For fintechs, the 2025 law removes any doubt about whether they are in scope. Virtual-asset service providers are named explicitly, so a crypto exchange, custodian or payments firm operating in or into the UAE carries the full weight of the AML regime, including registration, monitoring and goAML reporting.

 The free-zone question is the one most fintechs actually face, because many choose to license in the DIFC or the ADGM. The choice changes the supervisor and the rulebook, the DFSA in the DIFC or the FSRA in the ADGM, but it doesn’t exempt the firm from the federal law or from reporting to the national FIU. 

A fintech weighing where to set up should treat AML supervision as one of the real differences between the mainland and the two free zones, rather than assuming a free-zone licence lightens the load. It changes who inspects you, not whether you comply.

What the 2025 change means for firms already operating

 For a firm already licensed in the UAE, the new law isn’t a clean slate but a set of updates to re-paper against. Policies, procedures and risk assessments written for the 2018 law and the 2019 regulation now cite repealed instruments, so the practical task is to map existing controls to Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 and close any gaps the new scope opens.

The new obligations are the ones most likely to bite. A firm that never treated proliferation financing as a distinct risk now has to. A group with any virtual-asset activity has to confirm it is captured and supervised correctly. And a business that saw tax matters as outside its AML remit has to account for tax evasion now sitting among the predicate offences. None of these is exotic, but each is a place where a control built for the old law falls short of the new one. 

FAQs 

What is the current AML law in the UAE?

Federal Decree-Law No. 10 of 2025, effective 14 October 2025, which replaced Federal Decree-Law No. 20 of 2018. Its executive regulation is Cabinet Resolution No. 134 of 2025, effective 14 December 2025, which replaced the 2019 rules.

Why did the UAE update its AML law?

The overhaul followed the UAE’s period on the FATF grey list from March 2022 to February 2024. The reforms it made to exit the list, including stronger supervision and reporting, are codified in the 2025 law. 

Who regulates AML in the UAE?

Three supervisors, split by licence location: the Central Bank of the UAE for mainland financial firms, the DFSA for firms in the DIFC, and the FSRA for firms in the ADGM. All report suspicious transactions to the one national Financial Intelligence Unit via goAML.

Do virtual-asset firms fall under the UAE AML law?

Yes. The 2025 law brings virtual assets and virtual-asset service providers explicitly into scope, so crypto exchanges, custodians and related firms carry the full AML obligations.

What is goAML?

The reporting portal of the UAE Financial Intelligence Unit. All regulated firms must register on it and file suspicious-transaction reports, regardless of amount and including attempted transactions.

Next read

The UAE regime is one of several the compliance teams we cover have to run in parallel. For the rest of our regtech and compliance coverage, see the Compliance hub.