Keeping Pace with the UAE’s Evolving Anti-Money Laundering, Counter-Terrorism Financing and Counter Proliferation Financing Regulatory Framework

In anticipation of the Financial Action Task Force’s fifth round of mutual evaluations, which is currently underway, the UAE overhauled its anti-money laundering (AML), counter-terrorism financing (CTF) and counter proliferation financing (CPF) regime. This blog outlines the key changes introduced by the new federal framework and recent developments in the UAE’s AML, CTF and CPF landscape. This blog builds on our previous updates on the UAE’s AML and CTF framework which can be accessed here.

Summary of Key Updates 

In October 2025, the UAE replaced its 2018 AML/CTF framework with the new Federal Decree-Law No. (10) of 2025 regarding AML/CTF/CPF and its corresponding Executive Regulations (together, the "2025 AML Law"). In recent months, the DFSA and ADGM FSRA followed suit, updating their respective regulations and rulebooks to align with the new federal standards.

Simultaneously, the UAE Financial Intelligence Unit’s (FIU) updated risk indicators, targeted outreach, and rigorous supervisory standards drove a significant rise in Suspicious Transaction Reports from banks, insurers, wealth managers and Designated Non-Financial Businesses and Professions (DNFBPs).

In April 2026, the UAE Central Bank issued updated AML, CTF and CPF guidance with granular and heightened compliance requirements for banks that are at high risk for money laundering, terrorism and proliferation financing.

Key changes to the 2025 AML Law and what they mean for your business? 

• Increased application of the AML framework. The term “predicate offence” is now defined to include terrorist financing, proliferation financing, and both direct and indirect tax evasion, whether committed within or outside the UAE. This enables regulators to enforce against a wider range of conduct.
• Lower evidentiary standards. The evidentiary standard required to establish a predicate offence has been lowered from “actual knowledge” to an objective test where knowledge that funds were illicit “may be inferred from the factual and objective circumstances”.
• Proliferation financing is now a distinct offence. There is a new criminal offence of proliferation financing, which stands beside the criminal offences of money laundering and terrorist financing.
• The 2025 AML Law keeps pace with technological developments. Definitions have been updated to include digital and encrypted assets and digital systems, encrypted platforms and virtual asset channels. Of note is a new provision that enables regulators to punish any legal person who promotes, offers for sale, provides services or deals in virtual assets characterised by total anonymity that prevents regulators from tracing the transaction.
• Enhanced liability and penalties. Both individuals and legal persons face increased penalties, with fines for legal persons ranging from AED 5 million to AED 100 million or more. In serious cases, the FIU may order dissolution, closure, or asset freezing for up to 30 days without prior notice. Further, the Public Prosecution also reserves these powers and can impose these measures without any statutory time limit.
• Personal criminal Liability. With greater focus on individual accountability, senior management (such as directors, board members and executive officers) are now subject to personal criminal liability if they have knowledge of the predicate offence and participated in, or facilitated, the offence. Knowledge can be inferred from the factual and objective circumstances.
• Regulatory Expectations and Scrutiny. Consistent with global standards, regulators are required to adopt a more risk-sensitive approach to supervision. The new law mandates that Supervisory Authorities conduct risk assessments to determine the likelihood of money laundering, terrorism financing, and proliferation financing within regulated entities under their remit. In parallel, those Supervisory Authorities are applying heightened scrutiny to the identification, verification and maintenance of up-to-date records of Ultimate Beneficial Owners (UBOs) by regulated entities.

UAE FIU Publications and Enforcement Trends

To guide regulated entities in updating their risk assessments, the FIU regularly publishes annual reports and strategic analyses outlining emerging risk trends, enforcement priorities, and criminal typologies. Key recent publications highlight the following:

• Trends identified in UAE Annual Report 2024:
  • Misuse of legal entities. The FIU noted abuse of complex corporate structures and corporate service providers to obscure UBOs remains a primary ongoing risk.
  • Real estate sector focus. The FIU substantially increased direct engagement and supervisory outreach with the real estate sector, which remains classified as high-risk.
  • Surge in fraud risk. Suspicious transaction reports related to organised fraud grew by 57%, indicating both a rise in illicit activity and improved reporting capabilities across financial institutions and DNFBPs.
• Human Trafficking and Modern Slavery Typologies: This report outlines financial behaviours linked to human trafficking, noting that sex trafficking and labour exploitation proceeds are primarily routed through the banking sector and money service businesses.
• Environmental Crime Typologies: This analysis highlights money laundering risks associated with illegal mining, wildlife trafficking and smuggled oil. It highlights the abuse of trade-based money laundering and shell companies, warning the banking, logistics and trading sectors to monitor transactional and geographical risk indicators.

DFSA and FSRA Focus Areas

• DFSA:
  • Thematic Reviews. Across its 2025-2025 reviews and communications, it is clear the DFSA is focusing on senior management accountability and governance responsibility, the quality of risk assessments rather than box-ticking, targeted financial sanctions and proliferation financing, robust procedures for customer onboarding and beneficial ownership verification and proper evidence of compliance implementation rather than policy documentation.
  • AI Risk Management. The DFSA’s recent communications also outline clear expectations for AI risk management. The DFSA treats AI as a material operational risk, expecting DFSA-regulated financial institutions to establish documented AI governance frameworks that ensure clear board accountability and strict management of third-party cloud concentration risks.
• FSRA:
  • Thematic Reviews. Recent FSRA reviews focus on strengthening board oversight of outsourced compliance and refining automated transaction monitoring systems.
  • Targeted Financial Sanctions. The FSRA’s recent communications outline its requirement for FSRA-regulated entities to conduct prompt screenings against updated national and international sanctions lists. 

UAE Proliferation Financial National Risk Assessment Report 2026

In June 2026, the UAE National Anti-Money Laundering and Combatting Financing of Terrorism and Financing of Illegal Organisations Committee published the UAE Proliferation Financial National Risk Assessment Report. This report evaluates the UAE's exposure to the illicit funding of weapons of mass destruction and the evasion of targeted financial sanctions, identifying specific vulnerabilities within trade finance, shipping, and complex corporate structures. UAE organisations are expected to proportionately and as applicable to their business actively review their customer portfolios, proliferation financing risk assessments, geographic touchpoints and transaction profiles to detect proliferation-financing red flags, including attempts to evade proliferation-related targeted financial sanction. 

Practical considerations for you

The new framework requires AML-regulated entities to proactively address AML/CTF/CPF compliance. Recent DFSA enforcement action from February 2026 further demonstrates regulators will penalise regulated entities for inadequate AML/CTF/CPF compliance controls. 

Some key steps to ensure an effective AML/CTF/CPF compliance framework include:

1. Update policies and procedures: Review and revise AML/CTF/CPF policies, risk assessments, procedures, and controls to capture new definitions, obligations, and risk areas. This is particularly the case regarding CPF, which now has prominence alongside AML and CTF measures and is an area where compliance framework updates are likely required.
2. Ensure consistency in training, record-keeping, and reporting: Provide regular, role-specific, and locally relevant training for compliance staff and MLROs, and maintain robust systems to document compliance activities, including CPD logs, risk assessments, and suspicious transaction reports.
3. Active governance and oversight: Senior management should ensure that frameworks are up-to-date and effective, as well as monitor the fitness of MLROs and staff.
4. Open engagement with regulators: Keep open communication with Supervisory Authorities and proactively incorporate feedback.
5. Monitor regulatory developments: Establish a mechanism to track, assess and implement ongoing AML/CTF/CPF updates. 

By taking these steps, AML-regulated entities can further strengthen their compliance framework in combatting financial crime and ensure compliance with the UAE’s new 2025 AML Law.