UAE's New AML Law: A reset for corporate accountability

The United Arab Emirates has enacted a landmark reform of its financial crime regime with the introduction of Federal Decree-Law No. 10 of 2025 on Combating Money Laundering, the Financing of Terrorism, and the Financing of Arms Proliferation (the New AML Law), which came into force in mid-October 2025. This legislation repeals the 2018 AML framework and marks a comprehensive transformation in compliance and enforcement across all major sectors.

This is not a routine legislative update; it represents a fundamental reset. The New AML Law modernises investigative powers, significantly broadens the scope of regulated activities, and imposes substantially harsher penalties. These reforms underscore the UAE’s commitment to aligning with international best practices and strengthening its position as a transparent and trusted jurisdiction in the post-FATF grey list era.

Key implications for businesses:

• Unlimited exposure: Regulatory authorities now have the power to freeze assets for up to 30 days without prior notice.
• No limitation periods: Financial crime offences are no longer subject to statutory time limits.
• Expanded coverage: Entities operating in financial services, real estate, professional services, trade, logistics, manufacturing, virtual assets, and the non-profit sector are all within scope.

Given the scale and immediacy of these changes, organisations must urgently reassess their governance, risk, and compliance frameworks to ensure alignment with the new legal landscape.

Strategic support for navigating the New AML Law

Our Regulatory and Investigations team partners with businesses across all sectors to navigate the complexities of the UAE’s New AML Law. We conduct comprehensive compliance audits and gap assessments to proactively identify vulnerabilities before regulators do. We assist in updating governance frameworks and internal policies, equipping boards and senior management with the tools and documentation required to demonstrate effective oversight.

We deliver tailored training for board members and senior executives, focused on sector specific governance obligations, personal liability risks, and the practical implications of expanded FIU powers. For organisations operating in emerging or high risk areas such as proliferation financing, virtual assets, and beneficial ownership compliance, we provide strategic guidance on regulatory expectations and implementation pathways.

In the event of regulatory action, we represent clients in FIU investigations, asset freezing appeals, and enforcement proceedings. Our approach is focused on protecting both corporate and personal interests while maintaining constructive engagement with authorities.

Expanded scope and modernised coverage

The New AML Law significantly broadens the scope of the UAE’s anti-money laundering framework, extending its reach to new sectors, technologies, and activities. This modernised approach reflects the evolving nature of financial crime and ensures that the regulatory net captures emerging risks across the economy.

Proliferation financing - now recognised as a standalone criminal offence under Article 3, covering the financing of weapons of mass destruction, dual-use goods, and related technologies. This extends far beyond the defence industry - manufacturers, logistics companies, and trade-finance providers could all fall within scope if their transactions involve materials that could be repurposed for weapons use. Failure to conduct enhanced due diligence or report suspicious activity could expose businesses to fines of up to AED 100 million and criminal prosecution.

Virtual assets and service providers (VASPs) - now subject to the full AML/CFT regime. Article 30 prohibits anonymity-enhanced virtual assets that prevent transaction traceability, while Article 32 criminalises unlicensed VASP activity, punishable by imprisonment and fines of up to AED 10 million. Crypto exchanges, wallet providers, and DeFi platforms must now be licensed and implement AML controls equivalent to those applied by banks.

Tax evasion - expressly listed as a predicate offence, closing a long-standing ambiguity and bringing the UAE in line with international AML standards.

The perimeter of AML liability now extends well beyond banks and financial institutions to include fintechs, trading houses, manufacturers, logistics providers, virtual-asset operators, and professional services firms.

Increased penalties and unlimited exposure under the New AML Law

The UAE’s New AML Law introduces a significantly more stringent penalty regime and removes all limitation periods for financial crime offences, fundamentally reshaping the risk landscape for businesses.

Key changes include:

• Increased financial penalties: Legal entities may now face fines of up to AED 100 million for offences related to money laundering, terrorist financing, or proliferation financing. For individuals, the maximum term of imprisonment has increased to 10 years.
• Administrative sanctions: Regulators are empowered to impose fines ranging from AED 10,000 to AED 5 million per violation. Supervisory authorities may also suspend licences, restrict business activities, or remove senior management.
• Criminalisation of false disclosures: Providing false or misleading beneficial ownership information is now a criminal offence.

Perhaps the most consequential reform is found in Article 37, which abolishes any limitation period for financial crime offences. This means criminal proceedings can be initiated at any time, regardless of when the conduct occurred. Historical transactions may be revisited years, or even decades later if new evidence emerges.

For businesses, this creates enduring exposure and demands a proactive compliance posture. Organisations must now maintain robust record keeping systems. Until Executive Regulations clarify minimum retention periods, a prudent approach is to preserve transaction records, customer due diligence files, and beneficial ownership documentation indefinitely.

Independent FIU powers and extended enforcement reach

The New AML Law significantly strengthens the powers and independence of the Financial Intelligence Unit (FIU), positioning it at the centre of the UAE's financial-crime enforcement architecture. AML enforcement is now a strategic national priority, directly tied to the UAE's FATF commitments and its ambition to be recognised as a leading global financial centre.

Under Article 11, the FIU has been formally established as an independent statutory authority within the Central Bank, equipped with expanded investigative powers. The FIU Head is authorised to:

• Freeze assets for up to 30 days without prior notice
• Suspend transactions for up to 10 working days
• Demand information from financial institutions, DNFBPs, and VASPs within specified timeframes

Failure to comply with FIU requests may constitute a criminal offence, underscoring the seriousness of these obligations.

The law also marks a shift in regulatory focus, from procedural compliance to demonstrable governance. Regulators will now assess whether boards and senior management are actively engaged in AML oversight.

Evidence of this may include:

• Board minutes reflecting regular AML risk discussions
• Internal approval protocols for high-risk clients
• Escalation logs and risk committee reports
• Records of AML training and awareness programs

The central question is no longer whether policies exist, but whether leadership is visibly enforcing and monitoring them.

Continuity of Executive Regulations: What it means for your business

While the New AML Law is now in force, the 2018 Executive Regulations remain applicable to the extent they do not conflict with the new provisions. Updated Executive Regulations are expected in early 2026 to operationalise key aspects of the new framework, including controls on proliferation financing, supervision and licensing of virtual asset service providers (VASPs), enhanced powers of the Financial Intelligence Unit (FIU), and strengthened requirements for beneficial ownership verification and disclosure.

What this means in practice:

Organisations must apply the 2018 rules today, but recalibrate systems and governance to align with the broader scope and enhanced powers introduced by the New AML Law. 

Sector-specific implications include:

• Financial Institutions: Reassess transaction monitoring models for digital and cross-border flows; prepare for increased FIU requests and shorter response timelines.
• VASPs: Secure appropriate licences or registrations; implement bank-grade KYC and transaction monitoring systems; avoid products that enable anonymity.
• DNFBPs: Ensure registration on the goAML platform; apply risk-based customer due diligence and verify beneficial ownership; train frontline staff; note that legal privilege is narrowly construed.
• Corporates and Non-Profit Organisations: Maintain accurate and up-to-date beneficial ownership disclosures; extend record retention practices; reinforce internal controls and escalation protocols.

Businesses should act now to future-proof compliance frameworks and ensure readiness for the next phase of regulatory implementation.

Conclusion

The New AML Law marks a significant evolution in the UAE’s approach to financial crime. Its impact is measurable with corporate fines of up to AED 100 million, asset freezes for up to 30 days without notice, no limitation period for offences, and a strict 14-day window for appeals. But the broader message is even more important: preventing and detecting anti-money laundering is now a matter of governance and leadership.

Regulators are no longer focused solely on whether policies exist. The emphasis has shifted to whether boards and senior management are actively overseeing AML risks, making informed decisions, and engaging constructively with authorities.

The law is now in effect, and regulatory scrutiny is increasing. The key question is not whether your organisation should respond, but how quickly it can demonstrate board level commitment to the new compliance standard.