AML for Exchange Houses in the UAE: CBUAE Rules, Wire Transfers, Fines and goAML Reporting (2026)

Short answer: UAE exchange houses are licensed and supervised by the Central Bank of the UAE (CBUAE), and they carry the full anti-money laundering duties of financial institutions under Federal Decree-Law No. (10) of 2025. The CBUAE's Exchange Business Regulation of 2025 makes goAML access a condition of opening, and its Standards set due-diligence tiers stricter than the law: identification from AED 3,500 for currency exchange, full due diligence on every money transfer, and enhanced checks from AED 55,000. Suspicious transactions go to the Financial Intelligence Unit (FIU) through goAML without delay. In 2025 the CBUAE fined exchange houses up to AED 200 million and revoked several licences for AML failures.

This guide is for compliance officers, money laundering reporting officers (MLROs), boards and owners of UAE exchange houses, and for banks and payment firms that serve them. It is a practical guide, not legal advice: the laws, the CBUAE Rulebook and your supervisor's instructions are the authoritative texts.

---

The rules in 2026

Much of the CBUAE's AML guidance still cites the 2018 laws. Both 2025 decree-laws keep earlier regulations, standards and circulars in force until they are replaced, so read the guidance for the operational rules and the 2025 laws for the penalties.

---

The licence, and the AML conditions built into it

The Exchange Business Regulation has four categories:

AML compliance is a licence condition, not a separate project:

• Systems must support compliance with the AML laws, and no software, point-of-sale system or books may be kept hidden from the CBUAE.
• Governance must include a regulatory and financial crime compliance committee, and internal audit must cover AML/CFT.
• goAML first. The licensee "must obtain access to, and operationalise, suspicious transaction reporting systems provided by the FIU, such as go-AML system, prior to the commencement of its business operations".
• Notices. It must answer the authorities' "Search" and "Search and Freeze" notices within the time they set.
• Whistleblowing upwards. Heads of compliance, financial crime compliance and internal audit must report concealed violations to the CBUAE.

---

Customer due diligence: the CID, CDD and EDD tiers

The law sets due diligence for occasional transactions of AED 55,000 or more and for wire transfers of AED 3,500 or more (Article 7 of Cabinet Resolution No. 134). The CBUAE's Standards go further for exchange houses:

What each tier means:

• CID: an original Emirates ID, a passport with a valid visa, or a GCC national ID, recorded in the point-of-sale system. A customer who repeatedly exchanges amounts below AED 3,500 also needs CID.
• CDD: a customer profile with a permanent unique identification number, profession and expected annual activity. The Emirates ID is validated through the Federal Authority for Identity and Citizenship's gateway or UAE Pass, source of funds and purpose are captured for every CDD transaction, and the profile is reviewed every year or when the ID expires.
• EDD: evidence of the source of funds when the customer pays cash at the AED 55,000 thresholds.
• Politically exposed persons always get EDD, with approval from the compliance officer and the manager in charge before any transaction.
• Other DNFBPs and dealers in precious metals and stones as customers get EDD, including a check that they are supervised.

Third-party transactions are banned except under set conditions, such as a power of attorney. Kiosk money transfers are capped at AED 3,500 a transaction and AED 10,000 a customer a month, and people without a valid UAE visa may not transact, except in a grace period or an amnesty.

---

Remittances and the AED 3,500 wire-transfer rule

Cabinet Resolution No. 134 requires originating institutions to verify the originator information on international wire transfers of AED 3,500 or more. Each transfer must carry the originator's and beneficiary's names and account numbers, or a unique reference, and the originator's address, ID number, date and place of birth, or customer number (Article 28). Smaller transfers carry the same data without verification, unless there is suspicion. A non-compliant transfer may not be executed.

The CBUAE's Standards are stricter: every international transfer, inward or outward, carries the originator's identity details and unique identification number and the beneficiary's name and account, and the ordering exchange house verifies that data whatever the amount. Follow the stricter rule.

Agents and both ends of a transfer. Money or value transfer providers keep an updated list of agents, bring the agents into their AML programmes, and apply the wire-transfer rules through them (Articles 27 and 31). A provider that controls both the sending and the receiving end uses the information from both sides to decide on a suspicious transaction report, and files it with the FIU of the country concerned.

Correspondents and nesting. The CBUAE's 2025 correspondent-banking guidance says exchange houses "should screen all transfers, inwards or outward", and treats serving payment providers that act for other providers ("nesting") as a relationship that may need enhanced measures.

---

Monitoring, sanctions screening and freezing

• Automated monitoring. The Standards require automated, risk-based transaction monitoring with rules that "take account of ML/FT typologies in the Exchange Business sector", with special attention to third-party transactions.
• Real-time screening of every party before a transaction executes. For a remittance that means the remitter, the beneficiary and the beneficiary's bank.
• List updates. Register with the Executive Office for Control and Non-Proliferation for e-mail notices of listings, and freeze "without delay", which the Standards define as within 24 hours of the listing decision.
• Reporting a freeze. CBUAE documents say a freeze is reported through goAML within two business days, and a partial match is reported while the transaction stays suspended. Cabinet Decision No. 74 of 2020 and the Ministry of Economy & Tourism's 2026 guidance give five business days and call the confirmed-match report a CNMR. Follow the Executive Office's current guidance and keep the CBUAE informed.
• FIU requests. Sign up for the FIU's Integrated Enquiries Management System (IEMS), through which the FIU sends requests to every licensed institution at once.

---

Reporting to the FIU through goAML

Registration. "Registration in the system is mandatory for all entities under CBUAE's supervision", newly licensed institutions register immediately, and the registration must stay active.

Report types the CBUAE lists for licensed institutions: STR and SAR for a new suspicion, AIF and AIFT for more information on an earlier report, RFI and RFIT for FIU requests, and HRC and HRCA for business linked to high-risk countries. A transaction reported in an HRC may be executed only three working days after the report, and only if the FIU does not object. Our guide to goAML report types in the UAE covers each one.

Timing. The law requires reporting without delay. The CBUAE's 2021 guidance adds markers:

• an outer limit of 35 business days from the automated alert;
• 24 hours from an escalated decision;
• 24 hours where terrorist financing is suspected, under the Standards.

It also treats defensive filing as "indicative of an inefficient transaction monitoring system". The Standards require both the ordering and the beneficiary side of a transfer to be considered.

Data rules that trip exchange houses:

• every transaction goes in as a bi-party transaction;
• a currency exchange is reported "where the 'from' and 'to' parties are the same Person";
• a remittance runs from one person, account or entity to another;
• the auto-generate button for transaction references is for institutions other than banks and exchange houses;
• an AIFT with more than 10,000 transactions is split.

---

The compliance function

Prudential returns run alongside: Exchange House Return Forms through the CBUAE's Integrated Regulatory Reporting system, and remittance data uploaded to the Remittances Reporting System daily. Late returns draw strict-liability fines of AED 250 a day, up to AED 25,000 per violation, and wrong data AED 12,500, with no appeal.

---

Cash, declarations and banknote shipments

• Travellers declare currency, bearer instruments and precious metals and stones above AED 60,000 when entering or leaving the UAE. The CBUAE expects these declarations to be considered in due diligence.
• When a customer exchanges declared cash, the exchange house keeps the customs declaration form, or endorses a partial amount on it. It never exchanges more than the declared total on one form, and never treats the form as evidence of the source of funds.
• Changing small notes into large ones triggers CDD from AED 35,000 and EDD from AED 55,000, and EDD at any value for companies.
• Every banknote import or export counterparty needs its own CBUAE no-objection letter. Customer remittance funds go into designated intermediate accounts at UAE banks daily.

---

The risks the regulators see

The national risk assessment rates the exchange-house sector Medium-High for money laundering (inherent risk High). It lists cash of untraceable origin, fast cross-border transfers, banknote shipments without transaction limits, reliance on foreign remittance providers, third-party transactions, high daily volumes and new technologies. It rates registered hawala providers High.

The FIU's typologies and the CBUAE's guidance add red flags:

• structuring below the due-diligence thresholds, or cancelling when checks loom;
• sending money abroad and expecting an equal amount back;
• one customs declaration used for several exchanges;
• many senders to one beneficiary, or senders with no relationship to the receiver;
• customers sharing contact details, or acting for an undisclosed third party;
• transfers to gambling sites, prize claims or people met only online;
• incoming transfers missing originator or beneficiary information;
• staff whose lifestyle outruns their salary, or who will not take leave.

---

Enforcement, 2023–2026

The new Central Bank law raises the ceiling: fines of up to AED 1 billion on a licensed institution, AED 100,000 to AED 5 million on an authorised individual, licence revocation, and publication of the violator's name (Article 168). Under the AML law, supervisors can fine AED 10,000 to AED 5,000,000 per violation (Article 17). The number of licensed exchange businesses fell from 73 to 64 during 2025.

---

Registered hawala providers

Hawala is legal in the UAE only for registered providers. No one may carry it on without a CBUAE Hawala Provider Certificate, under the Registered Hawala Providers Regulation (Circular No. 24/2019).

• Registration: the certificate is valid for one year and is renewed at least two months before it expires.
• Within 90 days of registering: register on SACM and then goAML, on the CBUAE's reporting systems, and on the FIU's IEMS.
• Data: upload every transfer, remitter and beneficiary to the CBUAE daily.
• Due diligence: identification for transfers of AED 1 to AED 3,499, CDD from AED 3,500, and EDD from AED 55,000 and for PEPs, high-risk countries and every legal person. Corporate customers must be UAE-based, with owners of 25% or more identified.
• Not allowed: deposits, currency exchange, virtual assets, acting for another UAE hawala provider ("nesting"), and agents inside the UAE.

Banks and exchange houses must not accept unregistered UAE hawala providers as customers, and must file an STR when they detect one. In 2021 the CBUAE fined six registered hawala providers AED 350,000 in total for registering on goAML late.

---

Compliance checklist

1. Map your licence category to the activities you actually run, and check that cash and digital channels match it.
2. Configure due diligence to the Standards' tiers, not just the law's thresholds, including the 90-day and 45-day aggregation windows.
3. Send and verify full originator and beneficiary data on every international transfer, and keep agent lists current.
4. Screen every party in real time before execution, freeze within 24 hours of a listing, and file the sanctions reports through goAML.
5. Keep goAML and IEMS registrations active, and file STRs without delay, treating 35 business days only as the outer limit.
6. Report currency exchanges in goAML with the same person on both sides, and use your own transaction references.
7. Keep the compliance officer and alternate approved, trained and independent, and file the bi-annual reports.
8. Keep records for five years in a form you can hand to an examiner.

---

Frequently asked questions

Who regulates exchange houses in the UAE?

The Central Bank of the UAE, under Federal Decree-Law No. (6) of 2025, the Exchange Business Regulation (Circular No. 7/2025) and its Standards. For AML, exchange houses are financial institutions under Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025, and they report to the FIU through goAML.

What are the exchange house licence categories in the UAE?

Four: Category I (currency exchange, remittances and Wages Protection System payroll), Category II (currency exchange and remittances), Category III (currency exchange only) and Category IV (digital remittances only, with no cash in or out).

What due diligence thresholds apply to UAE exchange houses?

Under the CBUAE Standards, currency exchange needs customer identification from AED 3,500, due diligence from AED 35,000 and enhanced due diligence from AED 55,000 within 90 days. Money transfers need identification and due diligence at any value, and enhanced due diligence from AED 55,000 within 45 days. Legal persons and politically exposed persons always get enhanced due diligence.

Do exchange houses have to register on goAML?

Yes. Registration is mandatory for every CBUAE-supervised institution, and the Exchange Business Regulation requires an exchange house to have goAML access before it starts business.

How much has the CBUAE fined exchange houses?

In 2025 alone the CBUAE announced fines of AED 200 million and AED 100 million on two exchange houses, several fines between AED 800,000 and AED 12.3 million, and licence revocations, citing failures in their AML/CFT and sanctions frameworks.

Is hawala legal in the UAE?

Only for providers registered with the CBUAE under the Registered Hawala Providers Regulation. A registered provider must hold a current certificate, register on goAML, upload its transfer data daily and apply due diligence. Unregistered hawala is prohibited, and banks and exchange houses must report unregistered providers they detect.

---

See how Creodata's AML compliance software in the UAE handles screening, monitoring and goAML reporting for exchange houses: book a demo.