UAE Federal Decree-Law No. 10 of 2025 Explained: The New AML Law and What It Requires

Short answer: Federal Decree by Law No. (10) of 2025, issued on 30 September 2025, is the UAE's current law on anti-money laundering and countering terrorist and proliferation financing. It replaced Decree by Law No. (20) of 2018. With its executive regulations, Cabinet Resolution No. (134) of 2025, it requires financial institutions, DNFBPs and virtual asset service providers to:

• assess their risks and apply customer due diligence;
• report suspicious transactions to the Financial Intelligence Unit without delay;
• apply targeted financial sanctions forthwith;
• keep records for five years.

This guide is for compliance officers, money laundering reporting officers (MLROs), boards and legal teams at UAE banks, exchange houses, finance companies, insurers, virtual asset service providers and designated non-financial businesses and professions (DNFBPs). It is a practical guide, not legal advice: the Decree by Law, the regulations and your supervisor's rules are the authoritative texts.

---

What changed in 2025

Regulations, resolutions and circulars issued under the 2018 law stay in force where they are consistent with the new one, until replaced (Article 41). That keeps, for example, the Ministry of Economy circulars that created the DPMSR and REAR reports.

---

Who it covers

• Financial institutions. MoET's AML page lists the Central Bank of the UAE and the Securities and Commodities Authority among the supervisors.

• Designated non-financial businesses and professions (Article 3 of the regulations):

  • commercial gaming operators, for transactions of AED 11,000 or more;
  • real estate brokers and agents, for purchases and sales on behalf of customers;
  • dealers in precious metals and stones, for cash transactions of AED 55,000 or more, single or linked;
  • lawyers, notaries, other independent legal professionals and independent accountants, for listed transactions;
  • company and trust service providers.

  The Ministry of Economy & Tourism supervises the DNFBPs licensed on the mainland and in commercial free zones.

• Virtual asset service providers: exchange, transfer, safekeeping and administration of virtual assets, and services for issuers (Article 4 of the regulations).

• Non-profit organisations, under their own supervisor's rules.

Nobody may carry on any of these activities without a licence, registration or enrolment (Article 20). Doing so is punishable by imprisonment and a fine of AED 200,000 to AED 10,000,000, or either (Article 32).

---

The law at a glance

---

The offences

Money laundering (Article 2). A person commits money laundering if they know, or there are sufficient indications or evidence to believe, that funds are wholly or partly the proceeds of a predicate offence, and they intentionally:

• convert or transfer the proceeds, or carry out any transaction with them, to conceal or disguise their illicit origin;
• conceal or disguise their true nature, source, location, disposition, movement, ownership or related rights;
• acquire, possess or use them on receipt; or
• help the person who committed the predicate offence evade punishment.

Money laundering is an independent crime. No conviction for the predicate offence is needed, and knowledge can be inferred from the circumstances.

Terrorist and proliferation financing (Article 3). It is a crime to provide, collect or make available funds knowing they will be used for a terrorist act, by a terrorist or terrorist organisation, or for travel to commit or train for terrorism. That includes doing so through digital systems or virtual assets. It is also a crime to finance weapons of mass destruction, their means of delivery or related materials.

Legal persons (Article 4). A company is criminally liable for crimes committed intentionally in its name or for its account, without prejudice to the personal liability of the people involved.

Attempts carry the same penalty as the completed crime, and these crimes do not lapse by prescription (Articles 26 and 37). The person who actually manages a company can also be punished, if they knew and the crime resulted from a breach of their duties.

---

The Financial Intelligence Unit

The FIU is an independent unit within the Central Bank, and every suspicious transaction report goes to it, "exclusively", from financial institutions, DNFBPs and virtual asset service providers (Article 11). It can:

• ask for information: any additional information or documents, within the timeframe and in the form it prescribes;
• stop a transaction: order a suspected transaction stopped or suspended for up to 10 working days, without notice;
• freeze funds: freeze funds for up to 30 days, extendable by the Attorney General (Article 5).

Reports reach the FIU through goAML. See our goAML registration guide for the UAE and our guide to goAML report types.

---

What reporting entities must do

Report suspicious transactions (Article 18). Where you suspect, or have reasonable grounds to suspect, that a transaction or funds are proceeds of the crime, or related to or intended for it, you notify the FIU "without delay and directly", "regardless of their value". The report goes through the FIU's electronic system and contains all the data you have. Then you answer the FIU's follow-up questions without invoking confidentiality. The regulations add "Immediately and without delay" and include attempted transactions. Legal professionals and independent auditors are exempt for information under legal privilege.

The Article 19 obligations:

• identify, assess, document and keep updating your crime risks, and give the assessment to your supervisor on request;
• apply customer due diligence and continuous monitoring, scaled to risk and to the national risk assessment;
• open no anonymous, fictitious, alias or numbered accounts;
• adopt internal policies, controls and procedures approved by senior management and applied across majority-owned branches and subsidiaries;
• "implement forthwith" the targeted financial sanctions instructions of the Executive Office for Control and Non-Proliferation;
• keep transaction records immediately available to the authorities.

The detail in the regulations:

• Due diligence: financial institutions apply it to occasional transactions of AED 55,000 or more and wire transfers of AED 3,500 or more, and virtual asset service providers to occasional transactions of AED 3,500 or more.
• PEPs: foreign politically exposed persons need senior-management approval, source-of-funds and source-of-wealth checks and enhanced monitoring.
• Records: kept for at least five years (Article 25).
• The compliance officer: appointed at management level, with independence and duties that include "Monitoring Transactions related to the Crime". They also decide whether to notify the FIU "or to retain the matter stating the reasons therefor" (Articles 21 and 22). Supervisors keep a list of compliance officers and must approve an appointment in advance.

---

Confidentiality, tipping-off and protection

Information on suspicious transactions is confidential (Article 24). Telling a customer or anyone else that a report has been filed, or that an investigation is under way, is a crime (Article 29; Article 19 of the regulations).

Reporting is protected. No criminal, civil or administrative liability attaches to supervisors, the FIU, institutions or their staff for providing the required information, even if it breaches a confidentiality restriction, unless the report was made in bad faith to harm someone (Article 37).

---

Supervision and administrative penalties

Supervisory authorities assess risk and run desk-based and field inspections (Article 16). For any breach of the Decree by Law, the regulations or related decisions, they may impose (Article 17):

• a warning;
• an administrative fine of AED 10,000 to AED 5,000,000 for each violation;
• a ban from working in the sector;
• restrictions on the powers of responsible board members, executives or owners, including a temporary supervisor;
• suspension or replacement of the responsible managers;
• suspension or restriction of the activity;
• revocation of the licence.

They can also order periodic reports on remediation, raise the fine for a repeat violation within a year, and publish the penalties. A separate Cabinet resolution sets out the violations and penalties in detail (Article 39).

---

At the border

Anyone entering or leaving the UAE must disclose currencies, bearer negotiable instruments, precious metals and valuable stones they carry. The disclosure system is set by the Federal Authority for Identity, Citizenship, Customs and Port Security with the Central Bank (Article 10).

---

What this means for your systems

Our buyer's guide to AML compliance software in the UAE turns these duties into evaluation criteria, and our UAE goAML reporting guide covers filing.

---

Frequently asked questions

What is Federal Decree-Law No. 10 of 2025?

The UAE's law on anti-money laundering and countering the financing of terrorism and proliferation, issued on 30 September 2025. It replaced Federal Decree by Law No. 20 of 2018, and its executive regulations are Cabinet Resolution No. 134 of 2025.

Which law did Decree-Law No. 10 of 2025 replace?

Federal Decree by Law No. (20) of 2018. Its executive regulations, Cabinet Resolution No. (10) of 2019, were replaced by Cabinet Resolution No. (134) of 2025. Circulars issued under the old law stay in force where they are consistent with the new one.

What is the penalty for money laundering in the UAE?

One to ten years' imprisonment and a fine of AED 100,000 to AED 5,000,000, or the value of the criminal property if greater. In aggravated cases it is temporary imprisonment and AED 1,000,000 to AED 10,000,000, or twice the value. A legal person faces AED 5,000,000 to AED 100,000,000 (Articles 26 and 27).

What administrative fines can UAE supervisors impose?

An administrative fine of AED 10,000 to AED 5,000,000 for each violation, alongside warnings, sector bans, restrictions on managers, suspension of the activity and licence revocation (Article 17).

Who must report suspicious transactions in the UAE?

Financial institutions, DNFBPs and virtual asset service providers, to the Financial Intelligence Unit, without delay and regardless of the amount (Article 18). Lawyers, notaries, other legal professionals and independent auditors are exempt for information covered by legal privilege.

What does "implement forthwith" mean for targeted financial sanctions?

Article 19 requires institutions to "implement forthwith" the Executive Office's sanctions instructions. In practice, MoET's guidance for DNFBPs means freezing without delay (within 24 hours) on a confirmed match, and reporting through goAML within five business days.

---

See how Creodata's AML compliance software in the UAE maps each duty to a module: book a demo.