The UAE AML / CFT / CPF framework in 2026: what changed, and what it means for your programme

The UAE replaced its federal anti-money-laundering law last year, and the regulations that sit beneath it followed six weeks later. Federal Decree-Law No. (10) of 2025 was issued on 30 September 2025, published in Official Gazette No. 808, and came into force on 14 October 2025, repealing Federal Decree-Law No. (20) of 2018. Cabinet Resolution No. (134) of 2025 — its Executive Regulations — was issued on 29 October 2025, published in Official Gazette No. 811 on 14 November 2025, and came into force on 14 December 2025.

Both instruments are in force. So the question for an existing programme is not whether the framework has settled, but which parts of it your own arrangements now have to answer to.

What replaced what

The decree-law repeals the 2018 law. The Executive Regulations repeal Cabinet Resolution No. (10) of 2019, together with any provision conflicting with them. Those are two central instruments in the federal AML / CFT / CPF framework, and both have now been replaced outright.

Not everything beneath them has. The decree-law provides that regulations, resolutions and circulars issued under the 2018 law, and in force when the new law was issued, remain effective so far as they do not conflict with it, until superseding instruments are issued. The headline regulations have now been superseded. Others have not.

Targeted financial sanctions are the clearest working example. In its current published implementation guidance, the Executive Office for Control and Non-Proliferation states that targeted financial sanctions are to be implemented in accordance with Cabinet Decision No. 74 of 2020 and the relevant Security Council resolutions — while citing the 2025 decree-law for the penalties attaching to breaches of its instructions. An instrument issued under the old law and the new law are operating together. A programme that assumed the new law and its regulations had swept away everything below them would have the sanctions position wrong.

Who the framework reaches

The law is consistent about the populations it supervises: financial institutions, designated non-financial businesses and professions, virtual asset service providers, and non-profit organisations. Those are four distinct categories, not two. Virtual asset service providers are named separately throughout, and have their own defining article — they are not a sub-set of DNFBPs.

Where those categories are defined matters, because the decree-law and the regulations do different jobs here. The decree-law does not list which businesses are DNFBPs; it defines them as any person engaged in the activities "specified in the Executive Regulations". Article 3 of Resolution 134/2025 is where the list actually lives, and it has six limbs:

1. Commercial gaming operators, at or above AED 11,000 for a single transaction or linked transactions, with transactions involving only gaming chips or gaming instruments excluded.
2. Real estate brokers and agents, when concluding purchase or sale transactions for a customer.
3. Dealers in precious metals and stones, at or above AED 55,000 in cash.
4. Lawyers, notaries, other independent legal professionals and independent accountants, for a defined set of activities including real-estate transactions, managing client funds or accounts, and forming or managing companies and legal arrangements.
5. Company and trust service providers, for a defined set including acting as formation agent, director, registered-office provider, trustee or nominee shareholder.
6. Any further businesses or professions the supervisory authority adds in coordination with the National Committee.

Commercial gaming operators head that list, defined by reference to games licensed and regulated by the General Commercial Gaming Regulatory Authority, and expressly reaching gaming conducted on board vessels. An operator that falls within that definition should read Article 3 directly rather than rely on a sector summary.

Financial institutions and virtual asset service providers are defined the same way, in Articles 2 and 4. So if you want to know whether your activity is in scope, the answer is in the regulations, read against your licence and your supervisor — not in the law, and not in a sector list found online.

The law is blunt about the consequence of being in scope: no person may carry on covered financial activities, DNFBP activities or virtual asset service provider activities without a licence, registration or enrolment from the competent or supervisory authority.

What the framework asks a programme to do

Four obligations are worth reading in the original, because the wording sets the evidentiary bar.

On risk, you must identify, understand, manage and assess the crime risks in your business, proportionate to its nature and size, taking into account the risk-based approach and the results of the national risk assessment — and you must document the process, retain the study, update it on an ongoing basis, and provide it to the concerned authorities on request. A risk assessment that exists only as a conversation does not meet that sentence.

On governance, internal policies, controls and procedures must be approved by senior management, reviewed and updated on an ongoing basis, and applied across branches and majority-owned subsidiaries. The regulations go further than approval: they require a compliance officer at management level, employee screening, training programmes, and an independent audit function to test whether the policies work.

On reporting, suspicious transaction reports go to the Financial Intelligence Unit — an independent unit within the Central Bank — immediately and without delay, through the Unit's electronic system, regardless of value, and without invoking banking secrecy, professional secrecy or contractual liability. There is one exemption: it does not apply to lawyers, notaries, other independent legal professionals or independent statutory auditors where the information was obtained in assessing a customer's legal position, in defending or representing them, in arbitration or mediation, or in giving a legal opinion on proceedings.

On customer due diligence, the definition is broader than identity. It covers identifying and verifying the customer or beneficial owner, understanding the purpose and intended nature of the relationship, and understanding the nature of the customer's business and its ownership and control structure — with ongoing monitoring inside the definition rather than bolted on after it.

What to do now

This part is our own reading rather than a statutory test. Four checks, in the order in which we find them unanswered.

Confirm your scope against Article 3 — or Articles 2 and 4 — read together with your licence and your supervisor. Check that your risk assessment exists as a retained, current document you could hand over tomorrow. Confirm your policies carry a dated senior-management approval, extend to subsidiaries you control, and are tested by something independent of the people who operate them. And confirm your reporting route is the Unit's own electronic system, with the legal-professional position understood if you are a law firm or an audit practice.

There is a fifth requirement that sits outside those four: the regulations require due diligence to be applied to customers and relationships that already existed when they came into force, at times appropriate to materiality and risk. A programme that applies the new standard only to new customers has left its existing customer book unaddressed.

A note on sources

This briefing is written from primary instruments, read in full and in both languages: Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025, as published on the UAE legislation portal, and the Executive Office's published sanctions-implementation guidance. Where the regulations leave detail to a supervisory authority, we say so rather than fill the gap.

The legislation portal carries a standing note worth repeating: the English text is a translation, and in case of conflict the Arabic text prevails. We read the Arabic for that reason, and the terms used in this briefing follow the Arabic of the instruments rather than any secondary rendering.

This briefing describes the framework as at the review date shown above.