In October 2025, the UAE replaced the law that has anchored its anti-money laundering framework since 2018. Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation Financing, in force since 14 October 2025, repealed Federal Decree-Law No. 20 of 2018. Weeks later, Cabinet Resolution No. 134 of 2025 replaced Cabinet Decision No. 10 of 2019 as the Executive Regulations. It has applied since 14 December 2025.
A year on, we are still reviewing AML manuals that cite the 2018 law and the 2019 regulations. Inspectors notice. Here is what changed, and what it means in practice. This briefing covers the federal law. Firms in DIFC and ADGM must also follow the DFSA's and FSRA's own AML rules.
What stays the same
The architecture is familiar. Financial institutions, DNFBPs and VASPs must still assess risk, conduct customer due diligence, identify beneficial owners, screen against sanctions lists, report suspicions to the FIU through goAML and keep records.
Existing Cabinet resolutions, decisions and circulars also remain in force to the extent they do not conflict with the new law (Article 41(3)). That keeps Cabinet Decision No. 74 of 2020 on targeted financial sanctions, Cabinet Resolution No. 71 of 2024 on administrative penalties (for entities supervised by the Ministry of Justice and the Ministry of Economy), and Ministry of Economy circulars such as those on REARs and DPMSRs alive.
What has changed is scope, severity and emphasis.
Seven changes that matter
1. Proliferation financing is now a standalone crime
The title of the law tells the story: "Illegal Organisations" is out, "Proliferation Financing" is in. Article 3(3) makes financing the manufacture, supply, export, trans-shipment, brokering, transport or storage of weapons of mass destruction, including dual-use goods, a crime in its own right. Knowledge can be inferred from factual circumstances. Penalties include temporary imprisonment and a fine of AED 1 million to AED 10 million, or twice the value of the property involved.
2. Tax evasion is an express predicate offence
Predicate offences now expressly include evasion of direct and indirect taxes. A conviction for the underlying crime is not needed to prosecute money laundering. For accountants, corporate service providers and anyone handling client funds, tax-driven red flags now sit squarely within AML reporting.
3. Virtual assets are written in throughout
Laundering through digital systems, virtual assets or cryptographic technologies is expressly covered, and VASPs sit alongside financial institutions and DNFBPs across the law. There is also a new offence of dealing in fully anonymous or untraceable virtual assets.
4. Corporate liability has sharpened
A legal person convicted of money laundering, terrorist financing or proliferation financing faces a fine of AED 5 million to AED 100 million, or the value of the property if higher (Article 27). A company convicted of terrorist or proliferation financing must be dissolved. The person who actually manages the company can be personally liable where they knew of the offence and breached their duties.
5. Administrative penalties run to AED 5 million per violation
Supervisors can impose warnings, fines of AED 10,000 to AED 5,000,000 per violation, bans, suspension or replacement of managers, suspension of activity and licence revocation (Article 17). Repeat violations within a year can attract higher fines, and supervisors can publish the measures they take.
6. No expiry date on liability
Criminal proceedings and penalties for money laundering, terrorist financing and proliferation financing do not lapse (Article 37(2)). Confiscation is mandatory, extends to equivalent value, and remains possible even where the offender is unknown or cannot be held criminally liable (Article 31).
7. Reporting "without delay", regardless of value
Suspicious transactions must be reported to the FIU without delay, whatever their value (Article 18). Deliberately or grossly negligently failing to report is a criminal offence punishable by imprisonment and/or a fine of AED 100,000 to AED 1 million (Article 28). Tipping off remains an offence. The FIU can suspend a transaction for up to 10 working days and freeze funds for 30 days (Article 5).
What the Executive Regulations add
Cabinet Resolution No. 134 of 2025 translates the law into day-to-day obligations. Points we see clients miss:
- Your business risk assessment must take the National Risk Assessment into account, with specific measures where proliferation financing risk is high.
- New products, services and technologies must be risk-assessed before launch, not after.
- Beneficial ownership is based on ultimate effective control, with a 25% ownership threshold. Nominee shareholders are not beneficial owners merely because they hold shares as nominees.
- For customers subject to Corporate Tax, the tax registration number forms part of due diligence.
- Records must be kept for at least five years, counted from the latest of several events (completion of the transaction, end of the relationship or account closure, completion of an inspection, or a final judgment). The retention clock can run longer than you think.
- A Compliance Officer must be appointed at management level, with independence in decision-making (Article 22). For DNFBPs, the Ministry of Economy and Tourism's DNFBP Guidelines also require the supervisor's prior written approval.
- Commercial gaming operators are now DNFBPs.
What to do now
If your AML/CFT policy still cites Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, an inspector will read that as a programme nobody has reviewed in a year.
- Re-paper your framework. Update legal references in your policy, procedures, EWRA, forms and training.
- Add a proliferation financing section to your risk assessment. Use the UAE's latest Proliferation Financing National Risk Assessment as your baseline.
- Build tax evasion typologies into CDD, EDD and transaction monitoring.
- Map your virtual asset exposure: customers paying in crypto, funds derived from crypto, or VASP counterparties.
- Brief your board and senior management on personal and corporate liability. Document it.
- Revisit record-retention rules and archive settings against the new trigger events.
- Check your Compliance Officer appointment and alternate meet your supervisor's approval and registration requirements.
- Retrain staff. Your training materials should reference the 2025 law, not the 2018 one.