AML/CFT compliance in the UAE requires regulated crypto and fintech businesses to identify and assess financial crime risks, conduct customer due diligence, monitor transactions, report suspicious activities, and maintain effective internal controls.
These obligations arise under the UAE's federal anti-money laundering framework and applicable sector-specific regulatory requirements.
For virtual asset service providers (VASPs), payment companies, digital financial platforms, and other regulated fintech businesses, compliance must be embedded into the business model rather than treated as an administrative requirement.
This guide explains the anti-money laundering requirements in the UAE, including customer verification, transaction monitoring, suspicious transaction reporting, governance, and ongoing regulatory responsibilities.
Understanding the UAE AML/CFT Regulatory Framework
The UAE has established a comprehensive legal framework to combat money laundering, terrorist financing, and proliferation financing.
Its AML/CFT regime applies to relevant financial institutions, designated non-financial businesses and professions, and virtual asset businesses falling within the applicable regulatory scope.
The framework combines federal legislation with requirements imposed by sector-specific regulators.
For crypto and fintech businesses, the relevant supervisory authority depends on the company's jurisdiction and licensed activities.
The principal regulators include:
- Central Bank of the UAE (CBUAE): Supervises banks, payment service providers, and other financial institutions within its regulatory perimeter.
- Virtual Assets Regulatory Authority (VARA): Regulates virtual asset activities in Dubai, excluding DIFC.
- Financial Services Regulatory Authority (FSRA): Supervises regulated financial services and virtual asset activities in ADGM.
- Dubai Financial Services Authority (DFSA): Regulates financial services within DIFC.
- Securities and Commodities Authority (SCA): Exercises responsibilities within its applicable federal securities and virtual asset regulatory perimeter.
Businesses must identify both their federal AML/CFT obligations and the specific rulebooks governing their activities.
UAE AML/CFT Legislation: Important 2025–2026 Developments
The UAE introduced significant changes to its federal AML/CFT framework in 2025.
The principal legislation now includes:
- Federal Decree-Law No. 10 of 2025, concerning anti-money laundering and combating the financing of terrorism and proliferation financing, effective from 14 October 2025.
- Cabinet Resolution No. 134 of 2025, containing the implementing regulations, effective from 14 December 2025.
These instruments replaced Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, respectively.
The revised framework reinforces risk-based supervision, customer due diligence, internal controls, reporting obligations, and measures addressing emerging technologies.
The DFSA also introduced amendments to its AML and Glossary Modules, effective 2 March 2026, to align its framework with the updated federal legislation.
For businesses reviewing existing compliance policies, references to superseded legislation should be updated and operational procedures reassessed against the current requirements.
Essential AML/CFT Compliance Requirements for Crypto and Fintech Businesses
Enterprise-Wide Risk Assessment
An enterprise-wide risk assessment (EWRA) provides the foundation of an effective AML/CFT compliance programme.
Businesses must identify the money laundering, terrorist financing, and proliferation financing risks associated with their activities.
The assessment should consider customer profiles, geographical exposure, products and services, transaction channels, and emerging technologies.
For example, a crypto exchange facilitating international transactions may face different risks from a fintech company providing domestic payment services.
The business should assess inherent risks, evaluate the effectiveness of existing controls, and determine its residual risk exposure.
Risk assessments must be reviewed periodically and updated when material changes occur.
Customer Due Diligence and KYC
Customer due diligence (CDD) requires regulated businesses to identify customers and verify their identities using reliable, independent information.
For corporate customers, businesses must also identify relevant beneficial owners and understand the ownership and control structure.
The UAE's implementing regulations require CDD when establishing business relationships, where suspicion arises, and where previously obtained identification information becomes unreliable.
For occasional transactions, specific thresholds apply. For example, the federal implementing regulations establish an AED 3,500 CDD threshold for certain occasional transactions conducted by VASPs.
However, the threshold does not exempt suspicious transactions from scrutiny or reporting, regardless of value.
Enhanced Due Diligence for High-Risk Customers
Enhanced due diligence (EDD) applies where customers or transactions present elevated financial crime risks.
Higher-risk relationships may involve politically exposed persons, complex ownership structures, higher-risk jurisdictions, or transactions lacking an apparent economic purpose.
EDD measures may include obtaining additional identification information, verifying source of funds or wealth, securing senior management approval where required, and applying enhanced transaction monitoring.
Businesses should document the reasons for assigning higher risk ratings and the measures adopted to mitigate those risks.
Transaction Monitoring and Blockchain Analytics
Transaction monitoring is particularly important for crypto businesses because virtual assets can move rapidly across jurisdictions and blockchain networks.
VASPs should implement monitoring systems capable of identifying unusual or potentially suspicious transaction patterns.
Relevant indicators may include transactions involving sanctioned wallet addresses, exposure to illicit marketplaces, unusual movement of assets between wallets, or transaction activity inconsistent with a customer's known profile.
Blockchain analytics tools can assist with wallet screening, transaction tracing, and identifying exposure to high-risk services.
However, automated alerts should be supported by documented investigation procedures and appropriate human review.
FATF Travel Rule Compliance
The FATF Travel Rule requires relevant virtual asset service providers to obtain, hold, and transmit specified originator and beneficiary information in connection with qualifying virtual asset transfers.
VARA's Compliance and Risk Management Rulebook includes specific Travel Rule requirements for regulated VASPs.
Businesses must establish procedures for identifying counterparties, exchanging required information, protecting personal data, and handling transfers where information is missing or incomplete.
Travel Rule compliance should form part of the organization's broader AML/CFT framework rather than operate as an isolated technical process.
UAE Suspicious Transaction Reporting Requirements
The UAE suspicious transaction reporting requirements obligate relevant regulated entities to report suspected financial crime to the UAE Financial Intelligence Unit (FIU).
Businesses must submit Suspicious Transaction Reports (STRs) or Suspicious Activity Reports (SARs), as appropriate, through the UAE's goAML reporting system.
A report may be required where there is suspicion or reasonable grounds to suspect money laundering, terrorist financing, proliferation financing, or related criminal activity.
There is no minimum monetary threshold for suspicious transaction reporting.
Importantly, attempted transactions may also trigger reporting obligations.
Role of the MLRO
The Money Laundering Reporting Officer (MLRO), or the designated AML/CFT compliance officer under the applicable framework, is responsible for overseeing suspicious activity investigations and reporting arrangements.
The officer should have sufficient authority, access to information, and independence to perform the role effectively.
Internal reporting procedures must allow employees to escalate suspicious activities promptly.
Where reporting criteria are met, the designated officer must ensure timely submission to the FIU.
Confidentiality and Tipping-Off Restrictions
Businesses must maintain confidentiality concerning suspicious transaction reports and related investigations.
Employees must not improperly disclose information that could alert a customer to a report or investigation.
Policies should address access restrictions, internal communications, and secure handling of reporting information.
Sanctions Screening and Proliferation Financing Controls
Crypto and fintech businesses must comply with applicable targeted financial sanctions requirements.
Relevant obligations include screening customers, beneficial owners, and transactions against applicable sanctions lists and implementing required freezing or reporting measures.
Sanctions compliance must address both terrorism financing and proliferation financing risks.
Businesses should establish procedures for handling potential matches, investigating alerts, and escalating confirmed matches in accordance with applicable legal requirements.
AML Compliance for Fintech Companies: Governance and Internal Controls
Effective AML compliance for fintech companies requires clear accountability across senior management, compliance teams, and operational personnel.
The federal implementing regulations require regulated entities to maintain risk-proportionate internal policies and controls approved by senior management.
These include customer due diligence procedures, suspicious transaction reporting processes, compliance management arrangements, and employee screening.
Businesses should also maintain appropriate staff training, independent compliance testing, and internal audit arrangements where required.
Outsourcing KYC, sanctions screening, or transaction monitoring to technology vendors does not automatically transfer the regulated entity's legal responsibilities to those providers.
Management must retain appropriate oversight of outsourced functions.
Recordkeeping and Regulatory Inspections
Under Cabinet Resolution No. 134 of 2025, relevant financial institutions, DNFBPs, and VASPs must generally retain prescribed transaction and customer-related records for at least five years from the relevant transaction completion or termination of the business relationship.
Sector-specific requirements may impose additional or longer retention obligations.
Records should be sufficiently complete to reconstruct transactions, support regulatory inspections, and demonstrate compliance with applicable AML/CFT requirements.
Consequences of AML/CFT Non-Compliance in the UAE
Failure to comply with AML/CFT obligations can expose businesses to substantial regulatory and legal consequences.
Depending on the violation and applicable legislation, consequences may include administrative penalties, restrictions on business activities, licence suspension or revocation, and criminal liability.
Deficiencies involving customer due diligence, suspicious transaction reporting, sanctions compliance, or internal controls may also damage banking relationships and commercial credibility.
For regulated crypto and fintech businesses, effective AML/CFT compliance is therefore essential to maintaining operational continuity and regulatory confidence.
AML/CFT Compliance Checklist for UAE Crypto and Fintech Businesses
Businesses should periodically assess whether they have:
- Updated their AML/CFT policies to reflect the current federal legislation and sector-specific rules.
- Completed and documented an enterprise-wide risk assessment.
- Implemented risk-based KYC, CDD, and EDD procedures.
- Established sanctions screening and transaction monitoring systems.
- Appointed appropriately qualified compliance personnel and an MLRO where required.
- Implemented Travel Rule controls where applicable.
- Registered for goAML reporting and established STR/SAR escalation procedures.
- Conducted employee training and compliance testing.
- Established appropriate recordkeeping and regulatory reporting arrangements.
The precise compliance requirements depend on the entity's regulatory classification and authorised activities.
Frequently Asked Questions
What is the main AML law in the UAE?
Federal Decree-Law No. 10 of 2025 is the principal federal AML/CFT legislation, supported by Cabinet Resolution No. 134 of 2025 and applicable sector-specific regulatory requirements.
Do crypto companies need an MLRO in the UAE?
Regulated VASPs generally require an appropriately qualified MLRO or designated AML/CFT officer in accordance with the applicable regulatory framework. VARA, for example, expressly addresses MLRO appointment and duties in its Compliance and Risk Management Rulebook.
What is the minimum amount for reporting suspicious transactions?
There is no minimum monetary threshold for suspicious transaction reporting. A report may be required whenever the applicable suspicion or reasonable-grounds test is met.
Are fintech startups subject to AML/CFT requirements?
Fintech companies conducting regulated financial activities may be subject to AML/CFT obligations. The requirements depend on their business models, activities, and supervisory authorities.
