UAE AML Framework Explained — FATF, CBUAE, and What It Means for Finance Professionals

If you work in finance in the UAE — or are planning to — understanding the AML regulatory landscape is no longer optional. The UAE went through a major transformation between 2022 and 2024, and the result is a significantly stricter, more enforcement-focused compliance environment. Here's what you need to know.

What is FATF and why did it matter so much?

The Financial Action Task Force (FATF) is the global standard-setter for anti-money laundering and counter-terrorism financing (AML/CFT). It has 39 members — countries and organisations — and sets the international rules that govern how financial systems prevent and detect financial crime.

When FATF places a country on its "grey list" (Jurisdictions Under Increased Monitoring), it signals to the world that the country's AML/CFT framework has significant gaps. This triggers:

• Increased scrutiny from correspondent banks
• Higher compliance costs for businesses operating in or through that country
• Reputational damage affecting foreign investment and financial sector confidence

The UAE was grey-listed in March 2022. It was removed in February 2024 — after demonstrating major reforms across legislation, enforcement, and cross-border cooperation.

The UAE's core AML laws

• Federal Decree-Law No. 20 of 2018 — The primary AML/CFT law. Sets out obligations for all UAE-based financial and non-financial businesses
• Cabinet Decision No. 10 of 2019 — The implementing regulations detailing specific requirements for customer due diligence, record keeping, and reporting
• Federal Decree-Law No. 26 of 2021 — Updated the AML law post-grey-listing to strengthen enforcement and penalties
• Targeted Financial Sanctions (TFS) — The UAE Executive Office for Control and Non-Proliferation (EOCN) maintains the UAE sanctions list; all firms must screen against it

Key UAE regulators

What changed after the grey-listing

The UAE's response to grey-listing was comprehensive:

• Beneficial ownership registry — Companies must now register ultimate beneficial owners (UBOs) with the Ministry of Economy
• Real estate sector — Real estate agents and developers now have full AML obligations (previously under-regulated)
• Crypto-asset regulation — The Virtual Assets Regulatory Authority (VARA) was established; crypto firms now face full AML obligations
• Enforcement — Significant increase in AML prosecutions, asset freezes, and penalties for non-compliant firms
• goAML — All reporting entities must file Suspicious Transaction Reports (STRs) via the UAE FIU's goAML platform

What this means for finance professionals in the UAE

If you work at a UAE-regulated firm, you are required to:

• Complete mandatory AML training (typically annually)
• Report suspicions to your MLRO — with no "tipping off" the customer
• Understand your firm's AML/CFT policies and apply them in your day-to-day work
• Conduct sanctions screening for any new customer or transaction

Failure to comply — even as a junior employee who ignored a red flag — can result in personal liability, not just firm-level penalties.

This article is for educational purposes only. For specific regulatory compliance obligations, consult a licensed compliance professional or legal adviser.

Building a career in AML in the UAE? See our full roadmap: AML & Financial Crime Career Path →