The AML Regulations in Force in the UAE, Instrument by Instrument

People search for "the AML regulations" as though there were one document. There are four, and they do different jobs. One is a Decree-Law that creates the offences and the enforcement powers. One is the executive regulation that turns those powers into duties you can perform. One is a separate 2020 Cabinet Decision carrying targeted financial sanctions, the piece most published summaries omit. And one is the 2024 penalty schedule that puts a number on each failure.

Everything else you will be sent — ministry guidelines, supervisory circulars, portal manuals — is guidance under those four, and where guidance and instrument diverge the instrument governs. That is not theoretical here: the Ministry's own goAML landing page still founded the obligation on two repealed instruments when it was read on 17 August 2026, while the Ministry's own DNFBP Guidelines of March 2026, on the same site, cite the current pair.

The rewrite happened in two steps. Federal Decree-Law No. 10 of 2025 was issued on 30 September 2025 and, under its Article 42, entered into force two weeks after publication in the Official Gazette. Cabinet Decision No. 134 of 2025 followed on 29 October 2025 as the executive regulation, and its Article 70 repealed Cabinet Decision No. 10 of 2019. Both repeals are express and by name. The practical consequence is that a large amount of UAE AML material published before late 2025 — manuals, templates and training decks still being sold — cites instruments that no longer exist.

Article 17(1) of Federal Decree-Law No. 10 of 2025 names four regulated populations: financial institutions, designated non-financial businesses and professions, virtual asset service providers, and non-profit organisations. Most accounting, audit, corporate services and real estate businesses reading this page fall into the second.

The DNFBP test in Article 3 of Cabinet Decision No. 134 of 2025 turns on the activity carried out, not on the words printed on the trade licence. That distinction matters in both directions: a firm whose licence says "management consultancy" can be a DNFBP because of what it actually does, and a firm with an accounting licence is caught by reference to the listed activity rather than by profession. Article 3(4) names independent accountants; independent statutory auditors appear separately, in the privilege carve-outs at Articles 18(2) and 19(2). The Ministry's own online self-check is broader than the Decision and returns a positive on an auditing or accounting firm categorically, so do not treat the two as the same test.

Federal Decree-Law No. 10 of 2025 does not list the regulators by name. It defines the Supervisory Authority functionally, as the federal and local authorities entrusted by legislation with supervising financial institutions, DNFBPs, virtual asset service providers and non-profit organisations, or — where no specific supervisor is designated — the competent authority responsible for approving the activity or profession. Your AML supervisor follows your licence.

For the sectors this site serves, the allocation is settled. The Ministry of Economy and Tourism supervises independent accountants and auditors, trust and corporate service providers, dealers in precious metals and stones, and real estate agents and brokers, in the mainland and the commercial free zones. The Ministry of Justice supervises lawyers, notaries and other independent legal professionals. Firms licensed in the Dubai International Financial Centre answer to the Dubai Financial Services Authority, and those in Abu Dhabi Global Market to the Financial Services Regulatory Authority.

This decides more than correspondence. Cabinet Resolution No. 71 of 2024 is the fine schedule for entities supervised by the two Ministries; a DIFC or ADGM firm is fined under its own regulator's regime instead. It also decides which supervisory body you select when you register, and selecting the wrong one is a rejection.

Targeted financial sanctions are not in Federal Decree-Law No. 10 of 2025 or in Cabinet Decision No. 134 of 2025. They are in Cabinet Decision No. 74 of 2020, whose Article 21 sets out the DNFBP duty set: register on the Executive Office's website to receive listing alerts, screen the customer database, transaction parties, potential clients, beneficial owners and related persons on an ongoing basis, freeze without delay and without prior notice on a match, implement de-listings without delay, and report. A programme that does customer due diligence beautifully and never screens against the lists is not compliant; it is missing an instrument.

The operational detail sits with the Executive Office for Control and Non-Proliferation rather than in the Decision. Read there on 17 August 2026: the two lists are the UAE Local Terrorist List, issued by the Cabinet under Security Council Resolution 1373, and the UN Consolidated List; alerts come through the Notification Alert System; freezing is required without delay, within 24 hours; and a match is reported as a partial or confirmed name match report through goAML within five business days of the measure, while a false positive must be documented but not reported.

The duties are distributed across the two 2025 instruments in a way that is easy to lose. This map is deliberately a map: each line is a pointer to the article, not a summary of how to perform it. The performance detail — how to build a business-wide risk assessment, what enhanced due diligence looks like for a politically exposed person, how to structure the independent audit function — is a separate subject.

There are two layers, and confusing them produces most of the wrong numbers online. The statutory layer is Article 17(1) of Federal Decree-Law No. 10 of 2025: the Supervisory Authority may issue a warning, impose an administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation, bar the violator from the sector, restrict or suspend responsible officers, suspend the activity, or revoke the licence. The schedule layer is the list annexed to Cabinet Resolution No. 71 of 2024, which allocates a band to each specific failure.

The figures below were read line by line in the English text the Ministry publishes, and that Resolution was still listed as current on the Ministry's legislation index when the index was checked on 21 August 2026. Two caveats belong on the record: the annex cross-refers to articles of the repealed Cabinet Decision No. 10 of 2019, and the Resolution was itself made under the repealed 2018 law, surviving on Article 41(3). A replacement schedule aligned to the 2025 instruments would not be a surprise, so re-check the index before relying on a band.

The only dated registration deadline the Ministry of Economy and Tourism publishes for DNFBPs is historic. Its AML circular index labels Circular No. 2 of 2021 as extending the deadline for DNFBPs to register in goAML until 30 April 2021, alongside the earlier Circular No. 5 of 2021. No later goAML registration deadline appears anywhere on that index; the 2024, 2025 and 2026 circulars are high-risk-country, due-diligence and sanctions updates.

So there is no recurring deadline to diarise, and passing 2021 did not extinguish the obligation — a business that becomes a DNFBP today must register now, and the fine at item 23 attaches to the failure, not to the lateness. What we will not tell you is how many days a newly licensed company has: no instrument states a number, neither Cabinet Decision No. 134 of 2025 nor the March 2026 DNFBP Guidelines sets a window, and the competitor pages quoting one are inventing it. Because Article 18 reporting is immediate, registration has to precede your first reportable situation.