6+
UAE AML regulatory authorities
2018
Federal AML Law enacted
goAML
UAE FIU reporting platform
5 yrs
Minimum AML record retention
The UAE has one of the most comprehensive AML/CFT frameworks in the MENA region — but it is also one of the most layered. The Federal AML Law sets the baseline. Every regulator then adds its own sector-specific AML standards on top: the CBUAE for banks and exchange houses, the DFSA for DIFC firms, the ADGM FSRA for Abu Dhabi Global Market entities, and VARA for virtual asset service providers. Lexara indexes the complete UAE AML regulatory corpus across all these sources, enabling compliance officers to search across the full framework — not just one authority's rules — and get AI-cited answers grounded in the actual regulatory text.
The UAE AML framework operates at two levels. The Federal AML Law sets the statutory baseline — offences, obligations, and the FIU. Each regulator then issues sector-specific AML standards with detailed operational requirements for their supervised population.
Federal Decree-Law No. 20 of 2018 — the primary AML/CFT legislation
Cabinet Decision No. 10 of 2019 — detailed AML/CFT requirements by entity type
CBUAE AML Standards — for banks, exchange houses, finance companies, and insurers
DFSA AML Module — applies to all DFSA-authorised firms in the DIFC
ADGM FSRA AML Rulebook — for ADGM-licensed financial services firms
VARA Compliance and Risk Management Regulations — for Dubai VASPs
MOHRE and DNFBP-specific guidance from sector supervisors
Regardless of sector, regulated entities in the UAE share a common set of AML obligations derived from the Federal Law and supplemented by sector-specific standards. These form the baseline compliance programme every regulated firm must maintain.
Appoint a Money Laundering Reporting Officer (MLRO) — senior, knowledgeable, with direct access to the board
Conduct a business-wide AML risk assessment — documented, reviewed annually
Implement Customer Due Diligence (CDD) — identity verification, beneficial owner identification, purpose of relationship
Apply Enhanced Due Diligence (EDD) — mandatory for PEPs, high-risk countries, and complex/unusual transactions
File Suspicious Transaction Reports (STRs) via goAML — within 35 business days (or immediately for terrorism financing)
Screen all customers and transactions against UAE local sanctions list and UN consolidated list
Maintain all AML records for a minimum of five years
The UAE maintains a domestic Local Terrorist List (LTL) issued by the Executive Office of the Committee for Goods and Materials Subjected to Import and Export Control, in addition to implementing UN Security Council consolidated list obligations. Regulated firms must screen against both lists — not just OFAC or EU sanctions — and report any matches.
UAE Local Terrorist List (LTL) — issued and updated by the UAE Cabinet
UN Security Council Consolidated List — 1267/1989 and 1988 sanctions regimes
Obligation to freeze assets and report any match to the relevant authority immediately
No de minimis threshold — any match must be investigated and reported
Proliferation financing sanctions: OFAC SDN List and UN DPRK/Iran sanctions
PEP screening: domestic and foreign PEPs, their family members and close associates
How Lexara works
Laws Browser
Browse the full article corpus for any UAE authority. Filter by law, chapter, or topic tag.
Full-text search
Keyword and semantic search across 6,760+ indexed articles from 10+ UAE regulators.
AI Explorer
Ask a regulatory question in plain English. Get a cited answer grounded in the actual statutory text.
Trigger layer
Structured deadline data per article — event type, offset, recurrence. No manual calendar parsing.
What is the main UAE anti-money laundering law?
Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering, as amended, is the primary UAE AML legislation. It is supplemented by Cabinet Decision No. 10 of 2019 and sector-specific AML standards from CBUAE, DFSA, ADGM FSRA, and VARA.
Who is subject to UAE AML regulations?
Financial institutions (banks, exchange houses, investment firms, insurers) and Designated Non-Financial Businesses and Professions (DNFBPs) — real estate agents, precious metals dealers, lawyers, accountants, and company service providers. Virtual asset service providers are also covered under VARA.
What are the key AML obligations for UAE regulated firms?
Appoint an MLRO; conduct a business-wide risk assessment; implement CDD procedures; file STRs with UAE FIU via goAML; conduct ongoing monitoring; screen against UAE local and UN sanctions lists; apply EDD for PEPs and high-risk customers; retain records for 5+ years.
What is the STR filing deadline in the UAE?
Suspicious Transaction Reports must be filed with the UAE Financial Intelligence Unit via the goAML platform within 35 business days of identifying the suspicion. Reports related to terrorist financing must be filed immediately (same day or the next business day).
Are DNFBPs subject to the same AML requirements as banks?
DNFBPs face the same core obligations under the Federal AML Law — risk assessment, CDD, EDD for PEPs, STR filing, record keeping — but the sector-level standards and supervision arrangements differ. Real estate agents, dealers in precious metals, and company service providers all have specific threshold and trigger obligations under Cabinet Decision No. 10 of 2019.