Life After the Grey List: What FATF Delisting Actually Changed for UAE Business

The UAE's removal from the FATF grey list in February 2024 and from the EU's high-risk third-country list in 2025 did not signal relaxation. It locked in a permanently elevated compliance architecture — and a 2026 mutual evaluation means enforcement will only tighten further.

From Grey-Listing to Delisting: What Actually Happened and Why It Matters

The FATF placed the UAE on its 'Jurisdictions under Increased Monitoring' list — commonly called the grey list — in March 2022. The listing reflected deficiencies across beneficial ownership transparency, real estate gatekeeping, designated non-financial business and profession (DNFBP) supervision, and the prosecution of money laundering as a standalone offence rather than purely as an adjunct to predicate crimes. The UAE accepted an action plan of over thirty remedial items and undertook a legislative and institutional overhaul that was, by any objective measure, one of the fastest compliance transformations a major financial centre has executed.

FATF removed the UAE from increased monitoring in February 2024, following an on-site visit confirming that the action plan items had been substantially addressed. The European Union followed in 2025, delisting the UAE from its Delegated Regulation on high-risk third countries under the Fourth and Fifth Anti-Money Laundering Directives. For UAE-based financial institutions dealing with European counterparties, this was material: EU-regulated banks were previously required to apply enhanced due diligence to all transactions touching UAE entities, creating friction in trade finance, correspondent banking, and private wealth flows.

However, the critical analytical point for executives and general counsel is this: delisting was a reward for structural change already embedded in law and in supervisory practice, not a licence to ease controls. The legislation enacted during the grey-list period — most importantly what became Federal Decree-Law 10/2025 — does not expire with the grey list. It is permanent, and it is more demanding than anything the UAE had on its statute books before 2022. Businesses that treated grey-list compliance as a temporary burden are now exposed to permanent statutory obligations they may never have formally adopted.

The practical context for 2025 and beyond is that the UAE's next FATF Mutual Evaluation is scheduled for 2026. That evaluation will assess not only the legal framework but the effectiveness of implementation — whether prosecutions are being brought, whether suspicious transaction reports are leading to convictions, and whether supervisory sanctions are proportionate. Governments and regulators typically intensify enforcement activity in the eighteen to twenty-four months preceding a mutual evaluation. Boards and compliance officers should treat 2025 and early 2026 as a period of heightened supervisory scrutiny, not reduced attention.

Federal Decree-Law 10/2025: The Architecture of the New AML Regime

Federal Decree-Law 10/2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, which entered into force on 14 October 2025, is the cornerstone of the post-grey-list legal framework. It expressly repeals Federal Decree-Law 20/2018, which had itself replaced the original 2002 legislation. Cabinet Resolution 134/2025 provides the Executive Regulations and entered into force on 14 December 2025. Together they represent a complete re-codification, not a set of amendments, and every compliance programme built on FDL 20/2018 requires comprehensive review against the new text.

The most significant substantive expansions are as follows. First, proliferation financing — the financing of the manufacture, acquisition, development, export, or transport of weapons capable of mass destruction — is now a standalone predicate offence for money laundering purposes, aligning UAE law with FATF Recommendation 1 as revised. Second, tax evasion is expressly listed as a predicate offence. This has direct consequences for corporate tax planning structures: arrangements that produce an underpayment of corporate tax under Federal Decree-Law 47/2022 and are accompanied by concealment could now generate criminal AML exposure, not merely administrative penalties under Cabinet Decision 129/2025. Legal advisers structuring tax positions must consider this intersection explicitly.

Third, and of particular significance for financial institutions and DNFBPs, FDL 10/2025 introduces explicit personal criminal liability for managers and directors who knew, or ought reasonably to have known, that their organisation was being used to launder proceeds, finance terrorism, or finance proliferation, and who failed to take preventive action. This moves beyond the vicarious liability concepts that existed under the 2018 law and creates a direct duty on named individuals occupying compliance, risk, or executive functions. Fourth, the maximum administrative fine for AML/CFT violations has been raised to AED 100 million, an order of magnitude increase from prior ceilings. The Central Bank's own administrative fine ceiling under CBUAE Law No. 6/2025 stands at AED 1 billion for supervised financial institutions, meaning that for banks and exchange houses the combined exposure is potentially existential. Fifth, FDL 10/2025 removes any statute of limitations for money laundering offences. There is no temporal safe harbour: transactions from any period remain actionable.

Cabinet Resolution 134/2025 operationalises these provisions through detailed requirements on customer due diligence re-performance cycles, enhanced due diligence triggers, record retention (ten years, with a mechanism for extension on regulatory request), and suspicious transaction reporting timelines. Compliance teams should note that the Travel Rule threshold for virtual asset transfers under Cabinet Resolution 134/2025 is set at AED 3,500, bringing a wide range of retail-level crypto transactions within mandatory originator and beneficiary data requirements — a significant change from prior practice.

Beneficial Ownership Transparency: Cabinet Decision 109/2023 in Practice

Cabinet Decision 109/2023 governs the UAE's beneficial ownership register regime, establishing a 25% ownership or control threshold for identifying and disclosing ultimate beneficial owners. The Decision requires all UAE mainland companies (with specified exemptions for regulated entities filing equivalent information with their supervisory authority) to maintain an internal beneficial ownership register, file that register with the relevant licensing authority, and update it within fifteen days of any change. The fifteen-day obligation is frequently missed in practice, particularly on corporate restructurings, share transfers in free zone entities, or changes in control arising from trust arrangements.

From an AML enforcement perspective, a failure to maintain an accurate beneficial ownership register is not merely an administrative infraction. Under FDL 10/2025, a financial institution or DNFBP that onboards a customer without verifying beneficial ownership as required has, by definition, failed its customer due diligence obligations. That failure can constitute an AML offence independent of whether underlying funds were in fact illicit. For HNW individuals and family offices using multi-layered holding structures — common in the UAE real estate, private equity, and family succession planning contexts — the obligation to map and register beneficial ownership accurately through every tier of the structure is absolute. The 25% threshold is a minimum disclosure floor: where control is exercised through other means (shareholder agreements, power of attorney, nominee arrangements), those too fall within the beneficial ownership definition.

The enforcement posture of the Ministry of Economy and free zone authorities on beneficial ownership compliance has materially hardened since 2022. Inspections of DNFBP registers are now routine in sectors identified as high-risk in the National Risk Assessment, including real estate brokers, legal consultancies handling client funds, corporate service providers, and gold and precious metals dealers. Boards of directors of companies in these sectors should ensure that internal beneficial ownership registers are not only filed but are demonstrably accurate and reconciled against the company's constitutional documents, any trust deeds, and any shareholder agreements on at least an annual basis.

Capital Markets, Crypto, and Market Integrity: The 2025 Legislative Overhaul

The grey-list period also produced a fundamental restructuring of capital markets regulation. Federal Decree-Law 32/2025 establishes the Capital Markets Authority (CMA) to replace the Securities and Commodities Authority (SCA) with effect from 1 January 2026, repealing Federal Law 4/2000. Simultaneously, Federal Decree-Law 33/2025 codifies insider dealing, market manipulation, and related financial crime offences as standalone criminal provisions with penalties reaching AED 200 million. This is a deliberate signal: market abuse in UAE-regulated capital markets is now treated with a severity comparable to leading international jurisdictions.

The codification in FDL 33/2025 closes a significant gap that FATF evaluators had identified — namely that prior market abuse prosecution relied on a patchwork of SCA regulations and general penal code provisions rather than a single clear statutory framework. Under the new regime, individuals who trade on material non-public information, or who engage in artificial price manipulation in UAE-regulated securities, face criminal prosecution and fines that dwarf those previously available. For listed company executives, investment managers, and their legal and financial advisers, this requires a formal review of information barrier and trading window policies against the specific definitions and safe harbours in FDL 33/2025.

In the virtual asset space, VARA Rulebooks 2.0 (issued May 2025) and the VARA Issuance Rulebook (June 2025) govern the full spectrum of virtual asset service provider activity in Dubai (excluding DIFC). The Travel Rule requirements under Cabinet Resolution 134/2025, with their AED 3,500 threshold, apply to all licensed VASPs in the UAE mainland and ADGM. In DIFC, the DIFC Digital Assets Law No. 2/2024 establishes that crypto-assets constitute property capable of being owned, transferred, and made subject to proprietary remedies — a foundation that underpins both commercial certainty and enforcement. Cross-border asset tracing in crypto disputes now benefits from the DIFC Court Law No. 2/2025, under which worldwide freezing orders can be granted in support of foreign proceedings without any requirement to establish a local-asset nexus, following the principle affirmed in ADGM A17 v B17 [2025].

Criminal Procedure and Prosecution Mechanics: What Executives Need to Understand

The procedural framework for AML and white-collar prosecutions in the UAE is governed by Federal Decree-Law 38/2022 on Criminal Procedure, which entered into force on 1 March 2023 (as amended by Federal Decree-Law 45/2023). This replaces the prior Federal Law 35/1992. Practitioners and clients should be alert to the common error of citing Federal Law 35/2022 (the Evidence Law, a separate instrument) in this context. FDL 38/2022 introduces provisions on electronic evidence admissibility, digital search and seizure warrants, and remote examination of witnesses that are directly relevant to financial crime investigations in which digital records, email chains, and transaction data are typically the primary evidence.

Under FDL 38/2022, public prosecutors have broad powers to freeze assets at the investigative stage without prior judicial authorisation in urgent circumstances, subject to prompt judicial ratification. For executives under investigation, this means that bank accounts, real estate, and shareholdings can be frozen before charges are formally filed and before any opportunity to contest the measure. The practical imperative is to engage experienced criminal defence counsel at the first sign of a regulatory inquiry, not once charges are laid. The right to legal representation attaches at the point of detention or formal questioning, and statements made in early informal interactions with investigators have been relied upon in prosecutions under the current procedural framework.

Extradition and mutual legal assistance are governed by Federal Law 39/2006 as amended by Federal Decree-Law 38/2023. The 2023 amendments streamlined MLA procedures and expanded the categories of information that UAE authorities can share with foreign counterparts without requiring a formal treaty, provided reciprocity is established. The UAE maintains bilateral treaties with over forty jurisdictions and is party to the Arab League and GCC extradition frameworks. For individuals who have structured their affairs across multiple jurisdictions on the assumption that the UAE's MLA network is limited, the post-grey-list expansion of that network — both legally and operationally through the Financial Intelligence Unit — represents a material change in the enforcement landscape.

The interaction between the Federal Decree-Law 31/2021 Penal Code (as amended by FDL 36/2022) and sector-specific AML offences in FDL 10/2025 is important for sentencing analysis. The Penal Code's provisions on fraud, forgery, and breach of trust provide alternative or concurrent charging routes for prosecutors, and sentences under multiple counts can be cumulative in certain circumstances. Corporate defendants — UAE entities rather than individuals — face dissolution and asset confiscation as additional sanctions under FDL 10/2025 where the entity is found to have been used as a vehicle for money laundering.

DNFBP Obligations: Real Estate, Legal, and Financial Intermediaries

Designated non-financial businesses and professions bear obligations under FDL 10/2025 and Cabinet Resolution 134/2025 that are functionally equivalent in many respects to those imposed on financial institutions, though supervision is distributed across sector-specific regulators rather than the Central Bank. Real estate brokers and developers are supervised by the Real Estate Regulatory Agency (RERA) and its equivalents in free zones. Lawyers and legal consultancies handling client funds, company formation, or real estate transactions fall under the supervision of the Ministry of Justice and relevant bar councils. Gold, diamond, and precious metals dealers are supervised by the Ministry of Economy. Audit firms are supervised by the relevant professional body and, for regulated entity audits, the sector regulator.

The obligations that DNFBPs most frequently breach in practice are: failure to conduct and document a written business-wide risk assessment; failure to perform customer due diligence on occasional transactions above the prescribed thresholds; failure to file suspicious transaction reports (STRs) with the UAE Financial Intelligence Unit (UAEFIU) through the goAML platform within the required timeframe; and failure to apply enhanced due diligence to politically exposed persons (PEPs), their family members, and close associates. Under FDL 10/2025, the obligation to report extends to attempted transactions, not only completed ones, and to situations where a business relationship is terminated because of suspicion — a provision that is frequently overlooked in practice.

Law firms and legal consultancies occupy a structurally sensitive position because of legal professional privilege. FDL 10/2025, consistent with the FATF standards, carves out from the STR obligation information received in the course of ascertaining the legal position of a client or in performing a client's defence in legal proceedings. However, the carve-out does not extend to transactional work, corporate structuring, or the handling of client funds — the areas in which money laundering most commonly occurs in a legal services context. Firms that have not drawn a clear internal line between privileged advisory work and non-privileged transactional work face genuine ambiguity about when the reporting obligation is engaged, and should address this in their compliance policies as a matter of priority.

Strategic Implications: What Boards and GCs Should Do Now

The combination of the new legislative framework, the approaching 2026 mutual evaluation, and the supervisory intensity that accompanies it creates a defined window in which organisations need to have their compliance architecture demonstrably in order. The standard being applied by UAE supervisors — and that will be assessed by FATF evaluators — is effectiveness, not formal compliance. Having a policy document is insufficient if it has not been operationalised, tested, and evidenced through training records, audit findings, and STR activity proportionate to the organisation's exposure.

For financial institutions operating under CBUAE Law No. 6/2025, the AED 1 billion administrative fine ceiling is not theoretical. CBUAE enforcement actions since 2022 have included substantial fines against exchange houses and banks for deficiencies in transaction monitoring and correspondent banking due diligence. The lesson from comparable jurisdictions is that supervisory fines in the post-evaluation period tend to increase as authorities demonstrate to FATF that the enforcement framework is operational. Boards should commission an independent gap analysis against FDL 10/2025 and Cabinet Resolution 134/2025 before year-end 2025 — not as a discretionary best practice exercise but as a governance imperative given personal director liability under the new law.

For HNW individuals, family offices, and corporate groups with complex ownership structures, the intersection of corporate tax obligations under Federal Decree-Law 47/2022 and AML predicate offence status for tax evasion requires immediate attention. Where a group has taken aggressive tax positions that are not supported by defensible legal analysis, voluntary disclosure under Cabinet Decision 129/2025 — which attracts a penalty of 1–4% of the underpaid tax — is substantially preferable to audit discovery at 15%, and both are substantially preferable to a subsequent AML investigation premised on tax evasion as a predicate. The window for voluntary disclosure before a formal audit commences is the operative variable, and legal counsel should be involved before any approach to the Federal Tax Authority.

For transactions involving insolvency, the Federal Decree-Law 51/2023 Bankruptcy Law (in force 1 May 2024) creates a dedicated Bankruptcy Court and codifies fraudulent and negligent bankruptcy as criminal offences. Directors of companies approaching financial distress must understand that certain pre-insolvency transactions — preferential payments to connected parties, asset transfers at undervalue, incurring debt with no reasonable prospect of repayment — can constitute criminal acts under this framework, not merely voidable transactions in civil proceedings. Early engagement of restructuring and criminal counsel in parallel is advisable when insolvency risk materialises.

Practical checklist

• Re-baseline your AML/CFT programme against FDL 10/2025 and Cabinet Resolution 134/2025 before year-end 2025.
• Audit beneficial ownership registers under Cabinet Decision 109/2023 for accuracy and timely filing at every corporate tier.
• Map all tax positions under FDL 47/2022 against the AML predicate offence risk introduced by FDL 10/2025.
• Review manager and director liability exposure under FDL 10/2025 and update D&O insurance coverage accordingly.
• Ensure goAML STR reporting procedures cover attempted transactions and terminated relationships, not only completed transactions.
• Update virtual asset compliance policies to reflect the AED 3,500 Travel Rule threshold under Cabinet Resolution 134/2025.
• Commission a pre-mutual-evaluation readiness review against FATF effectiveness indicators before Q1 2026.
• Brief boards formally on FDL 33/2025 market abuse penalties and review information barrier and trading window policies.

Frequently asked questions

Related guides

• The New UAE AML Law Explained: Federal Decree-Law 10 of 2025
• Beneficial Ownership Compliance Under Cabinet Decision 109/2023
• goAML and STR Filing: A Reporting-Entity Playbook
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.