Trade-Based Money Laundering: Red Flags in Gold, Commodities and Free-Zone Trade

Trade-based money laundering remains among the most technically complex financial crime risks facing UAE banks, gold traders and free-zone operators. Federal Decree-Law 10/2025 — in force 14 October 2025 — materially raises penalties, extends predicate offences and imposes personal manager liability, demanding a fundamental reassessment of existing compliance frameworks.

The UAE Legal Framework for TBML: FDL 10/2025 and Cabinet Resolution 134/2025

The primary AML statute is Federal Decree-Law 10/2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Illegal Organisations and Combating the Financing of Proliferation of Weapons of Mass Destruction, which entered into force on 14 October 2025 and repealed the previous Federal Decree-Law 20/2018. Its executive regulations are set out in Cabinet Resolution 134/2025, effective 14 December 2025. These instruments govern every reporting entity operating in or from the UAE, including banks, money service businesses, DNFBPs and virtual asset service providers.

Three structural changes in FDL 10/2025 are directly relevant to trade-based money laundering (TBML). First, tax evasion and proliferation financing are now explicit predicate offences. A gold trader or commodity house that manipulates invoices to evade corporate tax under Federal Decree-Law 47/2022 thereby simultaneously generates a TBML predicate, exposing both the underlying tax offence and a distinct money-laundering charge under FDL 10/2025. Second, administrative fines reach AED 100 million for institutional failures, with no cap explicitly tied to transaction value — meaning a single under-invoiced shipment cycle can anchor a penalty that dwarfs the commercial margin of the transaction. Third, FDL 10/2025 eliminates any effective statute of limitations for money laundering offences, a change of profound significance for free-zone entities whose records may have been managed informally for years.

Personal liability for senior management is codified explicitly: where a legal person commits a TBML offence, directors, CEOs and compliance officers who knew or ought reasonably to have known of the conduct and failed to prevent it face individual criminal prosecution under the Federal Penal Code, Federal Decree-Law 31/2021 (as amended by FDL 36/2022), which provides custodial sentences for money laundering. The 'ought to have known' standard is objective — a board cannot rely on a compliance function it has under-resourced or a due-diligence process it has not validated. Cabinet Resolution 134/2025 requires entities to document the basis on which each material customer relationship and each high-risk transaction was assessed; absence of contemporaneous documentation will be treated as evidence of wilful blindness.

The CBUAE, exercising powers under CBUAE Law No. 6/2025, can impose administrative fines of up to AED 1 billion on licensed financial institutions for systemic AML failures — a ceiling that dwarfs the FDL 10/2025 figure and reflects the Central Bank's status as the primary prudential regulator for banks and exchange houses involved in trade finance and commodity payments. Enforcement coordination between the CBUAE, the Financial Intelligence Unit (FIU/goAML platform) and the Public Prosecution is now explicitly structured under FDL 10/2025, with mandatory information-sharing channels that remove the practical silos that historically slowed TBML investigations.

How TBML Works in UAE Trade: Over/Under-Invoicing, Phantom Shipments and Multiple Invoicing

Trade-based money laundering is the process of disguising the proceeds of crime by manipulating international trade transactions. The UAE — as a global re-export hub with over forty free zones, deep gold and diamond trading markets, and some of the world's highest commodity transit volumes — presents a structurally attractive environment for each of the core TBML typologies identified in the FIU's published guidance and mirrored in Cabinet Resolution 134/2025's risk-classification annexes.

Over-invoicing occurs where the exporter invoices goods at a price materially above fair market value. The importer pays the inflated sum from a jurisdiction where funds are clean or untraceable; the exporter receives 'legitimate' payment from which the premium — representing laundered value — is extracted. In the UAE gold market, this manifests as refiners or traders issuing invoices for gold bars or doré at prices 10–25% above the prevailing London Bullion Market Association (LBMA) benchmark with no commercial justification, often routed through DMCC-registered entities with thin operational substance. Under-invoicing reverses the flow: goods are exported at below-market prices, value is transferred to the importer, and the true payment is settled through an informal value-transfer mechanism or hawala network — both predicate typologies under FDL 10/2025.

Phantom shipments and falsified bills of lading are particularly prevalent in commodity and bulk-goods trade through Jebel Ali and the free zones of Sharjah, Fujairah and Ras Al Khaimah. A reporting entity may process documentary letters of credit or trade finance facilities against shipping documents that describe cargo that either does not exist or does not match the goods actually shipped. Multiple invoicing — presenting the same shipment to multiple financial institutions — allows the same underlying goods to generate several layers of ostensibly clean payment flows. The UAE Courts have addressed analogous document-fabrication scenarios under the Penal Code (FDL 31/2021) in the context of forgery and fraud, and prosecutors now routinely join TBML charges to such underlying offences.

Transshipment abuse is a distinct but related vector. Goods originating in sanctioned jurisdictions are transshipped through UAE free zones with re-labelling or false certificates of origin, enabling onward export to markets that would otherwise reject them. Beyond the sanctions exposure this creates under the UAE's autonomous sanctions framework and UN Security Council obligations, the transshipment transaction itself constitutes a TBML predicate if the underlying goods represent the proceeds of a sanctions-evasion scheme — which is a predicate offence under FDL 10/2025. Banks financing such transactions face both Central Bank supervisory action under CBUAE Law 6/2025 and criminal exposure for assisting money laundering.

Sector-Specific Exposure: Gold Trading, DNFBPs and Free-Zone Commodity Houses

The UAE gold and precious metals sector is classified by the FIU as a high-risk DNFBP sector, and Cabinet Resolution 134/2025 mandates enhanced customer due diligence (ECDD) for all reporting entities dealing in precious metals and stones above prescribed thresholds. Gold refiners, bullion dealers and jewellery traders operating under DMCC, Dubai Gold and Commodities Exchange (DGCX) or free-zone licences are required to identify and verify the beneficial owner of every transaction using the 25% ownership test set by Cabinet Decision 109/2023. Where the beneficial owner cannot be identified to this standard, the transaction must be declined and an STR filed via goAML.

The intersection of gold trading and virtual assets presents an emerging TBML vector. Crypto-to-gold conversion schemes — where virtual asset proceeds are used to purchase physical gold, which is then exported and re-sold — fall squarely within the VASP Travel Rule obligations under Cabinet Resolution 134/2025, which requires originator and beneficiary information for virtual asset transfers exceeding AED 3,500. A gold trader that accepts crypto payment without applying Travel Rule disciplines is simultaneously in breach of VARA Rulebook 2.0 obligations (if it holds a VARA licence) and the DNFBP provisions of FDL 10/2025. DIFC-based entities face the additional overlay of the DIFC Digital Assets Law 2/2024, which treats crypto as property and reinforces tracing rights relevant to asset-recovery proceedings.

Free-zone commodity houses — particularly those trading petroleum products, metals or agricultural commodities — often structure their operations to minimise UAE nexus, with principals located offshore and physical goods never entering UAE customs territory. This structure does not remove UAE legal exposure: FDL 10/2025 applies to any entity licensed or registered in the UAE, irrespective of whether the underlying trade touches UAE soil. A RAKEZ-licensed commodity trader that processes invoices through a UAE bank account for transactions conducted entirely between third-country parties remains a UAE reporting entity and must file STRs where required. Failure to maintain adequate transaction-monitoring systems in this scenario is an independent offence under Cabinet Resolution 134/2025, not merely an aggravating factor.

Beneficial ownership registers are a critical compliance tool here. Cabinet Decision 109/2023 requires UAE companies (including most free-zone entities except those in DIFC and ADGM, which have parallel but distinct requirements) to maintain accurate beneficial ownership registers and file them with the relevant authority. In TBML investigations, the Public Prosecution consistently uses gaps or inaccuracies in these registers as evidence of deliberate opacity — which, combined with anomalous trade patterns, supports a money-laundering charge even where the underlying predicate offence occurred offshore.

FIU TBML Typologies and Red-Flag Indicators: Operational Recognition

The UAE FIU's published TBML typologies — which are incorporated by reference into the risk guidance accompanying Cabinet Resolution 134/2025 — identify the following as primary red-flag indicators. Banks processing trade finance, commodity finance or correspondent banking flows, and trading companies processing high-value commercial transactions, are expected to embed these into their transaction-monitoring rules and relationship-review cycles.

• Price anomalies: Invoice prices that deviate materially from publicly available benchmarks (LBMA for gold, Platts or Argus for energy, LME for base metals) without documented commercial justification — typically flagged at deviations exceeding 10–15% in the FIU guidance, though no statutory threshold is prescribed.
• Geographic risk concentration: Trade routes involving jurisdictions on the FATF grey or black list, or UAE-designated high-risk jurisdictions, particularly where the counterparty has no established operational presence in that jurisdiction.
• Circular payment flows: Funds that originate from and return to the same entity or beneficial ownership group across multiple transactions, often with nominal goods movements in between — a classic layering mechanism.
• Document inconsistencies: Shipping documents, certificates of origin, weight notes or inspection certificates that are inconsistent with each other, with the declared goods, or with intelligence from port authorities or customs systems.
• Shell counterparties: Importers or exporters with no verifiable physical presence, no operational website or commercial history, and beneficial owners who cannot be identified to the Cabinet Decision 109/2023 standard.
• Rapid settlement patterns: Payment made before goods are shipped, or simultaneously with shipment, with no trade credit — inconsistent with normal commercial practice in the relevant commodity sector.
• Transshipment without economic rationale: Goods routed through one or more intermediate free zones or ports with no plausible logistical, commercial or cost justification for the additional transit leg.

Banks are required under Cabinet Resolution 134/2025 to apply a risk-based approach, meaning these indicators do not automatically mandate an STR — but they do require documented escalation to the MLRO, enhanced due diligence on the counterparty and transaction, and a written rationale for the conclusion reached. Where the MLRO concludes that a suspicious transaction report is not required, that decision must itself be documented and retained for a minimum period specified in the Regulations. Inadequately documented 'no STR' decisions are an established trigger for CBUAE supervisory findings on examination.

Controls for Banks and Trade Finance Providers: Compliance Architecture Under FDL 10/2025

For licensed financial institutions, the compliance obligations in TBML contexts are layered across FDL 10/2025, Cabinet Resolution 134/2025 and the CBUAE's supervisory standards under CBUAE Law 6/2025. The practical architecture should address the following elements.

Customer risk profiling and ECDD: Trade finance customers in high-risk sectors (precious metals, oil and gas, bulk commodities, free-zone commodity traders) must be subject to ECDD at onboarding and at each material change in the relationship. ECDD requires identification of all beneficial owners to the 25% threshold (Cabinet Decision 109/2023), understanding of the customer's trade flows and counterparty network, and independent verification of the commercial rationale for the trade route. Where the customer is a DNFBP that is itself subject to AML obligations, the bank cannot rely on that status alone as a de-risking measure — it must satisfy itself that the DNFBP's own compliance programme is adequate.

Transaction monitoring calibrated to trade finance: Standard retail or corporate banking transaction-monitoring rules are structurally inadequate for trade finance. Banks must configure monitoring logic that flags: invoice-to-market-price deviations above risk-appetite thresholds; payment flows inconsistent with the declared trade route; multiple documentary credits presented against identical or near-identical shipping documents; and counterparty names or addresses that appear on UAE, UN or other relevant sanctions lists. The monitoring system must be tested and validated at least annually under Cabinet Resolution 134/2025's governance requirements, and validation results reported to the board or relevant board committee.

Correspondent banking and de-risking: UAE banks that process dollar-clearing or commodity-finance flows for foreign correspondent banks face a specific FATF-acknowledged risk: the correspondent has no visibility of the ultimate trade underlying a payment instruction. Cabinet Resolution 134/2025 requires UAE respondent banks to obtain and provide sufficient information about underlying trades to enable their correspondents to comply with their own AML obligations. Conversely, UAE banks acting as correspondents must apply ECDD to respondent banks in jurisdictions with weaker AML frameworks. Blanket de-risking — exiting entire commodity-sector customer segments without granular risk assessment — is explicitly identified in FIU guidance as a compliance failure, not a safe harbour, because it drives illicit flows to less-regulated channels.

STR filing mechanics: Suspicious transaction reports must be filed via the goAML platform without notifying the subject of the report (tipping-off prohibition, FDL 10/2025). The report must be filed promptly upon the MLRO forming a suspicion — there is no minimum evidentiary standard, and delay in filing after suspicion crystallises is itself an offence. The tipping-off prohibition applies to all staff who become aware of an STR; briefing a client that a report has been or may be filed, even in the course of otherwise legitimate legal advice, requires careful navigation of the qualified privilege exceptions recognised in Cabinet Resolution 134/2025.

Investigation, Freezing Orders and Asset Recovery: Procedural Realities

Where a TBML investigation is initiated, the procedural framework is the Criminal Procedure Law, Federal Decree-Law 38/2022 (in force 1 March 2023, amended by FDL 45/2023). The Public Prosecution has broad powers under this Law to freeze assets, seize documents and compel the production of records without prior judicial authorisation in urgent circumstances — a power that in practice is exercised rapidly in commodity-fraud and TBML matters given the fungible and mobile nature of the assets involved. Entities and individuals under investigation should assume that account freezes and document preservation orders will be issued simultaneously, often before the subject is formally notified.

The UAE's mutual legal assistance framework under Federal Law 39/2006 as amended by FDL 38/2023 enables the Public Prosecution to request and provide assistance in locating and freezing assets held abroad. The practical counterpart — onshore freezing of assets in support of foreign proceedings — is addressed through the DIFC Court Law 2/2025, under which the DIFC Courts have confirmed jurisdiction to grant worldwide freezing orders in support of foreign arbitral or curial proceedings without requiring a local-asset nexus, following the approach taken in ADGM A17 v B17 [2025]. This development is significant for TBML asset-recovery: a commodity-trading group with UAE free-zone operations but assets held in multiple jurisdictions can now be subject to a coordinated worldwide freezing application through the DIFC Courts even where the UAE-held assets are minimal.

Confiscation of proceeds follows conviction under FDL 10/2025, which adopts a broad definition of 'proceeds' that includes assets derived directly or indirectly from the predicate offence, as well as assets used to facilitate the offence. There is no minimum value threshold. In practice, prosecutors have confiscated not only the proceeds of the specific TBML transactions charged but also the wider business assets of entities found to have operated as vehicles for TBML, particularly where the corporate structure lacks genuine economic substance beyond the laundering activity. Defendants seeking to challenge confiscation orders bear the burden of demonstrating the legitimate origin of the assets — a significant evidential burden where documentation has been inadequate or deliberately obscured.

Strategic Compliance and Crisis Response: Practical Steps for Executives and GCs

For executives, general counsel and compliance officers in banks and trading entities, the priority under the current UAE framework is to treat TBML risk as a board-level governance matter, not a compliance-function operational issue. FDL 10/2025's personal liability provisions mean that a director or CEO who has not actively engaged with the entity's TBML risk profile — reviewed the risk assessment, challenged the adequacy of monitoring controls, or ensured that the MLRO has adequate resources and independence — faces personal criminal exposure if a TBML failure subsequently materialises. Board minutes and audit committee records should evidence that engagement; their absence will be noticed by both regulators and prosecutors.

Where a potential TBML issue is identified internally — whether through a transaction-monitoring alert, a counterparty due-diligence finding, or a whistleblower report — the immediate priority is legal privilege preservation. Internal investigations conducted under the direction of external legal counsel attract attorney-client privilege under UAE law; investigations conducted by compliance staff alone may not. Engaging external counsel at the point of identification, before any regulatory disclosure, enables the entity to conduct a privileged internal review, assess whether a voluntary disclosure or STR is required, and approach any regulatory engagement from a defensible evidentiary position.

Voluntary disclosure of historical TBML-related compliance failures to the CBUAE or other supervisory authority does not provide immunity from prosecution but is a well-established mitigating factor in penalty determination. Cabinet Resolution 134/2025 specifically contemplates cooperation credit in administrative enforcement; the Public Prosecution has in practice afforded deferred prosecution or reduced charges to entities that self-report, cooperate fully, and implement demonstrable remediation. This calculus changes significantly if the entity has already been the subject of a regulatory examination that identified the same issues — post-examination 'voluntary' disclosure carries substantially less mitigation weight.

For trading companies that are not financial institutions but are DNFBPs — gold refiners, jewellery wholesalers, commodity brokers — the single most important practical step is a documented AML risk assessment specific to their trade flows, updated annually and whenever there is a material change in business model, customer base or geographic exposure. Cabinet Resolution 134/2025 requires this; its absence is the single most common finding in FIU and Ministry of Economy supervisory examinations of DNFBPs, and it is treated as evidence of systemic non-compliance rather than a minor technical gap.

Practical checklist

• Verify all beneficial owners to 25% threshold per Cabinet Decision 109/2023 before trade execution.
• Benchmark every invoice price against published commodity indices and document the justification for deviations.
• Screen counterparties and transshipment routes against UAE, UN and relevant sanctions lists at each transaction.
• Maintain contemporaneous MLRO escalation records for every red-flag alert, including 'no STR' rationale.
• Ensure trade-finance transaction monitoring rules are calibrated for price, route and document anomalies, not generic patterns.
• Update the entity's written TBML risk assessment whenever trade flows, customer sectors or geographic exposure change materially.
• Brief the board annually on TBML risk profile, control gaps and FIU typology updates — and minute that briefing.
• Engage external legal counsel under privilege at the first sign of a potential TBML issue before any internal or external disclosure.

Frequently asked questions

Related guides

• The New UAE AML Law Explained: Federal Decree-Law 10 of 2025
• Life After the Grey List: What FATF Delisting Actually Changed for UAE Business
• Beneficial Ownership Compliance Under Cabinet Decision 109/2023
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.