The New UAE AML Law Explained: Federal Decree-Law 10 of 2025

Federal Decree-Law 10 of 2025 rewrote the UAE's entire anti-money laundering framework on 14 October 2025, introducing proliferation financing as a standalone predicate, personal criminal liability for senior managers, fines reaching AED 100 million, and the abolition of any limitation period for money laundering offences.

Legislative Architecture: What FDL 10/2025 Repealed and Replaced

Federal Decree-Law 10 of 2025 (FDL 10/2025), brought into force on 14 October 2025, repealed and replaced Federal Decree-Law 20 of 2018 in its entirety. The companion instrument, Cabinet Resolution 134 of 2025 (the Executive Regulations), took effect on 14 December 2025 and operationalises the new obligations with granular technical detail. Any compliance programme, board policy, or legal opinion that still references FDL 20/2018 is now citing repealed law and should be updated immediately.

The UAE criminal law backdrop against which FDL 10/2025 operates is equally current. The primary penal code is Federal Decree-Law 31 of 2021 (in force 2 January 2022, as amended by FDL 36/2022), and criminal procedure is governed by Federal Decree-Law 38 of 2022 (in force 1 March 2023, as amended by FDL 45/2023). FDL 10/2025 sits within this framework as a special law: where its provisions conflict with the general penal code, FDL 10/2025 prevails on AML/CFT/CPF matters.

The Central Bank's supervisory powers are now reinforced by CBUAE Law No. 6 of 2025, which raises the Central Bank's maximum administrative fine to AED 1 billion for regulated entities. FDL 10/2025 and CBUAE Law 6/2025 operate in parallel — a financial institution may face both a criminal prosecution under FDL 10/2025 and a separate administrative enforcement action by the Central Bank for the same underlying conduct. Boards and GCs must appreciate that these are independent tracks with independent sanction ceilings.

For beneficial ownership identification — a core CDD obligation under the new regime — the operative threshold remains 25% of ownership or control, as established by Cabinet Decision 109 of 2023. Regulated entities are expected to conduct UBO verification against this standard and maintain records in the form prescribed by Cabinet Resolution 134/2025.

Expanded Predicate Offences: Proliferation Financing and Tax Evasion

The most structurally significant change in FDL 10/2025 is the elevation of proliferation financing (CPF) and tax evasion to standalone predicate offences for money laundering. Under the repealed FDL 20/2018, proliferation financing was an AML-adjacent obligation but not a fully developed money laundering predicate in the same statutory framework. FDL 10/2025 closes that gap, bringing the UAE into explicit alignment with FATF Recommendation 7 and the related Immediate Outcome 11 standards that were scrutinised during the UAE's grey-list period (2022–February 2024).

Proliferation financing is defined in FDL 10/2025 as the provision, collection, or making available of funds or financial services, directly or indirectly, with the knowledge or intention that they be used, in whole or in part, to finance the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling or use of nuclear, chemical, biological or radiological weapons or delivery systems. Financial institutions, DNFBPs and Virtual Asset Service Providers (VASPs) must now conduct targeted financial sanctions screening specifically calibrated to CPF risk — a distinct obligation from conventional AML/CFT screening. Cabinet Resolution 134/2025 specifies the required frequency and scope of that screening.

Tax evasion as a predicate operates in conjunction with Federal Decree-Law 47 of 2022 on corporate tax and Cabinet Decision 129 of 2025 on tax penalties. The practical implication is that structuring transactions to conceal taxable income — or moving the proceeds of UAE corporate tax evasion through the financial system — now constitutes money laundering, not merely a tax offence. The voluntary disclosure mechanism under the corporate tax regime (attracting a 1–4% penalty versus 15% on audit) becomes strategically material: self-reporting before an AML investigation is opened may significantly affect both criminal exposure and penalty quantum.

The predicate offence expansion also has extraterritorial reach. Where conduct constitutes an offence in the foreign jurisdiction in which it occurred, and would constitute a qualifying predicate under FDL 10/2025 if committed in the UAE, laundering of those proceeds in the UAE is prosecutable. This is particularly relevant for HNW individuals and family offices with cross-border structures who have brought funds into the UAE.

Personal Criminal Liability for Senior Managers and Board Members

FDL 10/2025 introduces a statutory personal liability provision for senior managers, directors, and board members of legal persons that commit AML/CFT/CPF violations. Under the new framework, a senior manager or board member is personally criminally liable where: (i) the legal person commits an offence under the law; and (ii) the offence was committed with the knowledge, authorisation, or wilful neglect of that individual. The threshold of wilful neglect is critical — it means that passive failure to implement adequate oversight is sufficient; active participation in the predicate conduct is not required.

This liability is in addition to, not instead of, the liability of the legal person itself. A financial institution may be fined up to AED 100 million while simultaneously its MLRO, CCO, or a board member faces personal prosecution, disqualification, and imprisonment. The imprisonment exposure for individuals under FDL 10/2025 reaches 10 years for aggravated offences — where, for instance, the offender is a public official, where a criminal organisation is involved, or where the predicate offence involves CPF. Cabinet Resolution 134/2025 sets out aggravating and mitigating factors that prosecutors and courts are directed to consider.

For GCs advising boards and for MLROs operating within regulated entities, the practical implication is that documented governance is now a personal protection measure. A board member who can demonstrate that they received proper compliance reporting, challenged management on identified gaps, and escalated unresolved concerns has materially better prospects than one who cannot. Board minutes, MLRO annual reports, compliance committee papers, and training records are now evidence of individual due diligence — or its absence. We recommend that these documents be prepared with the assumption that they may one day be reviewed by a prosecutor.

Notably, FDL 10/2025 also preserves the ability of the Public Prosecutor to pierce intra-group structures. Where a parent entity, subsidiary, or affiliate was used as the vehicle through which an individual exercised control, the personal liability provisions apply to the individual exercising de facto control, not merely the registered directors. HNW principals who operate through nominee or holding structures should take specific advice on whether their factual role exposes them to personal liability as a matter of UAE law.

Penalties: AED 100 Million Fines and No Statute of Limitations

FDL 10/2025 introduces a tiered penalty structure that is materially more severe than its predecessor. For legal persons — companies, partnerships, and other entities — the maximum administrative and judicial fine is AED 100 million. This ceiling applies per offence, meaning that a series of discrete violations (for example, repeated failures to file Suspicious Transaction Reports, combined with inadequate CDD across a portfolio of clients) can attract cumulative fines that substantially exceed AED 100 million in aggregate. The law also provides for confiscation of all proceeds of, or instrumentalities used in, the predicate offence and the laundering transaction. Courts have wide discretion to make confiscation orders against both the primary offender and any third party who received proceeds with knowledge of their origin.

The abolition of any limitation period for money laundering offences is the provision that most significantly alters strategic risk for clients with historical transactions. Under the general criminal procedure framework of Federal Decree-Law 38 of 2022, most serious criminal offences carry a limitation period that begins to run from the date of the offence. FDL 10/2025 expressly excludes money laundering from that framework. There is no point in time at which a UAE money laundering prosecution becomes time-barred. This has immediate implications for: (i) corporate acquisitions involving UAE targets with legacy compliance gaps; (ii) HNW individuals who restructured assets during grey-list-era investigations; and (iii) financial institutions conducting look-back reviews requested by regulators.

For asset freezing and provisional measures, the UAE's existing legal tools have been supplemented by significant judicial developments. The DIFC Court Law 2 of 2025 and the ADGM case A17 v B17 [2025] confirm that worldwide freezing orders can be granted in support of foreign proceedings without the need to demonstrate that the respondent holds assets within the UAE — materially broadening the reach of cross-border asset recovery. This matters because FDL 10/2025 investigations frequently involve assets held offshore, and regulators and prosecutors are increasingly using these tools in parallel with criminal proceedings.

Regulated institutions should also note that the Central Bank's independent sanction regime under CBUAE Law No. 6 of 2025 (maximum AED 1 billion) is not capped by, and runs independently from, the AED 100 million ceiling in FDL 10/2025. A significant compliance failure at a bank or exchange house could therefore attract aggregate sanctions from both tracks simultaneously.

Virtual Assets: VARA, the Travel Rule, and FDL 10/2025 Coverage

FDL 10/2025 explicitly brings Virtual Asset Service Providers (VASPs) within its full CDD, record-keeping, and suspicious transaction reporting obligations. This is no longer a matter of regulatory guidance alone — it is statutory. Cabinet Resolution 134/2025 operationalises VA-specific obligations, including a Travel Rule threshold of AED 3,500: any VA transfer at or above this value requires the originating VASP to transmit beneficiary and originator information to the receiving VASP, and to verify that information before executing the transfer.

In the Dubai mainland and Free Zone context, the primary regulator for VASPs is the Virtual Assets Regulatory Authority (VARA), operating under its Rulebooks 2.0 (May 2025) and the Issuance Rulebook (June 2025). VARA-licensed entities are required to maintain AML/CFT/CPF programmes that are consistent with FDL 10/2025 and Cabinet Resolution 134/2025 as a condition of their licence. VARA has the authority to impose its own regulatory sanctions — licence suspension, revocation, and fines — in addition to any criminal prosecution under FDL 10/2025. The personal manager liability provisions of FDL 10/2025 apply to VARA-regulated entities in the same manner as to conventional financial institutions.

In the DIFC, the legal characterisation of digital assets as property under DIFC Digital Assets Law 2 of 2024 intersects with AML obligations in an important way: crypto held in DIFC-based structures is subject to DIFC Financial Services Authority (DFSA) AML rules, and simultaneously to UAE federal AML law where the underlying conduct involves UAE-nexus transactions. GCs at DIFC-based funds or family offices that hold VA exposures must therefore map their obligations across both the DFSA regulatory perimeter and FDL 10/2025. The two regimes are broadly convergent but are not identical, and gaps in one may constitute a violation of the other.

Practically, VASPs and their legal counsel should note that the no-limitation-period provision in FDL 10/2025 applies equally to VA-related money laundering. The pseudonymous and immutable nature of blockchain records means that historical transaction data is often indefinitely accessible to investigators — making the absence of a statutory limitation period operationally real rather than merely theoretical. Blockchain analytics tools are used by UAE authorities, and travel rule non-compliance on historical transfers is a live investigation risk.

Compliance Obligations: Financial Institutions, DNFBPs, and Institutional Readiness

FDL 10/2025 and Cabinet Resolution 134/2025 impose a comprehensive compliance architecture on two principal categories of obliged entities: Financial Institutions (banks, exchange houses, insurance companies, VASPs, and investment firms) and Designated Non-Financial Businesses and Professions (DNFBPs) — including lawyers, accountants, real estate brokers, dealers in precious metals, and corporate service providers. The obligations are materially similar in structure but differ in granularity and supervisory authority. Financial institutions report to their prudential regulators (the Central Bank under CBUAE Law 6/2025, or VARA, DFSA, FSRA as applicable). DNFBPs report to the Ministry of Economy or their sector-specific supervisory authority.

Core obligations under FDL 10/2025 include: Customer Due Diligence (CDD) at onboarding and on a risk-triggered basis throughout the relationship; Enhanced Due Diligence (EDD) for politically exposed persons, high-risk jurisdictions, and complex or unusual transaction patterns; Suspicious Transaction Reporting (STR) to the UAE Financial Intelligence Unit (goAML platform) without tipping off the customer; record retention for a minimum of five years from transaction date or end of business relationship (whichever is later); and targeted financial sanctions screening against UAE Cabinet-designated lists and UN Security Council lists, on an ongoing basis. The CPF expansion in FDL 10/2025 means that screening programmes must now include proliferation-financing-specific typologies, not merely terrorism financing and conventional ML.

Cabinet Resolution 134/2025 introduces more prescriptive requirements around risk assessment. Obliged entities must maintain a written, board-approved enterprise risk assessment that is reviewed at least annually and updated following any material change in business model, customer base, or regulatory guidance. The risk assessment must specifically address CPF risk as a discrete category — a new requirement with no equivalent under the repealed FDL 20/2018 regime. Failure to maintain an adequate risk assessment is itself a prosecutable omission under the new law, not merely a regulatory deficiency.

For law firms and legal consultancies classified as DNFBPs — which includes any firm advising on real estate transactions, corporate structuring, or asset management in the UAE — the tipping-off prohibition under FDL 10/2025 operates alongside legal professional privilege. The boundary between the two requires careful navigation: FDL 10/2025 does not abrogate privilege for genuinely legal advice, but it does require STR filing where a lawyer identifies a suspicious transaction in the course of non-advisory, transactional work. Firms should have documented protocols that distinguish the two categories.

Investigation, Prosecution, and Defence Strategy

UAE AML investigations under FDL 10/2025 are typically initiated by one of three routes: an STR filed via the goAML platform by an obliged entity; a referral from a supervisory authority (the Central Bank, VARA, or the Ministry of Economy) following an inspection or audit; or a mutual legal assistance request from a foreign jurisdiction under Federal Law 39 of 2006 as amended by Federal Decree-Law 38 of 2023. The Public Prosecution has broad powers under Federal Decree-Law 38 of 2022 (Criminal Procedure Law) to freeze assets, seize documents, and restrict travel at an early investigative stage, often before formal charges are filed. Asset freezing in AML cases proceeds swiftly — counsel should be engaged at the earliest indication of an investigation, not after freeze orders have been executed.

A critical strategic consideration under FDL 10/2025 is the voluntary disclosure framework. The law provides for mitigation of penalties where an obliged entity or individual proactively discloses a compliance failure before an investigation is opened or an inspection is commenced. The magnitude of mitigation is at prosecutorial and judicial discretion, but Cabinet Resolution 134/2025 directs decision-makers to treat voluntary disclosure as a significant mitigating factor. The parallel exists in the corporate tax regime under Federal Decree-Law 47/2022: voluntary disclosure reduces the penalty multiplier from 15% (on audit) to 1–4%. Clients who have identified historical gaps — whether in STR filing, CDD documentation, or CPF screening — should take urgent advice on whether voluntary disclosure is appropriate before a regulator acts.

On the defence side, the most effective responses to FDL 10/2025 allegations typically engage three parallel tracks: (i) criminal defence — challenging the prosecution's characterisation of the predicate offence, contesting the requisite mental element (knowledge or intent), and scrutinising the chain of evidence under FDL 38/2022 procedure; (ii) regulatory engagement — managing the supervisory authority's parallel investigation and seeking to limit licence-level consequences; and (iii) civil asset recovery defence — responding to freezing orders and confiscation applications, potentially including cross-border recognition and enforcement proceedings. These three tracks must be coordinated from the outset because steps taken in one can have adverse consequences in another — particularly given that statements made in regulatory proceedings may be disclosed to the Public Prosecution.

The absence of a limitation period demands a particular approach to historical transaction review. Any merger and acquisition due diligence involving UAE-regulated entities, any restructuring of legacy holding structures, and any regulatory examination response must now proceed on the assumption that transactions from any historical period can be the subject of a money laundering investigation. Privileged look-back reviews — conducted under legal professional privilege with independent counsel — are the appropriate mechanism for identifying and managing this exposure before regulators do.

Practical checklist

• Update all AML policies to cite FDL 10/2025 and Cabinet Resolution 134/2025, not the repealed FDL 20/2018.
• Add proliferation financing (CPF) as a discrete risk category in your board-approved enterprise risk assessment.
• Map personal liability exposure for each senior manager and board member against FDL 10/2025 wilful neglect standard.
• Expand sanctions screening to cover CPF-specific typologies, not only terrorism financing and conventional ML lists.
• Implement Travel Rule controls for all VA transfers at or above the AED 3,500 threshold under Cabinet Resolution 134/2025.
• Ensure beneficial ownership verification is applied at the 25% threshold per Cabinet Decision 109/2023 with documented records.
• Commission a privileged historical transaction look-back review given abolition of the limitation period for ML offences.
• Establish a board-level protocol for voluntary disclosure decisions when compliance gaps are identified before regulatory inspection.

Frequently asked questions

Related guides

• Life After the Grey List: What FATF Delisting Actually Changed for UAE Business
• Beneficial Ownership Compliance Under Cabinet Decision 109/2023
• goAML and STR Filing: A Reporting-Entity Playbook
• White-Collar & Financial Crime — full guide

Published 15 July 2026. General information only — not legal advice. Contact us for matter-specific advice.