A missing customer document may seem like a minor administrative issue. In the UAE, repeated due diligence failures can expose a business to financial penalties, regulatory investigations, management liability and restrictions on licensed activities.
UAE AML penalties are not limited to banks and exchange houses. They can affect real estate businesses, accounting firms, auditors, corporate service providers, dealers in precious metals and other regulated organisations.
The legal framework has also changed. Federal Decree-Law No. 10 of 2025 replaced the previous federal AML legislation and became effective on 14 October 2025. Cabinet Resolution No. 134 of 2025 now provides the main executive regulations.
Businesses operating in 2026 should review policies, training materials and audit programmes that still present Federal Decree-Law No. 20 of 2018 as the current law. The 2018 legislation was expressly repealed.
Auditors support this process by testing whether AML controls work in practice. They identify weaknesses, report material risks and help management correct failures before they become regulatory findings.
UAE AML breaches can result in warnings, administrative fines, business restrictions, suspension of responsible personnel, licence revocation and criminal prosecution. Under the general federal AML framework, administrative fines can range from AED 10,000 to AED 5 million for each violation.
Key UAE AML Compliance Takeaways for Businesses
- Federal Decree-Law No. 10 of 2025 is the primary UAE AML law in 2026.
- Cabinet Resolution No. 134 of 2025 contains the main executive requirements.
- Administrative penalties can reach AED 5 million for each violation.
- Serious offences can lead to imprisonment, confiscation and corporate fines.
- Financial institutions, DNFBPs and virtual asset businesses must apply risk-based controls.
- Suspicious activity must be escalated without waiting for proof of a crime.
- Relevant AML records generally must be retained for at least five years.
- Independent audit testing is an essential part of an effective compliance framework.
- Management remains responsible when AML tasks are outsourced.
What Are UAE AML Penalties and How Are They Applied?
UAE AML penalties are the administrative, licensing and criminal consequences imposed when a person or organisation breaches anti-money laundering, counter-terrorist financing or counter-proliferation financing requirements.
The outcome depends on the seriousness, frequency and impact of the violation.
Administrative Penalties for AML Compliance Failures
Administrative penalties usually address weaknesses in a regulated business’s compliance framework. Examples include incomplete CDD, missing risk assessments, poor internal controls or inadequate records.
A supervisory authority may issue a warning, impose a fine or require corrective action. It can also restrict activities, limit management powers, suspend responsible personnel, request their replacement or revoke a licence.
Criminal Penalties for Money Laundering Offences
Criminal penalties apply to more serious conduct. This can include laundering criminal proceeds, deliberately failing to report suspicious activity or unlawfully informing another person about an AML review.
Individuals may face imprisonment, fines and confiscation. A legal person may also face criminal liability where representatives, directors or agents commit an offence on its behalf.
Business, Licensing and Reputational Consequences
The cost of an AML violation often extends beyond the official fine.
A business may lose banking facilities, face delayed transactions or experience greater scrutiny from investors and commercial partners. Public enforcement can weaken customer confidence and affect future tenders.
Serious or repeated weaknesses can also lead to restrictions on business activities or the revocation of a professional licence.
AML violation | Possible UAE consequence |
Inadequate customer due diligence | Fine and corrective-action requirement |
Failure to identify a beneficial owner | Fine or regulatory investigation |
Weak AML risk assessment | Remediation order and administrative action |
Failure to report suspicious activity | Administrative or criminal exposure |
Tipping off another person | Fine, imprisonment or both |
Repeated control failures | Activity restrictions or licence action |
Key UAE AML Laws and Regulations Applicable in 2026
The UAE AML framework combines federal legislation, executive regulations, beneficial ownership requirements, targeted financial sanctions and sector-specific supervisory rules.
Businesses should identify every requirement relevant to their licence, customers and activities.
Federal Decree-Law No. 10 of 2025
Federal Decree-Law No. 10 of 2025 is the main federal AML statute in force during 2026.
It addresses money laundering, terrorist financing, proliferation financing, suspicious transaction reporting, beneficial ownership information, regulatory supervision, confiscation and penalties.
The law repealed Federal Decree-Law No. 20 of 2018. Existing policies and legal registers should be updated accordingly.
Cabinet Resolution No. 134 of 2025
Cabinet Resolution No. 134 of 2025 explains how regulated organisations should implement the federal law. It became effective on 14 December 2025.
The resolution covers business risk assessments, CDD, EDD, beneficial ownership, politically exposed persons, ongoing monitoring, suspicious transaction reporting, record keeping, employee training and independent audit testing.
Role of UAE Regulators and International Standards
The UAE Central Bank supervises licensed financial institutions within its jurisdiction. The Ministry of Economy and Tourism supervises relevant DNFBPs, including auditors, accountants, real estate businesses, precious-metals dealers and corporate service providers.
Other authorities may impose additional requirements on free-zone entities, virtual asset businesses and regulated financial organisations. FATF standards also continue to influence the UAE’s risk-based AML framework.
Which Businesses Must Follow UAE AML Requirements?
AML responsibilities apply according to an organisation’s activities, customer profile, transaction exposure, licence and supervisory authority.
They are not limited to companies that describe themselves as financial businesses.
AML Obligations for Financial Institutions
Financial institutions can include banks, exchange houses, finance companies, insurance businesses, payment providers and certain investment firms.
These organisations generally require detailed customer onboarding, transaction monitoring and sanctions-screening systems. They must understand the source, purpose and expected nature of customer activity because they provide direct access to financial products and payment channels.
Businesses in this sector can also benefit from specialist audit services for financial institutions that consider regulatory and operational risks together.
AML Requirements for DNFBPs in the UAE
Designated Non-Financial Businesses and Professions are commonly known as DNFBPs.
Relevant categories include:
- Real estate brokers and agents
- Dealers in precious metals and stones
- Auditors and accountants
- Trust and company service providers
- Certain legal professionals
These sectors may be used to purchase assets, move funds or conceal ownership. In the first half of 2025, Ministry inspections identified 1,063 DNFBP violations and imposed fines exceeding AED 42 million.
Real estate businesses with high-value transactions and complex ownership structures may require sector-focused audit services for real estate companies.
Compliance Duties of Auditors and Accountants
Audit and accounting firms may have direct AML responsibilities when providing specified corporate or financial services.
Examples can include helping customers form companies, manage assets, operate accounts or conduct certain property transactions.
The firm should distinguish between its statutory audit responsibilities and its separate obligations as a regulated professional service provider. It must assess whether each service falls within the relevant DNFBP activities.
AML Rules for Virtual Asset Service Providers
Virtual asset service providers must comply where their activities fall within the applicable licensing and AML framework.
Relevant risks may include rapid cross-border transfers, unhosted wallets, privacy-enhancing technology and high-risk counterparties.
Controls should verify customers, identify beneficial owners, screen relevant parties, understand transaction purposes and investigate activity that does not match the expected customer profile.
Most Common AML Compliance Violations in the UAE
Many AML violations begin with ordinary procedures that were incomplete, inconsistently performed or poorly documented.
Regulators generally consider whether a failure is isolated or indicates a wider weakness in the compliance framework.
Inadequate Customer Due Diligence and KYC Checks
CDD requires more than collecting a passport and trade licence.
A business should verify the customer’s identity, understand the purpose of the relationship and establish an expected transaction profile.
Common failures include expired documents, missing addresses, unverified representatives and vague business descriptions. A file can appear complete while still failing to explain what the customer does or why transactions are expected.
Failure to Identify the Ultimate Beneficial Owner
The immediate shareholder is not always the ultimate beneficial owner.
Ownership may pass through holding companies, nominee arrangements, trusts or overseas entities. The business should trace the structure until it identifies the natural person who ultimately owns or controls the customer.
The executive regulations define the beneficial owner as the natural person exercising ultimate ownership or effective control, including through indirect means.
Weak AML Risk Assessments and Customer Ratings
An AML risk assessment should reflect the organisation’s actual customers, countries, services, delivery channels, payment methods and transaction patterns.
A generic template provides limited regulatory protection.
Customer risk ratings should also be explainable. Higher-risk factors should trigger stronger controls, including EDD, senior approval and more frequent monitoring. A rating has little value when it does not change how the relationship is managed.
Suspicious Transaction Reporting and Record-Keeping Failures
A business should not wait for proof of money laundering before escalating suspicious activity.
Where there are reasonable grounds for suspicion, the regulated organisation must report through the FIU’s approved electronic system immediately and without delay. Certain professional-secrecy exceptions apply in defined circumstances.
Relevant transaction, CDD, monitoring and reporting records generally must be retained for at least five years and remain available to competent authorities.
Where transaction anomalies may involve fraud or misconduct, specialist forensic audit services can support a documented investigation without replacing required regulatory reporting.
UAE AML Penalties and Enforcement Measures in 2026
The current framework allows regulators and courts to distinguish between a compliance weakness, repeated misconduct and participation in an actual financial crime.
Administrative Fines for AML Regulatory Breaches
The federal AML law permits administrative fines between AED 10,000 and AED 5 million for each violation.
A regulator may also restrict business activities, limit the powers of directors, suspend responsible personnel, request their replacement or revoke the licence.
The regulator may require periodic remediation reports and publish sanctions, increasing the potential reputational effect.
Criminal Liability for Money Laundering Offences
A person convicted of money laundering may face imprisonment from one to ten years and a fine between AED 100,000 and AED 5 million. An amount linked to the criminal property may apply where it is greater.
Corporate fines for qualifying money laundering, terrorist financing or proliferation financing offences can range from AED 5 million to AED 100 million.
Personal Liability of Directors and Compliance Officers
Individual liability may arise where the required legal conditions are proven.
A person responsible for the actual management of a legal entity may be punished where they knew about the offence and its commission resulted from a breach of their duties.
Deliberate or grossly negligent failure to meet suspicious transaction reporting obligations can also lead to imprisonment, a fine between AED 100,000 and AED 1 million, or both.
License Suspension and Reputational Damage
Recent enforcement shows that AML penalties are not theoretical.
On 24 June 2026, the UAE Central Bank announced an AED 20 million financial penalty against a foreign bank branch for significant and repeated AML/CFT and targeted financial sanctions control failures.
Ministry figures for the first half of 2025 also reported more than AED 4 million in penalties involving corporate service providers and auditors.
The Role of Auditors in Strengthening AML Compliance
Auditors do not own or manage the AML programme. That responsibility remains with the board and senior management.
The auditor provides independent challenge and objective assurance.
Independent Testing of AML Policies and Controls
Auditors test whether AML controls are properly designed and consistently followed.
Testing may cover customer files, beneficial ownership evidence, customer risk classifications, sanctions alerts and suspicious transaction decisions.
The purpose is not simply to confirm that a policy exists. The auditor must determine whether employees apply it consistently and whether the control produces reliable evidence.
Review of AML Risk Management and Governance
Auditors assess whether the business-wide risk assessment reflects the organisation’s actual exposure.
They also review board oversight, compliance resources and management reporting.
A company may have detailed onboarding procedures but weak governance. For example, material findings may remain unresolved because directors do not receive accurate information about overdue actions and control exceptions.
Reporting Weaknesses and Monitoring Remediation
Audit findings should explain the weakness, regulatory impact and root cause.
Each finding should have a responsible action owner and a realistic completion date.
Auditors should independently verify closed actions. Management’s statement that an issue has been corrected is not enough where the improved control has not been tested.
Auditor responsibility | Business benefit |
Test customer files | Identifies missing compliance evidence |
Review the AML risk assessment | Improves coverage of actual risks |
Test STR procedures | Reduces escalation and reporting delays |
Review governance | Strengthens management accountability |
Track remediation | Helps prevent repeated violations |
The executive regulations specifically require an independent audit function to test the effectiveness and adequacy of internal AML controls and procedures.
Key Responsibilities of External Auditors in AML Compliance
The responsibilities of an external auditor depend on the agreed engagement scope.
A statutory financial audit and a dedicated AML compliance review are different services.
AML Considerations During a Financial Statement Audit
During a statutory audit, the external auditor considers fraud, material misstatement and relevant legal non-compliance.
This may involve reviewing unusual journal entries, related-party transactions and management override.
A statutory audit does not automatically provide complete assurance over the AML framework. A separate engagement is normally required where management wants a dedicated compliance assessment.
Conducting an Independent AML Compliance Review
A dedicated AML review can test the organisation’s risk assessment, CDD, EDD, UBO verification, sanctions screening, transaction monitoring and reporting procedures.
Sampling should include higher-risk customers, complex structures and unusual transactions.
The report should distinguish between a control that was poorly designed and a control that was properly designed but not followed.
Businesses seeking independent assurance can use professional external audit services with a clearly defined compliance scope.
Managing Suspicion, Reporting and Auditor Independence
An external auditor who identifies suspicious conduct should follow applicable law, professional obligations and the firm’s confidential escalation procedure.
The issue should not be discussed with the customer in a way that could amount to tipping off.
The audit firm should also manage self-review threats where it previously designed the controls it is now being asked to assess.
Key Responsibilities of Internal Auditors in AML Compliance
Internal audit provides ongoing assurance within the organisation’s governance framework.
It should remain sufficiently independent from the compliance function.
Developing a Risk-Based AML Audit Plan
Internal audit should include AML within its annual or multi-year audit plan.
The frequency and depth of testing should reflect the organisation’s business model, customer profile, geographic exposure and previous findings.
Major legal changes, new services, control failures or regulatory action may justify an immediate review instead of waiting for the normal audit cycle.
Testing the Design and Effectiveness of AML Controls
Internal auditors should test both control design and operating effectiveness.
A policy may require annual customer reviews, while actual files remain overdue.
Testing should cover real customer records, transactions, alerts and approvals. The sample should include higher-risk relationships rather than relying only on randomly selected standard-risk customers.
Professional internal audit services can also support businesses that do not maintain a fully resourced in-house audit function.
Reporting AML Findings to the Board and Audit Committee
Internal audit reports should explain the regulatory risk, root cause, affected population and required corrective action.
High-risk findings should be escalated promptly.
Repeated overdue actions should not remain open across several audit cycles without challenge, revised ownership or senior management intervention.
Internal Auditor vs External Auditor in AML Compliance
Area | Internal auditor | External auditor |
Organisational position | Part of the governance structure | Independent third party |
Review frequency | Ongoing or periodic | Engagement-based |
Main focus | Controls and continuous improvement | Agreed audit or assurance scope |
Reporting line | Board or audit committee | Agreed users of the report |
Remediation follow-up | Usually tracks actions throughout the year | Performed where included in scope |
Primary strength | Detailed organisational knowledge | Independent specialist perspective |
Both functions can support AML compliance.
Internal audit provides continuing assurance and follows corrective actions throughout the year. External audit offers independent challenge and experience from other regulatory environments.
Their plans should be coordinated where appropriate to prevent unnecessary duplication.
How Auditors Help Businesses Reduce AML Risks
Practical audit testing converts broad regulatory requirements into evidence that management can act upon.
Detecting Hidden or Complex Beneficial Ownership
A customer may provide a shareholder certificate showing another company as its owner.
An auditor can trace each ownership layer until the natural person exercising ultimate control is identified.
This process may uncover nominee arrangements, unexplained offshore entities or inconsistent declarations requiring further verification, EDD, customer reclassification or confidential escalation.
Reviewing Suspicious Transactions and STR Decisions
An auditor can trace an unusual transaction from the original system alert to the final compliance decision.
The review should consider expected customer activity, supporting documents and the MLRO’s reasoning.
Testing may reveal alerts closed without adequate analysis, inconsistent treatment of similar cases or delayed reporting. Reviewing the complete process is more useful than simply counting submitted STRs.
Strengthening Internal Controls, Training and Remediation
Repeated KYC failures may indicate a process problem rather than a single employee error.
An auditor may connect missing evidence to unclear procedures, weak training or ineffective workflows.
Recommendations can include system validation, revised approvals and role-based training. Follow-up testing then determines whether the improvements operate consistently and prevent recurrence.
AML Requirements and Recommended Audit Procedures
AML requirement | Recommended audit procedure |
Business-wide risk assessment | Review methodology, underlying data and approval |
Customer identification | Test selected files against legal requirements |
Beneficial ownership | Trace ownership to relevant natural persons |
Customer risk rating | Recalculate ratings and review overrides |
Enhanced due diligence | Inspect source-of-funds and approval evidence |
PEP and sanctions screening | Test list updates and alert resolution |
Transaction monitoring | Compare activity with expected behaviour |
STR and SAR reporting | Trace alerts from detection to submission |
Record keeping | Test completeness, accessibility and retention |
Employee training | Review content, attendance and assessments |
Corrective action | Independently validate closure evidence |
Practical AML Audit Checklist for UAE Businesses
AML Governance and Management Oversight
- Policies reflect the current UAE AML framework.
- Senior management has approved the AML policies.
- A qualified compliance officer or MLRO is appointed.
- The compliance function has sufficient authority and resources.
- The board receives regular and meaningful AML reports.
Customer Due Diligence and Beneficial Ownership Controls
- Customer identity is verified.
- Representatives are authorised and verified.
- Beneficial owners are traced to natural persons.
- Customer risk ratings are documented and explainable.
- EDD is completed for higher-risk relationships.
Transaction Monitoring and Suspicious Activity Reporting
- Transactions are compared with expected customer activity.
- PEP and sanctions screening is current.
- Unusual activity is investigated promptly.
- Internal escalations remain confidential.
- STR and SAR decisions are documented.
- goAML access is operational.
Record Keeping, Employee Training and Independent Audit
- AML records are retained for the required period.
- Records can be retrieved promptly.
- Training reflects employee responsibilities.
- Independent testing follows a risk-based plan.
- Findings have named owners and deadlines.
- Closed actions are independently validated.
Best Practices for Improving AML Compliance in the UAE
An effective compliance framework requires practical controls, clear accountability and reliable evidence.
Update AML Policies for the Current Legal Framework
Review any policy that still presents the 2018 legislation as the current federal AML law.
The framework should refer to Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and applicable sector requirements.
The business should also maintain a process for identifying, approving and communicating future legal updates.
Strengthen CDD, EDD and Beneficial Ownership Checks
CDD should establish who the customer is, who controls the customer and why the relationship is being created.
Where risk is higher, the organisation should obtain additional information, secure appropriate approval and apply enhanced monitoring.
Complex ownership structures should be supported by credible evidence rather than unverified declarations.
Give the Compliance Function Adequate Authority and Resources
The compliance officer should have access to customer files, payment information, systems and senior management.
Commercial pressure should never prevent confidential escalation.
Material concerns, overdue reviews and significant reporting decisions should not be filtered through employees responsible for sales or customer acquisition.
Address the Root Causes of AML Control Failures
Correcting one incomplete customer file does not resolve a defective onboarding process.
Sustainable remediation may require revised workflows, mandatory system fields, updated procedures, employee training and data remediation.
Management should identify the wider affected population. Internal audit should then validate whether the improved controls operate effectively.
Frequently Asked Questions About UAE AML Penalties
What Is the Maximum AML Fine in the UAE?
The general administrative fine under Federal Decree-Law No. 10 of 2025 can reach AED 5 million for each violation. Multiple breaches, sector-specific regulatory powers or criminal offences may produce significantly higher total exposure.
Which UAE AML Law Applies in 2026?
Federal Decree-Law No. 10 of 2025 is the primary statute. Cabinet Resolution No. 134 of 2025 provides the main executive requirements covering risk assessments, due diligence, monitoring, reporting and record keeping.
Is Federal Decree-Law No. 20 of 2018 Still Applicable?
It is no longer the primary federal AML legislation. Federal Decree-Law No. 10 of 2025 expressly repealed it. Businesses should update policies, training materials and legal registers that still describe the 2018 law as current.
Are Auditors and Accountants Subject to UAE AML Rules?
They may have direct AML obligations when performing specified financial, corporate or transactional services. Their duties can include risk assessment, CDD, beneficial ownership verification, monitoring, reporting, training and record keeping.
What Is the Difference Between CDD and EDD?
CDD identifies and verifies the customer, beneficial owner and purpose of the relationship. EDD applies additional measures where the risk is higher, such as source-of-funds checks, source-of-wealth checks, senior approval and more frequent monitoring.
How Long Must AML Records Be Retained in the UAE?
Relevant transaction, due diligence, monitoring and reporting records generally must be retained for at least five years. A longer period may apply following an inspection, investigation, court judgment or other specified event.
Must Attempted Suspicious Transactions Be Reported?
A reporting obligation can arise where reasonable grounds for suspicion exist, including circumstances involving attempted, rejected or discontinued transactions. Employees should follow the organisation’s confidential escalation and reporting procedure.
Can Directors Be Personally Liable for AML Violations?
Personal liability may arise where the required legal elements are established. This can include knowledge of an offence and a breach of management duties that contributed to its commission.
Strengthen Your AML Controls with Audit Services UAE
UAE AML compliance is no longer a policy-writing or box-ticking exercise. Regulators expect businesses to demonstrate that customer checks, risk assessments, monitoring systems, reporting procedures and governance controls operate effectively in practice.
Weak CDD, incomplete UBO checks, delayed suspicious transaction reporting or unresolved audit findings can expose your organisation to substantial penalties, licensing risks and reputational damage.
A structured independent audit helps management identify those weaknesses before they develop into repeated violations or formal enforcement action.
Audit Services UAE provides independent, risk-focused audit support to organisations operating across Dubai, Abu Dhabi and the wider UAE. Its services include internal audit, external audit, compliance reviews, forensic investigations and internal control assessments.
The audit scope can be tailored to assess:
- AML governance and management oversight
- Business-wide and customer risk assessments
- CDD, EDD and beneficial ownership controls
- PEP and sanctions screening
- Transaction monitoring and alert management
- STR and SAR escalation procedures
- Record keeping and employee training
- Remediation of previous audit or regulatory findings
Do not wait for a regulatory inspection to reveal weaknesses that could have been identified earlier.
Contact Audit Services UAE to arrange an independent AML compliance review and receive practical recommendations aligned with your business activities, risk profile and regulatory obligations.
Protect your licence, strengthen your controls and give management greater confidence in the effectiveness of your AML framework.