Regulatory updates

UAE AML/CFT regulatory updates: what changed, and what DNFBPs need to do

The law changed in October 2025 and the rulebook that implements it changed again in December. Here is what actually moved, what is still settling, and what to check before you rely on any of it.

groAML compliance team Grovisor Business Consultants FZE
Published Updated 9 min read

Checked against secondary legal and compliance sources as of 4 Oct 2026; primary text not re-verified

On this page

At a glance

  • Federal Decree-Law No. 10 of 2025 replaced the 2018 AML law on 14 October 2025; its Executive Regulations, Cabinet Resolution No. 134 of 2025, took effect 14 December 2025.
  • The Executive Regulations are reported to fix the beneficial-ownership threshold at 25%, to set AED 55,000 / AED 3,500 monetary thresholds for CDD triggers (for some DNFBP sectors, such as dealers in precious metals and stones and real estate, AED 55,000 is also tied to cash-transaction reporting; confirm which applies to you), and to bring virtual asset service providers into scope explicitly. Confirm each figure against the Resolution text.
  • The new law is reported to give the FIU stronger powers to postpone or suspend a suspicious transaction and to freeze funds for limited periods; confirm the exact periods against the Decree-Law text.
  • The old Funds Freeze Report is now called the Confirmed Name Match Report (CNMR) across UAE goAML guidance — same obligation, new name.
  • The Ministry of Economy updates its high-risk and increased-monitoring country lists periodically (check the Ministry's website for the current circular); each update has to be folded into CDD and EDD decisions, not just noted and filed.
Who this is for:Real estate brokers and agentsDealers in precious metals and stonesCorporate service providersAuditors and accountantsLawyers and notaries

The headline change: a new law from the ground up

Federal Decree-Law No. 10 of 2025 on anti-money laundering, combating the financing of terrorism and proliferation financing came into effect on 14 October 2025, replacing Federal Decree-Law No. 20 of 2018 outright rather than amending it. It's the primary statute every AML/CFT obligation in the UAE now traces back to, including the Executive Regulations below.

At a structural level, the new law expands scope to proliferation financing as its own standalone offence (not just an adjunct to terrorist financing), brings virtual assets and VASPs explicitly within the federal AML framework, and gives the Financial Intelligence Unit (FIU) a stronger toolkit — covered in more detail below.

The Executive Regulations: the detail that actually governs you

A framework law is only as useful as the regulation that operationalises it. Cabinet Resolution No. 134 of 2025, the Executive Regulations to the new law, took effect 14 December 2025 and is where the operational detail — thresholds, categories, specific duties — actually lives. Day to day, this is the document your compliance program needs to match, not the framework law itself.

What the Executive Regulations are reported to set for DNFBPs

AreaReported in the Executive Regulations
Beneficial ownershipReported as a 25% shareholding/voting-rights threshold, with fallback to the senior managing official (confirm against the Resolution)
CDD trigger thresholdsReported as AED 55,000 for occasional transactions and AED 3,500 for wire transfers (confirm against the Resolution). For some DNFBP sectors, such as dealers in precious metals and stones and real estate, AED 55,000 is also tied to cash-transaction reporting, a separate duty from CDD. Confirm which applies to you
ScopeVirtual asset service providers brought explicitly within the regulated framework, alongside the existing DNFBP categories (real estate, precious metals and stones, corporate service providers, auditors/accountants, lawyers/notaries)

None of this is a wholesale change in philosophy — risk-based CDD, beneficial-ownership identification and suspicion-based reporting were already the model under the 2018 law. The figures in the table are reported as restated in the Executive Regulations; we have not confirmed which of them, if any, are new compared with earlier guidance or the 2018 regime.

Expanded FIU powers: postponement, suspension and freezing

Federal Decree-Law No. 10 of 2025 gives the FIU a materially stronger set of tools than the 2018 law did: the power to postpone a suspicious transaction on an urgent basis and to suspend it or freeze funds for limited periods set in the law (secondary sources report 10 working days and 30 days; confirm the exact periods against the Decree-Law text), independent of the separate sanctions-list freezing regime covered in our 24-hour rule guide. If a reporting entity receives a postponement, suspension or freeze instruction from the FIU under this power, that is a direct order to comply with, separate from and in addition to your own STR/SAR filing duty — see our goAML filing guide for how the underlying report gets filed.

A reporting name changed: FFR to CNMR

A smaller but practically important change: the report that used to be called the Funds Freeze Report (FFR) for a confirmed sanctions-list match is now referred to throughout current UAE goAML guidance as the Confirmed Name Match Report (CNMR). The underlying obligation — report a confirmed match within five business days of freezing — hasn't changed; only the name has. If your internal procedures or training materials still say "FFR," update the terminology so staff recognise the current form on goAML.

Country-risk lists keep moving

The Ministry of Economy periodically updates the lists of FATF high-risk and increased-monitoring jurisdictions that feed directly into CDD and enhanced due diligence decisions (see our risk assessment guide for how geographic risk factors into scoring). An update we have seen cited is Circular No. (1) of 2026 (reported as issued 11 March 2026), but we could not re-verify its text, so check the Ministry's website for the current circular. These lists move independently of the main legislative changes above, and a stale country-risk list quietly undermines an otherwise-compliant CDD program.

What this means for your compliance program, practically

  1. Re-point every policy document that still cites Federal Decree-Law No. 20 of 2018 or the pre-December-2025 thresholds to the current law and Executive Regulations.
  2. Check beneficial-ownership files against the reported 25% threshold (confirm it against the Resolution), and backfill documentation for structures where that wasn't previously recorded clearly.
  3. Update terminology in training and templates — CNMR, not FFR.
  4. Re-check your high-risk-country list against the latest Ministry of Economy circular, not whatever list you last updated.
  5. Know the FIU's postponement/suspension/freeze powers exist, so an instruction under them doesn't come as a surprise to whoever receives it.
How groAML handles this

groAML's risk ruleset carries its own effective-date and version stamp tied to the current Executive Regulations, and its sanctions lists refresh automatically, so a change like this one doesn't wait for someone to notice a policy document is out of date.

See how it works

How we keep this page current

This guide is checked against secondary legal and compliance sources (law-firm and compliance-publisher commentary), and we have not re-verified every figure against the primary text of the Decree-Law, the Executive Regulations or regulator guidance. The "Updated" date at the top of this page is the date of that last check, not just the last time the wording changed. Where we could not confirm a figure against primary text, we say so. Where we could only find a claim in a single source, or sources disagreed on specifics, we've either left it out or described it in general terms rather than stating an unverified figure as fact.

Frequently asked questions

Do I need to re-paper every existing customer file because of the new law?
Not automatically, but you do need to re-check your CDD thresholds, beneficial-ownership documentation and risk methodology against the new Executive Regulations, and update anything that no longer meets them — particularly beneficial-ownership evidence, since the Executive Regulations are reported to restate a 25% threshold (confirm against the Resolution text).
Is Cabinet Decision No. 74 of 2020 (the sanctions freezing rule) still in force?
As far as we are aware, yes. It sits alongside, not underneath, Federal Decree-Law No. 10 of 2025 — it implements the UN Security Council terrorism-list regime specifically. Check the EOCN's website for the current version of its guidance; our 24-hour rule guide describes the process in general terms.
What actually happens if I keep relying on guidance written for the old 2018 law?
The specific numbers to re-check are the CDD thresholds, the beneficial-ownership percentage, and references to report names (the Funds Freeze Report is now the CNMR). A policy document that still cites Federal Decree-Law No. 20 of 2018 as current law, or that doesn't reflect the Executive Regulations in force from 14 December 2025, is overdue for a review.
How often does this page get updated?
It's reviewed each time something material changes in UAE AML/CFT law or regulatory guidance, and the “Updated” date above always reflects the last check — not the last time we happened to edit the prose.

Sources

  1. Federal Decree-Law No. (10) of 2025: A Practical Guide for DNFBPs and High-Risk Entities, Lexology
  2. Cabinet Resolution No. 134 of 2025 on the Executive Regulations of Federal Decree-Law No. 10 of 2025, UAE Cabinet / Central Bank of the UAE Rulebook. In force 14 December 2025
  3. Circular No. (1) of 2026 on Updating the Lists of High-Risk Countries, Countries Subject to Increased Monitoring, and Related Measures, UAE Ministry of Economy and Tourism. Reported as issued 11 March 2026
  4. The UAE's AML Framework: Navigating a New Era of Financial Crime Compliance in 2026, Al Tamimi & Company
  5. A History of AML Regulations in UAE, AML UAE (amluae.com)

This guide is general information, not legal advice. It reflects the sources listed above as of 4 Oct 2026. Check the current EOCN guidance and confirm with your supervisory authority or a UAE-qualified adviser how these obligations apply to your business.

Sanctions & TFS

The 24-hour freezing rule: a practical guide to sanctions screening for UAE DNFBPs

Which lists trigger the 24-hour freeze, what to do in the first day after a match, how to report it on goAML, and how to build a screening process that holds up in an inspection.

11 min read
 CDD & KYC

Customer due diligence for UAE DNFBPs: identity, beneficial ownership and the risk-based approach

What CDD and KYC actually require in practice: verifying identity, tracing beneficial ownership to a natural person, when a customer needs simplified, standard or enhanced due diligence, and the ongoing monitoring that doesn't stop once onboarding is done.

11 min read
 goAML reporting

STR and SAR filing on goAML: a practical guide for UAE DNFBPs

What goAML actually is, the real difference between an STR and an SAR, what triggers a filing obligation, realistic timelines, and the record-keeping duty that goes with every report you file.

10 min read

Make the 24-hour rule routine

groAML screens against the UAE Local Terrorist List and the UN Consolidated List, matches Arabic names properly, and keeps a dated record of every check, match and decision.

See how groAML works Talk to Grovisor