Cabinet Resolution No. (134) of 2025chapter by chapter

Article 2Chapter One: Scope / Financial institutions

The AML/CFT regulations apply to any commercial activity involving financial transactions such as deposit taking, lending, and money exchange.

Article 3Chapter One: Scope / DNFBPs

Designated DNFBPs, including real estate brokers and legal professionals, must adhere to AML regulations for certain transactions.

Article 4Chapter One: Scope / Virtual asset activities

Virtual asset activities include exchanges of virtual assets, transfers, safekeeping, and related financial services as established by the Supervisory Authority.

Article 5(1)Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Two: Risk Identification and Mitigation

Financial institutions, DNFBPs and VASPs must identify, manage and document crime risks proportionately, considering customer, geographic, product, transaction and channel factors and National Risk Assessment results.

Article 5(2)-(4)Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Two: Risk Identification and Mitigation

FIs, DNFBPs and VASPs must mitigate identified risks with Senior Management-approved controls, apply enhanced due diligence to high risks, and may simplify due diligence for low risk.

Article 6Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Financial institutions, DNFBPs and VASPs must verify customer and beneficial owner identity before or during relationship establishment, with low-risk cases verifiable shortly after establishment under customer due diligence rules.

Article 7Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Customer due diligence applies on new business relationships, suspected crime, or doubtful prior identification; FIs at AED 55,000 and VASPs at AED 3,500 occasional transactions.

Article 8Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Financial institutions, DNFBPs and VASPs must conduct ongoing monitoring of transactions against customer knowledge and source of funds, and keep customer due diligence records current, especially for high-risk customers.

Article 9Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

FIs, DNFBPs, and VASPs are required to identify and verify customer identity using reliable sources and understand the customer's ownership and business purpose.

Article 10Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Financial Institutions, DNFBPs, and VASPs must identify and verify the Beneficial Owner based on ownership thresholds and control mechanisms.

Article 11-12Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Financial institutions need not identify shareholders of listed companies with adequate disclosure, but must obtain, verify at payout, and risk-rate life insurance beneficiaries, applying enhanced due diligence to high-risk legal person beneficiaries.

Article 13Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

Customer due diligence must be applied to existing customers and business relationships as of the Resolution's entry into force, based on materiality and risk, ensuring previously obtained data is adequate.

Article 14-15Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Three: CDD and Beneficial Owner Identification

FIs, DNFBPs, and VASPs must apply CDD and avoid transactions with unregulated entities, filing STRs if unable to perform CDD.

Article 16Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Four: Politically Exposed Persons

FIs, DNFBPs and VASPs must identify foreign PEPs, obtain Senior Management approval, establish source of funds and wealth, and monitor enhanced; domestic PEP measures apply, and life insurers must check beneficiary PEP status before payout.

Article 17Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Five: Suspicious Transaction Reports

FIs, DNFBPs and VASPs must establish suspicion indicators for identifying crimes, keeping them updated as methods evolve, following Supervisory Authority instructions.

Article 18Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Five: Suspicious Transaction Reports

Entities must file a Suspicious Transaction Report with the Financial Intelligence Unit immediately upon suspicion of criminal proceeds, providing all available information.

Article 19Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Five: Suspicious Transaction Reports

FIs, DNFBPs, VASPs and their directors, officers and employees are prohibited from tipping off customers or others that a suspicious transaction report has been or will be filed or that an investigation is underway.

Article 20Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Six: Reliance on a Third Party

Firms, DNFBPs and VASPs may rely on a regulated, supervised third party for customer due diligence but remain responsible for accuracy and must obtain CDD data immediately.

Article 21Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Seven: Internal Supervision

Financial institutions, DNFBPs and VASPs must maintain Senior Management-approved anti-crime policies covering customer due diligence, suspicious transaction reporting, compliance officer appointment, staff fitness screening, training and independent audit testing.

Article 22Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Eight: Compliance Officer

Financial institutions, DNFBPs and VASPs must appoint an independent, competent management-level Compliance Officer who reviews suspicious transaction reports, reports periodically to Senior Management, and cooperates with the Supervisory Authority.

Article 23Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Nine: High-Risk Countries

Financial institutions, DNFBPs and VASPs must apply proportionate enhanced due diligence to persons from high-risk countries and apply countermeasures required by supervisory authorities or the National Committee.

Article 24Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Ten: New Technologies

Financial institutions, DNFBPs and VASPs must identify and assess money laundering, terrorist financing and proliferation financing risks from new products, practices, delivery mechanisms and technologies before launch, and apply mitigating measures.

Article 25Chapter Two: FIs, DNFBPs, VASPs and NPOs / Division Eleven: Record-Keeping

FIs, DNFBPs, and VASPs must retain transaction records and CDD documentation for at least five years for compliance purposes.

Article 26Part Two: Obligations Specific to Financial Institutions / Division One: Correspondent Banking

Financial Institutions must perform due diligence before establishing correspondent banking relationships, ensuring thorough risk assessments and management approvals.

Article 27Part Two: Obligations Specific to Financial Institutions / Division Two: MVTS

Money or value transfer service (MVTS) providers must be licensed or registered, keep an updated agent list available to authorities, and include and monitor agents in anti-crime programmes.

Article 28Part Two: Obligations Specific to Financial Institutions / Division Three: Wire Transfers

Financial institutions must verify originator information on international wire transfers of AED 3,500 or more, include required originator and beneficiary data, and not execute non-compliant transfers.

Article 28(5)Part Two: Obligations Specific to Financial Institutions / Division Three: Wire Transfers

For domestic wire transfers, originating financial institutions may include only an account number or unique reference, but must provide full data within three Working Days of request.

Article 29Part Two: Obligations Specific to Financial Institutions / Division Three: Wire Transfers

Intermediary financial institutions must ensure originator and beneficiary information accompanies international wire transfers, keep records when technical limits apply, and apply risk-based policies to suspend or reject incomplete transfers.

Article 30Part Two: Obligations Specific to Financial Institutions / Division Three: Wire Transfers

Beneficiary financial institutions must identify international wire transfers missing required information, verify beneficiary identity for transfers of AED 3,500 or more, and apply risk-based reject, suspend or execute decisions.

Article 31Part Two: Obligations Specific to Financial Institutions / Division Three: Wire Transfers

MVTS providers must comply with wire transfer rules directly or via agents, and for cross-border cases weigh both states' information when filing suspicious transaction reports with the relevant FIU.

Article 32-33Part Two: Obligations Specific to Financial Institutions / Division Four: Financial Groups

Financial groups must implement group-wide anti-crime programmes, sharing customer and STR-related information with group compliance functions, and foreign branches must apply UAE-consistent measures where host rules are weaker.

Article 34Chapter Two / Part Three: Non-Profit Organizations

Non-Profit Organizations must implement risk-based measures against terrorism financing and maintain accountability and transparency policies in cooperation with the Supervisory Authority.

Article 36Chapter Two / Part Five: Virtual Asset Service Providers

Persons conducting virtual asset service provider activity in the UAE must be licensed or registered, and VASPs must obtain, retain and transmit originator and beneficiary information for transfers.

Article 38(1)Chapter Three: Transparency and Beneficial Ownership

Companies must obtain and retain basic and beneficial ownership information, update it within fifteen working days of any change, and keep the shareholder register within the State unless exempt.

Article 38(2)-(4)Chapter Three: Transparency and Beneficial Ownership

Companies must give beneficial ownership information to authorities and regulated entities without delay, and must not issue bearer shares or warrants.

Article 39Chapter Three: Transparency and Beneficial Ownership

Nominee directors and nominee shareholders must disclose their nominee status and nominator identity to the company, and notify any change within fifteen working days.

Article 40Chapter Three: Transparency and Beneficial Ownership

The Registrar, companies, their managers or liquidators, and others involved in dissolution must retain beneficial ownership and related records for at least five years after dissolution or cessation of customer status.

Article 41(2)-(4)Chapter Three: Transparency and Beneficial Ownership / Part Two: Legal Arrangements

Trustees of legal arrangements must retain accurate beneficial owner information, update it within fifteen working days of changes, keep records five years, and disclose their status to financial institutions.

Article 42Chapter Three: Information access / Secrecy

Banking and professional secrecy cannot prevent information sharing between financial institutions regarding third-party reliance and between concerned authorities under the decree-law.

Article 51(1),(3)-(4)Chapter Six: Provisional Measures

FIs, DNFBPs, and VASPs must suspend transactions related to suspected crimes and freeze suspected funds upon the Unit's order, without prior notice.

Article 51(7)-(8)Chapter Six: Provisional Measures / Frozen funds

Financial institutions must notify owners of frozen funds and provide documentation proving transaction integrity upon receiving a freezing order.

Article 54(2),(5)Chapter Six: Provisional Measures

Financial institutions and VASPs must place frozen funds in interest-bearing accounts at market rates, and no FI, DNFBP or VASP may dispose of frozen or seized funds without authorisation.

Article 25(1)-retRecord Retention — Records of domestic and international financial and cash transactions and commer

Records of domestic and international financial, cash and commercial dealings must be retained for a minimum of five years from transaction completion or relationship termination.

Article 25(2)-retRecord Retention — CDD and ongoing monitoring records, account files, business correspondence, ID c

AML records including CDD files, STRs and recordings must be retained minimum five years from the latest of relationship termination, inspection, investigation completion or final judgment.

Article 40-retRecord Retention — Company basic information, beneficial owner and nominee records (Registrar, comp

Company basic information and beneficial owner and nominee records must be kept at least five years after dissolution or cessation as a customer.

Article 41(3)-retRecord Retention — Legal arrangement beneficial owner and basic information held by trustees

Trustees must retain records of the legal arrangement's beneficial owner for a minimum of five years after ending their dealings.