Federal Decree Law No. 10 of 2025: Explained UAE New AML Law

What Federal Decree Law No. 10 of 2025 Means for Regulated Entities

Federal Decree Law No. 10 of 2025 introduces a fundamental shift in UAE AML/CFT expectations. This is not a routine legislative refresh. It represents a move toward demonstrable and measurable compliance effectiveness.

Regulated entities are now expected to evidence:

• Stronger governance and internal controls
• Higher-quality risk assessments and risk-based decisions
• Clear and defensible customer due diligence and beneficial ownership analysis
• Effective ongoing monitoring aligned to business activity
• Improved quality and consistency of suspicious transaction reporting
• Robust audit trails showing how AML/CFT decisions were reached

Supervisory authorities are increasingly focused on whether AML/CFT controls operate effectively in day-to-day practice, rather than whether policies exist on paper.

Federal Decree Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 in Practice

The UAE AML framework must be read as a combined structure:

• Federal Decree Law No. 10 of 2025 sets out core legal obligations and enforcement standards.
• Cabinet Resolution No. 134 of 2025 provides implementation depth and operational guidance.

For AML/CFT teams, this means shifting the focus from drafting policies to demonstrating control performance. Policies, procedures, systems, and governance forums must align to a single objective: risk-based prevention, detection, escalation, and reporting.

Supervisory Context Across UAE Authorities

Implementation under the UAE New AML Law must reflect the relevant supervisory environment. Many organisations operate across multiple licensing regimes or customer segments, creating overlapping regulatory obligations.

Depending on business activities, AML/CFT frameworks may need to address expectations linked to:

• DIFC
• ADGM
• VARA (virtual asset activities)
• CMA (capital market participants)
• MOET (DNFBP-related obligations)
• MOJ (lawyers and legal professionals)

A practical approach is to maintain a single, coherent AML/CFT control architecture, while tailoring procedures, governance pathways, and evidence packs to each applicable regulatory context.

Core AML/CFT Priorities Under the UAE New AML Law

1. Enterprise-Wide Risk Assessment Must Drive Decisions

Under UAE AML law 2025, the EWRA is not a static document. It should directly inform onboarding standards, monitoring thresholds, review frequency, and escalation triggers.

An effective EWRA should clearly link:

• Customer and product risk
• Delivery channel risk
• Geographic and cross-border exposure
• Sanctions and proliferation financing risks
• Control effectiveness outcomes

2. CDD and EDD Must Be Risk-Led and Defensible

Customer due diligence and enhanced due diligence expectations require transparent decision logic. Firms should be able to clearly explain:

• Why a customer is rated low, medium, or high risk
• What enhanced controls apply as a result of that risk rating

Consistency and defensibility are key supervisory expectations.

3. Beneficial Ownership Must Be Clear and Auditable

Beneficial ownership remains a core pillar of UAE AML/CFT compliance. Customer files should clearly document:

• Ownership structures and control relationships
• Validation steps taken
• Escalation of unresolved or complex ownership issues

The ownership determination process should be traceable and review ready.

4. Ongoing Monitoring Must Reflect Business Reality

Ongoing monitoring under UAE AML requirements should be calibrated to actual customer and transaction behaviour. Generic or imported thresholds often result in poor outcomes.

Effective monitoring achieves a balance between:

• Meaningful alerts
• Manageable alert volumes
• High-quality investigations
• Timely and consistent decisions

5. STR Quality Is a Key Control Outcome

Suspicious transaction reporting quality depends on structured case handling and coherent narratives. An independent reviewer should be able to follow the full decision path from trigger to conclusion without ambiguity.

6. Sanctions and PF Controls Must Be Fully Integrated

Sanctions screening and proliferation financing controls should be embedded across onboarding, transaction monitoring, investigations, escalation, and governance reporting. These controls should not operate in isolation from core AML processes.