UAE Cabinet Resolution No. 134 of 2025 - A Practical Guide
UAE Cabinet Resolution No. 134 of 2025 – Quick Overview
Topic | Practical Takeaway for Regulated Entities |
What it is | Cabinet Resolution No. 134 of 2025 is the executive regulation implementing Federal Decree Law No. 10 of 2025 |
Effective date | In force from 14 December 2025 |
What it replaced | Repeals the earlier executive framework under Cabinet Resolution No. 10 of 2019 |
Coverage | Applies to Financial Institutions, DNFBPs, and VASPs with expanded PF focus |
Key compliance shift | Stronger expectations for risk-based AML/CFT systems, governance, monitoring, and reporting quality |
Important expansion | Explicit inclusion of Proliferation Financing and broader sector application, including gaming-related DNFBP touchpoints referenced in market commentary |
Regulatory context | Must align with DIFC, ADGM, VARA, CMA, MOET, and MOJ regulatory environments |
Put an AML Policy in Place That Meets UAE Standards
Custom AML policies and procedures aligned with UAE AML law and supervisory expectations for auditors and accountants.
Why Cabinet Resolution No. 134 of 2025 Is Important Now
If Federal Decree Law No. 10 of 2025 is the legal foundation of the UAE’s new AML regime, Cabinet Resolution No. 134 of 2025 functions as the operational rulebook.
In simple terms, the Decree Law defines “what” must be done, while the Cabinet Resolution defines “how” it must be implemented.
For compliance teams, the focus has shifted from merely having policies to demonstrating that controls are proportionate, effective, and evidence based.
Relationship Between Federal Decree Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025
The structure of UAE AML legislation can be understood as follows:
- Federal Decree Law No. 10 of 2025 establishes the primary AML/CFT/CPF legal obligations.
- Cabinet Resolution No. 134 of 2025 provides the executive regulations for practical implementation.
- The 2025 Resolution supersedes the 2019 executive framework.
For boards and senior management, this creates a direct obligation to ensure AML/CFT operating models are updated comprehensively, not just reworded legally.
Scope and Applicability Under Cabinet Resolution No. 134 of 2025
From a practical compliance perspective, the resolution has broad sector coverage, including:
- Financial Institutions
- Designated Non-Financial Businesses and Professions (DNFBPs)
- Virtual Asset Service Providers (VASPs)
Market-facing commentary also highlights scope expansion through explicit Proliferation Financing integration and DNFBP perimeter developments relevant to gaming-related activities, requiring careful licence and business-line applicability checks.
Core Compliance Themes Reinforced by Cabinet Resolution No. 134 of 2025
Risk-Based AML/CFT and PF Control Design
The resolution emphasizes a risk-based framework, not a checklist. Controls should be designed around:
- Customer risk
- Product and service risk
- Transaction behaviour
- Delivery channel exposure
- Geography and sanctions exposure
- Proliferation Financing vulnerabilities
A generic template is unlikely to meet supervisory expectations.
Governance, Accountability, and Senior Oversight
Accountability must be visible and documented. Senior management should evidence:
- Clear ownership of AML/CFT and PF controls
- Periodic effectiveness reviews
- Risk-prioritised remediation decisions
- Timely escalation of high-risk findings
Stronger CDD, EDD, and Beneficial Ownership Justification
Institutions must show why conclusions were reached, not just that checks occurred.
UBO logic, risk scoring, and EDD triggers must be consistent, logical, and auditable.
Monitoring Quality Over Alert Quantity
The resolution encourages a shift from alert-heavy models to intelligence-driven monitoring, improving detection quality and reducing operational noise.
STR Decision Quality and Documentation Discipline
Suspicious Transaction Reporting remains a key outcome. Investigations should be:
- Chronology-based
- Fact-driven
- Clearly reasoned
- Supported by approval trails
Integration of PF and Sanctions into Daily Operations
PF and sanctions controls must be embedded across:
- Onboarding
- Screening
- Transaction reviews
- Escalation workflows
- Governance reporting
Regulatory Mapping Across UAE Jurisdictions
AML obligations are not jurisdiction neutral. Firms operating in multiple environments must align with:
- DIFC governance and regulatory requirements
- ADGM rulebook expectations
- VARA obligations for virtual assets
- CMA standards for capital markets
- MOET oversight for DNFBPs
- MOJ requirements for legal and professional services
Best practice involves a unified AML architecture with tailored procedures for each regulatory and legal entity.
Immediate Action Steps for Firms
Step 1: Legal-to-Control Mapping
Map each obligation to policies, procedures, systems, ownership, and evidence.
Step 2: AML/CFT/PF Gap Assessment
Evaluate effectiveness across EWRA, CDD/EDD, UBO, monitoring, sanctions, PF, and STR workflows.
Step 3: Monitoring and Screening Recalibration
Tune rules based on actual transaction behaviour and investigation results.
Step 4: Investigation and Reporting Upgrades
Standardise documentation, escalation logic, and approval frameworks.
Step 5: Board and Senior Management Strengthening
Provide dashboards highlighting risk concentration, control performance, and remediation status.
Step 6: Role-Based Training Delivery
Train frontline staff, operations, compliance teams, and leadership on decision quality and evidence standards.
Common Implementation Mistakes and Corrective Measures
- Treating Implementation as Legal Drafting
Fix: Approach it as a control transformation programme. - Using Generic Procedures Across Sectors
Fix: Tailor controls to business model and risk profile. - High Alert Volume with Low Analytical Value
Fix: Continuously measure and tune monitoring performance. - Weak Remediation Ownership
Fix: Assign accountable owners with timelines and escalation triggers. - Limited Management Visibility
Fix: Establish board-level reporting linked to risks and unresolved issues.
Train Your Team on UAE AML Obligations
Role-based AML training for partners, staff, and MLROs with practical, regulator-ready, and audit-proof.
Board-Level Readiness Questions
Senior leadership should ask:
- Which AML/CFT and PF risks have increased since implementation?
- Which controls are least effective based on testing evidence?
- Are CDD/EDD and UBO decisions consistent across business units?
- Do STR investigations meet quality and timeliness expectations?
- Are sanctions and PF controls fully integrated?
- Can high-risk findings be evidenced as closed with audit trails?
These questions reduce governance blind spots before supervisory reviews.
Final Takeaway on UAE Cabinet Resolution No. 134 of 2025
Cabinet Resolution No. 134 of 2025 acts as the implementation engine of the UAE’s updated AML regime. Organisations adopting structured, risk-based, and evidence-supported compliance models will be better positioned from regulatory, operational, and reputational standpoints.
For firms operating across DIFC, ADGM, VARA, CMA, MOET, and MOJ environments, this is the appropriate time to transition from fragmented compliance efforts to an integrated AML/CFT/PF control architecture.
UAE Cabinet Resolution No. 134 of 2025 FAQs
Cabinet Resolution No. 134 of 2025 is the executive regulation that implements the UAE’s New AML Law under Federal Decree Law No. 10 of 2025. It establishes the practical AML/CFT and Proliferation Financing (PF) compliance expectations that regulated entities must follow.
Federal Decree Law No. 10 of 2025 sets the legal foundation, while Cabinet Resolution No. 134 of 2025 provides the operational and procedural guidance on how those legal obligations should be carried out in day-to-day compliance activities.
Cabinet Resolution No. 134 of 2025 came into force on 14 December 2025.
Yes. It replaced the previous executive regulations issued under Cabinet Resolution No. 10 of 2019, introducing an updated compliance baseline aligned with the new UAE AML legislative framework.
The resolution applies to regulated entities that fall within UAE AML/CFT obligations, including:
- Financial Institutions
- Designated Non-Financial Businesses and Professions (DNFBPs)
- Virtual Asset Service Providers (VASPs)
Applicability depends on the entity’s licensing category and business activities.
Key priority areas include:
- Enterprise-wide risk assessment quality
- Risk-based CDD and EDD
- Beneficial ownership transparency
- Ongoing monitoring effectiveness
- Sanctions and Proliferation Financing Controls
- Suspicious Transaction Reporting (STR) quality
Yes. The framework places stronger attention on PF risk integration, requiring firms to align sanctions screening, escalation procedures, monitoring rules, and governance reporting accordingly.
A risk-based approach requires controls to be proportionate to actual exposure. This includes evaluating:
- Customer profile
- Product and service risk
- Geographic exposure
- Delivery channels
- Transaction behaviour
A uniform or “one-size-fits-all” framework is generally insufficient.
CDD and EDD processes must be evidence-driven and clearly documented. Organisations should be able to demonstrate:
- Why a specific customer risk rating was assigned
- Which enhanced checks were triggered
- How approvals and decisions were recorded
Beneficial ownership opacity can conceal ML/TF/PF risks. Firms are expected to maintain clear, defensible, and well-documented methods for identifying and verifying ultimate ownership and control structures.
Monitoring systems should generate meaningful intelligence rather than excessive alerts. Scenario design, calibration accuracy, investigation handling, and closure documentation are critical performance factors.
An effective STR framework is:
- Fact-based
- Chronology-driven
- Timely in submission
- Consistently documented
Case files should clearly show the trigger event, analysis performed, decision reasoning, reviewer oversight, and final reporting outcome.
Best practice is to maintain a unified enterprise-level AML/CFT framework, while tailoring procedures, approval routes, and evidence standards to each applicable regulator, jurisdiction, and licence type.
Frequent mistakes include:
- Treating implementation as policy editing only
- Applying generic controls across diverse sectors
- Weak documentation and audit trails
- Unclear ownership of remediation actions
- Limited board visibility into control effectiveness
Leadership oversight can be strengthened by asking:
- Where current ML/TF/PF risk concentration is highest
- Which controls are weakest based on testing evidence
- Whether CDD/EDD decisions are consistent across units
- Whether STR quality meets expected standards
- Whether high-risk findings are remediated with clear evidence trails
Strengthen AML Compliance Beyond goAML Registration
Implement AML software, managed KYC services, and ongoing compliance support tailored for accounting and audit firms in the UAE.