Everything You Need to Know About AML Laws for VASPs in UAE
AML Laws for VASPs in UAE: Key Highlights
Virtual Asset Service Providers (VASPs) in the UAE are required to establish and maintain a strong AML/CFT/CPF compliance framework under Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025. Regulatory expectations are also influenced by the applicable licensing authority and supervisory jurisdiction.
For VASPs, compliance goes beyond basic customer onboarding checks. Full adherence to AML Laws for VASPs in UAE must include wallet risk evaluation, counterparty risk, sanctions screening, continuous transaction monitoring, escalation procedures, and legally defensible record-keeping throughout the entire customer lifecycle.
Put an AML Policy in Place That Meets UAE Standards
Custom AML policies and procedures aligned with UAE AML law and supervisory expectations for auditors and accountants.
Virtual Asset Services Covered Under AML Laws for VASPs in UAE
This guide is intended for UAE-based or UAE-facing virtual asset businesses that fall within the VASP regulatory perimeter. It is relevant to senior management, MLROs, compliance teams, operations departments, and product leaders.
The AML laws apply to VASPs conducting the following activities:
- Exchange between Virtual Assets and fiat currencies
- Exchange between one or more types of Virtual Assets
- Transfer of Virtual Assets
- Safekeeping or administration of Virtual Assets, or tools enabling control over Virtual Assets
- Financial services related to an issuer’s offer or sale of Virtual Assets, or participation in such offers
- Any additional activity determined by a resolution of the Supervisory Authority in coordination with the National Committee
AML Laws Applicable to VASPs in the UAE
Federal AML / CFT Legal Instruments:
The following federal laws and cabinet resolutions form the primary AML framework:
- Federal Decree-Law No. (10) of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing
- Cabinet Resolution No. (134) of 2025 – Executive Regulations of Federal Decree-Law No. (10) of 2025
- Federal Law No. (7) of 2014 on Combating Terrorism Offences
- Cabinet Resolution No. (74) of 2020 – Regulation of Terrorist Lists and UN Security Council Implementation
- Cabinet Resolution No. (71) of 2024 – Violations and Administrative Penalties (MoJ & MoE Supervised Entities)
- Cabinet Decision No. (109) of 2023 – Beneficial Owner Procedures
- Cabinet Resolution No. (132) of 2023 – Administrative Penalties for Beneficial Owner Violations
UAE National Risk Assessment:
- UAE ML/FT National Risk Assessment
FATF Guidance Relevant to VASPs:
- Targeted Update on Implementation of FATF Standards on Virtual Assets and VASPs – 9 July 2024
- Updated Risk-Based Approach Guidance for Virtual Assets and VASPs – October 2021
- Second 12-Month Review of Revised FATF Standards – July 2021
- NAMLCFTC Public-Private Partnership Report on Criminal Use of Virtual Currencies
Common Regulatory Guidance for All Reporting Entities Including VASPs:
- Guidance on Targeted Financial Sanctions (EOCN) – July 2025
- Proliferation Finance Institutional Risk Assessment Guidance – December 2023
- Terrorist and Proliferation Financing Red Flags – December 2023
- Counter Proliferation Financing Guidance – November 2022
- Joint Guidance on Combating Unlicensed VASPs – November 2023
- Joint Guidance on Satisfactory / Unsatisfactory Practices – June 2021
- FIU Strategic Analysis Report on Terrorist Financing – May 2025
AML/CFT/CPF Legal Framework for VASPs in Dubai:
VASPs operating in or from Dubai fall under the supervision of the Virtual Asset Regulatory Authority (VARA). These entities must comply with VARA’s Compliance and Risk Management Rulebook in addition to federal AML laws, cabinet resolutions, national risk assessments, and FATF standards.
AML/CFT/CPF Legal Framework for VASPs in the UAE (Except Dubai):
VASPs operating outside Dubai are supervised for AML purposes by the Capital Market Authority (CMA). In addition to federal requirements, they must adhere to CMA-issued guidelines and circulars, including:
- CMA AML/CFT Guidelines – Board Decision No. (13/Chairman) of 2021, Chapter 5
- AML/CFT and Illegal Organisations Guidelines for Financial Institutions – July 2023
- Regulations of Virtual Assets and VASPs – 2023
- CMA Examination Observation Circulars
- Semi-Annual AML/CFT Minimum Reporting Standards – 2023
- CMA Instructions for 2024 Annual AML/CFT & TFS Risk Assessment
- CMA Questions & Answers – NRA
Train Your Team on UAE AML Obligations
Role-based AML training for partners, staff, and MLROs with practical, regulator-ready, and audit-proof.
AML/CFT/CPF Compliance Requirements Under AML Laws for VASPs in UAE
To effectively comply with AML Laws for VASPs in UAE, legal obligations should be translated into an operational framework consisting of five key control layers:
1. Governance and Oversight:
Defined accountability structures, policy ownership, approval hierarchies, and management reporting mechanisms.
2. Risk Assessment Architecture:
Enterprise-wide and customer risk assessment methodologies aligned with UAE regulatory and risk guidance.
3. Preventive Controls:
Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), sanctions screening, and structured onboarding processes with documented justifications.
4. Detective and Escalation Controls:
Transaction monitoring, alert review procedures, internal escalation channels, and suspicious activity reporting readiness.
5. Assurance and Evidence:
Recordkeeping standards, employee training, periodic testing, issue tracking, and remediation documentation.
Step-by-Step AML Implementation Framework for VASPs
Step 1: Establish a Legal Obligations Register
Map each AML obligation to its source regulation, control objective, responsible owner, and required evidence.
Step 2: Develop a Risk Methodology
Create enterprise and customer risk-scoring models reflecting virtual-asset-specific threats.
Step 3: Operationalise Onboarding Controls
Convert AML policies into workflow-based onboarding procedures with clear EDD triggers and approval checkpoints.
Step 4: Calibrate Monitoring and Screening Systems
Implement risk-based monitoring scenarios and structured alert-handling standards.
Step 5: Enhance Escalation Quality
Maintain structured case documentation and defined decision-making governance.
Step 6: Conduct Testing and Remediation
Perform periodic control testing and close findings with verifiable evidence.
Step 7: Strengthen Management Information Reporting
Track key metrics such as alert ageing, false-positive ratios, backlog volumes, and escalation outcomes.
FAQs on AML Laws for VASPs in UAE
In practical application, AML Laws for VASPs in UAE require Virtual Asset Service Providers to establish and maintain a risk-based AML/CFT/CPF compliance framework. This framework must cover customer due diligence, transaction monitoring, sanctions screening, escalation protocols, regulatory reporting, and defensible record-keeping, all supported by clear governance and documented evidence.
From an operational perspective, AML laws define the legal obligations and enforcement authority, while AML regulations and supervisory frameworks explain how those obligations should be implemented, monitored, and evidenced in day-to-day compliance operations.
No. Compliance obligations under AML Laws for VASPs in UAE continue throughout the entire customer lifecycle. Ongoing monitoring, sanctions screening, internal escalation, and the quality of suspicious activity reporting remain essential components beyond the onboarding stage.
Alignment with National Risk Assessment (NRA) and Sector Risk Assessment (SRA) guidance is important because these frameworks provide risk intelligence and sector-specific threat indicators. This enables VASPs to design proportionate, risk-based controls and justify enhancements or intensified monitoring where higher risks are identified.
Strengthen AML Compliance Beyond goAML Registration
Implement AML software, managed KYC services, and ongoing compliance support tailored for accounting and audit firms in the UAE.