AML Regulations for Banks in UAE

Last Updated / Reviewed On: 07/07/2026

Protect your business with reliable and effective AML strategies with AML UAE.

Key Highlights

Banks are Licensed Financial Institutions under Federal Decree-Law No. 10 of 2025 and its Executive Regulations in Cabinet Resolution No. 134 of 2025, so CBUAE AML/CFT/CPF guidance for LFIs applies to them where relevant to their activities, products, customers, delivery channels and geographic exposure.
The Central Bank of the UAE is the primary AML supervisor for banks in mainland UAE and the commercial free zones. Banks in the DIFC and ADGM answer to the DFSA and FSRA and sit outside this guide.
The banking sector’s residual money laundering risk is rated medium-high in the national risk assessment, with an inherent risk of high, and its proliferation financing risk is medium-high, mainly through trade finance.
Core obligations run across every bank: risk assessment, customer due diligence, sanctions screening, transaction monitoring, record-keeping, and suspicious transaction reporting through goAML.
On top of the federal laws, the Central Bank issues a deep body of guidance for licensed financial institutions that shapes day-to-day banking compliance.
This article catalogues the whole framework and links up to the banks and financial institutions pillar for the wider view.

Banks are among the most important and closely supervised parts of the UAE financial system for anti-money laundering. They take deposits, lend, move money across borders, and finance trade, so many major money laundering, terrorist financing and sanctions typologies involve banks directly or indirectly. This guide sets out the AML regulations for banks in the UAE: who is in scope, who supervises them, the full legal framework that applies, and how the national risk assessments rate the banking sector’s money laundering, terrorist financing, and proliferation financing risk. It covers banks licensed by the Central Bank of the UAE in mainland UAE and the commercial free zones.

Question	Direct answer
Who supervises UAE banks for AML?	The CBUAE, for banks it licenses outside the DIFC and ADGM.
What is the main AML law?	Federal Decree-Law No. 10 of 2025.
What is the executive regulation?	Cabinet Resolution No. 134 of 2025.
Where are suspicious reports filed?	With the UAE FIU through goAML.
What are the main bank AML controls?	AML Programme consisting of ML/FT risk assessment, policy, controls, and procedures, customer due diligence, beneficial ownership checks, sanctions screening, transaction monitoring, STR and SAR reporting, record-keeping, governance and training.

What counts as a bank for AML purposes in the UAE?

Commercial banks

Commercial banks take retail and corporate deposits, lend, and provide payment, card, and everyday banking services. Their scale, their reach across the customer base, and their exposure to cash, wire transfers, and high-risk customers put them at the front line of AML risk and give them the deepest set of obligations.

Wholesale banks

Wholesale banks focus on corporate, institutional, and high-value business rather than retail customers. Their exposure runs through corporate structures, trade finance, and cross-border flows, which is where much of the sector’s proliferation financing and trade-based laundering risk concentrates.

Branches of foreign banks

Branches of foreign banks licensed by the Central Bank must run a full local AML programme, even where their head office operates its own global controls. They remain answerable to the Central Bank for their UAE activities and must meet the same core local AML/CFT/CPF obligations for their UAE activities, subject to the terms of their CBUAE licence.

AML Supervisory Authority for Banks in the UAE

Supervision of banks in mainland UAE and the commercial free zones rests with a single authority.

Central Bank of the UAE (CBUAE)

The Central Bank of the UAE licenses banks, supervises their AML programmes, issues the guidance that shapes their controls, and inspects them. It runs thematic reviews and skilled persons’ reviews of bank AML programmes and can impose administrative and financial penalties, restrict activities, or withdraw a licence for breaches. Banks in the DIFC and ADGM are supervised instead by the DFSA and FSRA and fall outside this guide.

UAE FIU and goAML

Banks in scope of this guide submit suspicious transaction and activity reports and related filings to the UAE Financial Intelligence Unit through goAML. Registration on goAML is a baseline obligation, and suspicious transaction reports, suspicious activity reports, and related filings are submitted through it. See our goAML registration guide for the practical steps.

AML Legal Framework Applicable to Banks in the UAE

The framework has four layers: the core federal laws, the guidance that applies to all reporting entities, the national risk assessments, and the Central Bank’s guidance for licensed financial institutions. This section catalogues each layer, grounded in the Banks CBUAE library. Because banks are Licensed Financial Institutions, every instrument addressed to LFIs applies to them.

Federal AML Laws and Executive Regulations Applicable to Banks in the UAE

These instruments are the legal foundation for every bank in scope.

Federal Decree-Law No. 10 of 2025 on AML, CFT and CPF

Federal Decree-Law No. 10 of 2025 is the principal statute governing anti-money laundering, counter-terrorist financing, and proliferation financing in the United Arab Emirates. It sets the core definitions, including money laundering, predicate offences, targeted financial sanctions, and suspicious transactions, and it recognises offences committed through digital systems, virtual assets, and cryptographic technologies. It establishes the Financial Intelligence Unit within the Central Bank as the independent body to which banks must submit all suspicious transaction reports exclusively, empowering the Unit to request information and freeze suspect funds. For banks, the Decree-Law is the source of their core duties, supervisory oversight, and administrative penalties, functioning as the layer beneath every subordinate regulation.

Cabinet Resolution No. 134 of 2025, the Executive Regulations

Cabinet Resolution No. 134 of 2025 issues the Executive Regulations of Federal Decree-Law No. 10 of 2025, translating the statute into the operating rules that financial institutions must follow. It carries over the Decree-Law definitions and adds concepts such as senior management, beneficial owner, reasonable measures, correspondent and payable-through accounts and wire transfers. It identifies in-scope activities, expressly including banking, securities, funds transfers, and money and currency exchange. The Regulations set the substantive obligations: a risk-based approach, customer due diligence, beneficial owner identification and verification, ongoing monitoring, and internal policies approved by senior management. For banks, this is the practical rulebook that supervisors test in examinations and enforcement.

Cabinet Resolution No. 109 of 2023 on beneficial owner procedures

Cabinet Resolution No. 109 of 2023 regulates the beneficial owner procedures for legal persons licensed or registered in the United Arab Emirates. It defines the real beneficiary as the natural person who ultimately owns or controls a legal person, whether directly or through a chain of ownership or other indirect means. It requires legal persons to maintain accurate information on their beneficial owners, identify board nominee members, and keep beneficial owner and shareholder registers updated, generally within fifteen days of changes. This matters to banks, which rely on ownership data to verify beneficial owners behind corporate customers. These procedures apply to legal persons licensed or registered in the State, including commercial free zones, but exclude the financial free zones, the DIFC and ADGM, which operate their own beneficial ownership regimes.

Cabinet Resolution No. 132 of 2023 on penalties for beneficial owner violations

Cabinet Resolution No. 132 of 2023 sets out the administrative penalties for violations of the beneficial owner procedures established under Cabinet Resolution No. 109 of 2023. It empowers the registrar to impose fines, under an annexed schedule of violations and penalties, on legal persons that fail to maintain accurate registers or provide required information. Consequences escalate: on a third violation, the registrar may suspend the commercial licence and close the premises until the fine is paid and the breach corrected. For banks, this reinforces why corporate customers must keep beneficial ownership data current. These penalties apply to legal persons licensed or registered in the State, including commercial free zones, but not to the financial free zones, the DIFC and ADGM, which follow their own regime.

Cabinet Resolution No. 74 of 2020 on terrorist lists and UNSC resolutions

Cabinet Resolution No. 74 of 2020 regulates the terrorist lists and governs how the United Arab Emirates implements United Nations Security Council resolutions on terrorism, its financing, and the proliferation of weapons of mass destruction. It provides for a local list issued by the Cabinet, gives effect to the Security Council sanctions lists, and defines designation, listing, and de-listing. Freezing measures must be applied without delay, within twenty-four hours. For banks, it establishes the core sanctions duties: registering on the Executive Office website for notifications, continuously screening customers, beneficial owners, and transaction parties against the lists, freezing any match without prior notice, and reporting promptly to the supervisory authority.

Federal Law No. 7 of 2014 on combating terrorism crimes

Federal Law No. 7 of 2014 on Combating Terrorism Crimes is the criminal statute that defines terrorist offences in the United Arab Emirates and fixes the penalties attached to them. It sets out concepts such as terrorist crime, terrorist purpose, terrorist organisation, and terrorist person, and it distinguishes conventional from nonconventional weapons, including toxins, pathogenic agents, and radioactive materials. Penalties reach life imprisonment and, in specified circumstances, the death penalty. Of direct relevance to banks is its treatment of terrorism financing: it penalises providing, collecting, preparing, or maintaining funds for a terrorist purpose, and addresses freezing suspect funds, including those deposited in financial institutions.

AML Guidance Applicable to All Reporting Entities

Beyond the core laws, the Central Bank, the UAE FIU and the Executive Office issue guidance, typologies and reporting materials that banks should consider where relevant to their AML/CFT/CPF obligations and risk exposure.

UAE FIU Regulation No. 1 of 2026 on Suspension and Freezing Powers, April 2026

UAE FIU Regulation No. 1 of 2026, dated April 2026, governs the postponement or suspension of suspicious transactions and the freezing of funds. Issued under the AML/CFT Decree-Law and its Executive Regulation, it applies to reporting entities, including financial institutions. It introduces the Postponement Suspicious Transaction Report, an urgent filing where funds suspected of crime risk imminent transfer, withdrawal or dissipation, with a monetary threshold that does not apply to higher threat offences, third party laundering, organised crime or terrorist financing. It defines a Suspension Order of ten working days and a Freezing Order of thirty days. For banks, it is a fast-track mechanism preserving funds at risk.

UAE FIU Strategic Analysis Report on Human Trafficking, April 2026

The UAE FIU Strategic Analysis Report on Human Trafficking, dated April 2026, analyses money laundering and related financial flows connected to human trafficking, drawing on suspicious transaction and activity reports filed with the Financial Intelligence Unit. It sets out objectives, methodology and scope, covering sexual exploitation, forced labour and organ removal. It identifies patterns, including child sexual abuse material, laundering of trafficking proceeds and convergence with other crime, and profiles subjects such as organised crime groups, foreign politically exposed persons and money mules. It assesses the vulnerability of sectors, including financial institutions, and develops indicators around customer profile, behaviour, transactions and due diligence. For banks, it links trafficking to behaviour.

Guidance on Targeted Financial Sanctions for Financial Institutions, DNFBPs and VASPs, March 2026

The Guidance on Targeted Financial Sanctions for Financial Institutions, DNFBPs and VASPs, issued by the Executive Office for Control and Non-Proliferation, was first published in January 2021 and last amended in March 2026. It clarifies reporting entities’ obligations under the UAE’s targeted financial sanctions framework, which prevents misuse of the financial system for terrorism financing, proliferation financing and sanctions evasion. It sets out four obligations: registering in the Notification Alert System, screening against the Local Terrorist List and United Nations Consolidated List, freezing assets without delay, and reporting measures taken. The March 2026 update renames the Funds Freeze Report as the Confirmed Name Match Report, defining compliant screening for banks.

Joint Guidance on the Compliance Officer and MLRO, 2026

The Joint Guidance on the Compliance Officer and Money Laundering Reporting Officer, issued in 2026 by the UAE Supervisory Sub-Committee, establishes a unified framework for the appointment, authority and responsibilities of the officer across regulated sectors. It applies to institutions supervised by the Central Bank of the UAE, the Securities and Commodities Authority, the Ministry of Justice and the Ministry of Economy and Tourism, building on Federal Decree-Law No. 20 of 2018, Cabinet Decision No. 10 of 2019 and the 2025 framework. Recognising the role as a cornerstone of compliance, it sets expectations on seniority, experience, independence and board access. For banks, it clarifies how to appoint a fit officer.

FIU Strategic Analysis Report on Terrorist Financing, May 2025

The FIU Strategic Analysis Report on Terrorist Financing, published in May 2025 and subtitled Terrorist Financing Typologies and Facilitators, is produced by the UAE Financial Intelligence Unit. It draws on data from January 2021 to December 2024, including suspicious transaction and activity reports, cases disseminated to authorities, counterpart requests and open source material. It explains how terrorist financing works and reviews global typologies. It sets out transactional patterns such as moving funds through banks, unlicensed hawala, corporate networks, trade-based financing, high-value goods, real estate, virtual assets and crowdfunding. It examines facilitators and concludes with risk indicators that help banks detect, trace and report suspicious terrorist financing activity.

goAML FAQs, April 2024

The goAML FAQs, version 2.1 dated 18 April 2024, are a practical question-and-answer guide published by the UAE Financial Intelligence Unit to help reporting entities use the goAML reporting system and its registration and access services. It addresses common problems users encounter when registering and logging in, providing step-by-step remedies. It walks through expired one-time passwords during the first login, pop-up authentication requiring the system-issued username with a Google Authenticator passcode, the correct login sequence, and resetting a forgotten password. It sets out whom to contact when errors persist. For banks, the FAQs reduce friction in reporting, helping compliance teams meet obligations without avoidable delays.

PF Institutional Risk Assessment Guidance for FIs, DNFBPs and VASPs, December 2023

The Proliferation Financing Institutional Risk Assessment Guidance, published in December 2023, sets out how banks and other financial institutions should assess and manage exposure to proliferation financing. It explains a methodology built around inherent risks, control effectiveness and residual risks, and identifies the risk categories and factors institutions should consider when scoring their business. It describes mitigating measures covering client onboarding, customer due diligence, enhanced due diligence, sanctions and adverse media screening, ongoing and transaction monitoring, suspicious activity reporting, and employee training. It provides a customer risk scoring questionnaire, elevated risk factors and worked case studies. For banks, it translates proliferation financing obligations into a practical framework for calibrating controls.

Terrorist and Proliferation Financing Red Flags Guidance, December 2023

The Terrorist and Proliferation Financing Red Flags Guidance, updated in December 2023, gives banks a consolidated list of indicators to identify suspicious terrorist financing and proliferation financing activity, including evasion of targeted financial sanctions imposed under United Nations Security Council Resolutions or local designations. It explains how sanctioned parties evade controls through renaming, intermediaries, front companies and alternative networks. After setting out the legal basis for reporting, it presents terrorist financing red flags, then proliferation indicators grouped into customer profile, account and transaction activity, maritime and trade finance categories. For banks, it is a working reference for front-line and compliance teams, sharpening detection and informing reporting decisions.

Suspicious Activity and Transaction Reporting Thematic Review, January 2023

The Suspicious Activity and Transaction Reporting Thematic Review, issued in January 2023, sets out the key findings and regulatory expectations from the 2022 AML/CFT examination of licensed financial institutions and designated non-financial businesses and professions. It focuses on the suspicious transaction and activity reporting framework and the transaction monitoring systems feeding it, and is read alongside existing reporting and monitoring guidance. Organised around regulatory expectations with acceptable and deficient practices, it covers governance, policies, risk-based deployment of monitoring controls, data management, alert review, case investigation and reporting decisions. It applies across banks, exchange houses, finance companies and payment service providers, giving banks a practical benchmark before inspection.

Counter Proliferation Financing Guideline, November 2022

The Counter Proliferation Financing Guideline, published in November 2022 by the Executive Office for Control and Non-Proliferation, supplements the wider Guidance on Targeted Financial Sanctions. It raises awareness among banks and other regulated entities of proliferation financing threats, risks and vulnerabilities, helping them identify, assess and mitigate those risks in line with Financial Action Task Force standards. It explains what proliferation financing means, its stages and the UAE framework, including the interagency mechanism and federal laws. It covers building this risk into a bank’s assessment, preventive measures such as enhanced due diligence, correspondent banking, trade finance and dual-use goods, staff training, and red flags, clarifying obligations under Security Council Resolutions.

goAML Web Submission Guide, July 2022

The goAML Web Submission Guide, issued by the UAE Financial Intelligence Unit in July 2022, sets out the steps to follow when submitting a report to the FIU through the goAML platform. It is addressed to the designated Compliance Officer or Money Laundering Reporting Officer of a registered reporting entity, or the deputy where the lead officer is unavailable. It provides an overview of report types, including the Suspicious Transaction Report and the Suspicious Activity Report covering attempted, non-executed transactions, plus Additional Information Files, Request for Information and High Risk Country reports. It explains accessing goAML and completing the report cover. For banks, it standardises reporting.

Joint Guidance on Combating the Use of Unlicensed Virtual Asset Providers, March 2022

The Joint Guidance on Combating the Use of Unlicensed Virtual Asset Providers in the UAE, issued in March 2022, is a joint publication of the UAE Supervisory Authorities, including the Central Bank of the UAE, the Securities and Commodities Authority and the Virtual Assets Regulatory Authority. Aligned with Financial Action Task Force guidance on a risk-based approach, it educates the public and regulated entities on the risks of unlicensed virtual asset service providers. It reminds banks of their anti-money laundering obligations, setting expectations on vigilance, due diligence, transaction analysis, controls and reporting. It provides red flags such as absent licences, no physical presence, unrealistic promises and pressure to invest quickly.

IEMS User Guide for Reporting Entities, March 2022

The IEMS User Guide for Reporting Entities, dated March 2022, is a practical manual from the UAE Financial Intelligence Unit for its Integrated Enquiry Management System. The system automates requesting information, implementing public prosecutions’ decisions and handling other anti-money laundering and counter-terrorist financing requests from domestic authorities, providing an end-to-end flow between the Unit, authorities and reporting entities. It explains how banks register and log in, reuse goAML credentials, and reach the system through the Services or eServices portals. It describes the dashboard, request management and the reply and attachments workflow, and the Admin, Maker and Checker roles. For banks, it shows how to action enquiries and freeze instructions.

goAML Pre-Registration Guide, March 2022

The goAML Pre-Registration Guide, issued by the UAE Financial Intelligence Unit in March 2022, explains how reporting entities secure access to the Services Access Control Manager, known as SACM, before reaching the goAML application to register and file suspicious reports. The application is available through a public portal for reporting entities not regulated by the Central Bank of the UAE, except hawaladars, while entities under various Supervisory Bodies follow the steps set out. It describes SACM as the gateway to the goAML environments, with access controlled by a time-based one-time password through Google Authenticator, and explains how to secure a personal Secret Key. For banks, correct pre-registration enables secure access.

goAML Registration Guide, March 2022

The goAML Registration Guide, issued by the UAE Financial Intelligence Unit in March 2022, sets out the steps an organisation follows when registering with the FIU on its reporting platform, goAML. It applies to registration as a reporting entity, stakeholder or supervisory body, and explains that all accountable and reporting entities in the United Arab Emirates, regardless of their regulator, must register to submit suspicious reports. It describes reaching the portal through the Services Access Control Manager, noting that Central Bank-regulated institutions require a dedicated MPLS link while others use the internet, then covers registration type, organisation and person data and access rights. For banks, correct registration underpins timely reporting.

Strategic Review on Targeted Financial Sanctions Case Studies, November 2021

The Strategic Review on Targeted Financial Sanctions Case Studies, dated November 2021, examines targeted financial sanctions reporting in the United Arab Emirates over the review period. It sits within the framework under which the UAE, through Cabinet Resolution No. 74 of 2020, implements United Nations Security Council Resolutions on terrorism, terrorist financing and the financing of the proliferation of weapons of mass destruction, including freezing measures and prohibitions on providing funds and services. It sets out its methodology, then classifies reports by source, suspicion and instruments involved, distinguishing terrorist financing from proliferation financing, with red flags and recommendations. For banks, it shows how sanctions-related suspicions arise and are reported.

Typologies on the Circumvention of Targeted Sanctions, November 2021

This typologies report, last amended in November 2021 and issued by the Executive Office, compiles cases showing how sanctioned persons, groups and entities attempt to circumvent targeted sanctions relating to terrorism and the proliferation of weapons of mass destruction. Drawing on public sources from the UAE and abroad, it presents methods used to evade United Nations Security Council Resolutions and the UAE’s national terrorist list. It groups typologies by channel and sector, covering banking services, money remitters, exchange houses, hawala, online payments, non-profit misuse, cash and gold smuggling, dual-use goods, virtual assets and legal entities. For banks, it turns evasion tactics into learning that strengthens screening, monitoring and reporting.

Update to the List of High Risk Jurisdictions, November 2021

This November 2021 decision of the National Anti-Money Laundering and Combatting the Financing of Terrorism and Financing of Illegal Organisations Committee updates the list of high-risk jurisdictions subject to a call for action, the list under increased monitoring, and the counter-measures to apply, replacing an earlier March 2021 decision. Addressed to the supervisory authorities and the Financial Intelligence Unit, it reflects the Committee’s mandate to identify high-risk countries and instruct supervisors to ensure due diligence is applied by financial institutions. For banks it matters because country risk is a core input to risk based controls, signalling which jurisdictions warrant enhanced due diligence and keeping risk assessments current.

Joint Guidance on Satisfactory and Unsatisfactory Practice, June 2021

The Joint Guidance on Satisfactory and Unsatisfactory Practice, issued in June 2021, is a joint publication of the UAE Supervisory Authorities, including the Central Bank of the UAE, the Dubai Financial Services Authority, the Financial Services Regulatory Authority, the Securities and Commodities Authority and the Ministries of Justice and Economy. Drawing on supervisory inspections between January 2020 and May 2021, it contrasts satisfactory and unsatisfactory practices in the anti-money laundering framework, targeted financial sanctions and counter proliferation financing. For banks it covers governance, risk assessment, three lines of defence, policies, training, the compliance officer role, onboarding, monitoring, due diligence, sanctions screening and suspicious transaction reporting, helping firms benchmark controls.

Typologies on the Circumvention of TFS, PF and WMD, May 2021

This typologies report, last amended in May 2021 and issued by the Executive Office, examines how sanctioned persons, groups and entities receive financing in violation or evasion of United Nations Security Council Resolutions on terrorism and the proliferation of weapons of mass destruction. It explains that targeted financial sanctions cover asset freezing and prohibitions on making funds available to designated parties. Organised by financing method, it addresses the misuse of banking services, money remitters, hawala, online payments, non-profit organisations and cash smuggling, and, for proliferation, banking sector abuse, cyberactivity, economic resources, trade and legal entities. For banks it details concrete evasion techniques, supporting stronger screening, monitoring and reporting.

goAML FAQs, September 2020

The goAML FAQs Guide, issued by the UAE Financial Intelligence Unit in September 2020, is a practical question and answer reference for reporting entities that use the goAML platform, through which suspicious reports are filed in the United Arab Emirates. It compiles the queries most commonly raised by users and gives step by step responses for tasks arising once an organisation is registered. It explains how to reset a forgotten password, update organisation details through the My Org Details menu, and change personal details, and describes delegation of reporting to a third party by the Money Laundering Reporting Officer, subject to Supervisory Body approval. For banks it resolves routine issues.

goAML Registration Guide Stage 2, September 2020

The goAML Registration Guide Stage 2, issued by the UAE Financial Intelligence Unit in September 2020, outlines the steps an organisation follows when registering with the FIU on its reporting platform, goAML. It applies to registration as a reporting entity, stakeholder or supervisory body, and confirms that all accountable and reporting entities in the United Arab Emirates, whatever their regulator, must register to submit suspicious reports, noting that since 27 June 2019, reports must be submitted electronically. It explains reaching the portal through the Services Access Control Manager, noting that Central Bank-regulated institutions need a dedicated MPLS link while others use the internet. For banks, registration enables lawful reporting.

Guideline on Grievance Procedures

The Guideline on Grievance Procedures is issued by the Executive Office for Control and Non-Proliferation, the authority receiving grievance requests related to the UAE Local Terrorist List and the United Nations Security Council Consolidated List, together the Sanctions Lists. It clarifies how requests are submitted, the types available and how they are reviewed. Under Cabinet Resolution No. 74 of 2020, it processes three types of requests: to remove or de-list a designation, to cancel or lift freezing measures, and to permit use of frozen assets. Procedures apply only to freezes based on Sanctions List designations. For banks, it explains the lawful routes customers use to challenge designations or access frozen assets.

Online Grievance System User Guide

The Online Grievance System User Guide is issued by the Executive Office for Control and Non-Proliferation, the authority receiving grievance requests related to the UAE Local Terrorist List and the United Nations Security Council Consolidated List, together the Sanctions Lists. The Executive Office launched the system to streamline submissions, and this manual walks users through the application form. It explains the steps for the three request types: de-listing, cancellation of freezing measures, and permission to use frozen funds. It covers identifying the aggrieved party, selecting the relevant lists and grievance type, and attaching documents. For banks, it explains the route through which affected customers challenge designations or access frozen assets.

Simple Guide to Subscribe to the EOCN Notification Alert System (NAS)

This short guide explains how to subscribe to the Notification Alert System operated through the Executive Office’s website, so that users receive timely updates to the sanctions lists applied in the United Arab Emirates. It notes that targeted financial sanctions rest on two lists, together the Sanctions Lists: the UAE Local Terrorist List issued by the UAE Cabinet, and the United Nations Consolidated List issued by the Security Council. The guide sets out where the lists can be accessed and gives step-by-step subscription instructions. For banks, it supports a core control: screening only works from current lists, and prompt notification helps them freeze without delay.

Emerging ML, TF and PF Risks and Trends in the Financial Sector

Emerging ML, TF and PF Risks and Trends in the Financial Sector, issued by the Supervisory Subcommittee, gives banks a current overview of the money laundering, terrorist financing and proliferation financing threats reshaping the sector. Responding to technological innovation, geopolitical shifts and evolving criminal methods, it is issued under Article 16 of Federal Decree-Law No. 10 of 2025. It examines emerging risks, including exploitation of artificial intelligence, greenwashing and ESG-related fraud, trade finance abused for proliferation financing, illicit virtual asset transactions in banking, and sanctions evasion. Banking case studies cover money mule networks, trade-based laundering and virtual asset conversion, highlighting typologies and red flags for risk assessments and controls.

Typologies in the Financial Sector

Typologies in the Financial Sector is a report produced jointly by the Supervisory Authorities Sub-Committee and the Financial Intelligence Unit, with the Executive Office and a pilot group of financial institutions. It shares money laundering, terrorist financing, sanctions, fraud, and bribery and corruption typologies observed in the market, several emerging during the COVID-19 pandemic, to help firms anticipate and mitigate risks beyond those in the National Risk Assessment. It examines proactive analysis, the increased use of unlicensed money service operators that balance books over time, and combinations of risk indicators, noting links to modern slavery. For banks, it is an early warning tool to refine monitoring and engage authorities.

NRA, SRA, and Other Important Guidelines for Banks

The UAE assesses its money laundering, terrorist financing, and proliferation financing risk at the national level, and banks must align their own business and enterprise-wide risk assessments with those findings.

UAE PF National Risk Assessment 2026

The UAE Proliferation Financing National Risk Assessment 2026 examines the country’s exposure to proliferation financing, meaning financing of weapons of mass destruction and evasion of targeted financial sanctions under United Nations Security Council resolutions on the Democratic People’s Republic of Korea and Iran. Prepared under the Financial Action Task Force’s revised Recommendation 1, it rates threats across mainland and free zone sectors; overall risk is medium-high. Banks are rated medium-high in the mainland, exposed through trade finance and open account transactions, while virtual asset service providers are high, and exchange houses and hawala are medium-high. Free zone banks are medium, maritime insurance medium, stored value medium-low. It shows where risk sits.

The table below summarises the residual risk ratings that the banking sector should reflect in its own risk assessment (from the UAE ML and TF National Risk Assessment 2024 and the UAE PF National Risk Assessment 2026).

UAE ML and TF National Risk Assessment 2024

The UAE Money Laundering and Terrorist Financing National Risk Assessment 2024 is the country’s second national assessment, prepared using the World Bank methodology by the National Committee. Drawing on data from 2019 to 2023, it rates threats, vulnerabilities and residual risks, including a sectoral assessment of financial institutions across the mainland and financial free zones. Overall money laundering residual risk is medium-high, with drug trafficking and fraud among the highest threats. The banking sector is rated medium-high, reflecting its attractiveness and exposure to fraud and third-party laundering. Exchange houses are medium-high, registered hawala high, finance companies and insurance medium, and securities medium to medium-high. It sets the baseline for banks.

Assessment	Banking sector residual risk
Money laundering and terrorist financing (NRA 2024)	Medium-high, on an inherent risk of high, with controls assessed as largely effective
Proliferation financing (PF NRA 2026)	Medium-high in the mainland, mainly through trade finance and open account transactions

Alongside the national assessments, sector risk assessments, red flag guidance, and typologies reports give banks the detail they need to keep their enterprise-wide risk assessment current and defensible.

CBUAE Guidance Applicable to Banks in the UAE

The Central Bank’s guidance for licensed financial institutions applies to banks as Licensed Financial Institutions. The documents below make up that guidance set.

CBUAE Thematic Review on Sanctions List Screening in the Banking Sector, May 2026

Issued in May 2026, this CBUAE thematic review examines how banks screen against the UAE Local Terrorist List and the United Nations Security Council Consolidated List. It sets out findings and supervisory expectations on the quality of sanctions screening, name matching, and the timeliness of freezing and reporting, and it is read alongside the Central Bank’s guidance on the implementation of targeted financial sanctions.

CBUAE Best Practices for Licensed FIs on Implementing Role-Based AML/CFT/CPF Training, October 2025

The CBUAE Best Practices for Licensed Financial Institutions on Implementing Role-Based AML/CFT/CPF Training, published in October 2025, sets out how banks and other institutions should design and deliver training tailored to the specific responsibilities and risk exposure of each role. It treats a comprehensive programme as critical to compliance, helping staff identify money laundering, terrorist financing and proliferation financing red flags within their own functions. Content, frequency and intensity follow a risk-based approach. The document addresses scope, guidance for the Board, senior management and the three lines of defence, and how to document, update and record training. For banks, well-targeted training equips staff with the judgement their duties demand.

CBUAE Best Practices for Licensed FIs on a Risk-Based Approach and Institutional Risk Assessments, October 2025

The CBUAE Best Practices for Licensed Financial Institutions on Implementing a Risk-Based Approach and Conducting Institutional Risk Assessments, dated October 2025, assists banks and other licensed institutions in developing a methodology, conducting an institutional risk assessment, and applying a risk-based approach across money laundering, terrorist financing and proliferation financing risk. Issued under Article 44.11 of Cabinet Decision No. 10 of 2019, it sets expectations without replacing binding requirements. It describes an effective methodology, granularity, accountability and frequency, then best practices for assessing inherent risk across customers, products, channels and geographies, evaluating controls, and determining residual risk. It applies to banks and other institutions. Sound assessment underpins proportionate, compliant controls.

CBUAE Guidance for Licensed FIs on Correspondent Banking, October 2025

The CBUAE Guidance for Licensed Financial Institutions on Correspondent Banking and Managing Correspondent Banking Relationships, published in October 2025, explains how banks should understand and control the money laundering, terrorist financing and proliferation financing risks arising from correspondent banking and cross-border payments. It describes what correspondent banking involves and the requirements for processing cross-border transfers. It sets out respondent risk factors, including nested relationships, payable-through accounts, geography, ownership and customer base. On mitigation, it covers risk assessment, standard, specific and enhanced due diligence, ongoing monitoring, suspicious activity reporting, sanctions obligations, governance, audit, training and record-keeping. For banks, correspondent relationships can expose them to parties they do not themselves know.

CBUAE Guidance for Licensed FIs on Customer Due Diligence and Record-Keeping, October 2025

The CBUAE Guidance for Licensed Financial Institutions on Customer Due Diligence and Record-Keeping, published in October 2025, addresses controls foundational to anti-money laundering, counter-terrorist financing, counter-proliferation financing, sanctions, counter-fraud and anti-bribery compliance. It treats due diligence and know your customer processes as the cornerstone for banks seeking to understand customers, including occupation, source of funds, wealth and expected activity, so suspicious activity can be detected. It covers identification and verification of customers, beneficial owners and those acting on a customer’s behalf, risk profiling, ongoing monitoring, simplified and enhanced due diligence, non-face-to-face relationships, name screening, exit, third-party reliance and record-keeping. Reliable records underpin the ability to report financial crime.

CBUAE Guidance for Licensed FIs on Risks Related to Proliferation Finance, October 2025

The Guidance for Licensed Financial Institutions on Risks Related to Proliferation Finance, issued by the CBUAE in October 2025, helps banks understand and counter the financing of the proliferation of weapons of mass destruction. Read alongside the CBUAE’s Procedures and Guidelines, it sets expectations rather than new legislation. It explains what proliferation financing is, then the threats and vulnerable channels, including trade finance, correspondent banking, hawala, offshore accounts, free trade zones, shell and front companies, and dealers in precious metals. It addresses United Nations and FATF obligations, local requirements, a risk-based approach, and mitigating controls covering due diligence, monitoring, reporting, sanctions, governance, audit, training and record-keeping. It exploits legitimate structures.

CBUAE Guidance for Licensed FIs on Risks Related to Trade-Based ML and Transshipment, October 2025

The CBUAE Guidance for Licensed Financial Institutions on Risks Related to Trade-Based Money Laundering and Transhipment, published in October 2025, helps banks understand and manage the risks criminals exploit through international trade and the movement of goods. It provides background on the trade system and trade finance, distinguishing documentary finance from open account trade. It sets out typologies, including over- and under-invoicing, over- and under-shipment, multiple invoicing, falsely described goods, shell and front companies, free trade zones, back-to-back letters of credit and registered hawala providers. It addresses services-based money laundering, vulnerable sectors such as gold, and transhipment risks, then mitigation through risk assessment and enhanced due diligence.

Federal Decree-Law No. 6 of 2025 on the Central Bank and the regulation of financial institutions

Federal Decree-Law No. 6 of 2025 is not the AML law, but it sits directly behind a bank’s licence. Issued on 8 September 2025, it governs the Central Bank and the regulation of licensed financial institutions and activities and insurance business, and it confirms that no person may carry on a licensed financial activity in the State without Central Bank authorisation. It repealed Federal Decree-Law No. 14 of 2018, the previous Central Bank law, and regulations, decisions and circulars issued under the old law remain in force until they are replaced.

CBUAE AML and CFT Guidelines for Financial Institutions, July 2023

The CBUAE Anti-Money Laundering and Combating the Financing of Terrorism Guidelines for Financial Institutions, dated July 2023, help supervised institutions, banks among them, understand and perform their statutory obligations under the framework in force in the United Arab Emirates. Prepared jointly by the Supervisory Authorities, they set out minimum expectations for identifying, assessing and mitigating money laundering and terrorist financing risks. They apply to all financial institutions and their boards, management and employees. They summarise the legal frameworks, statutory obligations and typologies, and devote substantial attention to the risk-based approach across customers, products, channels and geography. For banks, they consolidate supervisory expectations into a reference that shapes compliance and due diligence.

CBUAE Guidance for Licensed FIs on Risks Related to Virtual Assets and VASPs, February 2023

The CBUAE Guidance for Licensed Financial Institutions on Risks Related to Virtual Assets and Virtual Asset Service Providers, issued on 20 February 2023, helps banks understand and manage the money laundering and terrorist financing risks arising from exposure to virtual assets and the businesses that deal in them. It explains the associated threats and vulnerabilities and how institutions may become exposed. It describes the UAE legal framework, including the roles of the SCA, CBUAE, VARA and FSRA, and the requirement for CBUAE non-objection before opening accounts for such providers. On mitigation, it addresses the risk-based approach, general, specific and enhanced due diligence. Virtual assets can move value rapidly and pseudonymously.

CBUAE Guidance for Licensed FIs on Digital Identification for Customer Due Diligence, October 2022

The CBUAE Guidance for Licensed Financial Institutions on Digital Identification for Customer Due Diligence, issued on 31 October 2022, helps banks understand how digital identity systems can be used to identify and verify customers and to conduct ongoing due diligence. It reflects the CBUAE’s expectations and should be read with the wider legal framework. It provides an overview of digital identity systems and their participants, explaining identity proofing and enrolment, authentication and lifecycle management. It sets out how such systems may support customer identification, ongoing due diligence and third-party reliance, and examines their risks. It explains how banks should assess a system’s reliability through its assurance levels.

CBUAE Guidance for Licensed FIs on Suspicious Transaction Reporting, August 2022

The CBUAE Guidance for Licensed Financial Institutions on Suspicious Transaction Reporting, issued on 3 August 2022, explains how banks and other institutions should identify, investigate and report suspicious transactions and activity. It sets out the legal basis for reporting, the consequences of failing to disclose, the protection afforded to those who report, and the meaning of a suspicious transaction. It describes the roles of the three lines of defence and the money laundering reporting officer, transaction monitoring methods, and the procedures for filing, structuring, submitting and amending reports. Further sections address confidentiality and the prohibition on tipping off. For banks, timely, well-drafted reporting is central to disrupting financial crime.

CBUAE Guidance for Licensed FIs on Risks Relating to Payments, August 2022

The Guidance for Licensed Financial Institutions on the Risks Relating to Payments, issued by the CBUAE in August 2022, addresses the money laundering and terrorist financing risks that arise across the payments sector and for the institutions, banks included, that serve it. Issued under Article 44.11 of Cabinet Decision No. 10 of 2019 and read with the CBUAE’s Procedures and Guidelines, it sets out expectations rather than creating new law. It explains what makes payments vulnerable, including the speed of funds movement, peer-to-peer and cross-border payments, intermediation, nesting, agents and merchant risks. On mitigation, it covers risk assessment, customer and enhanced due diligence, ongoing monitoring, wire transfer and correspondent requirements.

CBUAE Guidance for Licensed FIs on Risks Relating to Politically Exposed Persons, August 2022

The Guidance for Licensed Financial Institutions on the Risks Relating to Politically Exposed Persons, issued by the CBUAE in August 2022, sets out how banks should identify, understand and manage the heightened money laundering and terrorist financing risks associated with politically exposed persons. Issued under Article 44.11 of Cabinet Decision No. 10 of 2019 and read with the CBUAE’s Procedures and Guidelines, it explains that such customers warrant special attention not because banks should avoid them, but because thorough due diligence is needed before accepting a relationship. It distinguishes domestic and foreign politically exposed persons and heads of international organisations, reaching family and close associates, and covers screening.

CBUAE Guidance for Licensed FIs on Transaction Monitoring and Sanctions Screening, September 2021

The CBUAE Guidance for Licensed Financial Institutions on Transaction Monitoring and Sanctions Screening, issued on 8 September 2021, sets out how banks should design, operate and maintain the systems that detect suspicious activity and identify sanctioned parties. It reflects the CBUAE’s expectations for compliance and should be read alongside the wider legal framework. On transaction monitoring, it addresses risk assessment, risk-based deployment, data management, rule definition and testing, alert scoring, outcomes analysis and validation. On sanctions screening, it covers programme design and testing for name and transaction screening, and list management. A further section deals with governance, vendors, training and record-keeping. For banks, validated monitoring and screening are essential.

CBUAE Guidance for Licensed FIs to Cash-Intensive Businesses, September 2021

The Guidance for Licensed Financial Institutions Providing Services to Cash-Intensive Businesses, issued by the CBUAE in September 2021, helps banks manage the money laundering and terrorist financing risks that arise when customers handle large volumes of cash. Issued under Article 44.11 of Cabinet Decision No. 10 of 2019 and read with the CBUAE’s Procedures and Guidelines, it sets out expectations rather than new legal requirements. It explains why cash is vulnerable, the risks of alternatives such as bearer negotiable instruments and prepaid cards, and concerns including cross-border movement, couriers and currency exchanges. On mitigation, it sets out a risk-based approach, enhanced due diligence, beneficial owner identification and monitoring.

CBUAE Guidance for Registered Hawala Providers and LFIs, August 2021

The Guidance for Registered Hawala Providers and Licensed Financial Institutions Providing Services to Registered Hawala Providers, issued by the CBUAE in August 2021, addresses the money laundering and terrorist financing risks of hawala activity. Because banks are licensed financial institutions, this combined guidance reaches banks through the LFI side, addressing those that serve registered hawala providers as well as the providers themselves. Drawing on the FATF description of hawaladars, it explains what hawala is, its global risks, and UAE regulation, including permitted and non-permitted services. It addresses sanctions and freezing without delay, registration and operating requirements, the need for a bank account, and an AML/CFT programme covering due diligence.

CBUAE Guidance for Licensed FIs on Implementation of Targeted Financial Sanctions, July 2021

The CBUAE Guidance for Licensed Financial Institutions on the Implementation of Targeted Financial Sanctions, issued on 4 July 2021, helps banks meet their obligations to identify, freeze and report assets and transactions connected to designated persons and entities. Read alongside the CBUAE’s procedures and the Executive Office’s guidance, it sets out expectations for demonstrating compliance. It describes a sanctions compliance programme: senior management commitment, risk assessment and appetite, internal controls, training, independent audit and record-keeping. It then covers screening operations, evasion, the United Nations Consolidated List and Local Terrorist List, false positives, payments screening, confirmed matches and notification duties. Effective sanctions implementation is essential to avoid facilitating prohibited activity.

CBUAE Guidance for Licensed FIs to Legal Persons and Arrangements, June 2021

The Guidance for Licensed Financial Institutions Providing Services to Legal Persons and Arrangements, issued by the CBUAE in June 2021, helps banks manage the money laundering and terrorist financing risks that arise when customers are companies, other legal persons or legal arrangements. Read with the CBUAE’s Procedures and Guidelines, it sets out expectations rather than creating new law. It explains how such structures can be misused to obscure beneficial ownership, hide the purpose of an account, and conceal the source of funds. It covers formation requirements, beneficial owner identification, economic substance, and mitigation through the risk-based approach, customer risk rating and enhanced due diligence. Understanding ownership and control is central.

CBUAE Guidance for Licensed FIs to the Real Estate and Precious Metals and Stones Sectors, June 2021

The CBUAE Guidance for Licensed Financial Institutions Providing Services to the Real Estate and Precious Metals and Stones Sectors, issued on 16 June 2021, helps banks understand and manage the money laundering and terrorist financing risks that arise when they serve customers active in these two higher-risk sectors. Read alongside the CBUAE’s AML/CFT procedures, it does not replace any legal obligation; where a discrepancy arises, the legal framework prevails. It examines the risks presented by dealers in precious metals and stones and by real estate, the features that increase risk, and how each sector is supervised. On mitigation, it explains the risk-based approach, customer and enhanced due diligence, and reporting.

CBUAE STR Outreach for Banks and Finance Companies, March 2021

The CBUAE STR Outreach for Banks and Finance Companies, delivered in March 2021, is an awareness session prepared by the Financial Intelligence Unit and the CBUAE to strengthen suspicious transaction reporting across banks and finance companies. Prepared with input from the FIU, the AML/CFT supervision function and the Ministry of Interior, it explains reporting obligations and practical steps. It covers when to report, grounding the duty in Article 15 of Federal Decree-Law No. 20 of 2018 and Article 17 of Cabinet Decision No. 10 of 2019, and what to report regardless of value. It confirms goAML as the only channel and addresses compliance officer tasks and common deficiencies.

CBUAE Board of Directors Decision No. 59/4/2019 on AML and CFT procedures

Central Bank Board of Directors Decision No. 59/4/2019, issued on 13 June 2019, sets out anti-money laundering and combating the financing of terrorism procedures for financial institutions supervised by the Central Bank of the United Arab Emirates, including banks. Made under Decree Federal Law No. 14 of 2018, Decree Federal Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019, it cancels the earlier Circular No. 24/2000. It requires banks and their concerned persons to comply with the law, the implementing regulation and related Central Bank instructions. It empowers the Central Bank to supervise, examine, request information and impose administrative sanctions, establishing the supervisory basis underpinning bank compliance.

CBUAE Guidance Note on Responsible Use of AI and ML by LFIs

The CBUAE Guidance Note on the Responsible Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions sets out principles for the consumer-focused, ethical adoption of AI and machine learning, including generative AI, by banks. It is non-binding, intended to help institutions formulate internal policies focused on areas bearing on consumers, promoting consumer protection and good market conduct, with principles that can evolve as the technology develops. It covers governance and accountability, placing responsibility with senior management and the Board, a documented framework, reporting and a model inventory. It addresses fairness, transparency, data quality, privacy, monitoring, human oversight, outsourcing and ethical innovation.

CBUAE List of Administrative and Financial Sanctions

The CBUAE List of Administrative and Financial Sanctions records the penalties the Central Bank can impose under the Central Bank Law and the Anti-Money Laundering and Combating the Financing of Terrorism Law. It applies to all licensed institutions and persons, including banks. It explains that the CBUAE is the supervisory authority responsible for addressing shortcomings in compliance frameworks. Under Article 14 of Decretal Federal Law No. 20 of 2018, as amended, it can impose penalties from a warning to licence revocation, and fines of fifty thousand to five million dirhams per violation. Under Article 137, fines reach two hundred million dirhams. It shows a methodical, dissuasive approach to enforcement.

Core AML Obligations for Banks at a Glance

Whatever the licence, the AML regulations for banks in the UAE turn on a common set of duties.

Registration with the UAE Financial Intelligence Unit on the goAML platform, the baseline for reporting.
An enterprise-wide assessment of money laundering, terrorist financing and proliferation financing risk, aligned to the national risk assessments.
AML/CFT/CPF policies and procedures approved by senior management.
Customer due diligence, KYC and, for higher-risk relationships, enhanced due diligence, including verifying the ultimate beneficial owner of corporate customers and checking the source of funds and the source of wealth where the risk requires it.
AML/CFT/CPF training tailored to staff roles.
Targeted financial sanctions screening and freezing without delay, using sanctions screening against the UN and local lists.
Ongoing transaction monitoring and suspicious transaction and activity reporting through goAML, with particular care over correspondent banking and trade finance.
A qualified compliance officer and MLRO.
Governance and senior management oversight of the AML programme.
Independent audit of the AML programme, supported by full record-keeping throughout.

Expert Tip:

For a bank, the two areas that draw the most supervisory attention are correspondent banking and trade finance, because both move value across borders through third parties. Build your enhanced due diligence and transaction monitoring around those flows and document the rationale, and the rest of the programme becomes far easier to defend.

Conclusion

AML regulations for banks in the UAE come down to a simple chain: banks are Licensed Financial Institutions, the Central Bank supervises them, and Federal Decree-Law No. 10 of 2025, its Executive Regulations, targeted financial sanctions rules, and relevant CBUAE LFI guidance form the core framework for banks licensed by the Central Bank. The banking sector carries the deepest obligations in the financial system because it carries the highest inherent risk. Use the national risk assessments to calibrate your programme, treat this guide as the map, and read across to the wider view in our guide to anti-money laundering laws in the UAE and the pillar on AML regulations for banks and financial institutions in the UAE.

Frequently Asked Questions

Yes. Banks are Licensed Financial Institutions under Federal Decree-Law No. 10 of 2025, supervised by the Central Bank of the UAE, and must run customer due diligence, sanctions screening, transaction monitoring, record-keeping, and suspicious transaction reporting through goAML.

The Central Bank of the UAE supervises banks in mainland UAE and the commercial free zones. Banks established in the DIFC and ADGM are supervised by the DFSA and FSRA under their own AML rulebooks.

The UAE ML and TF National Risk Assessment 2024 rates the banking sector at medium-high residual risk, with an inherent risk of high. For proliferation financing, mainland banks are rated medium-high, mainly through trade finance and open account transactions.

A bank must maintain a risk assessment aligned with the national risk assessments, perform customer due diligence and enhanced due diligence, screen against sanctions and PEP lists, monitor transactions, report suspicious activity through goAML, keep records, and appoint a qualified compliance officer and MLRO.

A bank must identify and verify the customer and any beneficial owner, screen against sanctions and politically exposed person lists, risk-rate the relationship, and establish the source of funds where relevant, applying enhanced due diligence to higher-risk customers before the relationship proceeds.

Common indicators include structuring of cash deposits, unexplained or rapid cross-border wire transfers, trade finance documents that do not match the underlying goods, money mule activity, and transactions that do not fit the customer’s known profile. The red flags and typologies guidance sets these out for detection and reporting.

Yes. A branch of a foreign bank licensed by the Central Bank must run a full local AML programme and remain answerable to the Central Bank for its UAE activities, even where the head office operates its own global controls.

This guide focuses on banks licensed and supervised by the Central Bank of the UAE outside the financial free zones. Banks in the DIFC and ADGM are supervised by the DFSA and FSRA, respectively, under their own AML rulebooks, while UAE federal AML legislation also forms part of the applicable framework in those financial free zones.

Need help building or reviewing your bank's AML programme?

Ensure your bank's AML programme is effective, compliant, and aligned with regulatory expectations. Get expert advice tailored to your business.

Share via :

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik