Yes. Not holding client money does not by itself remove a firm from the AML/CFT framework where its regulated activities fall within the applicable financial activities. The firm’s obligations depend on the nature of its activities and business relationships and can include risk assessment, customer due diligence, beneficial-owner identification, ongoing monitoring, sanctions controls and suspicious transaction reporting.

A promoter should assess the products, funds and providers it markets, verify the relevant regulatory status and consider whether the activity or provider falls within the applicable licensing requirements. Requests to promote unlicensed activities, opaque structures or unrealistic investment returns should be treated as potential risk indicators and assessed accordingly. Where the firm’s obligations give rise to a suspicion of a crime, the matter should be handled through the applicable AML/CFT reporting framework.

Where required by the risk profile or circumstances of the relationship, an advisor or arranger should obtain information concerning the source of funds and take reasonable measures to verify it. Unexplained or inconsistent funding can increase the risk associated with a relationship and may require enhanced measures or, where there are grounds for suspicion, a suspicious transaction report.

Yes. The Capital Market Authority requires supervised firms to maintain a business-wide risk assessment, and the federal framework requires an enterprise-wide risk assessment. For an advisory or promotion firm, the exercise needs to capture its client base, the products and providers it markets, its channels and introducers, and the geographies it touches, sit in step with the national and sector risk assessments, and stay current and defensible. Firms without the in-house capacity to run it often commission a business risk assessment and refresh it annually.

Advising on or promoting virtual assets can raise regulatory questions beyond the firm’s ordinary securities activities, depending on the nature of the product and service. A firm should therefore determine whether the activity falls within the CMA’s virtual-asset or securities framework or another applicable UAE regime, and assess the associated AML/CFT/CPF risks. Where a firm is itself carrying out a regulated virtual-asset activity, the requirements applicable to VASPs, including the Travel Rule where relevant, may apply, as set out in the AML regulations for virtual asset service providers in UAE. Simply having a client involved in virtual assets does not by itself make the advisor a VASP.

Older SCA AML decisions, notices, and guidance may remain relevant where they have not been repealed, superseded, or otherwise replaced, and continue to form part of the applicable regulatory framework. They should, however, be read against the current legal and regulatory framework, including Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, where applicable. Firms should therefore verify the current status of each older instrument rather than assume that every SCA instrument remains in force.

For investment management companies in the mainland and the commercial free zones, the AML and CFT supervisor is the Capital Market Authority, which succeeded the Securities and Commodities Authority under Federal Decree-Law No. 32 of 2025. It maintains the rulebook chapter, publishes guidance and notices, collects AML returns, conducts examinations, and levies penalties. For these CMA-regulated investment management activities, the Authority, rather than the Central Bank, oversees AML/CFT supervision.

A fund manager should establish the ownership and control structure of corporate, institutional, pooled, nominee, and feeder-fund investors and identify the natural persons who ultimately own or control the customer, where required under the applicable CDD framework. Complex or offshore ownership structures may require enhanced due diligence and additional information to establish who ultimately controls or benefits from the investments. Where a regulated third party is relied upon for elements of CDD, the applicable legal conditions and the firm’s continuing responsibility should also be considered.

Managers should establish and, where risk requires, corroborate the source of the subscription and investment funds, and understand the investor’s source of wealth. Unexplained, third-party or high-risk funding should be treated as a red flag warranting enhanced measures. The depth of these checks should be proportionate to the investor’s risk profile and the size and nature of the subscription.

Yes. The federal AML framework requires Financial Institutions to conduct a business-wide risk assessment, while CMA-supervised firms are expected to maintain one as part of their AML programme. For an investment management company, an AML business risk assessment should cover its own funds, mandates, client types, products, distribution channels, and geographies; align with the national and sector risk assessments; and remain current and defensible, since the Authority checks it through returns and examinations.

Virtual asset activities are subject to a separate regulatory framework. Where an investment management company has exposure to virtual assets or virtual asset service providers, it should identify and manage the associated risks, apply enhanced due diligence where appropriate, and comply with applicable Travel Rule requirements. Treat dealings with unlicensed providers as higher risk and subject to closer scrutiny.

Yes. Existing SCA notices, decisions and guidance may continue to apply where they remain in force and are not inconsistent with the current Capital Markets legislation or subsequent regulations. Federal Decree-Law No. 10 of 2025, Article 41(3) is the authority for this: regulations, resolutions and circulars issued under the repealed Federal Decree-Law No. 20 of 2018 remain in force only so far as they do not conflict with the new statute, and only until they are replaced. A fund or wealth manager should continue to consider instruments such as SCA Board Chairman’s Decision No. 21 of 2019 and the 2021 notices, while reading references to the earlier AML framework in light of Federal Decree-Law No. 10 of 2025 and its Executive Regulations.

A firm that offers leveraged currency and derivative trading deals in securities products, so its licence and AML supervision both come from the Capital Market Authority under Federal Decree-Law No. 32 of 2025. A Central Bank-licensed exchange house is a different sector, concerned with physical currency exchange and remittance. Each falls under a different regulator, follows a different rulebook, and the two should not be conflated.

A forex company should establish and, where risk requires, corroborate the source of the funds a client deposits as margin, understand the customer’s source of wealth where appropriate, and treat unexplained, third-party or high-risk funding, and rapid round-trip deposits and withdrawals, as red flags warranting enhanced measures and, where appropriate, a suspicious transaction report through goAML.

A firm remains responsible for the clients an introducing broker or affiliate brings in. It should conduct due diligence on the introducer, understand the markets and client types it introduces, monitor for higher-risk business and bonus or rebate schemes that could disguise the movement of funds, and keep ultimate responsibility for customer due diligence with the firm, not the introducer, even where reliance is placed on a third party in accordance with the applicable legal requirements.

Yes. The federal AML framework requires Financial Institutions to identify, assess and understand their money laundering, terrorist financing and proliferation financing risks using a business-wide risk assessment. CMA-regulated firms are expected to maintain and periodically update this assessment as part of their AML programme.

Dealing in virtual assets and Virtual Asset Service Providers (VASPs) is subject to a separate regulatory framework alongside the securities rules covered here. Even so, a forex company should identify and manage any exposure to virtual assets or VASPs, apply the UAE Travel Rule where applicable, and treat dealings with unlicensed virtual asset providers or high-risk asset funding routes as higher-risk scenarios requiring enhanced due diligence.

Yes. Existing Securities and Commodities Authority notices, decisions and guidance continue to apply unless they have been repealed or are inconsistent with the new Capital Market legislation or subsequent regulations. Firms should keep applying instruments such as the SCA Board Chairman decision and the 2021 notices, while reading any mention of the earlier 2018 and 2019 regime through the lens of Federal Decree-Law No. 10 of 2025 and its Executive Regulations.

Under Article 17 of Federal Decree-Law No. 10 of 2025 the Authority can issue a warning, impose administrative fines, ban a firm from the activity and revoke its licence. The Authority’s own examination observations put the fine range at AED 50,000 to AED 5,000,000 for each violation, alongside loss of licence in the most serious cases. Separately, a legal person that keeps an inaccurate beneficial owner register faces sanctions under Cabinet Resolution No. 132 of 2023, where a third breach lets the registrar suspend the licence and close the premises until the fine is paid and the violation remedied.

Two periodic filings sit alongside event-driven goAML reporting. The annual AML/CFT and targeted financial sanctions risk assessment return runs across five tabs, covering customer risk, product and service risk, distribution-channel risk, signatories, and the controls and quality of mitigation, with figures stated in dirhams and country data given in standard names or codes. The semi-annual AML and CTF report covers the periods closing 30 June and 31 December, must be reviewed by the board, and is lodged with the Capital Market Authority together with the board’s remarks within two months of each period end.