UAE's Landmark AML Law Takes Full Effect — DFSA Rulebook Updated 2 March 2026

Insight Advisory — insightadvisory.ae — 21 March 2026

Background

The UAE replaced its entire anti-money laundering framework in late 2025 with Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism, and Countering Proliferation Financing. This came into effect on 14 October 2025, repealing the 2018 law. The implementing Cabinet Resolution No. 134 of 2025, comprising 71 articles and nearly 300 enforceable requirements, entered into force on 14 December 2025. The DFSA in DIFC then aligned its own rulebook with the new federal framework, effective 2 March 2026 — bringing the DIFC squarely within the new national AML architecture.

Key Changes in the New AML Law

The new law introduces standalone offences for proliferation financing — the financing of weapons of mass destruction programmes — a category not covered in the 2018 framework. It also expands predicate offences to explicitly include tax evasion and broadens the definition of proceeds to capture any advantage derived from criminal property, closing previous loopholes on indirect gains.

Critically, the law lowers the evidentiary threshold for establishing money laundering offences. A person may now be liable not only where they knew funds originated from criminal conduct, but where they should reasonably have known. This negligence-based standard is a significant shift that substantially increases compliance exposure for business operators who fail to conduct adequate due diligence.

DFSA Rulebook Update: 2 March 2026

The Dubai Financial Services Authority’s updated AML, Counter-Terrorist Financing and Sanctions (AML) Module came into force on 2 March 2026. The amendments were introduced to align DIFC firms’ obligations with the new federal legislation. DFSA-regulated entities must now update their internal controls, reporting protocols, and asset-freezing procedures to reflect the new federal standards. FAQs have also been published by the DFSA to help firms interpret their obligations under the aligned regime.

Expanded Scope: DNFBPs and Gaming Operators

The new Cabinet Resolution expands the definition of Designated Non-Financial Businesses and Professions (DNFBPs) to include commercial gaming operators — those running gaming halls, online gaming platforms, sports betting, or lottery operations. This is directly connected to the UAE’s licensing of casino and commercial gaming activity, including the planned Wynn resort in Ras Al Khaimah. Legal and corporate service providers, real estate agents, auditors, and precious metals dealers remain within the DNFBP scope and are required to update their compliance frameworks.

Virtual Asset Service Providers

For the first time, Virtual Asset Service Providers (VASPs) are subject to the full suite of AML obligations that apply to traditional financial institutions. This includes compliance with the Travel Rule (requiring full sender and receiver information on virtual asset transfers), specific customer due diligence requirements, ongoing monitoring, and sanctions compliance. VASPs regulated by VARA must reconcile the Executive Regulations against their existing VARA rulebook obligations, as there may be differences in the specific requirements across the two frameworks.

Higher Penalties and Personal Liability

Corporate penalties for money laundering, terrorism financing, or proliferation financing have increased substantially — legal persons now face fines from AED 5 million to AED 100 million, up from the previous range of AED 500,000 to AED 50 million. More significantly, personal criminal liability now extends to individual managers and directors where it is proven that they were aware of an offence and its commission resulted from their breach of duty.

The Financial Intelligence Unit has also been granted expanded asset-freezing powers — freezing orders may last up to 30 days (extended from 7 days under the 2018 law) and seizure orders up to 10 days. Courts are now authorised to enforce foreign judicial orders on provisional measures and confiscation without a separate local investigation.

FATF Mutual Evaluation in June 2026

The new AML framework is timed in part to address an upcoming FATF mutual evaluation of the UAE anticipated for mid-2026. Since being removed from the FATF grey list in February 2024 and the EU’s high-risk countries list in August 2025, the UAE is seeking to demonstrate sustained and effective implementation of its AML/CFT framework. Regulators are expected to conduct more active supervision in 2026, and enforcement activity has already increased materially year-on-year.

What Regulated Entities Must Do Now

Review policies and procedures immediately against the new law and Cabinet Resolution, with particular focus on proliferation financing controls and digital asset risks. Update training programmes to reflect the lower knowledge threshold for liability and the new personal exposure for senior management. Reassess customer due diligence for existing high-risk relationships. DFSA-regulated firms must confirm alignment with the updated AML Module effective 2 March 2026.

Sources

Book a free consultation

Get a clear view of the right setup, structure, and compliance steps for your case.

Speak to an expert

Want a quick estimate?

Use our tools to get a high-level idea before you commit.

Try our calculators