UAE VASP AML Compliance 2026 : Thresholds, Travel Rule and goAML Reporting

Key numbers: UAE VASP AML compliance in 2026

• 14 December 2025: date the current executive regulations took effect.
• AED 5,000,000: maximum administrative fine per violation (AML Law, Art. 17).
• AED 100,000,000: maximum corporate fine for money laundering (AML Law, Art. 27).
• 20+ VASP licence applications structured by NeosLegal since 2016 (NeosLegal practitioner data, 2026).

UAE VASP AML compliance changed fundamentally in 2025. Federal Decree-Law No. 10 of 2025 repealed the 2018 anti-money laundering law outright, and Cabinet Resolution No. 134 of 2025 replaced the executive regulations with effect from 14 December 2025. Any compliance manual still citing the old instruments is working from repealed law. In this guide, Irina Heaver, Founder of NeosLegal and recommended by Lexology as the UAE’s leading blockchain lawyer, sets out what VASPs must implement, drawing on 20+ VASP licence applications structured since 2016: governance and personnel, due diligence thresholds, the Travel Rule, goAML reporting, sanctions obligations and record retention.

Which authorities regulate UAE VASP AML compliance?

Three bodies matter, and they do different jobs. The Financial Intelligence Unit receives your suspicious transaction reports. The Executive Office for Control and Non-Proliferation runs the sanctions regime. Your licensing regulator supervises you and holds the enforcement power. Confusing them is the most common structural error we see in draft compliance manuals.

The Financial Intelligence Unit

The Unit is the national centre for receiving, analysing and disseminating suspicious transaction reports. It sits within the Central Bank and operates with independence. Every suspicious transaction report from every financial institution, DNFBP and VASP in the country goes to it exclusively, through the goAML portal.

The Unit is not your supervisor. It does not inspect you and it does not fine you. It can, however, order a transaction suspended for up to ten working days, or funds frozen for up to thirty days, on the strength of its own analysis. Register on goAML before you begin licensed activity, not after. Registration is not instant, and you cannot discharge a reporting obligation you have no channel to file through.

The Executive Office for Control and Non-Proliferation

The Executive Office administers targeted financial sanctions in the UAE. It maintains the alert system that tells you when the UAE Local Terrorist List or the UN Consolidated List changes. You must register on it. The Executive Office also handles applications to use frozen funds and processes grievances about listings.

Your licensing regulator, acting as Supervisory Authority

Supervision, inspection and administrative penalties sit with whichever authority licenses you. That authority assesses your risk profile, conducts off-site and on-site inspections, and can impose penalties running from a warning to revocation of your licence. Which authority that is depends on where and how you operate, and choosing between them is the first structuring decision in any UAE crypto and VASP licensing project.

The practical point is that the federal AML obligations in this guide apply to you whichever of these licenses you. Your regulator then layers its own rulebook on top, and where the two differ you follow the higher standard. If you are still deciding, our detailed notes on VARA crypto licensing in Dubai, ADGM crypto licensing in Abu Dhabi and the CMA federal crypto licence set out the perimeter and cost of each, and the UAE VASP Licence Tracker shows who currently holds what.

Which AML laws apply to UAE VASPs in 2026?

Two instruments. Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing, in force from 14 October 2025. And Cabinet Resolution No. 134 of 2025, its executive regulations, in force from 14 December 2025. Cabinet Decision No. 74 of 2020 continues to govern targeted financial sanctions alongside them.

What changed in 2025

These are replacements, not amendments, and that distinction matters more than it sounds. The AML Law repealed Federal Decree-Law No. 20 of 2018 in its entirety. The executive regulations repealed Cabinet Decision No. 10 of 2019 and Cabinet Resolution No. 24 of 2022. The article numbering changed throughout, so a cross-reference that was correct in 2024 is now pointing at nothing.

The substance moved as well. Proliferation financing is now a distinct offence sitting alongside money laundering and terrorist financing, and your reporting obligation covers all three. Penalties for legal persons increased. Personal criminal liability for managers is available where they knew of the offence and it followed from a breach of their duties. And the law now expressly captures conduct carried out through digital systems, virtual assets and cryptographic technologies, which removes any argument that the framework was written for a different kind of business.

The full instrument stack

Two instruments carry the core obligations, but they do not sit alone. A complete obligations register for a UAE VASP covers the following.

• Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing.
• Cabinet Resolution No. 134 of 2025, the executive regulations. Some English translations render this as Cabinet Decision No. 134 of 2025. It is the same instrument.
• Federal Law No. 7 of 2014 on Combating Terrorism Offences, which supplies the definition of a terrorist act and is expressly preserved by the AML Law.
• Cabinet Decision No. 74 of 2020 on the terrorism lists and implementation of UN Security Council resolutions, which governs targeted financial sanctions.
• Cabinet Decision No. 109 of 2023 on beneficial owner procedures, with Cabinet Resolution No. 132 of 2023 setting the penalties. These apply to mainland and commercial free zone entities. DIFC and ADGM run separate beneficial ownership rules.
• The UAE National Risk Assessment, which you must take into account when setting your own risk appetite.
• Guidance on Targeted Financial Sanctions issued by the Executive Office, updated July 2025.
• The UAE Virtual Assets Travel Rule, adopted for CMA licensees by CMA Notice No. 1 of 2026 pursuant to Cabinet Decision No. 134 of 2025, which adds counterparty, unhosted wallet and privacy token requirements on top of Article 36(2).

On top of that sits your own regulator’s AML rulebook. For a CMA-licensed VASP, Article 29(2) of the General Framework Module requires compliance with anti-money laundering and counter-terrorist financing as set out in the Authority’s Financial Activities Rulebook, which is Chapter 5 of Board Decision No. 13/Chairman of 2021. For a VARA-licensed VASP in Dubai, it is the Compliance and Risk Management Rulebook. Where the federal position and your rulebook differ, you follow the higher standard.

Which activities bring you into scope

Article 4 of the executive regulations defines virtual asset activities as: exchange between virtual assets and fiat currencies; exchange between one or more types of virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or of instruments enabling control over them; and provision of financial services or activities related to an issuer’s offer or sale of virtual assets or participation therein; and any other activity determined by resolution of the Supervisory Authority in coordination with the National Committee. That last limb matters: the perimeter can be widened by resolution without the regulations being amended. Conducting any of these without a licence, registration or listing from the competent Supervisory Authority carries imprisonment and a fine of AED 200,000 to AED 10,000,000, or either penalty.

Those limbs map onto different licence categories in practice. Running an order book points to a UAE crypto exchange licence, holding client keys points to a crypto custody licence, and executing client orders points to a broker-dealer licence. Most businesses need more than one, and the combination drives both your capital requirement and the shape of your AML programme.

What AML framework must a VASP put in place?

Written policies approved by senior management, a Compliance Officer at management level appointed with your Supervisory Authority’s prior approval, a documented risk-based approach, ongoing training, and an independent audit function to test whether any of it works. Those five things are the minimum. Everything else in this guide sits inside them.

Policies, controls and procedures

Your internal policies must be approved by senior management and proportionate to your identified risks and to the nature and size of your business. They must cover due diligence measures, procedures for reporting suspicious transactions, compliance management arrangements, employee screening, training programmes, and an independent audit function. Review and update them on an ongoing basis rather than annually by habit.

The practical test a reviewer applies is whether the policy describes your business or somebody else’s. A conversion service and a custodian face different risks and should not be running the same monitoring rules.

The Compliance Officer and the AMLRO

You must appoint a Compliance Officer at management level, under your own responsibility, with independence in decision-making and appropriate competence and experience. Your Supervisory Authority must approve the appointment in advance, and it maintains a list of Compliance Officers which it shares with the Financial Intelligence Unit. Treat this as a gating item in your launch plan, because you cannot backfill it.

The role carries five duties: monitoring transactions, reviewing and assessing suspicious transaction data and deciding whether to notify the Unit, reviewing internal systems and reporting periodically to senior management, developing and documenting training, and cooperating with the Supervisory Authority and the Unit. Several UAE regulators, including the CMA, also require a separately named Anti-Money Laundering Reporting Officer, which many firms refer to as the MLRO. Check your rulebook, because the federal regulations name only the Compliance Officer.

Both roles carry personal exposure. Enforcement against individuals can include restriction of powers, suspension, replacement, and criminal liability under the reporting and tipping-off offences.

The risk-based approach

Identify, understand, manage and assess your financial crime risks in a way proportionate to your business, taking account of the National Risk Assessment. Consider customer risk, country and geographic risk, product and service risk, transaction risk and delivery channel risk before you set an overall risk level. Document the process, keep the assessment, update it, and hand it over when the authorities ask.

Add proliferation financing to that list. Where you identify high proliferation financing risk, you must apply enhanced internal controls aimed at detecting circumvention of sanctions instructions, keep documented records of what you did, and review those controls as the risk level moves. This is new since 2025 and most inherited policy templates do not have it.

You must also assess the risks of any new product, business practice, delivery mechanism or technology before you launch it, not after. For a sector that ships quickly, this is the obligation most often discovered in hindsight.

Training, screening and independent audit

Screen employees for fitness and propriety on appointment. Train them at the start of employment and on an ongoing basis, tailored to what they actually do, with attendance and outcomes documented. Then have an independent audit function test whether the controls work. Across the applications we have run, the audit function is the item most often promised in the manual and least often evidenced in practice, and reviewers ask for the evidence.

When does customer due diligence apply, and at what threshold?

For VASPs, customer due diligence applies to occasional transactions from AED 3,500, whether that is a single transaction or several that appear to be linked. That figure is specific to VASPs under Article 7(3) of the executive regulations. The AED 55,000 threshold that circulates widely applies to financial institutions, not to you, and building your onboarding to the higher figure will leave you materially under-scoped.

The gap is deliberate, and it is not new. Cabinet Resolution No. 24 of 2022 inserted Article 33 bis (3) into the 2019 regulations with effect from 1 April 2022 and set the VASP figure at AED 3,500 then; the 2025 regulations carried it across into Article 7(3) rather than introducing it. What that figure tells you is how the drafters view virtual asset customers relative to everyone else: AED 3,500 is the level the financial institution regime reserves for occasional wire transfers alone. Plan your onboarding on the basis that full due diligence is the default rather than the exception.

When due diligence applies

• At the commencement of a business relationship.
• For occasional transactions of AED 3,500 or more, single or linked.
• Where a crime is suspected.
• Where there are doubts about the accuracy or adequacy of identification data obtained previously.

In genuinely low-risk cases you may complete verification after the relationship begins, provided you finish as soon as possible, the deferral is necessary so as not to disrupt normal business, and you manage the risk in the meantime. Across the applications we have run, the trigger most often missed is the linked-transaction limb, because founders scope onboarding to single-transaction values and never build the aggregation logic.

What you must collect

For natural persons: name as stated in the identity card or travel document, nationality, address, date and place of birth, employer name and address where applicable, and a true copy of a valid identity document. For legal persons and legal arrangements: name, legal form, memorandum of association, tax registration number where the entity is subject to corporate tax, registered office address, articles of association, and the names of senior management. Verify that anyone acting on a customer’s behalf is authorised, and identify them too.

You must also understand the purpose and intended nature of the relationship, and the customer’s business and ownership and control structure. Collecting documents is not the same as understanding the customer, and reviewers can tell the difference.

Beneficial ownership

Identify any natural person who ultimately owns or controls 25 percent or more of a legal person, alone or jointly. Where no such person can be identified, or where you doubt that the shareholder is the beneficial owner, identify whoever exercises legal or actual control by any other means. Where that also fails, identify the relevant natural person holding a senior management position. For trusts and other legal arrangements, identify the settlor, trustee, protector, beneficiaries or classes of beneficiaries, and anyone else exercising ultimate effective control.

Your own beneficial ownership obligations

Beneficial ownership runs in both directions. You identify your customers’ beneficial owners, and separately, as a UAE company, you must maintain and file your own. Cabinet Decision No. 109 of 2023 requires mainland and commercial free zone entities to keep a register of beneficial owners, partners or shareholders, and nominee directors, and to file it with the relevant registrar. DIFC and ADGM operate their own frameworks.

The executive regulations tightened the mechanics. Companies must update beneficial ownership and basic information within 15 working days of any change and verify accuracy on an ongoing basis. Bearer shares and bearer share warrants are prohibited outright, with any issued before the regulations took effect to be converted into registered shares within 30 working days of publication. Nominee directors and nominee shareholders must disclose their status to the company and report any change within 15 working days. Records must be kept for at least five years after dissolution.

This is the obligation founders most often discover late, because it sits with the corporate registrar rather than the AML function, and the penalties come from a separate instrument. It is best handled at the point of UAE Web3 company formation, when the ownership chain is being built, rather than retrofitted once the licence application is live.

Enhanced due diligence and politically exposed persons

Apply enhanced measures to high-risk customers and to anyone connected with a high-risk country. Enhanced measures include obtaining additional information on identity and occupation, establishing source of funds and source of wealth, updating due diligence more frequently, increasing monitoring, and obtaining senior management approval to begin or continue the relationship.

Three of those moved in 2025 and are easy to miss. Source of wealth is now required, where the earlier regulations addressed only source of funds. Senior management approval is now available as a general enhanced measure, where it was previously tied to politically exposed persons. And the regulations now list, as an enhanced measure, carrying out the first payment through an account in the customer’s name held with a financial institution subject to equivalent due diligence standards. For a conversion business that constrains the funding channels you can accept from a high-risk customer, so it belongs in your product design and not only in your policy.

The definition of a politically exposed person also widened. It now expressly captures senior political party officials and persons entrusted with the management of international organisations, including directors, deputy directors and board members within those bodies. The regulations do not give an exhaustive list of what counts as an international organisation, so record the interpretation you have adopted and apply it consistently rather than case by case.

For foreign politically exposed persons the enhanced measures are mandatory, including senior management approval and source of wealth checks. For domestic politically exposed persons and people holding prominent positions in international organisations, you must first determine whether the customer falls into the category, then apply the enhanced measures where the relationship is high-risk. The distinction is worth building into your screening logic rather than treating all politically exposed persons identically.

Ongoing monitoring

Scrutinise transactions across the life of the relationship to check they remain consistent with what you know about the customer, their activity and their risk, including source of funds where necessary. Keep documents and data current, with particular attention to high-risk customers. Screen customers, beneficial owners and counterparties against the sanctions lists continuously, not only at onboarding.

You are prohibited from establishing or continuing a relationship, or executing a transaction, where you cannot apply due diligence measures, and you should consider filing a report. Where you suspect a crime and have reasonable grounds to believe that running due diligence would alert the customer, you may stop, but you must then file a report explaining why you stopped.

How does the Travel Rule apply to virtual asset transfers?

The originating VASP must obtain accurate originator and beneficiary information, transmit it immediately and securely to the beneficiary VASP or beneficiary financial institution, retain it, and make it available to the authorities on request. Article 36(2) of the executive regulations states this obligation without a monetary threshold. The AED 3,500 figure that appears elsewhere in the regulations is a due diligence trigger and should not be read across as a Travel Rule floor.

What information must travel

For the originator: name, account number or virtual asset wallet address, and residential or business address. For the beneficiary: name, and account number or virtual asset wallet address. The Supervisory Authority may specify further information, and it holds the power to determine the scope, limits and form of virtual asset transfers, verification obligations and technical standards. If a threshold is introduced later it will come through that route, so configure your gateway to the unconditional position now and relax it only against a published instruction.

Who holds the obligation

Both ends. The originating VASP collects, retains and transmits. The beneficiary VASP obtains and retains accurate information on both parties and makes it available on request. The same requirements apply to financial institutions when they send or receive virtual asset transfers for a customer, which matters if your banking partner is in the chain.

Practically, this is a vendor decision as much as a policy decision. Whichever Travel Rule gateway you use, accountability stays with you. You must vet the provider, document your oversight, test the controls, and be able to show your Compliance Officer can evidence effective monitoring. Outsourcing the mechanism never outsources the obligation.

Travel Rule Instrument

There is a separate instrument, the UAE Virtual Assets Travel Rule, which applies by its own terms to virtual asset service providers across the UAE including the free zones and the financial free zones. The Capital Market Authority adopted it for its licensees by Notice No. 1 of 2026, expressly issued pursuant to Cabinet Decision No. 134 of 2025. It is also published in the Central Bank Rulebook, where the web rendering still shows a superseded legal basis; the published PDF is the version to work from.

Four requirements in it go beyond Article 36(2) and belong in your build.

• Transfers to a virtual asset service provider that is not appropriately regulated, whether inside or outside the UAE, must not be executed, so counterparty status becomes a pre-transfer check rather than a periodic review.
• Transfers to and from unhosted wallets attract enhanced due diligence, including additional identification and source of funds.
• For domestic transfers below a daily aggregated AED 3,500 the information need not be verified in the absence of suspicion, which is a verification threshold and not a reason to stop collecting or transmitting.
• Outright prohibition: no UAE virtual asset service provider may execute a transfer of a privacy token.

That last one is a listing and product decision, not a monitoring rule, and it is the provision most often missed by firms that have read only the executive regulations.

How do VASPs report suspicious transactions and sanctions matches?

Suspicious transaction reports go to the Financial Intelligence Unit through goAML immediately and without delay, with no monetary threshold. Sanctions matches are different: freeze within 24 hours, then report the freeze through goAML to the Executive Office and your Supervisory Authority together, within five business days. Two separate regimes, two separate clocks.

What is reportable

Any transaction, attempted transaction, or funds where you suspect or have reasonable grounds to suspect that they constitute proceeds, are related to money laundering, terrorist financing or proliferation financing, or are intended to be used in those crimes. Regardless of value. Attempted transactions count on exactly the same footing as completed ones, which catches declined, abandoned and blocked transactions that firms often leave out of their procedures.

You must establish indicators that let you identify suspicion, and update them as criminal methods develop, in line with any instructions from your Supervisory Authority. A static indicator list from launch is a finding waiting to happen.

How fast is “immediately”

The question we are asked most often is what immediately means in practice. There is no number, and that makes the standard stricter rather than looser. The clock starts when suspicion forms, not when a committee meets. Any lag between an analyst flagging something and the report leaving the building will be measured against it, so your escalation path from first line to Compliance Officer to filing needs to be short and documented.

Banking secrecy, professional secrecy and contractual liability are not defences. You must also respond promptly to any request from the Unit for additional information.

Tipping off

You, your directors, officers and employees are prohibited from disclosing to the customer or anyone else that a report has been or is about to be filed, or that an investigation is underway. Breach carries imprisonment and a fine of not less than AED 50,000, or either penalty. Where the disclosure results in the proceeds being lost, destroyed or devalued, the penalty rises to imprisonment of not less than one year and a fine equal to the value of the proceeds, subject to a floor of AED 100,000. Information sharing within a financial group is permitted on defined terms.

Targeted financial sanctions

Screen customers, prospective customers, beneficial owners and transactions against the UN Consolidated List and the UAE Local Terrorist List on an ongoing, risk-based basis: at onboarding, before transactions, at periodic review, and whenever the lists change. On a confirmed match, freeze without delay and within 24 hours, and prohibit the making available of funds or services, all without prior notice to the customer. The Central Bank publishes its own targeted financial sanctions guidance alongside the Executive Office materials.

Then report. The report goes to the Executive Office and to your Supervisory Authority together, through goAML, within five business days of taking the freezing or suspension measure or of rejecting the transaction. On a confirmed match you file a Confirmed Name Match Report; on a partial match you cannot resolve, a Partial Name Match Report. Before rejecting on a partial match, allow a reasonable period for identification documents, which the Executive Office guidance puts at ten business days.

One point that catches virtual asset businesses specifically. The obligation to freeze named client assets within 24 hours is a technical capability question, not only a policy question, where balances sit on-chain through multi-party computation infrastructure. Establish who can actually effect a freeze, and document it, before you are asked to prove it.

The reporting safe harbour

Filing carries no downside exposure. No criminal, civil or administrative liability attaches to you, your board members, employees or authorised representatives for furnishing required information or for breaching a confidentiality restriction in doing so, even where you were not fully aware of the nature or actual occurrence of the crime. The only exception is a report made in bad faith with intent to harm. When the judgement call is close, the safe harbour is the reason to file.

How long must records be kept, and what happens if you get it wrong?

Five years is the federal floor, running from completion of the transaction or termination of the relationship. Your licensing perimeter may require longer, and where it does you follow the longer period. Penalties for failure run from a warning through administrative fines of up to AED 5,000,000 per violation, to corporate criminal fines of up to AED 100,000,000 and revocation of your licence.

Retention periods by perimeter

The federal five-year clock runs from the latest of several events: termination of the relationship, account closure, completion of an occasional transaction, completion of a supervisory inspection, completion of an investigation, or issuance of a final court judgment. Set your retention schedule to the highest applicable figure across your whole perimeter rather than per record type, because the failure mode is always the record you deleted on the shorter clock.

The categories widened in 2025. Alongside due diligence records, monitoring records, account files, business correspondence and identification documents, you must now retain suspicious transaction reports, the results of any analysis you conducted, and closed-circuit television and automated teller machine recordings. Retention policies written before December 2025 will not cover the last two.

Records must be organised so that individual transactions can be reconstructed and financial flows traced, to a standard capable of supporting a prosecution. Storage that satisfies an auditor will not necessarily satisfy that test.

Penalties

Two features are worth noting beyond the numbers. Your Supervisory Authority may publish the administrative penalties it imposes, so the reputational consequence arrives with the financial one. And attempted money laundering, terrorist financing and proliferation financing carry the same penalty as the completed offence. Separately, the fastest route to an enforcement file for most VASPs is not an AML failure at all but a promotional one, which is why UAE crypto marketing compliance sits alongside the AML programme rather than after it.

Work with the UAE’s first crypto-native law firm

UAE VASP AML compliance now rests on a framework rebuilt from the ground up in late 2025, and most compliance manuals in the market have not caught up. The obligations that matter most in practice are the AED 3,500 due diligence threshold, the Travel Rule with no monetary floor, immediate suspicious transaction reporting through goAML, and the 24-hour sanctions freeze. NeosLegal has structured 300+ Web3 and virtual asset projects since 2016 and advised on over 20 VASP licence applications across UAE regulators, with zero client enforcement actions. Get the framework right before you submit, not after.

How we help:

• UAE crypto and VASP licensing: regulator selection, application drafting and the full AML and CFT framework behind it.
• CMA federal crypto licence, VARA licensing in Dubai and ADGM licensing in Abu Dhabi: perimeter, capital and timeline for each route.
• UAE Web3 company formation: corporate structure, beneficial ownership registers and substance built to survive regulator review.
• UAE crypto market entry: a compliance health check with a keep, fix and avoid plan before you commit to a jurisdiction.

About the Author

Irina Heaver is the UAE Crypto Lawyer and Founder of NeosLegal, the UAE’s first crypto-native law firm, established in 2016. She has structured 300+ Web3 and virtual asset projects and has advised on VASP licensing and regulatory structuring across VARA, ADGM FSRA, DIFC DFSA, CMA and DMCC.

She is a contributor to the Chambers and Partners Virtual Assets Practice Guide, a Forbes Digital Assets contributor, and was named Middle East Technology Legal Team of the Year 2025 at The Oath Middle East Legal Awards. She is recommended by Lexology as the UAE’s leading blockchain lawyer. Irina has practised law in the UAE since 2008 and co-founded and exited a UAE-based crypto exchange, making her one of the few lawyers globally who has built and operated the type of business she now advises.

Reviewed by Zainab Kamran, Associate, Web3 and Digital Assets, NeosLegal.

NeosLegal is the UAE’s first crypto-native law firm for founders, operating since 2016. In 2026 it was named Best UAE Crypto Law Firm by the UAE Business Awards Middle East, and in 2025 it won Middle East Technology Legal Team of the Year at The Oath Middle East Legal Awards. Founder Irina Heaver is recommended by Lexology as the UAE’s leading blockchain lawyer, is a contributor to the Chambers and Partners Virtual Assets Practice Guide, and is a Forbes Digital Assets contributor. The firm has structured 300+ projects, advised on $500B+ in deal value and over 20 VASP licence applications, and recorded zero client enforcement actions across ten years and five regulators. neoslegal.co