Federal Decree Law No. 10 of 2025 represents more than a regulatory update. The UAE's expanded AML/CFT framework eliminates the statute of limitations for financial crimes, grants regulators authority to freeze assets without notice, and pulls sectors like real estate, logistics, construction, trade, manufacturing, virtual assets, and nonprofits into the compliance perimeter previously reserved for banks and payment processors.
If your organization operates in any of these sectors, you're now subject to the same investigative scrutiny, record-keeping obligations, and penalty exposure as a commercial bank. This shift is part of a coordinated global tightening that started with FATF guidance on beneficial ownership transparency and is now accelerating across MENA, APAC, and EU jurisdictions.
Key Changes in the Framework
The framework introduces three structural changes that alter how compliance programs must function:
Expanded predicate offenses. Money laundering now encompasses a broader set of underlying crimes, increasing the scenarios in which your transaction monitoring must flag activity. The law doesn't just criminalize laundering proceeds from drug trafficking or corruption. It covers environmental crimes, tax evasion, and sanctions violations, meaning your risk assessment must account for upstream conduct that wouldn't have triggered AML controls under prior regimes.
No statutory limitation. Financial crimes prosecuted under the new framework carry no time bar. Regulators can investigate transactions from any period, which means your retention obligations extend indefinitely for high-risk relationships. You can't rely on a seven-year lookback window to constrain your exposure.
Pre-notice asset freezes. Regulators gained authority to freeze assets without prior notification, removing the procedural buffer that previously allowed entities to contest or clarify before enforcement action. Once flagged, your accounts lock before you can submit exculpatory evidence or correct a filing error.
Implications for Risk Managers
Real estate transactions now require full CDD protocols. Property developers, brokers, and management firms must implement customer due diligence measures comparable to those required of financial institutions. This includes beneficial ownership verification, source-of-funds documentation, and ongoing monitoring of client relationships. If you've been treating real estate closings as one-time transactions, you're non-compliant.
Virtual asset providers face the same obligations as banks. Crypto exchanges, wallet providers, and NFT platforms operating in or through the UAE must register with regulators, appoint compliance officers, file suspicious transaction reports, and maintain transaction records that link wallet addresses to verified identities. The framework doesn't distinguish between fiat and digital asset flows.
Nonprofits must demonstrate fund traceability. Charitable organizations and NGOs now fall under CFT provisions that require documentation of donor identity, fund origin, and end-use verification. If your nonprofit accepts cross-border donations or operates in conflict zones, you need controls that prove funds didn't originate from or flow to sanctioned entities.
Logistics and trade companies must screen counterparties. Freight forwarders, customs brokers, and trade finance intermediaries are now designated reporting entities. You must verify that shipments don't involve sanctioned goods, that invoicing reflects actual value, and that payment flows align with declared trade activity. Trade-based money laundering is a specific enforcement priority.
Construction firms must verify contractor and supplier ownership. Large-scale projects often involve layered subcontracting and supplier networks. The framework requires you to identify beneficial owners across your supply chain, not just your direct contractual counterparties. If a Tier 2 subcontractor is controlled by a sanctioned individual, your project is at risk.
Strategic Adjustments for Your Team
Your compliance function can't remain a finance-department appendage. If you're a risk manager in a newly regulated sector, you need dedicated AML/CFT resources with investigative experience, not generalists who review contracts part-time.
You'll need technology that automates name screening, transaction monitoring, and case management. Manual spreadsheet reviews won't scale when you're processing thousands of transactions monthly and regulators expect real-time flagging of suspicious patterns.
Your board must understand the exposure. Asset freezes without notice mean operational disruption, not just financial penalty. If your primary operating account locks mid-quarter, you can't make payroll or settle supplier invoices while you contest the action. That's an enterprise risk, not a compliance technicality.
Action Items by Priority
Immediate (within 30 days):
Conduct a gap assessment against the framework's designated non-financial business and profession (DNFBP) requirements. Identify which provisions apply to your sector and where your current controls fall short. Don't wait for sector-specific guidance; the core obligations are already in force.
Appoint a compliance officer with AML/CFT expertise and grant them direct board access. This role can't report through legal or finance if you want independent escalation authority.
Near-term (within 90 days):
Implement enhanced due diligence procedures for high-risk clients, including politically exposed persons, cross-border transactions above your risk threshold, and any relationship involving jurisdictions flagged by FATF as high-risk or under increased monitoring.
Deploy transaction monitoring technology that flags patterns consistent with trade-based money laundering, structuring, or sanctions evasion. Rule-based systems that only check name matches won't detect behavioral anomalies.
Establish a suspicious transaction reporting protocol that defines escalation triggers, investigation timelines, and filing deadlines. Your team needs clear authority to freeze transactions pending review.
Ongoing:
Train operational staff to recognize red flags specific to your sector. Real estate agents need different indicators than logistics coordinators. Generic AML training won't prepare your front line to spot invoice discrepancies or beneficial ownership obfuscation.
Review and update your risk assessment annually, incorporating lessons from enforcement actions, typology reports published by UAE regulators, and FATF guidance updates. Your risk profile isn't static.
Test your controls through independent audits that simulate regulatory examinations. If your internal audit team can't validate your CDD files or transaction monitoring effectiveness, regulators won't accept them either.
