Regulatory Compliance

AML compliance counsel in the UAE

The UAE rewrote its anti-money laundering framework in 2025. Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 replaced the law and regulations that every compliance manual in the country was built on, and the regulators now inspect against the new framework with penalties that reach executives personally. Neo Legal designs, refreshes and tests AML/CFT programmes for VARA-licensed VASPs, DFSA and FSRA firms, payment companies and designated non-financial businesses, supports their MLROs month to month, and handles the inspections and enforcement that follow when something goes wrong.

Speak to our compliance team → Start with what changed in 2025
Ex-VARA
Regulator experience on the team
VASP · DFSA · DNFBP
Every UAE AML regime, one practice
Animoca Brands
Advised on its Dubai VASP licence
Est. 1891
The UAE practice of Cornwalls

What we do for you

Why 2026 is the year to fix the programme

Three things landed at once. The law changed. Federal Decree-Law No. 10 of 2025 repealed the 2018 law and Cabinet Resolution No. 134 of 2025 replaced the 2019 regulations, so a manual that cites the old instruments is citing repealed law. The lists changed. The FATF's June 2026 lists were applied to UAE non-financial businesses by the Ministry of Economy and Tourism's Circular No. 2 of 2026, with mandatory enhanced due diligence, specific goAML templates and a ban on third-party reliance from black-listed states. Enforcement changed. VARA, the Capital Markets Authority, the Central Bank and the Ministry are fining licensed firms for compliance failures, and the 2025 framework reaches executives and senior management personally. The firms being fined are not the unlicensed ones. They are the licensed ones whose programme stopped matching their business.

Who we act for

Virtual asset service providers licensed by VARA or applying, and token projects whose exchanges and banks ask for compliance opinions; DIFC and ADGM firms under the DFSA and FSRA AML rulebooks; payment, stored value and exchange businesses under the Central Bank; real estate brokerages, corporate service providers, audit firms and precious metals dealers supervised by the Ministry of Economy and Tourism; and family offices and foundations that need a defensible position on source of wealth and sanctions for their banks. Licensing itself runs through our VARA, CMA and financial services licensing practices, and accounting and tax compliance through our group's accounting arm, Neo Finance.

How an engagement runs

Most relationships start with one of two fixed-fee projects. A programme refresh: we map the current law, the Executive Regulations and your sector rulebook against your existing documents, produce a gap register, redraft what needs redrafting, re-run the business risk assessment with your data, and deliver the board paper and training module. Or an independent review: we test the risk assessment against the business, the policies against the law and the files against the policies, and deliver a findings register with owners and dates. From there, most clients move to ongoing compliance support on a fixed monthly fee: the quarterly MLRO board report, regulatory watch, judgement on reportable suspicion and sanctions matches, policy maintenance and regulator correspondence. Inspection and enforcement work is handled on our standard rates where the scope cannot be known in advance. We do not publish fees; we confirm them on the first call once we know the licence, the business and the regulator.

The compliance bench

The practice is led by founder and managing partner Harly Zappino, who has advised on virtual asset regulation since 2015 and led Neo Legal's work on Animoca Brands' Dubai VASP licence, with Manpreet Kaur, Director of Licensing and Regulatory Compliance, who worked inside VARA on the framework that governs every licensed VASP in Dubai and previously at KPMG and PwC on the live compliance operations of regulated financial businesses. Regulatory investigations and enforcement draw on founding partner Levent Shevki's financial services practice, and Mandarin-language compliance support for Chinese-owned licensees runs through our China Desk.

AML compliance UAE: frequently asked questions

What does an AML compliance lawyer do in the UAE?
Three things a compliance consultant cannot. First, interpret the law: whether a customer, product, counterparty or jurisdiction is inside the obligations in Federal Decree-Law No. 10 of 2025 and its Executive Regulations, and put the firm's name to that position. Second, handle the regulator: inspection findings, information requests, enforcement letters and remediation plans. Third, build and test the programme to a legal standard, so the policies, risk assessment and MLRO reporting line survive an inspector reading them against the rulebook rather than against a template.
Which UAE law governs anti-money laundering compliance now?
Federal Decree-Law No. 10 of 2025 on anti-money laundering, countering the financing of terrorism and the financing of illegal organisations, which repealed and replaced Federal Decree-Law No. 20 of 2018, together with its Executive Regulations in Cabinet Resolution No. 134 of 2025, which replaced Cabinet Decision No. 10 of 2019. Sector rulebooks sit on top: VARA's Compliance and Risk Management Rulebook for Dubai VASPs, the DFSA AML Module in the DIFC, the FSRA AML Rulebook in ADGM, and the Central Bank's standards for banks, exchange houses and payment firms. Targeted financial sanctions run under Cabinet Decision No. 74 of 2020.
Does my AML policy need updating for the 2025 law?
Almost certainly. Any manual that cites Federal Decree-Law No. 20 of 2018 or Cabinet Decision No. 10 of 2019 as its legal basis is citing repealed law, and inspectors notice. Beyond the citations, the 2025 framework brings proliferation financing expressly into scope, reorganises national oversight and widens the penalty regime, so the risk assessment, the high-risk country procedure and the sanctions section usually need substantive changes rather than a find-and-replace.
Who has to comply with UAE AML obligations?
Two groups. Financial institutions: banks, exchange houses, payment and stored value firms, insurers, securities firms, fund managers and virtual asset service providers licensed by VARA, the Capital Markets Authority, the DFSA or the FSRA. And designated non-financial businesses and professions: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, lawyers and notaries. Both groups must register on goAML, appoint a compliance officer, run a documented risk-based programme and file suspicious transaction reports.
Can Neo Legal act as our MLRO?
It depends on the regulator. VARA requires the MLRO to be a UAE-resident employee of the VASP, so for Dubai VASPs we support the MLRO rather than hold the role. DFSA and FSRA firms may use an outsourced MLRO provided the individual is approved by the regulator, and DNFBPs have more flexibility. In every case we provide the reporting-line design, the quarterly MLRO board report, the regulatory watch and the judgement calls that make the function work, whoever holds the title.
What is an independent AML audit and do we need one?
A periodic test of the whole programme by someone independent of the compliance function: does the risk assessment match the business, do the policies match the law, do the files match the policies, and does the MLRO actually report what the procedures say. The Executive Regulations require an independent audit function proportionate to the size and risk of the business, and the sector regulators ask for the output. A law firm review carries weight with an inspector that a review by the firm's own accountant does not.
What happens if a regulator finds AML breaches?
A findings letter with a deadline, usually with a request for a remediation plan. Depending on the regulator and the breach, outcomes range from a supervisory letter to administrative fines on the firm and on individual executives, licence conditions, suspension or, under the Decree-Law, criminal referral. The response in the first two weeks sets the tone for everything that follows, which is why we treat an inspection letter as urgent legal work rather than a compliance task.
How does Neo Legal price AML compliance work?
Fixed fees for defined projects such as a programme refresh for the 2025 law or an independent review, a fixed monthly fee for ongoing compliance support, and our standard hourly rates for inspection and enforcement work where the scope cannot be known in advance. We confirm the fee on the first call once we understand the licence, the business and the regulator involved.
The compliance library
The 2025 Law Refresh
What every UAE AML manual must now say.
VARA AML Requirements
The Dubai VASP layer on top of federal law.
Independent AML Review
Testing the programme before the regulator does.
Inspections and Fines
The first two weeks after the findings letter.

A manual that cites the old law,
an inspection letter, or an MLRO who needs backup?

Tell us the licence, the regulator and where the programme stands. We will map the gaps against the 2025 framework and propose the fastest route to a programme that passes.

Schedule a Consultation →