Federal Decree-Law No. 10 of 2025 repealed and replaced Federal Decree-Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 replaced Cabinet Decision No. 10 of 2019 as the Executive Regulations. Every AML policy, risk assessment and training deck that cites the old instruments needs a documented refresh, and the high-risk country, proliferation financing and sanctions sections usually need substantive change.
What was replaced
Two instruments carried the UAE's AML framework from 2018: Federal Decree-Law No. 20 of 2018 and its Executive Regulations in Cabinet Decision No. 10 of 2019. Both have gone. Federal Decree-Law No. 10 of 2025 on anti-money laundering, countering the financing of terrorism and the financing of illegal organisations repealed and replaced the 2018 law from 14 October 2025, and Cabinet Resolution No. 134 of 2025 replaced the 2019 regulations. The sector rulebooks of VARA, the DFSA, the FSRA, the Capital Markets Authority and the Central Bank continue to apply on top of the federal framework and cross-refer to it.
The structure of the obligations is familiar. Risk-based approach, customer due diligence, enhanced due diligence, beneficial ownership, record keeping, suspicious transaction reporting, a compliance officer, independent audit and training all remain. What changed is the detail around them and the architecture above them.
The changes that matter in practice
Proliferation financing is expressly in scope
The 2025 law names the financing of proliferation of weapons of mass destruction alongside money laundering and terrorist financing. Programmes written to the 2018 law often mention proliferation only in the sanctions section, if at all. A refreshed business risk assessment needs a proliferation financing dimension, and training needs to explain what it looks like in the firm's actual products.
National oversight was reorganised
The Decree-Law restructures the committees that set national AML policy and issue the lists and guidance that firms must follow. For a compliance team the practical point is that circulars, high-risk country lists and typologies now flow from the reorganised bodies, and the policy should identify the right sources rather than naming committees that no longer exist in the same form.
Penalties widened
The 2025 framework broadens the administrative and criminal consequences for firms and for the individuals running them. Senior management exposure is personal. That is a governance point as much as a compliance point: boards should minute that they have seen the refreshed framework and approved the updated programme.
High-risk countries
Article 23 of the Executive Regulations requires enhanced due diligence proportionate to risk for relationships and transactions involving countries the national committee identifies as high-risk, and countermeasures where a supervisor directs them. The Ministry of Economy and Tourism's Circular No. 2 of 2026 of 14 September 2026 applied that article to the June 2026 FATF lists for the DNFBPs it supervises, with mandatory enhanced due diligence, goAML reporting templates for high-risk jurisdiction activity, a ban on relying on third parties located in black-listed countries for customer due diligence, and targeted financial sanctions compliance. Our DNFBP guide covers the circular in detail.
The refresh checklist
- Legal basis section. Replace every reference to the 2018 law and the 2019 regulations. Add the sector rulebook and the targeted financial sanctions instrument, Cabinet Decision No. 74 of 2020.
- Business risk assessment. Add proliferation financing. Re-score country risk against the current FATF lists and the national committee's list. Record the date and the data used.
- Customer risk model. Check that the factors and weights still produce sensible outcomes for the current product set. Many models were built for a business that has since changed.
- High-risk country procedure. Rewrite to Article 23 of the Executive Regulations, including the third-party reliance prohibition and the specific goAML templates.
- Sanctions section. Screening scope, frequency, list sources, freeze and reporting steps under Cabinet Decision No. 74 of 2020 and the Executive Office for Control and Non-Proliferation's requirements.
- MLRO and compliance officer mandate. Reporting line, independence, access to records, the quarterly board report.
- Independent audit. Scope and frequency proportionate to the firm, with the first post-refresh review scheduled.
- Training. A dated module on what changed, delivered to everyone with a customer-facing or control role, with attendance recorded.
- Board approval. A minute approving the refreshed programme. Inspectors ask for it.
How we run a refresh
We start with the existing manual and the regulator's most recent correspondence, map every obligation in the 2025 law and the Executive Regulations and the applicable sector rulebook against the current documents, and produce a gap register. The register becomes the drafting plan. We redraft only the sections that need it, re-run the business risk assessment with the client's data, prepare the board paper and the training module, and set the independent review date. The output is a programme that reads as the firm's own, cites the current law, and comes with a record of why each change was made. See our AML compliance practice page for the full scope of what we do.
Frequently asked questions
Did Federal Decree-Law No. 10 of 2025 replace the 2018 AML law?
Yes. Federal Decree-Law No. 10 of 2025 repealed and replaced Federal Decree-Law No. 20 of 2018 from 14 October 2025. Cabinet Resolution No. 134 of 2025 replaced Cabinet Decision No. 10 of 2019 as the Executive Regulations.
Is an AML manual that cites the 2018 law still valid?
The obligations it describes largely continue, but the manual cites repealed law and will not reflect proliferation financing, the reorganised oversight structure or the current high-risk country rules. Inspectors treat an out-of-date legal basis as a finding in itself. It needs a documented refresh approved by the board.
What is new about proliferation financing under the 2025 law?
The financing of proliferation of weapons of mass destruction is named expressly alongside money laundering and terrorist financing. Business risk assessments, customer risk models and training must address it, not just the sanctions screening section.
Which article covers high-risk countries in the Executive Regulations?
Article 23 of Cabinet Resolution No. 134 of 2025 requires enhanced due diligence proportionate to risk for relationships and transactions involving countries identified as high-risk, and countermeasures where a supervisor requires them. The Ministry of Economy and Tourism's Circular No. 2 of 2026 applies it to the FATF lists for DNFBPs.
How long does an AML programme refresh take?
For a single-licence firm with an existing manual, typically four to six weeks from documents to board approval, including the re-run risk assessment and a training module. Multi-licence groups and firms with open regulator findings take longer because the remediation plan and the refresh must be reconciled.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
