UAE's enhanced AML and CTF Regime: a journey from grey list to compliance

These improvements demonstrate the UAE’s policy priorities of: 

• increasing transparency;  
• developing the UAE’s legal framework to better ensure that appropriate tools are available to identify and sanction wrongdoing; and
• keeping regulation in-step with emerging technologies and financial products.

Tightened AML, CTF, and sanctions regime

The UAE was placed on the Financial Action Task Force’s (FATF) “grey list” in March 2022 due to deficiencies in its AML, CTF, and sanctions regime, which meant that it was subject to increased monitoring by FATF. The UAE was removed from the grey list on February 23, 2024 after undertaking significant reforms to address these deficiencies. Reforms undertaken by the UAE include:

• a new specialist court to prosecute financial crimes;
• new AML and CTF guidelines for financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs), being entities which are subject to higher existing AML/CTF regulation; and
• a new penal code to strengthen the UAE’s existing AML, CTF, anti-bribery and corruption regulations, e.g., by providing that a manager or employee of a private organization who demands or accepts a bribe may be imprisoned for a period not exceeding five years.

The FATF praised the UAE for:

• facilitating regulatory investigations by increasing the number of outbound mutual legal assistance requests;
• improving awareness of DNFBP supervisors’ understanding of AML/CTF risks, e.g., by inviting executives from DNFBPs to attend sessions aimed at raising awareness of these risks and how best to mitigate them;
• applying effective non-compliance sanctions;
• enhancing the Financial Intelligence Unit’s (being a key UAE regulator of AML/CTF) resourcing; and
• increasing enforcement activity.

The FATF will commence its next mutual evaluation process in 2025, with the evaluation of the UAE expected to take place in 2026. 

The FATF’s initial criticism of the UAE partially related to the lack of enforcement by the UAE of the relevant laws. The UAE’s removal from the grey list is the result of increased enforcement activity which, as described below, has been felt in the form of the suspensions of operating licenses and financial penalties, particularly among precious metal traders in the past year.

Increased enforcement activity reflects the UAE’s strategic priorities in AML and CTF compliance

2024 saw a continuation of the trend towards greater enforcement activity and increased cross-border and inter-agency cooperation by the UAE authorities:

• Licenses of 32 local gold refineries were suspended between July and October 2024. The refineries were charged with 256 violations relating to their failures to sufficiently address money laundering risks. These violations included failing to notify the Financial Intelligence Unit of suspicious transactions and not implementing satisfactory systems and controls to identify money laundering risks.
• The Cabinet passed a Resolution that sets out a more comprehensive framework of penalties that can be imposed upon regulated entities. These include, for example, a range of new penalties which relate to failures by entities as to the existence or adequacy of their AML/CTF policies and procedures. 
• A fine of AED5.8 million (USD1.6 million) on a local bank for breaching AML/CTF laws, issued by the UAE Central Bank.
• In May, the UAE participated in the 40th plenary session of the Eurasian Group on Combating Money Laundering and Financing of Terrorism and, in November, it participated in the 39th plenary session of the Middle East and North Africa Financial Action Task Force, where it was appointed as the Vice Chair of the group for 2025.
• In September, Hamid Al Zaabi, Secretary-General of the National Committee (discussed further below) confirmed that, in 2023, the UAE had signed 45 mutual legal assistance treaties, with plans to sign new treaties in 2024 and 2025.
• The UAE hosted the 2024 Asia Pacific Group on Money Laundering Annual Meeting and Technical Assistance and Training Forum.

The UAE’s regulatory bodies have not yet published their latest figures for 2024. However, for context:

• Between March 2023 and July 2023, the UAE confiscated assets worth more than AED1.309 billion relating to AML/CTF activities. 
• In the same period, the UAE Executive Office of the Anti-Money Laundering and Countering the Financing of Terrorism to the National Committee (Executive Office) reported a conviction rate of 92.1%.
• In 2023, the DFSA reported commencing 13 new investigations and concluding 15 investigations (inclusive of the 12 investigations carried over from previous years), demonstrating an increase from 2022 when it reported commencing eight new investigations and concluding one investigation (inclusive of the 11 investigations carried over from previous years).
• In 2024, the DFSA finalized eight enforcement actions, issued 24 alerts, and issued fines totalling USD2.5 million against individuals and firms for undertaking unauthorized financial services activities, misleading investors, failing to comply with AML obligations, and misleading the DFSA or obstructing its investigations. Notably, the DFSA fined a former Relationship Manager at a DFSA regulated bank nearly USD1 million for deceptive conduct, which involved providing misleading information and falsifying client communications.

Increased regulatory protections for whistleblowers

Enhanced protections for whistleblowers came into force on July 5, 2024 (Employment Regulations (Amendment No. 1) 2024 and the Whistleblower Protection Regulations 2024). The regulations demonstrate the commitment of the Abu Dhabi Global Market (ADGM) to maintaining high global standards of business practice and include the following:

• Recognition and protection of good faith reporting of reasonably suspected misconduct by introducing the concept of “protected disclosures.”
• Encouragement of protected disclosures by permitting disclosures to be made anonymously.
• Availability of internal and external channels for reporting suspected breaches of ADGM legislation or financial crime.
• Integrating non-retaliation protections into existing employment regulations to protect employees against potential negative outcomes (such as dismissal or forced resignation) of whistleblowing.
• Good governance requirements to support whistleblowing for all ADGM entities.
• Written policies and procedures for firms licensed by the FSRA, DNFBPs, and large ADGM entities.

ADGM employers must implement appropriate arrangements to uphold effective whistleblowing by May 31, 2025. This will require them to assess and, if necessary, escalate matters concerning information received through protected disclosures, and to implement measures to safeguard the identities of individuals who make protected disclosures. 

Legislative developments/law reforms

Enhancements to the UAE’s existing AML/CTF framework through amendments to existing AML legislation

Amendments to the existing AML law¹ were introduced in August 2024² (the New AML Law). Key features include:

• A new National Committee for Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organizations (the National Committee). A “General Secretariat” function of the National Committee is likely to handle the day-to-day operations of the National Committee and oversee implementation of the National Strategy.
• The restructuring of the Higher Committee into the Supreme Committee for Supervising the National Strategy to Combat Money Laundering and Terrorism Financing (the Supreme Committee).

These reforms help to deliver some of the key objectives of the UAE’s National Strategy for Anti-Money Laundering, Countering the Financing of Terrorism and Proliferation Financing for 2024–2027 (the National Strategy). For further discussion on the New AML Law and the National Strategy, see our article here.

New legislation regulating virtual assets

The UAE continues to position itself as a global hub for virtual assets and trading, with developments in 2024 signalling a deeper embedding of the UAE’s virtual currency regulatory framework. This priority of the UAE has seen instances of misconduct begin to emerge in this sector. For example, in 2023, the criminal courts fined a gang that had been running an AED10 million (USD2.7 million) Bitcoin scam in Dubai over AED321,000 (USD87,400) each, for illegally obtaining money from their victims. The fraudsters were each fined AED20,000 (USD5,450) for practising virtual assets work without obtaining a license from the relevant authorities.

To foster this emerging industry and to better protect against misconduct, in 2024 the UAE took steps to bolster virtual assets regulation:

• The Virtual Assets Regulatory Authority (VARA) issued 11 VASP licenses in 2024 bringing these licensees within the ambit of its supervision.
• In March 2024, the DIFC enacted DIFC Law No. 2 of 2024 (the Digital Assets Law) alongside supporting amendments to existing legislation. The Digital Assets Law regulates, among other things, the control and title of virtual assets.
• On September 5, the Securities and Commodities Authority signed a cooperation agreement with VARA, demonstrating increased cooperation between regulatory authorities on digital asset regulation.

DFSA’s continued focus on cyber resilience

As in many jurisdictions, UAE businesses saw a material increase in exposure to cybersecurity crime. This has meant that cybersecurity has remained a policy priority of UAE regulators in 2024.

Of note is the review conducted by the DFSA of market participants and their exposure to cybersecurity risk and compliance with regulation (the Review). The Review found that:

• 80–90% of firms had implemented governance practices mandated by the relevant regulations. 
• 90% of firms had implemented practices to protect against cyber incidents as prescribed by the relevant regulations.

However, the Review did detect areas for improvement in the industry, for example:

• It was found that a lack of governing body and/or senior management oversight of cyber risk management programs was more prevalent for those firms which outsourced their IT services and cybersecurity functions to an external service provider.
• Only 75% of firms declared that they followed a due diligence process to ensure that third-party service providers meet cybersecurity requirements, as defined by the firm, before the service provided was given access to the firm’s data or information systems.

Given the increasing cybersecurity risk, the findings of the Review, and the recent introduction of DFSA’s cyber management rules, it is expected that more enforcement activity will occur in this area in the year ahead.

Predications for 2025

It is anticipated that the UAE will continue to prioritize AML/CTF governance in 2025, particularly in light of the upcoming 2026 FATF assessment. This includes regulatory agencies continuing to take a strong posture toward enforcement activities.

The National Strategy remains a work in progress and we expect over the next 12 months for it to result in further amendments to the current legislative framework to ensure increased clarity and consistency in the UAE’s approach to its AML, CTF, and sanctions regimes.

The development of whistleblowing regulation is likely to remain a key focus point in 2025. It is important for ADGM entities to meet the May 2025 deadline for implementing the necessary arrangements to uphold effective whistleblowing, and for the wider UAE business community to continue developing and implementing effective whistleblowing policies and procedures. Senior management in DIFC-based firms must also ensure that it reviews and uplifts its cyber management framework to comply with DFSA rules.

Directory quotes

• “A highly respected practitioner in his field, team head Yacine Francis has an ‘excellent strategic mind’ that allows him to handle complex, multi-faceted cross-border litigation cases, with an eminent reputation in corporate fraud and regulatory investigations.” — Legal 500 2024 UAE (Dispute Resolution: Arbitration and International Litigation)
• “The team is a respected presence in the DIFC Courts, notably acting on financial services and white-collar crime cases.” — Chambers Global 2023 UAE (Dispute Resolution)
• “A very efficient team, constantly thinking ahead and working to achieve the best result.” — Legal 500 2023 UAE (Dispute Resolution: Arbitration and International Litigation)
• “In addition to its experience handling financial services and securities disputes, the team is further noted for its strong track record in corporate investigations.” — Chambers Global 2021 Middle East (Dispute Resolution)

Footnotes 

1. Federal Decree Law No. 20 of 2018. 

2. Via Federal Decree Law No. 7 of 2024.

This article is part of the A&O Shearman Cross-Border White-Collar Crime and Investigations Review. Please click here for our overviews and insights in other jurisdictions.