CMA AML Compliance UAE: The 2026 Broker Guide
CMA AML compliance in the UAE changed hands on 1 January 2026. The Securities and Commodities Authority no longer exists. The Capital Market Authority took its place as the federal supervisor for brokers, dealers and market institutions outside the DIFC and ADGM. It inherited the AML and counter-terrorist financing supervision that came with the role.
Most licensed firms have carried on screening and filing exactly as before. That is mostly correct. The part that is not correct sits in the paperwork.
Last updated: 20 August 2026. Written by the AML/CFT compliance team at ADZ, Dubai.
Quick Answer: Who Supervises AML for UAE Brokers in 2026?
The Capital Market Authority supervises AML and CFT compliance for UAE capital market licensees outside the DIFC and ADGM. It replaced the Securities and Commodities Authority on 1 January 2026 under Federal Decree-Law No. 32 of 2025 and succeeded to all of its rights and obligations. Existing licences, registrations and approvals carried over automatically.
Key Takeaways
- The supervisor changed, not your obligations. Federal Decree-Law No. 32 of 2025 created the Capital Market Authority and made it the legal successor of the Securities and Commodities Authority, with effect from 1 January 2026.
- Your licence did not lapse. Existing decisions and implementing regulations stay in force where they do not conflict with the new laws. References to the old authority are read as references to the new one.
- The AML law underneath is newer than most policies. Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025 and Cabinet Decision No. 134 of 2025 followed on 14 December 2025.
- The sector’s own AML instruments still cite the repealed law. The supervisor’s published annual return instructions define AML/CFT scope by reference to Cabinet Decision No. 10 of 2019 and Federal Decree-Law No. 20 of 2018. Both were replaced in 2025.
- The annual return is the exam. Five tabs, 35 customer risk categories and 18 control sections. It must be fully completed before it can be submitted.
- Even the web address moved. The old supervisor domain now redirects to the Capital Market Authority site, so policy footnotes and training decks point at a redirect.
- Penalties sit under the AML law, not the securities law. Federal Decree-Law No. 10 of 2025 carries administrative fines on legal persons of AED 5 million to AED 100 million.
What Changed on 1 January 2026?
Two federal decree-laws came into force together on 1 January 2026. Federal Decree-Law No. 32 of 2025 established the Capital Market Authority as an independent federal authority with legal personality and financial and administrative independence. Federal Decree-Law No. 33 of 2025 reset the substantive regulation of the capital market.
Between them they repealed Federal Law No. 4 of 2000, which had created the Securities and Commodities Authority a quarter of a century earlier.
Does the CMA simply replace the SCA?
Yes, and the succession is written into the law rather than left to practice. Article 2 of Federal Decree-Law No. 32 of 2025 makes the Capital Market Authority the legal successor of the former authority in all of its rights, obligations and contracts. It directs that references to the former authority are read as references to the new one.
Article 5 sets out its powers: licensing and supervision of regulated activities, policy and guidance, systemic risk work, international cooperation, and enforcement powers including inspections and the imposition of penalties.
The practical consequence for a compliance officer is short. There is no re-application to make and no gap in supervision to explain.
Does my existing AML approval still stand?
It does. Decisions and implementing regulations issued under the old regime remain in force where they do not conflict with the new decree-laws, until they are formally amended or replaced. That includes the sector AML instruments most licensed firms map their policies against.
Federal Decree-Law No. 33 of 2025 carries a transition period of one year, which puts the outer edge of the settling-in window at the end of 2026. Firms that treat 2026 as a free year usually discover the cost during their first supervisory engagement under the new authority.
The detail nobody put in a client alert
The supervisor’s web domain moved with the name. A request to the old sca.gov.ae address now returns a permanent redirect to the Capital Market Authority site, verified on 20 August 2026.
That sounds trivial until you open your AML manual. A footnote points at a page that no longer exists under its own name. A training deck names an authority dissolved eight months ago. Supervisors read those documents, and a manual naming the wrong regulator is the first sign it has not been reviewed.
Need your AML policy remapped to the 2025 instruments? ADZ rewrites AML/CFT policies, procedures and risk assessments against the law and executive regulations actually in force. Talk to the ADZ compliance advisory team.
Which AML Law Applies to a CMA-Licensed Firm in 2026?
The capital market authority supervises AML compliance, but it does not write the AML law. The obligations come from the federal framework, and that framework was rewritten in late 2025.
The instruments in force
| Instrument | Status | In force |
|---|---|---|
| Federal Decree-Law No. 10 of 2025 on AML/CFT and proliferation financing | Current primary law | 14 October 2025 |
| Cabinet Decision No. 134 of 2025 (executive regulations) | Current implementing regulation | 14 December 2025 |
| Federal Decree-Law No. 20 of 2018 | Replaced | Repealed 2025 |
| Cabinet Decision No. 10 of 2019 | Replaced | Repealed 2025 |
| Federal Decree-Law No. 32 of 2025 (Capital Market Authority) | Creates the supervisor | 1 January 2026 |
| Federal Decree-Law No. 33 of 2025 (capital market regulation) | Sector regulation, one-year transition | 1 January 2026 |
Our guide to Federal Decree-Law No. 10 of 2025 covers the substantive changes in the primary law. The point for capital market licensees is narrower. The law you comply with was replaced ten months ago, and the sector paperwork you comply through has not caught up.
Why does my AML policy cite a repealed law?
Read the supervisor’s own instructions for the annual AML/CFT and targeted financial sanctions risk assessment return. Under the heading defining the scope of AML/CFT regulation, the document points readers to Articles 2 and 3 of Cabinet Decision No. 10 of 2019, the implementing regulation of Federal Decree-Law No. 20 of 2018. Its reference table lists the same two instruments alongside:
- Decision No. 21/Chairman of 2019 on AML/CFT procedures
- Decision No. 13/Chairman of 2021
- Cabinet Decision No. 58 of 2020 on beneficial owner procedures
- Cabinet Resolution No. 53 of 2021 on penalties for beneficial owner breaches
- Cabinet Decision No. 74 of 2020 on terrorism lists
The sectoral AML/CFT Guidance for the Capital Market Sector, issued in September 2021, does the same. It applies to institutions licensed under the authority in respect of activities under Article 2 of Cabinet Decision No. 10 of 2019.
Both documents remain valid guidance under the succession rule. Neither has been reissued against the 2025 instruments. So a firm that mirrors the supervisor’s template ends up with an AML policy whose legal basis section cites a repealed decree-law and a repealed cabinet decision. That is a finding waiting to be written up.
What to fix this quarter
- Legal basis section. Replace every reference to Federal Decree-Law No. 20 of 2018 with Federal Decree-Law No. 10 of 2025, and Cabinet Decision No. 10 of 2019 with Cabinet Decision No. 134 of 2025. Keep the older citations only where you describe history.
- Supervisor name. Replace the Securities and Commodities Authority with the Capital Market Authority in the manual, the training material, the board pack and customer-facing disclosures.
- Reference links. Repoint policy footnotes and intranet bookmarks to the current authority domain rather than relying on a redirect.
- Version control. Record the review date, the reason for the change and the approver.
- Sector instruments. Keep applying Decision No. 21/Chairman of 2019 and the September 2021 sectoral guidance. Add a policy note explaining that they remain in force under the succession rule while their citations predate the 2025 law.
Who Does the CMA Supervise for AML Purposes?
UAE AML supervision is split by sector and by jurisdiction, which is why firms holding more than one licence often run two reporting calendars.
| Supervisor | Population supervised |
|---|---|
| Capital Market Authority | Brokers, dealers, market institutions, exchanges, clearing and settlement bodies and other licensed capital market firms in onshore UAE |
| Central Bank of the UAE | Banks, exchange houses, finance companies, insurers and other licensed financial institutions |
| Ministry of Economy and Tourism | DNFBPs including real estate agents, dealers in precious metals and stones, auditors and accountants, and corporate service providers |
| Dubai Financial Services Authority | Firms licensed in the DIFC |
| Financial Services Regulatory Authority | Firms licensed in the ADGM |
| Virtual Assets Regulatory Authority | Virtual asset service providers in Dubai outside the DIFC |
A firm licensed in the DIFC or the ADGM answers to that centre’s own regulator, not to the Capital Market Authority. Our comparison of AML requirements across mainland, DIFC and ADGM sets out where the three regimes diverge.
Whichever supervisor you answer to, the reporting channel is the same. Every reporting entity registers with the UAE Financial Intelligence Unit and files through the goAML portal. Sanctions obligations run through the lists published by the UAE Executive Office for Control and Non-Proliferation.
Why the Capital Market Sector Carries Distinct ML/TF Risk
The sectoral guidance names the features that make this sector attractive to launderers. Quote them in your risk assessment rather than paraphrasing into generalities:
- The number of intermediaries involved in a single transaction
- The speed of execution
- The relative anonymity available when transacting through an intermediary
- The volume of large-value transactions
- The variety and complexity of instruments
- High liquidity in certain products and how easily they convert to cash
- The cross-border reach of the sector
- Valuation difficulty for complex or thinly traded products
- Multiple participants on both sides, which limits any one party’s view of the whole transaction
What are the trade-based money laundering red flags?
The guidance treats trade-based money laundering as a primary typology for the sector, including where a broker provides trade finance. It names four core manipulations:
- Misrepresenting the price of a good or service
- Invoicing the same shipment more than once
- Misstating quantity, including phantom shipments where nothing ships at all
- Misrepresenting quality or type, so documents and cargo do not match
The red flags a securities provider should act on:
- Copy documents used where originals would be expected, with no reasonable explanation
- A customer unable or unwilling to provide documentation supporting the transaction
- Most activity running to or from a jurisdiction designated high risk
- A payment method inconsistent with the risk characteristics of the transaction
- Cash or other payments from third parties with no apparent connection to the transaction
- Front or shell companies in the chain
- Highly structured, fragmented or complex transactions involving multiple parties without legitimate justification
- Indications of collusion, for example a buyer and seller sharing an address
- A buyer whose legal structure prevents identification of its owners, or who acts through agents
Cash is the other named risk. The guidance describes the UAE as a cash-intensive economy exposed to illicit cash movement, with free zones flagged for routine acceptance of large cash volumes. Our guide to trade-based money laundering in the UAE covers the document-level checks.
The CMA Annual AML/CFT and TFS Risk Assessment Return
The annual return is where a capital market licensee’s programme is actually measured. The supervisor publishes a hundred-page instruction document defining every field. Reading it before the submission window opens is the difference between a clean return and a remediation letter.
What does the annual return ask for?
| Tab | What it captures |
|---|---|
| 1. Customer Risk | Inherent exposure across 35 client and counterparty categories |
| 2. Products and Services Risk | Activity volumes, securities types, correspondent relationships, cash, payment forms, virtual assets, forex |
| 3. Distribution Channel Risk | Structure, online platforms, onboarding, introduced clients, third-party reliance, rejected and terminated relationships |
| 4. Controls and Quality of Risk Mitigation | 18 control sections graded against the inherent risk declared in tabs 1 to 3 |
| 5. Signatories | Attestation by named individuals |
Three mechanical rules catch firms out every year:
- The questionnaire must be fully completed before it can be submitted, so a half-answered tab blocks the whole filing.
- All monetary values are reported in AED, so convert a multi-currency book before you start rather than while you type.
- Country breakdowns must use ISO 3166-1 country names, or ISO two-alpha, three-alpha or three-numeric codes when pasting in bulk.
The customer risk tab is not one question
It runs through 35 categories, and each expects a number you can evidence. Client types include natural persons, corporates, trusts and other legal arrangements, government clients, financial institutions, professional investors and non-profit organisations, plus five separate DNFBP client types.
Higher-risk exposures are counted separately:
- Politically exposed persons and high net worth individuals
- Complex ownership structures, nominee shareholders and directors, and special purpose vehicles
- Third parties acting on behalf of others
- Virtual assets, forex and collective investment schemes
- Casinos and gambling, prepaid cards, art and antiques, auction houses and luxury vehicles
- Defence and arms, import and export, oil and gas, real estate development and high-value goods
- Cash-intensive businesses
A broker who cannot produce those counts on demand usually has a client master that was never built to segment by risk. That is a data problem before it is a compliance problem, and it is the most common reason a return takes six weeks instead of six days.
The eighteen control sections
Tab four grades the programme against these sections:
- Compliance and regulation history
- General policies and procedures
- AML/CFT risk assessment, and a separate virtual assets risk assessment
- Governance
- Compliance officer or MLRO
- KYC and customer due diligence
- High-risk customers and enhanced due diligence
- Politically exposed persons
- Cash transactions
- Transaction monitoring
- Suspicious transaction reporting
- Record keeping
- Training
- Targeted financial sanctions
- Internal audit
- Third parties
- Branches and subsidiaries
Read that as a supervisory expectation rather than a form. Each section is a control the supervisor believes a licensed firm already operates, documents and tests. If a section has no owner on your organisation chart, the gap surfaces in the return before it surfaces in an inspection.
Want those control sections tested before the supervisor tests them? ADZ conducts independent AML/CFT audits for CBUAE, DFSA and VARA-regulated entities, and applies the same control testing method to capital market licensees. See ADZ independent audit services.
Building the Programme a CMA-Licensed Firm Needs
The control list maps onto a build sequence. This is the order ADZ works in when a licensed firm asks for a programme that will survive a supervisory review.
1. Business risk assessment first
Everything downstream is calibrated by the enterprise-wide risk assessment. It covers customer, product, delivery channel and geographic risk, documented with a methodology someone else can follow. The return asks you to declare virtual assets separately, so any digital asset exposure needs its own assessment. Our walkthrough of the AML business risk assessment in the UAE covers methodology and evidence.
2. Governance and a compliance officer with authority
The return treats governance and the compliance officer as two distinct sections, which tells you the supervisor separates them. An MLRO with the right title but no direct line to the board and no budget is a governance finding. The MLRO responsibilities guide sets out what the role must be able to do independently.
3. CDD, EDD and politically exposed persons
Customer due diligence carries three separate sections in the return. Beneficial ownership follows the 25 per cent threshold in Cabinet Decision No. 58 of 2020. The beneficial owner is whoever ultimately owns or controls 25 per cent or more of the shares or voting rights, directly or through a chain of ownership.
The same decision captures equivalent control, such as the right to appoint or dismiss the majority of directors. See our enhanced due diligence guide for the triggers and the evidence standard.
4. Sanctions screening against the current lists
Targeted financial sanctions get their own control section. Screening runs against the lists issued through the Executive Office for Control and Non-Proliferation and the UN consolidated list, at onboarding and on an ongoing basis, with a documented match-handling and freezing procedure. Our guide to targeted financial sanctions in the UAE covers the freezing and reporting timelines.
5. Transaction monitoring calibrated to the book
Speed of execution and instrument complexity are the sector’s declared vulnerabilities, so generic monitoring rules either miss the pattern or drown the team in alerts. Thresholds need to come from your own client segmentation and product mix, and every rule change needs a documented rationale. See AML transaction monitoring in the UAE for tuning and testing.
6. Reporting through goAML
Suspicious transaction reporting is its own control section. The obligation is to file with the Financial Intelligence Unit without delay once suspicion forms, then protect the confidentiality of the report. Our STR filing guide walks through the submission itself.
7. Record keeping, training and internal audit
These three close the loop and they are the three most often thin. Records need to be retrievable in the form the supervisor asks for, not merely stored. Training needs attendance and assessment evidence per role, not one annual all-staff session. Internal audit needs to test the AML programme specifically, with findings tracked to closure.
See our guidance on AML record-keeping requirements and AML training requirements for UAE employees.
Training evidence is a graded control section. Compliance 360 by ADZ delivers 32 KHDA-approved AML/CFT courses with per-role attendance and assessment records you can submit as evidence. Browse ADZ training programmes.
What the 2026 FATF Evaluation Adds
The UAE is being assessed under the FATF fifth-round methodology, with the onsite visit expected in mid-2026. The fifth round weights effectiveness more heavily than technical compliance. A policy that says the right thing counts for little; evidence that it produced decisions, alerts, reports and remediation counts for a great deal.
Two immediate outcomes bear directly on capital market licensees. Supervision looks at whether supervisors apply risk-based oversight and whether firms respond to it. Preventive measures looks at whether firms actually apply CDD, monitoring and reporting rather than merely documenting them.
A newly constituted supervisor entering an evaluation year has strong reason to demonstrate active oversight. Our FATF mutual evaluation guide covers the assessment structure.
The enforcement backdrop is not theoretical. The Central Bank of the UAE issued more than AED 370 million in AML/CFT fines during 2025. The Ministry of Economy and Tourism fined 29 DNFBP companies AED 22.6 million across 225 violations. Federal Decree-Law No. 10 of 2025 carries administrative fines on legal persons of AED 5 million to AED 100 million, and natural persons remain individually liable alongside the company.
Frequently Asked Questions
Is the SCA still the AML supervisor in the UAE?
No. The Securities and Commodities Authority was replaced by the Capital Market Authority on 1 January 2026 under Federal Decree-Law No. 32 of 2025. The new authority succeeded to all of the former authority’s rights, obligations and contracts, and it supervises AML and CFT compliance for licensed capital market firms in onshore UAE. References to the former authority in existing documents are read as references to the Capital Market Authority.
Does my SCA licence remain valid under the CMA?
Yes. Licences, registrations and regulatory approvals issued by the former authority transferred to the Capital Market Authority automatically, with no re-application process. Decisions and implementing regulations issued under the previous framework remain in force where they do not conflict with the new decree-laws, until they are amended or replaced.
Which AML law applies to a CMA-licensed broker in 2026?
Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, together with its executive regulations in Cabinet Decision No. 134 of 2025, in force since 14 December 2025. These replaced Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. Sector instruments such as Decision No. 21/Chairman of 2019 continue to apply under the succession rule even though they cite the earlier law.
What does the CMA annual AML return ask for?
The annual AML/CFT and targeted financial sanctions risk assessment return has five tabs: customer risk, products and services risk, distribution channel risk, controls and quality of risk mitigation, and signatories. Customer risk alone covers 35 client and counterparty categories, and the controls tab covers 18 sections. The questionnaire must be fully completed to be submitted, monetary values are reported in AED, and country breakdowns use ISO 3166-1 names or codes.
Do CMA-licensed firms register on goAML?
Yes. Every reporting entity in the UAE registers with the Financial Intelligence Unit and files suspicious transaction reports and sanctions-related reports through the goAML portal. Registration is free. The supervisor changing identity does not change the reporting channel or the duty to file without delay once suspicion forms.
My AML policy still cites the 2018 law. Is that a problem?
Yes, and it is easy to fix. Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 were replaced in 2025. A policy stating its legal basis by reference to repealed instruments suggests the policy has not been reviewed since the change, which is what a supervisor infers. Update the legal basis section, the supervisor’s name and the reference links, then record the review date and approver.
Does the CMA supervise DIFC and ADGM firms?
No. Firms licensed in the Dubai International Financial Centre are supervised by the Dubai Financial Services Authority, and firms licensed in the Abu Dhabi Global Market are supervised by the Financial Services Regulatory Authority. The Capital Market Authority supervises licensed capital market activity in onshore UAE outside those two financial free zones.
How long is the transition period for the new capital market regime?
Federal Decree-Law No. 33 of 2025 carries a one-year transition period from its entry into force on 1 January 2026. The AML obligations under Federal Decree-Law No. 10 of 2025 are not subject to that transition. They have applied since 14 October 2025 and are enforceable now.
Related Reading
- Federal Decree-Law No. 10 of 2025: UAE AML Compliance Guide
- AML Requirements: Mainland vs DIFC vs ADGM
- AML Business Risk Assessment in the UAE: 2026 Guide
- MLRO Responsibilities in the UAE: 2026 Guide
- Targeted Financial Sanctions (TFS) in the UAE
- AML Transaction Monitoring in the UAE: 2026 Setup Guide
- How to File an STR in the UAE: 2026 goAML Reporting Guide
- How to Prepare for a UAE AML Inspection
Getting the CMA Transition Right
A supervisor changing name is not a compliance event on its own. What makes it one is everything that quietly went stale alongside it. The legal basis section still cites a repealed decree-law. The training deck still names a dissolved authority.
A policy footnote points at a redirected domain, and the client master cannot produce the 35 category counts the annual return expects. None of that is difficult to fix, and all of it is visible to an inspector in the first hour.
ADZ is a UAE-based practitioner firm. We build and run AML/CFT programmes rather than only advising on them, and we are ISO 27001 and ISO 9001:2015 certified. We are an approved channel partner for ADGM, DIFC, DMCC and eight other free zones.
Our First Compliance platform screens against more than 1,800 sanction lists and 5.5 million PEP records, and Compliance 360 delivers 32 KHDA-approved AML/CFT courses. Contact ADZ for a free consultation and gap analysis.
Disclaimer: this article is general information on UAE AML/CFT requirements as at 20 August 2026. It is not legal advice. Obligations depend on your licence category, supervisor and business model. Take advice specific to your circumstances before acting.
