UAE Central Bank Law AML Compliance: 2026 Deadline

UAE Central Bank Law AML compliance moved from a planning question to a dated one when Federal Decree-Law No. 6 of 2025 took effect on 16 September 2025 with a one-year transitional period attached. That period closes in mid-September 2026. Firms that were pulled inside the widened licensing perimeter do not simply acquire a licence file. They acquire a full AML/CFT obligation set under Federal Decree-Law No. 10 of 2025, and the Central Bank has spent the last eighteen months proving it will fine both the institution and the individual.

Quick Answer

Federal Decree-Law No. 6 of 2025, the new UAE Central Bank Law, gave in-scope entities until 16 September 2026 to regularise their licensing and compliance position. Firms that become Licensed Financial Institutions inherit AML/CFT duties under Federal Decree-Law No. 10 of 2025: an enterprise-wide risk assessment, an appointed MLRO, customer due diligence, sanctions screening, goAML registration and independent audit.

Key Takeaways

The date. The transitional period under Federal Decree-Law No. 6 of 2025 runs one year from the Law taking effect on 16 September 2025, closing 16 September 2026. Several UAE advisers date the close at 15 September 2026, so treat mid-September as the hard stop rather than arguing over a day.
The perimeter widened. Virtual asset and decentralised finance activity, open finance, marketing and promotional communications for financial activities, and technology providers that facilitate financial services are now capable of falling inside Central Bank supervision.
Licensing status drives AML status. Becoming a Licensed Financial Institution is what switches on the obligation set in Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025.
Two penalty stacks now apply. The Central Bank Law allows administrative fines up to AED 1,000,000,000 on institutions and up to AED 5,000,000 on authorised individuals. The AML law runs a separate ladder topping out at AED 100,000,000.
Personal liability is live. In June 2026 the Central Bank fined a foreign bank branch AED 20,000,000 and fined its Head of Compliance and MLRO AED 300,000 personally.
Enforcement volume is already high. The Central Bank issued more than AED 370,000,000 in AML/CFT fines during 2025, including AED 200,000,000 against a single exchange house, plus three exchange house licence revocations.
The FATF context matters. The UAE is inside its fifth-round mutual evaluation cycle, which weighs real outcomes rather than paper frameworks, so supervisory tolerance for an unbuilt programme is low.

What the New UAE Central Bank Law Actually Changed

Federal Decree-Law No. 6 of 2025 was published in the Official Gazette on 15 September 2025 and came into force the following day. It is the largest rewrite of UAE financial services regulation in seven years. Being precise about what it did matters here, because most of the commentary has treated it purely as a licensing story.

One Law Where There Were Two

The Law repeals and replaces the 2018 Central Bank Law and the 2023 insurance decree-law, folding banking, insurance and payment services into a single supervisory framework administered by the Central Bank of the UAE. Regulations, circulars and guidance issued under the old frameworks stay in force until they are expressly replaced, so nothing in the existing rulebook fell away on day one. The full text sits on the CBUAE Rulebook.

For an established bank or insurer, the practical effect is a set of policy and governance updates. For a firm that was previously outside the perimeter, the effect is categorically different.

Who Is Newly Inside the Licensing Perimeter

The Law extends Central Bank reach across several activity types that previously sat in a grey area or under a different regulator:

Virtual asset activity and decentralised finance arrangements, including payment services that settle in virtual assets
Open finance activity, covering data access and initiation services built on top of licensed institutions
Marketing and promotional communications for financial activities, which captures parties that never touched customer money
Technology providers that facilitate the delivery of financial services, including platforms and protocols

That last category is the one catching firms out. A payments enabler, an onboarding platform or an embedded finance provider may have built its entire risk framework around information security and data protection. Under the new perimeter it may now be a supervised entity with a financial crime obligation set it has never staffed for.

Why a Licensing Change Is an AML Compliance Change

This is the connection most coverage of the Law misses. Licensing status is the trigger that switches on the UAE AML regime for your firm.

Definition: Licensed Financial Institution

A Licensed Financial Institution (LFI) is an entity licensed by the Central Bank of the UAE to carry on one or more financial activities. Under UAE AML law, LFI status brings a mandatory obligation set. That set covers a documented enterprise-wide risk assessment, risk-based customer due diligence, an appointed compliance officer, targeted financial sanctions screening, suspicious transaction reporting through goAML, record retention and periodic independent audit.

The Obligation Chain

The sequence runs in one direction and it is short:

Federal Decree-Law No. 6 of 2025 determines whether your activity requires a Central Bank licence.
Holding that licence makes you a Licensed Financial Institution.
LFI status places you squarely inside Federal Decree-Law No. 10 of 2025, the UAE AML law that replaced Federal Decree-Law No. 20 of 2018.
Cabinet Decision No. 134 of 2025, which replaced Cabinet Decision No. 10 of 2019, sets the implementing detail.
Central Bank sectoral guidance, including the April 2026 AML/CFT and counter-proliferation guidance, sets supervisory expectations on top.

A firm that spends the transitional period on its licence application and leaves the AML build for afterwards has misread the order of work. The supervisor will expect the financial crime framework to exist at the point of authorisation, not six months later.

Not sure which side of the perimeter you fall on? ADZ maps regulatory obligations for UAE firms and builds the AML/CFT framework that follows. Speak to the ADZ compliance advisory team.

What the 16 September 2026 Deadline Requires

The transitional period is a reconciliation window rather than a grace period for non-compliance. The Central Bank Board retains discretion to extend it, and no general extension has been announced. Planning on one is not a strategy.

What Regularised Means in Practice

Regularising a position means four things have happened before the window closes:

Every revenue line has been tested against the widened licensing perimeter and the conclusion written down, including for the lines you decided fall outside it.
Where an activity now requires authorisation, an application is filed or a variation to an existing licence is lodged.
Board and senior management arrangements, fitness and propriety, and controlled function appointments match what the Law requires.
The AML/CFT programme is written, board approved, resourced and running, rather than drafted and sitting in a folder.

Before and After: How Your AML Position Changes

Element	Outside the perimeter	As a Licensed Financial Institution
Risk assessment	Optional internal exercise	Documented enterprise-wide risk assessment, reviewed at least annually
Compliance officer	Discretionary	Appointed MLRO with defined authority and direct board access
Customer onboarding	Commercial KYC	Risk-based CDD, with EDD for higher-risk relationships and PEPs
Sanctions	Ad hoc checks	Screening against the UAE Local Terrorist List and UN Security Council consolidated list, with defined match handling
Reporting	None	goAML registration and mandatory STR, SAR and sanctions-related filings
Records	Commercial retention	Statutory retention of CDD and transaction records
Assurance	None	Periodic independent AML/CFT audit
Supervision	None	Central Bank inspection, remediation plans and enforcement exposure

Two Laws, Two Penalty Stacks

Boards tend to ask one question at this point: what is the downside. The answer is that a firm inside the Central Bank perimeter now carries two separate penalty exposures that can run at the same time for the same failure.

	Federal Decree-Law No. 6 of 2025 (Central Bank Law)	Federal Decree-Law No. 10 of 2025 (AML Law)
Maximum administrative fine, institution	AED 1,000,000,000	AED 100,000,000 for severe or repeat breaches
Lower administrative bands	Scaled by breach under the Article 168 toolkit	AED 50,000 to AED 500,000 for procedural breaches; AED 500,000 to AED 5,000,000 for material or repeat breaches
Individual exposure	Up to AED 5,000,000 on authorised individuals; responsible management liability under Article 181	Personal liability for compliance failures, alongside criminal exposure for the underlying offence
Market infrastructure breaches	Up to AED 20,000,000 for specified violations	Not applicable
Proportional penalty	Up to ten times the value of the violation or the unjust enrichment	Not applicable
Unlicensed activity	Criminalised, with fines and possible imprisonment	Separate criminal offences for money laundering and financing of terrorism
Other measures	Activity restrictions, corrective directives, disgorgement, de-linking from market infrastructures, licence revocation, published enforcement decisions naming the violator	Supervisory remediation, licence action by the relevant supervisor

Two features of the Central Bank Law deserve attention from any finance director reading this. Fines may be debited automatically from the violating party’s accounts held at the Central Bank or at any licensed financial institution. And enforcement decisions may be published, including the name of the violator, which turns a regulatory penalty into a reputational event.

Personal Liability Is Now the Live Risk

The June 2026 case is the one every UAE compliance officer should read. The Central Bank fined the UAE branch of a foreign bank AED 20,000,000 after inspections found significant and repeated failures across its AML, CFT and sanctions framework. It then fined that branch’s Head of Compliance and MLRO AED 300,000 in a personal capacity.

Read that as a change in supervisory posture rather than a one-off. The person carrying the MLRO responsibility in the UAE now needs documented authority, documented resourcing requests and documented escalation. The defence to personal liability is a paper trail showing what was raised and when.

Independent assurance before the supervisor arrives. ADZ conducts four types of independent AML/CFT audit, covering Federal, DFSA, VARA and supply chain scopes. Review the ADZ independent audit service.

The AML/CFT Build a Newly Licensed Firm Needs

If your firm is entering the perimeter, this is the framework the Central Bank expects to find. None of it is optional, and none of it can be bought as a document pack.

Enterprise-Wide Risk Assessment

The enterprise-wide risk assessment is the foundation document, because every other control is justified by reference to it. It covers customer, product, delivery channel, geographic and transaction risk, scored with a stated methodology, and it must be revisited when the business changes. A firm that has just changed its regulatory status has, by definition, changed. An EWRA written for an unlicensed technology provider will not survive an inspection of a Licensed Financial Institution.

Governance, MLRO and Board Reporting

Appoint an MLRO with the seniority to stop a relationship, not just to report on one. Define the reporting line to the board, the frequency of management information, and the deputy arrangement for absences. Where the firm cannot hire that seniority immediately, an outsourced or seconded arrangement is a recognised route, provided accountability stays with the licensed entity.

CDD, EDD and Ongoing Monitoring

Risk-based customer due diligence at onboarding, with enhanced due diligence for higher-risk customers, politically exposed persons and complex ownership structures. Beneficial ownership must be identified and verified, not accepted on a self-declaration form. Transaction monitoring then has to be calibrated to your actual product set, with tuned thresholds and a documented alert-to-decision workflow.

Sanctions and PEP Screening

Screening against the UAE Local Terrorist List and the United Nations Security Council consolidated list at onboarding and on an ongoing basis, with list updates applied promptly and a written procedure for handling potential matches. Targeted financial sanctions obligations carry the shortest response windows in the UAE regime, and manual list handling is where most firms fail.

goAML Registration and Reporting

Registration on the goAML portal operated by the UAE Financial Intelligence Unit is a prerequisite rather than a follow-up task. Our goAML registration guide sets out the enrolment steps, and the UAE FIU publishes the current registration requirements. Once registered, the firm must be able to file suspicious transaction reports, suspicious activity reports and sanctions-related notifications within the required timeframes.

Record-Keeping, Training and Independent Audit

Statutory retention of CDD documents, transaction records and internal reports. Role-appropriate AML training with attendance and assessment records, refreshed annually and after any material regulatory change. And a periodic independent audit that tests whether the controls work rather than whether the policy exists.

Screening and reporting without spreadsheets. First Compliance runs CDD, sanctions and PEP screening across 1,800 plus sanction lists and 5.5 million plus PEP records, with goAML reporting built in. See First Compliance.

A Seven-Day Triage If You Are Not Ready

Some firms will read this in the last week of the window. A partial, documented, honestly reported position is a materially better place to be than silence. Work in this order:

Day 1. Scope decision. List every activity the firm performs and mark each one in scope, out of scope or uncertain against the licensing perimeter. Write down the reasoning. The document itself is evidence of good faith.
Day 2. Licensing position. For each in-scope activity, confirm whether you hold the right authorisation, need a variation, or need a new application. Where an application is required, start it.
Day 3. Gap analysis. Test the current control set against the AML obligations that attach to LFI status. Score each gap by regulatory severity, not by how easy it is to fix.
Day 4. Interim controls. Put manual controls over the highest-severity gaps immediately: a screening check before onboarding, a documented escalation route, a named MLRO even if the arrangement is interim.
Day 5. EWRA and policy. Produce the enterprise-wide risk assessment and the AML/CFT policy that follows from it, and get both formally approved by the board.
Day 6. goAML and screening. Begin goAML enrolment and stand up the screening capability. Neither is instant, and the date you started is worth recording.
Day 7. Remediation plan. Convert everything unfinished into a dated remediation plan with named owners and board sign-off. Supervisors respond very differently to a firm that arrives with a plan than to a firm that arrives with an explanation.

What Enforcement Looks Like After the Deadline

The pattern in UAE financial crime enforcement over the last two years is consistent, and it tells you what to expect once the transitional period closes.

During 2025 the Central Bank issued more than AED 370,000,000 in AML/CFT penalties. The headline actions included:

AED 200,000,000 against one exchange house for failures across its AML and CFT framework
AED 100,000,000 against a second exchange house for repeat breaches, which included failing to implement remediation plans from earlier inspections
AED 18,100,000 across two branches of foreign banks
Licence revocation for three exchange houses

Two lessons sit inside those numbers. The first is that repeat findings are treated far more severely than first findings, so an unimplemented remediation plan is worse than an identified gap. The second is that licence revocation is a live tool, not a theoretical one.

Sitting behind all of this is the FATF mutual evaluation of the UAE, which under fifth-round methodology weighs effectiveness and real outcomes rather than technical compliance on paper. Supervisors under evaluation pressure do not soften.

Firms in DIFC and ADGM answer to their own regulators, the DFSA and the FSRA, which run parallel regimes with the same federal AML law underneath. A group operating across the mainland and the financial free zones therefore needs one framework carrying several rulebook overlays, rather than several disconnected programmes. Our guide to AML requirements across mainland, DIFC and ADGM covers how those overlays differ.

Frequently Asked Questions

Does the new UAE Central Bank Law change my AML obligations?

Not directly. Federal Decree-Law No. 6 of 2025 changes who is licensed. Your AML obligations still come from Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025. The link is that becoming a Licensed Financial Institution is what brings the full AML obligation set into force for your firm, so a licensing change produces an AML change.

What happens if I miss the September 2026 deadline?

Carrying on a licensed financial activity without the required authorisation is a criminal matter under the Central Bank Law, with fines and possible imprisonment. The Central Bank can also apply administrative measures, including activity restrictions and published enforcement decisions. If an AML failure is found alongside it, the AML law penalty ladder applies separately, up to AED 100,000,000.

Do technology providers now need an AML programme in the UAE?

If the technology provider falls inside the widened licensing perimeter, yes. The Law brings platforms and protocols that facilitate the delivery of financial services within reach of Central Bank supervision. A provider that becomes licensed carries the same AML obligations as any other Licensed Financial Institution, including EWRA, CDD, screening, goAML registration and independent audit.

Is Federal Decree-Law No. 6 of 2025 the same as the UAE AML law?

No. Federal Decree-Law No. 6 of 2025 is the Central Bank Law, covering the Central Bank, regulation of financial institutions and activities, and insurance business. Federal Decree-Law No. 10 of 2025 is the AML law, which replaced Federal Decree-Law No. 20 of 2018. They are separate statutes with separate penalty regimes that can apply to the same firm at the same time.

Do I need to register on goAML if I become CBUAE licensed?

Yes. goAML registration with the UAE Financial Intelligence Unit is mandatory for Licensed Financial Institutions and for designated non-financial businesses and professions. Registration should be completed as part of becoming operational, because a firm cannot file a suspicious transaction report without it, and the obligation to report begins immediately.

Can the Central Bank fine my MLRO personally?

Yes. The Central Bank Law allows administrative fines of up to AED 5,000,000 on authorised individuals, with responsible management liability addressed under Article 181. In June 2026 the Central Bank fined a bank’s Head of Compliance and MLRO AED 300,000 personally alongside an AED 20,000,000 fine on the institution.

Does the transitional deadline apply to DIFC and ADGM firms?

The Central Bank Law governs federal licensing, so DIFC and ADGM firms are regulated by the DFSA and the FSRA respectively for their financial services activity. The federal AML law still applies across the UAE, including the financial free zones. A group operating on both sides needs a single AML framework with jurisdiction-specific rulebook overlays.

How long does an AML framework build actually take?

For a firm starting from nothing, a defensible framework takes six to twelve weeks. Budget two to three weeks for the enterprise-wide risk assessment and policy set, two to three weeks for system selection and screening configuration, and the remainder for goAML enrolment, training delivery and testing. Interim manual controls can and should be in place well before that.