ع
The 2025 law is in its first full year of application, the FATF onsite evaluation was set for June, and regulators are now issuing one penalty against the company and a second against the individual responsible.
On 24 June 2026 the Central Bank of the UAE issued two penalties out of a single investigation. The first was a fine of AED 20 million on the branch of a foreign bank for what the regulator called significant, repeated failures in its anti-money laundering, counter-terrorist financing and sanctions framework. The second was a fine of AED 300,000 on the branch’s head of compliance and money laundering reporting officer, for failing to discharge the responsibilities of the position.
That structure, a corporate penalty and a personal one drawn from the same file, is the defining feature of financial crime enforcement in the UAE this year.
Two developments changed the calculation. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, repealing the 2018 legislation, which makes 2026 the first full year of its application. And the joint FATF and MENAFATF fifth-round mutual evaluation of the UAE is under way, with the onsite visit scheduled for June 2026.
For companies, exposure begins well before a penalty notice arrives. In guidance published on 28 July, Dubai firm Awatif Mohammad Shoqi Advocates, formerly Al Rowaad Advocates, sets out the sequence that decides outcomes in the first days of an inquiry: preserve records before anything else, avoid unverified informal explanations that later contradict the file, and do not tip off the customer or third party. Its central point is aimed at boards. Directors cannot treat AML compliance as something delegated to junior staff or external consultants, because the law now reaches them personally.
What the 2025 law changed
Two provisions matter most for ordinary commercial businesses.
The first is scope. Predicate offences now expressly include terrorist financing, proliferation financing and both direct and indirect tax evasion, whether committed inside or outside the UAE. A company that has never handled anything resembling criminal proceeds can find a counterparty relationship assessed against a definition that now reaches tax conduct in another jurisdiction.
The second is the standard of proof. The evidentiary threshold has been lowered from actual knowledge to an objective test, under which knowledge that funds were illicit may be inferred from the factual and objective circumstances. The question a business must answer moves from what its staff knew to what its controls should have detected. Fines on legal persons run from AED 5 million to AED 100 million and above, the Financial Intelligence Unit can order closure or freeze assets for up to 30 days without prior notice, and the Public Prosecution’s use of those powers carries no statutory time limit.
The 2026 supervisory calendar
Supervisors have moved in step. The DFSA took enforcement action over inadequate controls in February. In April the Central Bank issued updated guidance imposing more granular requirements on banks assessed as high risk. In June the National Committee published a national risk assessment for proliferation financing, identifying vulnerabilities in trade finance, shipping and complex corporate structures, categories that describe a large share of UAE commercial activity rather than a niche.
The scale was set out in the 2025 performance indicators adopted on 3 June 2026 at the 23rd meeting of the Higher Committee, chaired by Sheikh Abdullah bin Zayed Al Nahyan: 781 inspections of financial institutions and virtual asset service providers producing AED 384 million in fines, 8,900 inspections of designated non-financial businesses and professions producing AED 160.33 million, and 516 incoming mutual legal assistance requests. Separately, money laundering cases rose 46 percent to 942, suspicious transaction reports reached 66,000 and domestic confiscations totalled AED 4.23 billion.
The fifth-round methodology tests effectiveness rather than statute, and the same distinction now runs through inspections at company level. Awatif Al Khouri, the founding partner of Awatif Mohammad Shoqi Advocates, makes the point directly: a policy that is copied, outdated or not followed by staff will not protect a business when an inspection or an investigation arrives.
The realistic scale of exposure
The nine-figure penalties are not representative. Across 8,900 DNFBP inspections, AED 160.33 million works out at roughly AED 18,000 for every inspection carried out, and the largest sanctions announced remain concentrated in exchange houses and bank branches handling high volumes of cross-border payments. The Ministry of Economy and Tourism recorded 1,063 violations in the first half of 2025, most of them at real estate brokerages and precious metals traders. For the majority of UAE companies the realistic outcome is an administrative fine and a remediation deadline. What has changed sits at the tail: the weakening of a knowledge defence, personal liability for the officer who signed off, and no limitation period.
Why the pressure will not ease this year
The UAE left the FATF grey list on 23 February 2024 and the European Union’s high-risk list on 5 August 2025. Enforcement volume is the evidence supervisors bring to the evaluation. The same FATF plenary in June added Iraq and Bosnia and Herzegovina to the grey list and removed Algeria and Namibia, leaving 22 jurisdictions under increased monitoring and handing every UAE business a country-risk file to update.
The response to an inquiry has to hold two positions at once, and that is where the financial and white-collar crime practice at Awatif Mohammad Shoqi Advocates locates the work: cooperating with the authorities and demonstrating the business acted responsibly, without making unnecessary admissions. Under the previous law, a company could argue about what it knew. Under this one, it will be asked to produce the file.
