The UAE has one of the most robust — and actively enforced — AML/CFT regulatory frameworks in the region. Under Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combatting the Financing of Terrorism, supervisory authorities have broad powers to impose administrative and criminal sanctions on non-compliant entities.
If your business is a designated entity and you are not meeting your AML obligations, the financial and reputational consequences can be severe. This article explains what penalties exist, what triggers them, and how to protect your business.
Administrative (Civil) Penalties
Administrative penalties are imposed by supervisory authorities (CBUAE, SCA, VARA, MOEC, and free zone regulators) without requiring a criminal prosecution. They can be applied quickly and are increasingly common.
| Violation | Maximum Administrative Penalty |
|---|---|
| Failure to register on goAML / failure to file STRs | AED 1,000,000 per violation |
| Failure to implement AML/CFT policies and procedures | AED 1,000,000 per violation |
| Failure to conduct Customer Due Diligence (CDD/KYC) | AED 1,000,000 per violation |
| Failure to appoint a Compliance Officer / MLRO | AED 500,000 |
| Failure to maintain required records for 5 years | AED 500,000 |
| Failure to screen customers against sanctions lists | AED 1,000,000 per violation |
| Tipping off a customer about an STR | AED 500,000 |
| Failure to conduct risk assessment | AED 500,000 |
| Repeated / serious violations | Up to AED 5,000,000 |
Note that penalties above are per violation — not per business. An entity with multiple compliance gaps could face penalties that stack across each individual failure.
Licence Suspension and Revocation
Beyond fines, supervisory authorities have the power to suspend or permanently revoke a business's operating licence. This is the most devastating sanction for most businesses and is increasingly used as a first-resort measure in cases of serious or repeated non-compliance.
Free zone authorities (DIFC, ADGM, JAFZA, DMCC, and others) apply this power independently of the federal supervisory authorities. A business that loses its licence in one jurisdiction may also face difficulties obtaining or retaining licences in others.
Criminal Penalties
Criminal prosecution is reserved for the most serious violations, including wilful facilitation of money laundering or terrorist financing. Criminal sanctions under UAE law include:
- Imprisonment of up to 10 years for money laundering offences
- Fines of up to AED 5,000,000 for criminal violations
- Confiscation of proceeds of crime
- Deportation for non-UAE nationals
- Corporate dissolution
Compliance Officers and MLROs can be personally prosecuted for failures within their oversight. Personal liability for compliance failures is a real risk.
Reputational and Commercial Consequences
The consequences of AML non-compliance extend well beyond regulatory fines. Practical commercial impacts include:
- Loss of correspondent banking relationships — major international banks terminate accounts with entities in poorly rated jurisdictions
- De-risking by payment processors, insurers, and financial partners
- Damage to reputation that is nearly impossible to reverse in a relationship-driven market like the UAE
- Inclusion on published enforcement lists maintained by supervisory authorities
What Triggers an AML Inspection?
Understanding what draws regulatory attention helps you prioritise where to focus compliance efforts. Common triggers for inspection include:
- Customer or counterparty complaints filed with the regulator
- Information sharing between UAE FIU and international financial intelligence units
- Sector-wide risk assessments (the UAE publishes national risk assessments that lead to sector sweeps)
- Unusually high transaction volumes with high-risk jurisdictions
- Failure to file STRs when an entity's business profile suggests it should be filing
- Random supervision cycles — all designated entities are subject to routine examination
The Most Common Compliance Gaps Found in UAE Inspections
Based on publicly available supervisory guidance, the violations most frequently identified during UAE AML inspections are:
- No written AML policy and procedures — or an outdated, template policy not tailored to the business
- Not registered on goAML, or registered with stale / incorrect information
- Incomplete Customer Due Diligence — no PEP screening, no beneficial ownership identification
- No formal Business Risk Assessment conducted or documented
- No MLRO appointed, or MLRO with no relevant training or authority
- No AML training for staff in the past 12 months
- Customer records not retained for the required 5-year period
An AML Health Check and Gap Analysis is the most efficient way to identify and remediate these gaps before a regulator does.
How to Protect Your Business
The good news is that all of these risks are manageable with the right compliance framework in place. The minimum that every designated entity needs is:
- An active goAML registration with current details
- A tailored AML/CFT policy and procedures manual
- A completed annual Business Risk Assessment
- A functioning KYC/CDD programme
- An appointed and trained MLRO or Compliance Officer
- Annual AML training for all relevant staff
- An internal process for reviewing and filing STRs
Is Your Business Inspection-Ready?
Our AML Health Check identifies every gap before the regulator does — with a prioritised remediation roadmap. Free consultation available.
Book a Free Health Check