November 4, 2026 · Jurisdiction Briefing · 8 min read

UAE: correspondent banking, money or value transfer services and wire transfers under Cabinet Resolution No. (134) of 2025

The Executive Regulations treat a cross-border payment as a chain. An originating institution sends it, an intermediary receives and transmits it, and a beneficiary institution is the end point. The duties along that chain are not the same.

Cabinet Resolution No. (134) of 2025 holds these rules in the part headed Obligations Specific to Financial Institutions. The CBUAE Rulebook shows the Resolution effective from 14 December 2025, with the status In-Force. This briefing reads Articles (26) to (31), then the extension to virtual assets in Article (36).

Two scope points come first. Money or value transfer services are themselves a financial activity under Article (2), excluding anyone who solely provides financial institutions with messaging or other support systems for the transfer of funds. And “the Crime”, used throughout, is the Decree by Law’s defined term: money laundering and its predicate offences, the financing of terrorism, or proliferation financing.

Correspondent banking: five measures before you enter

The definition is wider than a nostro account. A Correspondent Banking Relationship runs through a current account “or any other type of account or related service”, and it includes relationships established for securities transactions or funds transfers.

Article (26)(1) applies before entering into such a relationship “or any other similar relationship”. The financial institution must:

refrain from entering into or continuing a relationship with Shell Banks, or with any institution that permits its accounts to be used by Shell Banks;
collect sufficient information on the respondent to identify it and fully understand the nature of its business, and, through publicly available information, determine its reputation and the level of supervision it is subject to, including whether it has been subject to an investigation relating to the Crime or to a supervisory action;
assess the anti-crime controls the respondent applies;
obtain Senior Management approval before establishing a new relationship;
understand the anti-crime responsibilities of each institution.

A Shell Bank is a bank incorporated or licensed in a jurisdiction where it has no physical presence and which is not affiliated with a regulated Financial Group. Article (15) adds a separate prohibition. It binds financial institutions, DNFBPs and VASPs, and it bars dealing with Shell Banks “in any manner whatsoever”, including opening accounts for them or accepting funds or deposits from them.

Article (26) is framed as a pre-entry test and states no review cycle. But its first limb says “entering into or continuing”. Our reading: a respondent that starts letting Shell Banks use its accounts after onboarding falls within the limb, so the file needs a way to find that out.

Payable-Through Accounts, meaning correspondent accounts used directly by third parties to conduct transactions on their behalf, get their own clause. Under Article (26)(2), the institution must ensure that the respondent has applied due diligence to customers with direct access to those accounts, and that it can provide the relevant due diligence information on request.

Money or value transfer services: licence, agents, both ends

Article (27) has two clauses.

Licence or registration. Providers must be licensed by or registered with the concerned Supervisory Authority. The Authority must take the necessary measures to penalise anyone providing the service without one, in accordance with its applicable legislation, and ensure that licensed or registered providers comply with anti-crime controls.
Agents. Providers must keep an updated list of agents and make it available to the concerned authorities in the State where the provider and its agents operate, include the agents in their anti-crime programmes, and monitor their compliance.

Article (31)(1) applies the wire transfer rules in Articles (28), (29) and (30) to these providers, “whether they conduct their activities directly or through their agents”. Using an agent does not take a transfer outside those articles.

Article (31)(2) deals with a provider that acts at both ends: the originator from the UAE and the recipient in another State. It must collect all information on the originator and the beneficiary to determine whether to submit a Suspicious Transaction Report. If it decides to submit one, the report goes to the Financial Intelligence Unit of the concerned State, with all relevant information. Our reading: a provider in this position holds both sides of the transfer, so its procedure should say who reviews them together and how the concerned State is determined.

Wire transfers: what AED 3,500 does and does not change

The Resolution defines a Wire Transfer as an electronic funds transfer by a financial institution or a VASP on behalf of an originator to a specified beneficiary at another financial institution, VASP or virtual wallet, whether or not originator and beneficiary are the same person.

AED 3,500 is a test for verification. It is not a test for whether data travels with the payment. Under Article (28):

At or above AED 3,500 (international). Verify the accuracy of originator information, and ensure the transfer is always accompanied by the data below.
Below AED 3,500 (international). The same data must accompany the transfer, without the need to verify its accuracy, unless there are suspicions of the commission of the Crime.

The data is:

the full name of the originator and the beneficiary;
the account number of each or, where none exists, a unique transaction reference number that enables tracing;
the originator’s address, or identity number or travel document number, or date and place of birth, or the customer identification number held by the originating institution, which must refer to a record containing such data.

Two further clauses deal with batches and domestic payments:

Batch files. Where several international transfers from one originator are bundled, the file must include accurate originator data and complete beneficiary information fully traceable in the beneficiary country, plus the originator’s account number or a unique transaction reference number.
Domestic transfers. The same originator data must accompany them, unless it is otherwise available to the beneficiary institution and the concerned authorities by other means. In that case only the account number or unique reference is required, provided it permits tracing, and the originating institution must supply the data within three Working Days of receiving a request. Clause (4) states no amount.

Article (7) separately requires financial institutions to apply customer due diligence to occasional transactions in the form of wire transfers at or above AED 3,500.

Who does what along the chain

Article (29) is addressed to intermediary institutions and Article (30) to beneficiary institutions. Article (28) is mostly addressed to “Financial Institutions”, and names originating institutions in some clauses, including domestic transfers and retention. The first column below reads it from the originating side.

	Art. 28	Intermediary (Art. 29)	Beneficiary (Art. 30)
Data	Ensure it accompanies the transfer	Ensure all originator and beneficiary information accompanies international transfers	Take Reasonable Measures to identify international transfers lacking it, such as monitoring during execution, where feasible, or after
Missing data	Prohibited from executing where the conditions of the article are not met	Reasonable and immediate measures to identify; risk-based policies on whether to execute, suspend or reject, and on follow-up	Risk-based policies on when to execute, reject or suspend, and on follow-up
Verification	Originator information, at or above AED 3,500	Not stated	Beneficiary identity, at or above AED 3,500, where not previously verified
Records	All information collected, per Article (25)	Where technical limitations stop the data travelling on a domestic leg, a record of all information received, per Article (25)	All information collected, per Article (25)

The missing-data row is the one to read twice. Article (28)(6) prohibits execution where the article’s conditions are not met. Articles (29) and (30) do not repeat that prohibition; they ask for risk-based policies. Clause (6) is addressed to “Financial Institutions” generally, not only to originating institutions. Our reading: an intermediary or beneficiary institution should still make its policy explicit, and say how it squares with that general wording, rather than assume the risk-based route settles every case.

Two more cross-cutting points:

Sanctions. Article (28)(8) requires financial institutions, when processing wire transfers, to apply freezing measures and transaction prohibition measures under the instructions of the Executive Office or other competent authorities on Targeted Financial Sanctions. It is also addressed to financial institutions generally, and it has no amount attached.
Retention. Article (25)(1) sets not less than five years from the date of completion of the Transaction or the termination of the Business Relationship.

Secrecy cannot be invoked for these exchanges

Article (42) says banking secrecy, professional secrecy or contractual liability may not be invoked to prevent the application of the Decree by Law and the Resolution in the exchange of information between financial institutions, where the exchange relates to reliance on third parties, correspondent banking relationships or wire transfers under Articles (20), (26) and (28) to (31).

Our reading: this is worth citing in the response when a counterparty refuses a request for missing originator data under those articles.

Virtual assets: the same articles, with a stated minimum

Article (36)(2) requires VASPs to comply with Articles (26) to (33) in a manner proportionate to the nature of their activities and in accordance with Supervisory Authority instructions, subject to two rules.

The originating VASP must obtain and retain accurate originator and beneficiary information, transmit it immediately and securely to the beneficiary VASP or beneficiary financial institution, if any, and make it available to concerned authorities upon request.
The beneficiary VASP must obtain and retain accurate information on both parties and make it available to concerned authorities upon request.

The information includes what the Supervisory Authority determines and, at a minimum: for the originator, name, account number or wallet address, and residential or business address; for the beneficiary, name and account number or wallet address. Under Article (35), the Authority responsible for VASPs may also issue decisions, circulars and procedures on the scope, limits and form of Virtual Asset Transfers.

Article (36)(2) states no amount for these rules. Article (7)(3) separately sets AED 3,500 for customer due diligence on occasional transactions by VASPs, whether single or several that appear to be linked.

Article (36)(4) reaches beyond VASPs. The requirements in clauses (1) and (2) apply to financial institutions where they send or receive Virtual Asset Transfers on behalf of a Customer.

What to do with this

Map your role per payment flow. A firm can be originating on one flow and intermediary or beneficiary on another. Check that each procedure cites the right article.
Separate data from verification. Confirm that system rules apply the data requirement to all international transfers, and that AED 3,500 only switches on verification, with the suspicion override below it.
Write down the missing-data decisions. Record who decides to execute, suspend or reject, on what risk factors, and what the follow-up is.
Test the domestic shortcut. If you send only an account number or reference, confirm that the full data can be produced within three Working Days.
Refresh the correspondent file. Keep the reputation and supervision research, the controls assessment, the Senior Management approval and the Shell Bank confirmation in one place, and decide how the “continuing” limb is monitored.
List your agents. For money or value transfer providers, check that the agent list is current, and that each agent is in the programme and monitored.
Check virtual asset flows. If a financial institution sends or receives Virtual Asset Transfers for customers, confirm the Article (36) data set is captured.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates