October 7, 2026 · Jurisdiction Briefing

UAE: who can penalise a reporting entity under Federal Decree by Law No. (10) of 2025, and for what

A penalties slide with one headline figure on it does not describe the UAE's AML law. Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing puts administrative penalties in…

A penalties slide with one headline figure on it does not describe the UAE’s AML law. Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing puts administrative penalties in the hands of the Supervisory Authority in Chapter Seven, and sets out criminal penalties in Chapter Twelve. A failure to report a suspicion, for example, is a violation the Supervisory Authority can penalise under Article (17), and an offence under Article (28) where it is deliberate or grossly negligent.

The Decree by Law was issued on 30 September 2025. Article (42) provides for publication in the Official Gazette and entry into force two weeks after the date of publication, and the CBUAE Rulebook shows it effective from 14 October 2025 with the status In-Force. Article (41) repeals Federal Decree by Law No. (20) of 2018.

This briefing reads the penalty provisions only. The executive regulations — Cabinet Resolution No. (134) of 2025 — were covered on 23 September.

“The Supervisory Authority” is a definition, not one body

Article (1) defines the Supervisory Authority in the plural, as the federal and local authorities entrusted under the legislation with the supervision of financial institutions, designated non-financial businesses and professions, virtual asset service providers and non-profit organisations — or, where no specific supervisory authority is designated, the competent authorities responsible for granting approval to engage in an activity or profession.

So the first question for any firm is which authority that is for its licence. The answer decides who inspects it and who can impose an Article (17) penalty on it.

Article (16) gives each Supervisory Authority, within its own area of competence, the duties of supervision, monitoring and follow-up. It lists conducting risk assessments of the likelihood of the Crime occurring in the supervised sectors, performing supervisory and inspection operations whether desk-based or field-based, and maintaining statistics on the measures undertaken and the penalties imposed. “The Crime” is the law’s collective term for money laundering and its predicate offences, the financing of terrorism, and proliferation financing.

The administrative ladder in Article (17)

Article (17) applies where a financial institution, DNFBP, virtual asset service provider or non-profit organisation violates any provision of the Decree by Law, its Executive Regulations, or any other decisions issued in connection with them. The Supervisory Authority may then impose:

a warning;
an administrative fine of not less than AED 10,000 and not exceeding AED 5,000,000 for each violation;
a prohibition on the violator engaging in the sector relevant to the violation, for a period the Supervisory Authority determines;
a restriction on the powers of board members, executive, supervisory or managerial personnel, or owners proven responsible for the violation, including the appointment of a temporary supervisor;
the suspension of directors, board members, or executive or supervisory personnel proven responsible for the violation, for a period the Supervisory Authority determines, or a request for their replacement;
the suspension or restriction of the activity or profession, for a period the Supervisory Authority determines;
revocation of the licence.

The rest of the article changes how that list should be read.

The fine is per violation. The AED 5,000,000 figure is the top of the range “for each violation”, so it is not written as a ceiling on what one inspection can cost.

Repetition is priced separately. The Supervisory Authority may impose an incremental administrative fine if the same violation recurs within a period not exceeding one year from the date of the prior administrative fine imposed for it.

Remediation can be ordered and monitored. On imposing administrative penalties, the Supervisory Authority may issue an order requiring periodic reports on the measures undertaken to remedy the violation.

Publication is always available. The article says that, in all cases, the Supervisory Authority may publish the administrative penalties it imposes through various media outlets.

Article (17) also opens with a reservation: it applies “without prejudice to any more severe administrative sanction prescribed under any other legislation”. An institution licensed by the Central Bank has a second sanctions article to read alongside it. Article (168) of Federal Decree-Law No. (6) of 2025, shown on the Rulebook as effective from 16 September 2025, lets the Central Bank act on a violation of that decree-law, of the regulations, decisions, rules, standards, guidelines or instructions it issues in implementation of it, or of any measures it takes, “including sanctions or procedures for countering money laundering, combating terrorist financing”. The sanctions listed there include a fine on the violating licensed financial institution not exceeding AED 1,000,000,000, and a fine on the violating party not exceeding ten times the amounts of funds subject to the violation or unjust enrichment, as determined by the Central Bank. Article (2) of the same decree-law states that it does not apply to the Financial Free Zones or to financial institutions regulated by the authorities of those zones.

One more provision belongs in this section. Article (39) requires the Cabinet, upon the proposal of the Minister of Finance and after coordination with the Supervisory Authority, to issue a resolution prescribing the violations and administrative penalties, the entities responsible for imposing them, the mechanism for grievance against them, and the entity entrusted with collecting administrative fines. And Article (41) keeps the executive regulations, resolutions and circulars issued under the 2018 law effective, insofar as they do not conflict with the Decree by Law, until the instruments that supersede them are issued.

The criminal track: compliance failures that are offences

Chapter Twelve is where a control failure becomes a matter for a court. Article (25) says its penalties apply without prejudice to any more severe penalty provided for in any other law. Each provision below carries its own condition, and the condition is the part to copy into training material.

Failing to report. Article (18) requires financial institutions, DNFBPs and virtual asset service providers that suspect, or have reasonable grounds to suspect, that a transaction or funds represent proceeds or are related to the Crime — regardless of value — to notify the Unit without delay and directly. Under Article (28), whoever violates Article (18) deliberately or through gross negligence is punished by imprisonment and a fine of not less than AED 100,000 and not exceeding AED 1,000,000, or by either of the two penalties.

Tipping off. Under Article (29), a person who notifies or warns another person, discloses information related to transactions under review concerning suspicious transactions, or reveals that the competent authorities are conducting inquiries or investigations, in contravention of Article (24), is punished by imprisonment and a fine of not less than AED 50,000, or by either.

Breaching a freezing order. The same article applies the same penalty to a person who deliberately or through gross negligence violates an order issued by a competent authority regarding seizure, freezing or other precautionary measures. If either act results in the inability to seize the proceeds, or in their destruction or loss of value, the punishment becomes imprisonment for not less than one year and a fine equal to the value of the proceeds, and not less than AED 100,000.

Targeted financial sanctions. Article (33) punishes any person who violates the instructions issued by the Executive Office or any other competent authority related to targeted financial sanctions with imprisonment and a fine of not less than AED 20,000, or by either.

The core preventive duties. Article (35) reaches the obligations in Article (19): risk assessment, customer due diligence and ongoing monitoring, the ban on anonymous, fictitious, alias or numbered accounts, internal policies approved by senior management, immediate implementation of targeted financial sanctions instructions, and record-keeping. A person who violates Clause (1) of Article (19) is punished by imprisonment and a fine of not less than AED 10,000, or by either. The same provision extends to paragraphs (A), (C) and (D) of Clause (2) of that article.

The firm, and the person who runs it

Article (4) makes a legal person criminally liable where any of the crimes in the Decree by Law is intentionally committed in its name or for its account, without prejudice to the personal criminal liability of the perpetrator and to the administrative penalties provided for by law.

Article (27) then sets the corporate fines. Where a legal person’s representatives, directors or agents commit money laundering, the financing of terrorism or proliferation financing on its behalf or in its name, the fine is not less than AED 5,000,000 and not exceeding AED 100,000,000, or an amount equivalent to the value of the criminal property involved, whichever is greater. Where they commit the offences in Articles (28), (29), (30), (32), (33), (34) or (35) — which include the reporting, tipping-off, sanctions and preventive-duty offences above — the fine is not less than AED 200,000 and not exceeding AED 10,000,000.

On conviction of a legal person for the financing of terrorism or proliferation financing, the court shall order its dissolution and the closure of the premises where its activity is conducted. For money laundering the court may do so.

Individuals are named too. The person responsible for the actual management of the legal person is punished by imprisonment and a fine, or either, if it is proven that they were aware of the crime and that its commission was due to their breach of the duties of their position. Both limbs are in the text.

What protects the reporter, and what never expires

Article (37) removes criminal, civil and administrative liability from financial institutions, DNFBPs, virtual asset service providers, and the members of their boards, employees and legally authorised representatives, for furnishing required information or breaching a confidentiality restriction — even if they were not fully aware of the nature or actual occurrence of the Crime — unless it is proven that the reporting was made in bad faith with the intent to harm others.

The same article provides that criminal proceedings for money laundering, the financing of terrorism or proliferation financing do not lapse by prescription, that the penalties imposed do not extinguish by lapse of time, and that the civil actions arising from them do not lapse either.

What to do with this

Name your Supervisory Authority in the policy. The law defines the term and leaves the allocation to other legislation. Write down which authority it is for each licence your group holds.
Rewrite the penalties page of your training deck. Replace any single headline figure with the Article (17) range per violation, the incremental fine for a repeat within one year, and the measures aimed at named individuals.
Teach the conditions, not just the amounts. “Deliberately or through gross negligence” for a missed report. “Proven aware” and “breach of the duties of their position” for the person in actual management.
Keep the remediation file inspection-ready. A Supervisory Authority can order periodic reports on remediation, and a repeat of the same violation within a year can be fined incrementally.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates