What Are AML Penalties in the UAE? Fines & Enforcement Explained

AML penalties in the UAE are the sanctions imposed for breaches of the anti-money-laundering and counter-terrorist-financing framework — Federal Decree-Law No. 10 of 2025 and its Executive Regulation, plus the supervisors' rulebooks. They operate on two tracks: criminal penalties for money laundering itself (imprisonment and fines imposed by the courts on those who launder), and administrative penalties for compliance failures by regulated firms (fines, restrictions and licence actions imposed by supervisors for deficient KYC, monitoring, reporting or record-keeping).

The administrative track is the one most firms encounter. Article 17(1)(b) of FDL 10/2025 provides for administrative fines of AED 10,000 to AED 5,000,000 against violators, alongside measures such as banning managers, restricting activities and suspending licences (as of 2026-10-02). Supervisors — the CBUAE, DFSA, FSRA, SCA, VARA and the Ministry of Economy for DNFBPs — apply these within their populations, and their enforcement actions are increasingly published, creating the deterrent effect the framework intends.

The penalties' logic is economic: the fine must exceed the cost of compliance, or rational firms will treat non-compliance as the cheaper option. The UAE's enforcement trajectory since the grey-list period has moved decisively in that direction — and published actions ensure the market updates its cost-benefit analysis with each penalty.

Penalties attach to specific failures across the AML programme. Registration failures: operating a covered activity without goAML registration. Customer due diligence failures: deficient KYC/KYB — unverified identities, unmapped UBOs, missing purpose documentation, absent risk ratings. Monitoring failures: no transaction monitoring, uncalibrated rules, or alerts systematically ignored. Reporting failures: late or missing STRs, thin narratives, tipping off. Record-keeping failures: incomplete or inaccessible CDD and transaction records. Sanctions failures: deficient screening or failure to freeze on designation. Governance failures: no empowered compliance officer, no training, no independent testing.

Supervisors calibrate the penalty to the failure's gravity, duration, systemic nature and the firm's cooperation. A single late STR from an otherwise functioning programme draws a different response from a multi-year absence of monitoring — and voluntary remediation before examination consistently mitigates. Published enforcement actions show the pattern: the largest penalties fall on firms where the failures were systemic, prolonged and unremediated, while cooperative firms with isolated gaps receive proportionate, often unpublished, supervisory measures.

Criminal liability sits above the administrative regime: money laundering carries imprisonment and fines under the Penal Code and FDL 10/2025, and legal persons (companies) can face criminal liability including dissolution in the gravest cases. Compliance officers and senior managers face personal exposure where their negligence enabled the failure.

The interaction between the tracks matters operationally. An administrative examination that uncovers evidence of actual laundering — not just control failures — is referred for criminal investigation, and the firm's cooperation with the administrative process does not immunise individuals from criminal liability. This is why firms under examination need both regulatory and criminal counsel: the administrative file and the criminal exposure must be managed together, with consistent but carefully separated strategies.

In the UAE, AML penalties have been the visible edge of the post–grey-list settlement. Supervisors across all populations — banks, exchange houses, DNFBPs, VASPs — have imposed and publicised penalties at a pace unfamiliar from the pre-2022 era, and the market has repriced compliance accordingly: AML programme budgets that were once discretionary are now board-level items, and enforcement headlines are standing agenda items in risk committees.

The DNFBP wave has been particularly significant. Real-estate brokers, precious-metals dealers and company service providers — sectors brought into active supervision during the remediation — have faced registration drives followed by examination and penalties, compressing a decade of supervisory maturation into a few years. Firms in these sectors that still treat AML as a banking obligation are the most exposed population in the system.

For firms, the practical penalty-avoidance programme has five elements: complete goAML registration with an empowered compliance officer; documented risk assessment driving a calibrated programme; KYC/KYB files that would survive examination sampling; monitoring that plausibly detects the firm's typologies; and prompt, analytical STR filing. Each element is independently penalised when absent — there is no partial credit for a programme that registers but does not monitor, or monitors but does not report.

A mid-sized exchange house's examination illustrates how penalties accumulate across programme gaps:

• Finding 1 — registration: the firm registered on goAML two years after commencing covered activity. Historical breach: administrative fine component AED 200,000 [Illustrative apportionment of supervisory penalties].
• Finding 2 — KYC: a sample of 40 customer files shows 11 with unverified beneficial ownership and 7 with no documented purpose. Systemic CDD failure: fine component AED 500,000 [Illustrative apportionment].
• Finding 3 — monitoring: transaction-monitoring rules unchanged since implementation, with 94% of alerts auto-closed without review. Monitoring failure: fine component AED 750,000 [Illustrative apportionment].
• Finding 4 — reporting: three instances where internal reports were not escalated to STRs within the expected timeframe. Reporting failure: fine component AED 300,000 [Illustrative apportionment].
• Total illustrative exposure: AED 1,750,000 in administrative fines, plus a mandated remediation plan with quarterly progress reporting to the supervisor and a temporary restriction on new-agent appointments.

The apportionments are illustrative — actual penalties are set case by case within the AED 50,000–5,000,000 statutory range — but the structure is real: each programme element is independently penalised, and systemic, prolonged failures compound.

Treating penalties as a cost of doing business. The statutory range (AED 50,000–5,000,000) plus licence actions is designed to exceed any compliance saving. Firms that budget for penalties instead of programmes eventually face the licence actions that fines alone do not capture.

Remediating only the examined sample. Supervisors penalise the systemic failure, not the 40 sampled files. Fixing the sample while leaving the programme untouched converts one penalty into two — the original plus the failed-remediation follow-up.

No empowered compliance officer. Penalties frequently cite the governance failure behind the technical ones. A compliance officer without board access, budget or veto authority is evidence of a non-serious programme.

Ignoring published enforcement. Supervisors publish actions precisely so the market learns. A firm whose gaps mirror a recently penalised peer's cannot claim surprise — the precedent was the warning.

Delaying voluntary remediation. Self-identified gaps remediated before examination mitigate penalties; the same gaps found by examiners aggravate them. The economics of prompt self-remediation are unambiguous.

Federal Decree-Law No. 10 of 2025 is the penalised statute. goAML registration and goAML reporting failures are the most penalised gaps. KYC/KYB deficiencies are the examination staple. The UAE Financial Intelligence Unit receives the reports whose absence is penalised. Targeted financial sanctions breaches carry the severest consequences. And the FATF grey list episode is why enforcement intensified.