Compliance Handbook

How to Build an AML Program for UAE VASPs

MLRO Appointment, Blockchain Analytics, Travel Rule, Transaction Monitoring, and STR Filing

Published February 16, 2026 · UAE Tokenization Regulations Editorial Team

This implementation guide provides step-by-step instructions for practitioners navigating this aspect of UAE virtual asset compliance. Designed for compliance officers, in-house legal teams, VASP founders, and regulatory consultants, the guide translates regulatory requirements into actionable operational procedures that can be implemented within existing compliance workflows. All regulatory citations reference official publications from the relevant UAE regulatory authorities, with guidance current as of February 2026.

Regulatory Framework Context

The UAE's virtual asset regulatory architecture encompasses five distinct authorities: VARA governing Dubai mainland and free zones (excluding DIFC), ADGM FSRA operating as an independent international financial center in Abu Dhabi, DIFC DFSA functioning as a separate common-law jurisdiction within Dubai, the SCA/CMA providing federal-level securities oversight, and the CBUAE retaining exclusive authority over payment tokens and AED-denominated stablecoins. Each regulator maintains distinct requirements, and practitioners must identify the applicable regulatory authority before implementing compliance measures. All guidance in this handbook reflects the regulatory framework as of February 2026, incorporating VARA Rulebook 2.0 (effective June 2025), ADGM FRT framework (effective January 2026), and DIFC Consultation Paper 168 proposals.

Implementation Considerations

Compliance implementation in the UAE requires navigating jurisdictional complexity that goes beyond simply meeting a single regulator's requirements. Multi-jurisdictional operators — holding licenses in both VARA and ADGM, for example — must maintain parallel compliance programs tailored to each regulator's specific rulebook requirements. The August 2025 CMA-VARA mutual recognition agreement is reducing some of this burden through shared frameworks, but operational compliance teams should continue to treat each jurisdiction's requirements independently until formal harmonization is confirmed. Technology compliance, AML/CFT programs, and governance structures must be documented separately for each licensing jurisdiction, even where underlying systems are shared across entities.

Practical Recommendations

Engage specialist UAE virtual asset legal counsel before committing to a regulatory pathway — the choice of jurisdiction has cascading implications for licensing costs, capital requirements, operational structure, and client access. Begin banking engagement immediately upon receiving initial VARA or ADGM approval, as account opening typically takes 3-6 months and can delay operational launch. Build OECD CARF-compliant data collection infrastructure from inception rather than retrofitting existing systems. Invest in technology compliance from day one — the cost of implementing TGRAF, penetration testing, and custody standards increases significantly when bolted onto existing infrastructure versus being designed into the platform architecture from the ground up. For the latest regulatory guidance, consult official sources: VARA Regulations, ADGM Digital Assets, and DFSA. This guide is for informational purposes only and does not constitute legal, financial, or regulatory advice.

Building Your AML Technology Stack

Deploy blockchain analytics as the foundation of your transaction monitoring capability. Chainalysis KYT provides real-time screening with comprehensive risk scoring across major blockchain networks. Elliptic offers strong DeFi protocol analysis and cross-chain tracing. Fireblocks integrates custody and monitoring into a single platform. Annual costs range from $50,000-$200,000 depending on volumes. Layer in a Travel Rule protocol — Notabene or Shyft Network — for compliant cross-border transfer documentation. Configure KYC/KYB onboarding with identity verification technology supporting document authentication, biometric matching, and PEP/sanctions screening. Build transaction monitoring rules calibrated to your specific business model, client risk profile, and the UAE's published AML/CFT typologies for virtual assets. Test all systems extensively before go-live — VARA expects demonstrated operational capability, not merely installed software.

STR Filing and goAML Integration

Configure access to the UAE goAML portal — the centralized platform for filing Suspicious Transaction Reports with the Financial Intelligence Unit. Define internal escalation procedures from initial alert generation through analyst review, MLRO assessment, and STR submission. Establish quality standards for STR narratives — reports should include detailed transaction analysis, risk indicators identified, customer due diligence findings, and conclusions supporting the suspicion. VARA assesses STR quality during inspections, and inadequate reporting can constitute an independent compliance breach regardless of the underlying transaction risk.

Sanctions Screening Architecture

Deploy automated sanctions screening against OFAC Specially Designated Nationals list, EU Consolidated Financial Sanctions list, United Nations Security Council sanctions, and local UAE designations. Configure screening to run at customer onboarding, before every outgoing transfer, and periodically against the entire customer base when sanctions lists are updated. Blockchain analytics platforms provide wallet-level sanctions screening — identifying addresses associated with sanctioned entities, darknet markets, and known exploit addresses. False positive management is critical: establish clear escalation procedures, document disposition decisions, and retain screening records for the minimum period specified by your regulator's AML rulebook. Integration with your Travel Rule protocol ensures that sanctions screening covers both on-chain and counterparty institution dimensions of every qualifying transfer.

Record Retention and Audit Readiness

Maintain comprehensive AML/CFT records for the minimum retention period specified by your regulator — typically five to seven years. Records must include customer identification and verification documentation, transaction records with supporting blockchain analytics data, risk assessment reports and scoring rationale, STR case files including investigation notes and filing confirmation, Travel Rule transmission records, sanctions screening results and disposition decisions, training attendance records with competency assessment outcomes, and all internal and external audit reports with remediation evidence. Organize records for rapid retrieval during VARA inspections — the ability to produce specific compliance documentation within hours demonstrates operational maturity that regulators recognize as evidence of a genuine compliance culture.

Related Guides

The Complete Compliance Handbook

VARA License Cost Breakdown · ADGM Authorization Guide · AML Program Guide