anti-money laundering and counter-terrorism financing (aml/cft)

comprehensive definition of the aml/cft framework as applied to virtual asset service providers under uae federal law and authority-specific regulations.

definition

Anti-money laundering and counter-terrorism financing (AML/CFT) refers to the comprehensive set of laws, regulations, procedures, and controls designed to prevent the financial system from being used to launder the proceeds of crime or to finance terrorist activities. In the UAE, the AML/CFT framework is established at the federal level through Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations, creating a compliance baseline that applies to all virtual asset service providers regardless of their licensing jurisdiction.

federal legal framework

Federal Decree-Law No. 20 of 2018 and its implementing regulations establish the UAE’s unified AML/CFT framework. The law applies to all “reporting entities,” a category that explicitly includes VASPs licensed by any UAE regulatory authority. Key obligations under the framework include customer due diligence (CDD) requiring identification and verification of customer identity before establishing a business relationship or conducting transactions, with enhanced due diligence for higher-risk customers including politically exposed persons. Ongoing monitoring requires continuous assessment of business relationships and transactions to detect suspicious activity. Suspicious transaction reporting mandates filing STRs with the UAE FIU through the goAML system when there are reasonable grounds to suspect money laundering or terrorist financing. Record-keeping requires maintaining all transaction records and CDD information for at least five years. The Travel Rule requires transmitting originator and beneficiary information with virtual asset transfers. Sanctions screening requires screening against lists maintained by the EOCN and the UN Security Council.

authority-specific implementation

Each UAE regulatory authority implements the federal AML/CFT framework through authority-specific regulations that layer additional requirements on top of the federal baseline. VARA requires licensed VASPs to implement AML/CFT programs tailored to the specific risks of each activity category, with enhanced requirements for exchange and custody activities. ADGM FSRA integrates AML/CFT requirements into its broader Financial Services and Markets Regulations, applying its established supervisory methodology to digital asset firms. The DFSA applies its AML/CFT rulebook to firms authorized for crypto token activities within DIFC. The SCA administers AML/CFT compliance for onshore VASPs under Cabinet Decision No. 111. The CBUAE supervises AML/CFT compliance for banks providing services to VASPs, creating an indirect supervisory channel.

The AML/CFT federal requirements analysis examines how the federal framework is implemented across authorities. The federal AML/CFT amendments brief tracks recent changes.

risk-based approach

The UAE’s AML/CFT framework mandates a risk-based approach (RBA), consistent with FATF Recommendation 1. The RBA requires VASPs to assess the money laundering and terrorist financing risks associated with their customers, products, services, delivery channels, and geographic exposure, and to calibrate their AML/CFT controls accordingly. Higher-risk situations require enhanced measures, while lower-risk situations may permit simplified measures.

For virtual asset operations, risk assessment must account for the specific characteristics of blockchain-based transactions including pseudonymity, cross-border reach, transaction speed, and the availability of privacy-enhancing technologies. The AML/CFT compliance implementation guide provides practical guidance on conducting virtual asset-specific risk assessments.

fatf standards and grey list context

The UAE’s AML/CFT framework is aligned with FATF standards, as validated by the FATF grey list removal in February 2024. The FATF assessment examined both technical compliance with the 40 Recommendations and operational effectiveness across 11 Immediate Outcomes. For virtual assets specifically, FATF Recommendation 15 requires countries to apply the full suite of AML/CFT measures to VASPs.

The grey list experience accelerated AML/CFT framework development across all UAE jurisdictions, resulting in enhanced supervisory capacity, improved STR filing quality, and strengthened enforcement. Ongoing FATF monitoring requires sustained compliance, creating a continuous improvement imperative for VASPs.

practical compliance elements

Effective AML/CFT compliance for UAE VASPs requires several operational elements including a compliance officer with appropriate authority and resources, written policies and procedures covering all AML/CFT obligations, technology systems for transaction monitoring and sanctions screening including blockchain analytics tools, staff training programs covering AML/CFT obligations and virtual asset-specific typologies, independent testing and audit of the AML/CFT program, and board-level oversight of AML/CFT risk management.

The multi-authority compliance map dashboard shows how AML/CFT requirements apply across jurisdictions. The VARA enforcement actions brief identifies AML/CFT deficiencies as a primary enforcement theme.

blockchain analytics and virtual asset-specific compliance tools

Effective AML/CFT compliance for virtual asset operations requires specialized tools beyond those used in traditional financial services. Blockchain analytics platforms enable VASPs to trace transaction flows across public blockchains, identify interactions with sanctioned addresses, assess the risk profile of counterparty wallets, and monitor for patterns indicative of money laundering or terrorist financing. The integration of blockchain analytics with traditional transaction monitoring systems is a key technical challenge for VASPs operating across both on-chain and fiat currency channels. The AML/CFT compliance implementation guide provides practical guidance on deploying these technology solutions within the UAE regulatory framework. The EOCN profile explains the specific sanctions screening requirements that blockchain analytics tools must address.