What the CBUAE’s 2026 Guidance Really Says About Real-Time Monitoring

CBUAE real-time transaction monitoring is a phrase that now appears in many summaries of the Central Bank’s April 2026 guidance package. Read the documents themselves and the picture is narrower, and more useful.

On 16 April 2026 the CBUAE issued four guidance documents and two best-practice manuals. The guidance covers proliferation financing risk, trade-based money laundering and transshipment, correspondent banking, and customer due diligence with record-keeping. The manuals cover risk-based institutional risk assessment and role-based training. None of the six is a new transaction monitoring guidance.

That does not make real time irrelevant. It means the expectation is spread across several sources of different strength. Separating them is the first design task for any group deciding where to invest.

Real time attaches to payment screening, name screening and optional risk-score updates, each under a different source and with a different strength.

What the April 2026 package actually contains

The package is aimed at licensed financial institutions and registered hawala providers. The proliferation financing guidance sets out three components of an effective framework: assessing inherent risk, evaluating the policies, procedures and controls in place, and monitoring emerging risks and typologies. The trade-based money laundering and correspondent banking guidance, and the two best-practice manuals, sit outside this article’s scope. The customer due diligence guidance is the one that touches monitoring most directly, and it says of itself that it neither constitutes legislation nor replaces legal requirements, and that the law prevails if the two differ.

Where real time actually appears in CBUAE guidance

The clearest real-time expectation is in sanctions screening, and it is not new. The CBUAE’s Guidance on Transaction Monitoring and Sanctions Screening, effective from 8 September 2021 and still listed as in force on the CBUAE rulebook, tells licensed institutions to screen all payments before completing the transaction, which it calls real-time screening, at a point where the transaction can still be stopped. For name screening it states, citing the Executive Office’s guidance, that screening must happen before onboarding and on an ongoing basis, at least daily.

The same 2021 guidance describes transaction monitoring differently. It gives rule- or scenario-based systems that typically process transactions in post-execution batches, daily, weekly, monthly or ad hoc, as an example of an automated tool. It expects institutions with a larger scale of operations to have automated systems, and it leaves the institution to demonstrate that its programme is effective and risk-based.

What the 2026 due diligence guidance says about ongoing monitoring

The due diligence guidance, dated October 2025 on its cover and issued as part of the April 2026 package, treats ongoing monitoring as part of continuous customer due diligence, applying to all customers. Institutions may use automated systems, manual processes or a combination, although larger institutions are recommended to use automated transaction monitoring. It describes monitoring as the check that activity matches the profile built at onboarding, and expects monitoring results to feed back into that profile.

On timing, the language is permissive. The guidance says that, if appropriate for the size and complexity of the institution, ongoing monitoring may be used to trigger enhanced due diligence reviews or adjust a customer’s risk score in real time. Its example review cycle of annual, two-yearly and three-yearly reviews for high, medium and low risk customers is expressly described as not mandatory. It also names event triggers for off-cycle reviews.

Examples of event triggers named in the guidance:

Identity signals as monitoring inputs

One section of the guidance goes beyond transaction data. Where an institution uses a digital identification system to authenticate existing customers, the guidance says it should use the data generated by authentication, with related information such as geolocation or IP addresses, to support ongoing due diligence and transaction monitoring. Its example is using an IP address to spot a customer transacting from a sanctioned or high-risk jurisdiction. For non-face-to-face relationships it also points to the anti-fraud checks institutions already run, including multi-factor authentication.

This is where anti-money-laundering, fraud and identity controls meet in the text of the guidance.

What this means for architecture

Read together, the sources describe layers rather than one real-time requirement. Payment screening runs before execution. Name screening runs at least daily. Anti-money-laundering monitoring is risk-based and event-driven, with real-time risk-score updates available to institutions large and complex enough to justify them. Treating all of these as one real-time project risks over-engineering the last layer and under-evidencing the first two. Fraud-prevention requirements are set outside this guidance and should be read separately.

That is the case for letting identity, transaction and screening signals reach one customer risk profile. FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. The design question for a group is which signals may move a customer’s risk rating, how quickly, and who reviews the change.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.