How Federal Decree-Law No. 10 of 2025 Turns UAE Transaction Monitoring Into a Board-Level Governance Question

UAE transaction monitoring compliance now rests on a new statute. Federal Decree-Law No. 10 of 2025 was published on 30 September 2025 and took effect on 14 October 2025, repealing Federal Decree-Law No. 20 of 2018.

Cabinet Resolution No. 134 of 2025, the executive regulations, followed with effect from 14 December 2025, and the Central Bank of the UAE (CBUAE) rulebook lists both instruments. Under Article 41, earlier regulations and circulars stay in force only where they do not conflict with the new law, until they are replaced.

Most commentary dwells on the headline penalties. For a group risk leader the more useful reading is operational: several articles change what a monitoring programme has to be able to do, and who answers when it cannot.

Article 19 sets the risk assessment and monitoring duties, Article 18 the reporting duty, and Article 5 what the FIU can do next.

What the law requires of monitoring programmes

Article 19 sets the baseline for financial institutions, designated non-financial businesses and professions, and virtual asset service providers. They must identify, understand, assess, document and continuously update their money laundering, terrorism financing and proliferation financing risks. They must apply customer due diligence and continuous monitoring procedures, with scope set by several risk dimensions and the national risk assessment. And they must keep policies, controls and procedures that senior management has approved. The definition of customer due diligence in Article 1 includes ongoing monitoring procedures, so monitoring sits inside due diligence by definition.

Article 18 requires a suspicious transaction report without delay and regardless of value, sent directly to the Financial Intelligence Unit. Attempted transactions fall within the definition of suspicious transactions. Article 20 requires a licence, registration or enrolment before anyone carries on a financial activity, a DNFBP activity or a virtual asset service provider activity.

Why group-wide application changes the design question

Article 19(1)(d) extends approved policies, controls and procedures to every branch and majority-owned subsidiary. In a group that runs different monitoring tools in its bank, exchange house and insurance arm, that sentence turns a technology inventory into a compliance question. A rule set tuned for one entity and left alone in another is hard to describe as one programme.

The same logic applies to customer data. The CBUAE’s 2021 transaction monitoring guidance asks institutions, where practicable, to monitor at customer or relationship level, including across financial groups, and expects the baseline of normal activity to come from customer due diligence and peer-group behaviour. Where entities hold different versions of the same customer, the baseline differs by entity, and so do the alerts.

What the FIU’s powers mean for case handling

Article 5 lets the Chief of the Unit order, without prior notice, the suspension of a transaction suspected of being related to the crime for up to ten working days. The Chief may also order the freezing of funds held with financial institutions, DNFBPs or virtual asset service providers for up to thirty days, extendable by the Attorney General or a delegate. Institutions must lift a freeze when the order is cancelled or expires, unless it has been extended.

A suspicious transaction report is therefore no longer the end of the institution’s part in the matter. The Unit can act on it quickly, and under Article 11 can ask for further information in the form and timeframe it sets. A case file that shows what was seen, when, and why a report was or was not filed lets an institution respond inside that window. Under Article 28, deliberately or through gross negligence failing to comply with the reporting duty is an offence, punishable by imprisonment and a fine of AED 100,000 to AED 1 million, or either.

Liability and the time horizon of monitoring evidence

Article 27 sets a corporate fine of AED 5 million to AED 100 million, or the value of the criminal property if greater, where representatives, directors or agents commit money laundering, terrorism financing or proliferation financing offences on a legal person’s behalf. Article 17 separately lets supervisors impose administrative fines of AED 10,000 to AED 5 million per violation, with higher fines for a repeat violation within a year, and allows the penalty to be published.

Article 37(2) provides that criminal proceedings for these offences do not lapse by prescription. Record-keeping periods are set elsewhere, and the CBUAE’s guidance describes a statutory minimum of five years. They are different questions, but together they mean an institution cannot assume that a monitoring decision from several years ago will never be examined. In practice, decision records that explain reasoning age better than alert logs that record only outcomes.

Where fraud and financial crime meet in the new offences

Two offences sit on the border between fraud controls and anti-money-laundering controls. Article 35(2) criminalises unlawfully enabling another person to benefit from one’s account with a financial institution or virtual asset service provider, knowing or having sufficient grounds to believe the use is intended to misuse the account. Article 30(2) covers dealing in virtual assets that are totally anonymous or that obstruct the tracing of a transaction or its parties. A programme that treats mule-account behaviour as a fraud topic and suspicious transaction reporting as a compliance topic can find it hard to show a single view of the same pattern.

What to do before the next supervisory cycle

None of this needs to wait for a supervisory visit. Four checks are within a group’s control now.

How Nexiant supports monitoring that can be governed as one programme

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For a group working through Article 19(1)(d), the questions to put to any monitoring capability are whether one decision record can span entities, and whether rule changes, alert outcomes and reporting decisions reach senior management in the same form.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.