October 28, 2026 · Jurisdiction Briefing · 7 min read

UAE: assessing your own crime risks, and the risks of new products, under Cabinet Resolution No. (134) of 2025

Every control in an AML programme rests on a judgement about risk: how much due diligence, how often to review, which alerts matter. Before the Executive Regulations reach customer due diligence, they require that judgement to be made, written down and kept up to date.

The duty starts in the law. Article (19) of Federal Decree by Law No. (10) of 2025 requires financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers (VASPs) to identify, understand, manage, assess, document and continuously update the risks of the Crime within their business scope. “The Crime” is a defined term: money laundering and its predicate offences, the financing of terrorism, or proliferation financing. The CBUAE Rulebook shows the Decree by Law effective from 14 October 2025.

Cabinet Resolution No. (134) of 2025, the Executive Regulations, fills in the detail. The Rulebook shows it effective from 14 December 2025, with the status In-Force. This briefing reads two of its articles: Article (5), in the Division headed Risk Identification and Risk Mitigation, and Article (24), in the Division headed Requirements Relating to New Technologies. Customer identification and the deferral of verification were covered on 21 October; enhanced due diligence for high-risk countries under Article (23) is not covered here.

Assess: all the factors, before the overall rating

Article (5)(1) requires firms to identify, understand, manage and assess their crime risks in a manner proportionate to the nature and size of their business. Two inputs are named: the risk-based approach, and the results of the National Risk Assessment.

It then sets two duties.

Consider all relevant risk factors before determining the overall level of risk and the appropriate level of mitigation. The factors are given as examples (“such as”): customer risks, countries and geographic risk, and product, service, transaction and delivery channel risks.
Document and keep it. Firms must document the processes for identifying and assessing risks and the related information, retain the relevant study, update it on an ongoing basis, and provide it to the concerned authorities upon request.

The order matters. The factors are considered prior to the overall rating and the choice of controls. Our reading: an assessment that starts from a target rating and works backwards to the factors has the article’s sequence upside down, and the documented process should show the factors first.

Two wording points. Article (5) asks for updates “on an ongoing basis”; it does not set a fixed cycle. A three-year figure does appear in the Resolution, but for someone else: under Article (48), the National Committee updates the National Risk Assessment at least once every three years, or whenever necessary. And the audience differs between the two instruments. The Resolution says the study goes to “the concerned authorities upon request”; Article (19) of the Decree by Law says the Supervisory Authority. Our reading: keep the study in a form that can be handed over without editing.

Mitigate: policies, then measures

Article (5)(2) turns to mitigation. Here a third input joins the risk-based approach and the National Risk Assessment: sectoral assessments. Firms must:

establish internal policies, controls and procedures approved by Senior Management, enabling them to manage and mitigate the identified risks, and review and update them on an ongoing basis;
ensure those policies, controls and procedures are proportionate to the nature and size of the business, monitor their implementation, assess their effectiveness and enhance them where necessary, in accordance with Article (21);
apply Enhanced Due Diligence measures to manage and mitigate identified risks.

Senior Management is a defined term: the person or persons with authority to take strategic and executive decisions materially affecting risk management, compliance policies and operational governance, including chief executive officers, general managers and board members.

Article (21), the cross-reference, lists what the policies must include. Among its items are customer due diligence measures (including risk management for relationships before verification is complete), procedures for reporting suspicious transactions, a Compliance Officer at management level, fitness and propriety screening of employees, training programmes, and an independent audit function to test the effectiveness and adequacy of the policies, controls and procedures.

The Enhanced Due Diligence examples

Article (5)(2)(c) gives its Enhanced Due Diligence measures “by way of example”. They are:

obtaining and verifying additional information, such as on the customer’s identity and occupation, the beneficial owner, the amount of funds, and information from public databases and open sources;
obtaining additional information on the purpose of the relationship, or the reasons for expected or actual transactions;
updating customer due diligence information on the customer and the beneficial owner more regularly;
taking Reasonable Measures to identify the source of funds and wealth of the customer and the beneficial owner;
increasing the degree and level of ongoing monitoring, and selecting transaction patterns for further scrutiny;
carrying out the first payment through an account in the customer’s name at a financial institution subject to equivalent due diligence standards;
obtaining Senior Management approval to commence or continue the relationship.

Because these are examples, the list is not closed. Our reading: the procedure should say which measures apply to which risk, rather than reproduce the list.

Simplified due diligence: earned, and coordinated

Article (5)(3) allows Simplified Due Diligence where low risks are identified, but on stated terms:

only upon fulfilling the requirements of clauses (1) and (2), that is, after the assessment and the mitigation framework are in place;
in coordination with the Supervisory Authority;
not where there is a suspicion that a crime has been committed;
proportionate to the elements of low risk, and ensuring full implementation of the instructions of the Executive Office or other Competent Authorities on Targeted Financial Sanctions.

Its examples are verifying the customer and beneficial owner after the relationship begins, updating customer data at longer intervals, reducing the frequency of monitoring and transaction scrutiny, and inferring the purpose and nature of the relationship from the type of transaction or relationship.

The sanctions condition is the one to hold onto. Simplified measures can reduce how often a file is refreshed. Under Article (5)(3), they must still ensure full implementation of the Targeted Financial Sanctions instructions.

Proliferation financing: its own clause

Article (5)(4) applies where high risks related to Proliferation Financing are identified. Firms must take proportionate measures to manage and mitigate them, including, by way of example:

enhanced internal controls aimed at detecting and preventing potential violations, non-implementation or circumvention of Targeted Financial Sanctions instructions, with ongoing enhanced scrutiny of the relationship;
documented records of the measures taken, available to the competent authorities upon request;
periodic reviews of internal controls in line with changes in the level of risk.

Our reading: if the assessment under clause (1) never asks whether proliferation financing risk is high, clause (4) can never be triggered. The assessment should answer that question explicitly.

New products, practices and technologies: assess before launch

Article (24) is short, and it is about timing. Firms must identify and assess the risks of money laundering, terrorist financing and proliferation financing that may arise from:

the development of new products and new business practices;
new service delivery mechanisms;
the use of new or developing technologies, for both new and pre-existing products.

Clause (2) then fixes the moment: firms must assess such risks prior to the launch or use of the products, practices or technologies, and take appropriate measures to manage and mitigate them.

Two consequences follow from the text. A new technology bolted onto an existing product is in scope, because the article covers pre-existing products. And the assessment comes before launch, not after the first quarter’s data.

The same subject appears higher up. Under Article (48), the National Committee’s competences include identifying and assessing crime risks arising from new products or business practices, such as new or emerging technologies or delivery methods. Under Article (49), Supervisory Authorities identify and assess the risks arising from new products, new professional practices, new delivery methods and new or emerging technologies, for new and existing products.

How the assessment is used by the supervisor

Article (49) also explains why the document matters beyond the firm. Supervisory Authorities determine the frequency of supervision and inspection based on, among other things, the National Risk Assessment and the crime risks, the level of understanding of them, and the policies, controls and procedures applied by each firm, as determined in the Supervisory Authority’s assessment of each firm’s risk structure.

Article (22) gives the Compliance Officer a related role: reviewing the firm’s AML, CFT and proliferation financing systems and procedures, assessing their consistency with the Decree by Law and the Resolution, and preparing periodic reports to Senior Management, with a copy to the Supervisory Authority on its request.

What to do with this

Show the factors first. Structure the documented assessment so the customer, geographic, product, service, transaction and delivery channel factors are recorded before the overall rating and the chosen controls.
Cite the inputs. Record how the National Risk Assessment and, for mitigation, the sectoral assessments were taken into account.
Record Senior Management approval of the policies, controls and procedures, and the dates they were reviewed and updated.
Tie simplified due diligence to its conditions. For each simplified measure, keep the low-risk basis, the coordination with the Supervisory Authority, and the confirmation that sanctions screening is unaffected.
Answer the proliferation financing question in the assessment, and if the answer is high, the Article (5)(4) controls and their records.
Put Article (24) into the product approval process, so a new product, channel or technology, including one added to an existing product, has a risk assessment signed off before launch.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates