Everything financial advisors, promoters, introducers, and placement agents need to know about anti-money laundering compliance under the UAE's new Capital Market Authority regime — laws, obligations, deadlines, and penalties, verified against official sources.
Contact US : https://kumanoconsulting.com/
Quick summary: If you're licensed by the UAE's Capital Market Authority (CMA) to advise on, promote, arrange, introduce, or place securities and investment products onshore (i.e., outside the DIFC and ADGM free zones), you are an obligated entity under the UAE's federal AML framework. That means risk assessments, customer due diligence, sanctions screening, suspicious transaction reporting via goAML, 10-year record-keeping, and a board-backed compliance function — with fines up to AED 5,000,000 per violation. This guide breaks down exactly what applies to you and when.
Table of Contents
Who Is the CMA (and Why the Name Changed)
Who Is In Scope — and Who Is Not
The Legal Framework: Every Law That Applies to You
Your Core AML Obligations
Key Deadlines and Timelines
Penalties for Getting It Wrong
Compliance Checklist
Frequently Asked Questions
Disclaimer
1. Who Is the CMA (and Why the Name Changed)
If your licence paperwork still says "SCA," here's what happened.
The Securities and Commodities Authority (SCA) — established in 2000 as the UAE's federal securities regulator — was reconstituted as the Capital Market Authority (CMA) with effect from 1 January 2026, under Federal Decree-Law No. 32 of 2025 (the CMA Establishment Law) and Federal Decree-Law No. 33 of 2025 (the CMA Regulatory Law) [Source: Latham & Watkins; Wikipedia — Capital Market Authority (UAE)].
This was not merely a rebrand. The new CMA carries an expanded statutory mandate, including:
A modernized enforcement toolkit — administrative fines of up to AED 200 million for serious violations, plus license suspension and revocation powers
Pre-prosecution settlement (reconciliation) mechanisms for certain offenses
An expanded regulatory perimeter covering virtual assets, free-zone activities with a UAE nexus, and even certain cross-border activities conducted abroad
A dedicated Anti-Money Laundering and Financial Crimes Department within its organizational structure
Critically for advisors and promoters: the supervisor's name changed, but the regulated perimeter did not. SCA-era instruments — including the AML/CFT rulebook chapter and SCA Board decisions — continue to apply unless repealed, superseded, or replaced, and firms should verify the status of each instrument rather than assume it survives [Source: AML UAE].
2. Who Is In Scope — and Who Is Not
In scope
The following entities licensed by the CMA (onshore UAE) fall within the AML framework as obligated persons:
Entity Type What They Do
Financial advisors / consultants Provide advice on securities and investment products
Promoters and marketers Market investment products and schemes to UAE investors
Arrangers Structure and arrange securities transactions
Introducers Refer clients to licensed firms or product providers
Placement agents Place securities and investment products with investors
Even if your firm never holds client money, you are still in scope — advice and distribution activity alone triggers the full AML obligation set [Source: AML UAE].
Out of scope (for this guide)
The UAE operates distinct financial free zones with their own regulators and AML regimes:
DIFC (Dubai) — regulated by the Dubai Financial Services Authority (DFSA)
ADGM (Abu Dhabi) — regulated by the Financial Services Regulatory Authority (FSRA)
A CMA-licensed advisory or promotion business operating outside these free zones is not subject to DFSA or FSRA rules. Note, however, that Federal Decree-Law No. 33 of 2025 now gives the CMA jurisdiction over financial activities conducted in free zones where a sufficient UAE nexus exists, with a transitional period until 1 January 2027 — so cross-border firms should review their structures [Source: Latham & Watkins].
3. The Legal Framework: Every Law That Applies to You
Here is the complete stack of legislation governing AML compliance for CMA-regulated advisors and promoters:
Tier 1 — The Federal AML Law
Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing — the primary AML/CFT/CPF law. It:
Repealed Federal Decree by Law No. (20) of 2018 (Article 41)
Establishes an independent Financial Intelligence Unit (FIU) within the Central Bank (Article 11), to which all Financial Institutions, DNFBPs, and VASPs must submit Suspicious Transaction Reports exclusively
Requires a risk-based approach, Customer Due Diligence (CDD) with continuous monitoring, a ban on anonymous/fictitious accounts, internal controls, Targeted Financial Sanctions implementation, and retention of all transaction records (Article 19)
Sets administrative fines of AED 10,000 to AED 5,000,000 per violation (Article 17), and criminal fines on legal persons of AED 200,000 to AED 100,000,000 depending on the violation (Article 27)
[Source: UAE Legislation Portal]
Tier 2 — The Executive Regulations
Cabinet Resolution No. (134) of 2025 — the Executive Regulations of Federal Decree by Law No. 10 of 2025. It:
Entered into force on 14 December 2025 (30 days after Official Gazette publication)
Repealed Cabinet Resolution No. (10) of 2019 (the old executive regulations under the 2018 law), along with any conflicting provisions
Defines the obligated sectors: Financial Institutions (including participation in securities issuance and related financial services — the hook that captures advisors and promoters), DNFBPs, and VASPs
[Source: UAE Legislation Portal; Al Tamimi & Partners]
Tier 3 — Sector-Specific CMA Rules
Chapter Five of the CMA Rulebook — Guidelines for Combating Money Laundering, Counter Terrorism Financing and Funding of Illegal Organisations — mandatory standards aligning AML measures with federal law
SCA Board Chairman's Decision No. 21 of 2019 on AML and CFT Procedures — continuing to apply post-transition
CMA Notices, including CMA Notice 1/2022 governing the Confirmed Name Match Report via goAML (formerly the Funds Freeze Report)
[Source: UAE CMA — AML & Financial Crimes Framework; AML UAE]
Tier 4 — Targeted Financial Sanctions & Beneficial Ownership
Cabinet Resolution No. (74) of 2020 — implements UAE terrorist lists and UN Security Council sanctions; governs the freeze-without-delay regime
Cabinet Decision No. (109) of 2023 — beneficial owner procedures
Cabinet Resolution No. (132) of 2023 — penalties for beneficial owner violations
Federal Law No. (7) of 2014 — combating terrorism crimes
[Source: AML UAE]
Context: The International Backdrop
The UAE was removed from the FATF "grey list" (Jurisdictions under Increased Monitoring) on 23 February 2024 — a milestone reflecting the strengthening of the framework these laws build on. The new 2025 legislation continues that trajectory of alignment with international standards [Source: FATF; Norton Rose Fulbright; Reuters].
4. Your Core AML Obligations
A CMA-regulated advisor or promoter must operate a risk-based AML programme proportionate to the nature and size of its business. Here are the pillars:
4.1 Enterprise-Wide Risk Assessment
Document a business-wide assessment covering your client base, the products and providers you market, your channels, and your introducers. Refresh it periodically and whenever material changes occur.
4.2 Customer Due Diligence (CDD)
Apply CDD at the required trigger points in the customer relationship, including:
Identification and verification of clients
Ultimate beneficial ownership (UBO) checks
Politically exposed person (PEP) identification and enhanced scrutiny
Enhanced Due Diligence (EDD) for higher-risk clients
Ongoing monitoring of the business relationship (per Article 19 of the AML Law)
Keep the beneficial owner register current — updates are due within 15 days of a change (see Deadlines).
4.3 Source of Funds & Wealth
Understand — and where risk demands, corroborate — where the money behind a planned investment came from. For advisors promoting third-party products, this means being able to challenge unusual wealth narratives, not just ticking boxes.
4.4 Targeted Financial Sanctions (TFS) Screening
Screen clients and referred parties against:
The UAE Local Terrorist List
The UN Security Council Consolidated List
Any other applicable lists
On a confirmed match: freeze without delay and within 24 hours (Cabinet Resolution No. 74 of 2020), then file a Confirmed Name Match Report via goAML within 5 business days (CMA Notice 1/2022). The old "Funds Freeze Report" terminology has been superseded.
4.5 Product Diligence
Diligence applies to the schemes and providers you promote — with particular vigilance against unlicensed activity being dressed up as legitimate distribution. If a product provider can't evidence its own regulatory standing and AML controls, that's a red flag you need to escalate.
4.6 Third-Party / Introducer Reliance
You may rely on an introducer or other third party for parts of the CDD process — but responsibility for the due diligence remains yours. Document the reliance, obtain the underlying data on request, and periodically test the introducer's standards.
4.7 Governance: Compliance Officer & MLRO
Appoint a competent Compliance Officer and Money Laundering Reporting Officer (MLRO)
Secure board backing for the function
The compliance officer's duties include the semi-annual AML/CFT report to the Authority
4.8 Suspicious Transaction Reporting via goAML
Register on goAML — the UAE FIU's reporting platform, mandatory for all obligated entities
File STRs/SARs exclusively with the UAE FIU (housed within the Central Bank under Article 11 of Federal Decree by Law No. 10 of 2025)
Observe the no-tipping-off rule — never disclose to the client that a report has been or may be made
[Source: UAE FIU; UAE Ministry of Economy — goAML Registration; UAE Legislation Portal]
4.9 Record Keeping
Retain for ten years:
Customer due diligence files
Advice and transaction records
Screening results
Risk assessments and internal reports
Records must be immediately available to competent authorities upon request (Article 19(f) of Federal Decree by Law No. 10 of 2025).
4.10 Staff Training
Maintain an ongoing training programme reaching advisors, marketers, introducer-facing staff — and the board. Training should be role-appropriate and refreshed as the rules evolve (which, as 2025 demonstrated, they do).
4.11 Regulatory Returns
Lodge the annual and semi-annual returns the CMA calls for, including the annual AML/CFT/TFS risk assessment return.
5. Key Deadlines and Timelines at a Glance
Obligation Deadline Legal Basis
Freeze on confirmed sanctions match Without delay, within 24 hours Cabinet
Resolution No. 74 of 2020
Confirmed Name Match Report (goAML) Within 5 business days of confirming the match CMA Notice 1/2022
Beneficial owner register update Within 15 days of a change Cabinet Decision No. 109 of 2023
Semi-annual AML/CFT report to CMA Within 2 months of each period ending 30 June and 31 December CMA rulebook / notices
Annual AML/CFT/TFS risk assessment return Yearly CMA rulebook / notices
Record retention 10 years Federal Decree by Law No. 10 of 2025, Art. 19
Free-zone / extraterritorial perimeter compliance transition By 1 January 2027 Federal Decree-Law No. 33 of 2025
[Sources: AML UAE; UAE Legislation Portal; Latham & Watkins]
6. Penalties for Getting It Wrong
Non-compliance carries escalating consequences at two levels:
Administrative penalties (Federal Decree by Law No. 10 of 2025, Article 17)
The CMA, as your Supervisory Authority, may impose on obligated entities that violate the law, its Executive Regulations, or related decisions:
Administrative fines of AED 10,000 – AED 5,000,000 for each violation — note the per violation framing, which multiplies quickly across multiple client files
Prohibition from engaging in the sector
Restrictions on powers of board members or personnel; suspension of directors or personnel
Suspension or restriction of activities
Revocation of the licence
Criminal penalties (Article 27)
Legal persons committing AML crimes face fines of AED 200,000 up to AED 100,000,000 depending on the nature of the violation — alongside potential criminal liability for individuals.
Under the CMA's own enforcement regime
The new CMA Regulatory Law also empowers administrative fines of up to AED 200 million for serious violations within its capital-markets enforcement remit, though it introduces discretionary pre-prosecution settlement mechanisms as a mitigation pathway [Source: Latham & Watkins].
The takeaway: the cost of a robust AML programme is trivially small compared to a single Article 17 fine — or worse, a licence revocation.
7. Compliance Checklist for CMA-Regulated Advisors & Promoters
Use this as a starting audit framework:
Governance & Programme
Written, board-approved AML/CFT/CPF policy aligned to Federal Decree by Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025
Competent Compliance Officer and MLRO appointed, with clear reporting lines
Enterprise-wide risk assessment documented, current, and refreshed
Client-Facing Controls
CDD/KYC procedures with UBO identification at all trigger points
PEP identification and EDD workflows for higher-risk clients
Source of funds/wealth corroboration procedures
Sanctions screening against UAE Local Terrorist List + UNSC Consolidated List (clients and referred parties)
Product diligence on every promoted scheme and provider
Reporting
goAML registration completed with the UAE FIU
STR/SAR filing procedures with no-tipping-off controls
24-hour freeze + 5-business-day Confirmed Name Match Report workflow tested
Housekeeping
Beneficial owner register updated within 15 days of changes
10-year record retention system (with immediate retrieval capability)
Ongoing training calendar covering advisors, marketers, introducer-facing staff, and the board
Semi-annual AML/CFT report to CMA diarized (2 months after each 30 June / 31 December)
Annual risk assessment return scheduled
Status of each legacy SCA-era instrument verified (still in force? superseded?)
8. Frequently Asked Questions
Q: We never touch client money — do AML rules really apply to us? A: Yes. Advising, promoting, arranging, introducing, and placing activity alone puts a CMA-licensed firm inside the AML framework. Holding client funds is not a prerequisite.
Q: Our licence says SCA. Is it still valid? A: Yes — the CMA took over the SCA's mandate under Federal Decree-Law No. 32 of 2025 with effect from 1 January 2026. The regulated perimeter did not change with the name; verify whether any SCA-era instrument you rely on has been superseded.
Q: We operate in the DIFC/ADGM. Does this apply? A: No — those free zones are regulated by the DFSA and FSRA respectively, each with their own AML regimes. But the expanded CMA perimeter under Federal Decree-Law No. 33 of 2025 (with transition until 1 January 2027) means firms with UAE-nexus cross-border activity should review their exposure.
Q: What replaced the old AML law everyone cited? A: Federal Decree by Law No. 10 of 2025 replaced Federal Decree by Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 (in force 14 December 2025) replaced Cabinet Resolution No. 10 of 2019 as the executive regulations. Update your policy documents and training material accordingly.
Q: What's the single biggest fine risk? A: AED 5,000,000 per violation administratively (Article 17) — and remember violations can be counted per breach, not per firm. Criminal fines reach AED 100,000,000 for legal persons.
Q: Where do we file suspicious transaction reports? A: Exclusively to the UAE FIU via the goAML platform, after completing goAML registration. STRs go to no other body.
9. Disclaimer
This article is provided for general information purposes only and does not constitute legal, regulatory, or compliance advice. Laws, resolutions, notices, and rulebook provisions are amended frequently, and instruments issued under the former SCA may have been superseded. Always verify the current status of each cited instrument with the Capital Market Authority (cma.gov.ae), the UAE Legislation Portal (uaelegislation.gov.ae), the UAE FIU, or qualified UAE legal counsel before acting. Figures and deadlines are accurate as of the date of publication based on the sources cited.
