AML Regulations for CMA-Regulated Advisors and Promoters in UAE

Everything financial advisors, promoters, introducers, and placement agents need to know about anti-money laundering compliance under the UAE's new Capital Market Authority regime — laws, obligations, deadlines, and penalties, verified against official sources.

Contact US : https://kumanoconsulting.com/

Quick summary: If you're licensed by the UAE's Capital Market Authority (CMA) to advise on, promote, arrange, introduce, or place securities and investment products onshore (i.e., outside the DIFC and ADGM free zones), you are an obligated entity under the UAE's federal AML framework. That means risk assessments, customer due diligence, sanctions screening, suspicious transaction reporting via goAML, 10-year record-keeping, and a board-backed compliance function — with fines up to AED 5,000,000 per violation. This guide breaks down exactly what applies to you and when.

Table of Contents

Who Is the CMA (and Why the Name Changed)

Who Is In Scope — and Who Is Not

The Legal Framework: Every Law That Applies to You

Your Core AML Obligations

Key Deadlines and Timelines

Penalties for Getting It Wrong

Compliance Checklist

Frequently Asked Questions

Disclaimer

1. Who Is the CMA (and Why the Name Changed)

If your licence paperwork still says "SCA," here's what happened.

The Securities and Commodities Authority (SCA) — established in 2000 as the UAE's federal securities regulator — was reconstituted as the Capital Market Authority (CMA) with effect from 1 January 2026, under Federal Decree-Law No. 32 of 2025 (the CMA Establishment Law) and Federal Decree-Law No. 33 of 2025 (the CMA Regulatory Law) [Source: Latham & Watkins; Wikipedia — Capital Market Authority (UAE)].

This was not merely a rebrand. The new CMA carries an expanded statutory mandate, including:

A modernized enforcement toolkit — administrative fines of up to AED 200 million for serious violations, plus license suspension and revocation powers

Pre-prosecution settlement (reconciliation) mechanisms for certain offenses

An expanded regulatory perimeter covering virtual assets, free-zone activities with a UAE nexus, and even certain cross-border activities conducted abroad

A dedicated Anti-Money Laundering and Financial Crimes Department within its organizational structure

Critically for advisors and promoters: the supervisor's name changed, but the regulated perimeter did not. SCA-era instruments — including the AML/CFT rulebook chapter and SCA Board decisions — continue to apply unless repealed, superseded, or replaced, and firms should verify the status of each instrument rather than assume it survives [Source: AML UAE].

2. Who Is In Scope — and Who Is Not

 In scope

The following entities licensed by the CMA (onshore UAE) fall within the AML framework as obligated persons:

Entity Type What They Do

Financial advisors / consultants Provide advice on securities and investment products

Promoters and marketers Market investment products and schemes to UAE investors

Arrangers Structure and arrange securities transactions

Introducers Refer clients to licensed firms or product providers

Placement agents Place securities and investment products with investors

Even if your firm never holds client money, you are still in scope — advice and distribution activity alone triggers the full AML obligation set [Source: AML UAE].

 Out of scope (for this guide)

The UAE operates distinct financial free zones with their own regulators and AML regimes:

DIFC (Dubai) — regulated by the Dubai Financial Services Authority (DFSA)

ADGM (Abu Dhabi) — regulated by the Financial Services Regulatory Authority (FSRA)

A CMA-licensed advisory or promotion business operating outside these free zones is not subject to DFSA or FSRA rules. Note, however, that Federal Decree-Law No. 33 of 2025 now gives the CMA jurisdiction over financial activities conducted in free zones where a sufficient UAE nexus exists, with a transitional period until 1 January 2027 — so cross-border firms should review their structures [Source: Latham & Watkins].

3. The Legal Framework: Every Law That Applies to You

Here is the complete stack of legislation governing AML compliance for CMA-regulated advisors and promoters:

Tier 1 — The Federal AML Law

Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing — the primary AML/CFT/CPF law. It:

Repealed Federal Decree by Law No. (20) of 2018 (Article 41)

Establishes an independent Financial Intelligence Unit (FIU) within the Central Bank (Article 11), to which all Financial Institutions, DNFBPs, and VASPs must submit Suspicious Transaction Reports exclusively

Requires a risk-based approach, Customer Due Diligence (CDD) with continuous monitoring, a ban on anonymous/fictitious accounts, internal controls, Targeted Financial Sanctions implementation, and retention of all transaction records (Article 19)

Sets administrative fines of AED 10,000 to AED 5,000,000 per violation (Article 17), and criminal fines on legal persons of AED 200,000 to AED 100,000,000 depending on the violation (Article 27)

[Source: UAE Legislation Portal]

Tier 2 — The Executive Regulations

Cabinet Resolution No. (134) of 2025 — the Executive Regulations of Federal Decree by Law No. 10 of 2025. It:

Entered into force on 14 December 2025 (30 days after Official Gazette publication)

Repealed Cabinet Resolution No. (10) of 2019 (the old executive regulations under the 2018 law), along with any conflicting provisions

Defines the obligated sectors: Financial Institutions (including participation in securities issuance and related financial services — the hook that captures advisors and promoters), DNFBPs, and VASPs

[Source: UAE Legislation Portal; Al Tamimi & Partners]

Tier 3 — Sector-Specific CMA Rules

Chapter Five of the CMA Rulebook — Guidelines for Combating Money Laundering, Counter Terrorism Financing and Funding of Illegal Organisations — mandatory standards aligning AML measures with federal law

SCA Board Chairman's Decision No. 21 of 2019 on AML and CFT Procedures — continuing to apply post-transition

CMA Notices, including CMA Notice 1/2022 governing the Confirmed Name Match Report via goAML (formerly the Funds Freeze Report)

[Source: UAE CMA — AML & Financial Crimes Framework; AML UAE]

Tier 4 — Targeted Financial Sanctions & Beneficial Ownership

Cabinet Resolution No. (74) of 2020 — implements UAE terrorist lists and UN Security Council sanctions; governs the freeze-without-delay regime

Cabinet Decision No. (109) of 2023 — beneficial owner procedures

Cabinet Resolution No. (132) of 2023 — penalties for beneficial owner violations

Federal Law No. (7) of 2014 — combating terrorism crimes

[Source: AML UAE]

Context: The International Backdrop

The UAE was removed from the FATF "grey list" (Jurisdictions under Increased Monitoring) on 23 February 2024 — a milestone reflecting the strengthening of the framework these laws build on. The new 2025 legislation continues that trajectory of alignment with international standards [Source: FATF; Norton Rose Fulbright; Reuters].

4. Your Core AML Obligations

A CMA-regulated advisor or promoter must operate a risk-based AML programme proportionate to the nature and size of its business. Here are the pillars:

 4.1 Enterprise-Wide Risk Assessment

Document a business-wide assessment covering your client base, the products and providers you market, your channels, and your introducers. Refresh it periodically and whenever material changes occur.

 4.2 Customer Due Diligence (CDD)

Apply CDD at the required trigger points in the customer relationship, including:

Identification and verification of clients

Ultimate beneficial ownership (UBO) checks

Politically exposed person (PEP) identification and enhanced scrutiny

Enhanced Due Diligence (EDD) for higher-risk clients

Ongoing monitoring of the business relationship (per Article 19 of the AML Law)

Keep the beneficial owner register current — updates are due within 15 days of a change (see Deadlines).

 4.3 Source of Funds & Wealth

Understand — and where risk demands, corroborate — where the money behind a planned investment came from. For advisors promoting third-party products, this means being able to challenge unusual wealth narratives, not just ticking boxes.

 4.4 Targeted Financial Sanctions (TFS) Screening

Screen clients and referred parties against:

The UAE Local Terrorist List

The UN Security Council Consolidated List

Any other applicable lists

On a confirmed match: freeze without delay and within 24 hours (Cabinet Resolution No. 74 of 2020), then file a Confirmed Name Match Report via goAML within 5 business days (CMA Notice 1/2022). The old "Funds Freeze Report" terminology has been superseded.

 4.5 Product Diligence

Diligence applies to the schemes and providers you promote — with particular vigilance against unlicensed activity being dressed up as legitimate distribution. If a product provider can't evidence its own regulatory standing and AML controls, that's a red flag you need to escalate.

 4.6 Third-Party / Introducer Reliance

You may rely on an introducer or other third party for parts of the CDD process — but responsibility for the due diligence remains yours. Document the reliance, obtain the underlying data on request, and periodically test the introducer's standards.

 4.7 Governance: Compliance Officer & MLRO

Appoint a competent Compliance Officer and Money Laundering Reporting Officer (MLRO)

Secure board backing for the function

The compliance officer's duties include the semi-annual AML/CFT report to the Authority

 4.8 Suspicious Transaction Reporting via goAML

Register on goAML — the UAE FIU's reporting platform, mandatory for all obligated entities

File STRs/SARs exclusively with the UAE FIU (housed within the Central Bank under Article 11 of Federal Decree by Law No. 10 of 2025)

Observe the no-tipping-off rule — never disclose to the client that a report has been or may be made

[Source: UAE FIU; UAE Ministry of Economy — goAML Registration; UAE Legislation Portal]

 4.9 Record Keeping

Retain for ten years:

Customer due diligence files

Advice and transaction records

Screening results

Risk assessments and internal reports

Records must be immediately available to competent authorities upon request (Article 19(f) of Federal Decree by Law No. 10 of 2025).

 4.10 Staff Training

Maintain an ongoing training programme reaching advisors, marketers, introducer-facing staff — and the board. Training should be role-appropriate and refreshed as the rules evolve (which, as 2025 demonstrated, they do).

 4.11 Regulatory Returns

Lodge the annual and semi-annual returns the CMA calls for, including the annual AML/CFT/TFS risk assessment return.

5. Key Deadlines and Timelines at a Glance

Obligation Deadline Legal Basis

Freeze on confirmed sanctions match Without delay, within 24 hours Cabinet
Resolution No. 74 of 2020

Confirmed Name Match Report (goAML) Within 5 business days of confirming the match CMA Notice 1/2022

Beneficial owner register update Within 15 days of a change Cabinet Decision No. 109 of 2023

Semi-annual AML/CFT report to CMA Within 2 months of each period ending 30 June and 31 December CMA rulebook / notices

Annual AML/CFT/TFS risk assessment return Yearly CMA rulebook / notices

Record retention 10 years Federal Decree by Law No. 10 of 2025, Art. 19

Free-zone / extraterritorial perimeter compliance transition By 1 January 2027 Federal Decree-Law No. 33 of 2025

[Sources: AML UAE; UAE Legislation Portal; Latham & Watkins]

6. Penalties for Getting It Wrong

Non-compliance carries escalating consequences at two levels:

Administrative penalties (Federal Decree by Law No. 10 of 2025, Article 17)

The CMA, as your Supervisory Authority, may impose on obligated entities that violate the law, its Executive Regulations, or related decisions:

Administrative fines of AED 10,000 – AED 5,000,000 for each violation — note the per violation framing, which multiplies quickly across multiple client files

Prohibition from engaging in the sector

Restrictions on powers of board members or personnel; suspension of directors or personnel

Suspension or restriction of activities

Revocation of the licence

Criminal penalties (Article 27)

Legal persons committing AML crimes face fines of AED 200,000 up to AED 100,000,000 depending on the nature of the violation — alongside potential criminal liability for individuals.

Under the CMA's own enforcement regime

The new CMA Regulatory Law also empowers administrative fines of up to AED 200 million for serious violations within its capital-markets enforcement remit, though it introduces discretionary pre-prosecution settlement mechanisms as a mitigation pathway [Source: Latham & Watkins].

The takeaway: the cost of a robust AML programme is trivially small compared to a single Article 17 fine — or worse, a licence revocation.

7. Compliance Checklist for CMA-Regulated Advisors & Promoters

Use this as a starting audit framework:

Governance & Programme

 Written, board-approved AML/CFT/CPF policy aligned to Federal Decree by Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025

 Competent Compliance Officer and MLRO appointed, with clear reporting lines

 Enterprise-wide risk assessment documented, current, and refreshed

Client-Facing Controls

 CDD/KYC procedures with UBO identification at all trigger points

 PEP identification and EDD workflows for higher-risk clients

 Source of funds/wealth corroboration procedures

 Sanctions screening against UAE Local Terrorist List + UNSC Consolidated List (clients and referred parties)

 Product diligence on every promoted scheme and provider

Reporting

 goAML registration completed with the UAE FIU

 STR/SAR filing procedures with no-tipping-off controls

 24-hour freeze + 5-business-day Confirmed Name Match Report workflow tested

Housekeeping

 Beneficial owner register updated within 15 days of changes

 10-year record retention system (with immediate retrieval capability)

 Ongoing training calendar covering advisors, marketers, introducer-facing staff, and the board

 Semi-annual AML/CFT report to CMA diarized (2 months after each 30 June / 31 December)

 Annual risk assessment return scheduled

 Status of each legacy SCA-era instrument verified (still in force? superseded?)

8. Frequently Asked Questions

Q: We never touch client money — do AML rules really apply to us? A: Yes. Advising, promoting, arranging, introducing, and placing activity alone puts a CMA-licensed firm inside the AML framework. Holding client funds is not a prerequisite.

Q: Our licence says SCA. Is it still valid? A: Yes — the CMA took over the SCA's mandate under Federal Decree-Law No. 32 of 2025 with effect from 1 January 2026. The regulated perimeter did not change with the name; verify whether any SCA-era instrument you rely on has been superseded.

Q: We operate in the DIFC/ADGM. Does this apply? A: No — those free zones are regulated by the DFSA and FSRA respectively, each with their own AML regimes. But the expanded CMA perimeter under Federal Decree-Law No. 33 of 2025 (with transition until 1 January 2027) means firms with UAE-nexus cross-border activity should review their exposure.

Q: What replaced the old AML law everyone cited? A: Federal Decree by Law No. 10 of 2025 replaced Federal Decree by Law No. 20 of 2018, and Cabinet Resolution No. 134 of 2025 (in force 14 December 2025) replaced Cabinet Resolution No. 10 of 2019 as the executive regulations. Update your policy documents and training material accordingly.

Q: What's the single biggest fine risk? A: AED 5,000,000 per violation administratively (Article 17) — and remember violations can be counted per breach, not per firm. Criminal fines reach AED 100,000,000 for legal persons.

Q: Where do we file suspicious transaction reports? A: Exclusively to the UAE FIU via the goAML platform, after completing goAML registration. STRs go to no other body.

9. Disclaimer

This article is provided for general information purposes only and does not constitute legal, regulatory, or compliance advice. Laws, resolutions, notices, and rulebook provisions are amended frequently, and instruments issued under the former SCA may have been superseded. Always verify the current status of each cited instrument with the Capital Market Authority (cma.gov.ae), the UAE Legislation Portal (uaelegislation.gov.ae), the UAE FIU, or qualified UAE legal counsel before acting. Figures and deadlines are accurate as of the date of publication based on the sources cited.