Introduction
The Central Bank of the UAE (CBUAE) maintains strict anti-money laundering (AML) standards that all licensed financial institutions must follow. Understanding these requirements is crucial for banks, money exchange houses, payment providers, and other regulated entities operating in the Emirates.
This guide breaks down CBUAE’s AML framework, reporting obligations, and practical steps to ensure compliance.
—
CBUAE’s AML Regulatory Framework
Primary Legislation
The CBUAE operates under several key legal instruments:
- Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism
- Cabinet Decision No. 10 of 2019 concerning the Implementing Regulation of AML Law
- CBUAE Regulations and circulars issued to licensed financial institutions (LFIs)
Scope of Regulation
CBUAE supervises:
- Banks operating in the UAE
- Money exchange houses
- Finance companies
- Insurance companies and brokers
- Payment service providers
- Virtual asset service providers (VASPs)
—
Core CBUAE AML Requirements
1. Customer Due Diligence (CDD)
Financial institutions must verify customer identity before establishing business relationships:
For Individuals:
- Full name, nationality, date of birth
- Valid Emirates ID or passport
- Proof of address
- Source of funds/wealth
For Legal Entities:
- Trade license and registration documents
- Articles of association
- Beneficial ownership information (UBO)
- Authorized signatories
2. Enhanced Due Diligence (EDD)
EDD is required for:
- High-risk customers (PEPs, high-net-worth individuals)
- High-risk jurisdictions (countries under FATF increased monitoring)
- Complex ownership structures
- Unusual transaction patterns
3. Ongoing Monitoring
CBUAE mandates continuous monitoring of:
- Transaction patterns and behaviors
- Customer risk profiles
- Sanctions list updates
- Adverse media
4. Record Keeping
Institutions must maintain:
- CDD records for 5 years after relationship ends
- Transaction records for 5 years after transaction completion
- STR (Suspicious Transaction Report) records
—
The goAML Platform: UAE’s Reporting System
What is goAML?
goAML is the UAE’s unified electronic system for reporting suspicious transactions and activities. Developed by the UN Office on Drugs and Crime (UNODC), it’s mandatory for all reporting entities.
Registration Requirements
All LFIs must:
- Register on the goAML portal
- Designate a Compliance Officer
- Obtain digital certificates for secure reporting
- Complete mandatory training
Types of Reports
| Report Type | Trigger | Deadline |
|---|---|---|
| STR (Suspicious Transaction Report) | Suspicious activity detected | Immediately |
| CTR (Cash Transaction Report) | Cash transactions ≥ AED 55,000 | Within specified timeframe |
| Fund Freeze Report | Assets linked to sanctions | Immediately |
| Partial Name Match Report | Potential sanctions match | Per CBUAE guidelines |
goAML Best Practices
✅ Automate where possible — Manual reporting is error-prone
✅ Train staff regularly — Ensure team understands red flags
✅ Document decisions — Maintain rationale for not filing STRs
✅ Monitor deadlines — Late reporting can trigger penalties
—
CBUAE Compliance Program Requirements
Mandatory Components
1. Risk Assessment
- Enterprise-wide money laundering risk assessment
- Customer risk categorization
- Product/service risk evaluation
- Geographic risk analysis
2. Policies and Procedures
- Written AML policies
- Customer acceptance criteria
- Escalation procedures
- Record keeping protocols
3. Governance Structure
- Board-level oversight
- Dedicated Compliance Officer
- Independent audit function
- Clear reporting lines
4. Training Program
- Initial training for all staff
- Annual refresher training
- Specialized training for high-risk areas
- Training records maintenance
—
CBUAE Enforcement and Penalties
Administrative Penalties
CBUAE can impose fines for:
- Failure to register on goAML
- Late or incomplete STR filing
- Inadequate CDD measures
- Poor record keeping
- Insufficient training programs
Fine ranges:
- Minor violations: AED 10,000 – 50,000
- Moderate violations: AED 50,000 – 200,000
- Serious violations: AED 200,000 – 1,000,000+
Criminal Liability
In severe cases, individuals may face:
- Imprisonment
- Personal fines
- Professional disqualification
Recent Enforcement Trends
CBUAE has intensified enforcement, with particular focus on:
- Money exchange houses
- Virtual asset service providers
- Cross-border payment providers
—
Technology Solutions for CBUAE Compliance
Key Capabilities Required
1. Sanctions Screening
- Real-time screening against UN, OFAC, EU, UK, and UAE lists
- Fuzzy matching for name variations
- Arabic language support
2. Transaction Monitoring
- Rule-based and AI-powered detection
- Scenario modeling
- Alert management
3. Case Management
- Investigation workflows
- Audit trails
- Regulatory reporting integration
4. goAML Integration
- Direct API connectivity
- Automated report generation
- Status tracking
—
Tracefort for CBUAE Compliance
Tracefort’s platform is designed to meet CBUAE requirements:
Features
- ✅ UAE sanctions lists — Including local UAE-specific databases
- ✅ Arabic name matching — Advanced transliteration algorithms
- ✅ goAML-ready — Structured data for seamless reporting
- ✅ Real-time monitoring — Instant alerts on suspicious activity
- ✅ Audit trails — Complete documentation for inspections
Benefits
- Reduce compliance costs by up to 60%
- Cut false positives by 70%
- Deploy in days, not months
- 24/7 customer support
—
Compliance Checklist for CBUAE
Monthly Tasks
- [ ] Review sanctions list updates
- [ ] Analyze transaction monitoring alerts
- [ ] Update customer risk ratings
- [ ] Review pending STRs
Quarterly Tasks
- [ ] Risk assessment review
- [ ] Policy and procedure updates
- [ ] Training effectiveness evaluation
- [ ] Management reporting
Annual Tasks
- [ ] Enterprise-wide risk assessment
- [ ] Independent AML audit
- [ ] Board compliance review
- [ ] Technology solution evaluation
—
Frequently Asked Questions
How do I register for goAML?
Visit the UAE Financial Intelligence Unit (FIU) website and complete the online registration. You’ll need your trade license and authorized signatory details.
What triggers an STR?
Unusual transactions that don’t match customer profile, complex structures without economic purpose, transactions just below reporting thresholds, or any activity you suspect may involve illicit funds.
Can I outsource AML compliance?
You can outsource technology and some processes, but ultimate responsibility remains with the institution. The Compliance Officer must be an employee.
How often does CBUAE update sanctions lists?
Updates can occur daily. Your screening solution should check in real-time or at least daily.
What’s the difference between CBUAE and DFSA requirements?
CBUAE regulates mainland UAE financial institutions. DFSA regulates DIFC entities. Requirements are similar but may differ in specific implementation details.
—
Conclusion
CBUAE’s AML framework is comprehensive and strictly enforced. Financial institutions must invest in robust compliance programs, effective technology, and ongoing training to meet obligations and avoid penalties.
The cost of compliance is far less than the cost of non-compliance—and with modern AI-powered solutions like Tracefort, achieving compliance is more affordable and efficient than ever.
Need help with CBUAE compliance? Contact our team for a consultation.
—
Last updated: April 2026
Categories: UAE Regulations, CBUAE, Compliance
Tags: CBUAE, goAML, AML compliance, UAE banking, financial regulation
