AML and CFT Meaning — What the Two Halves of the UAE Regime Actually Do

Anyone who has renewed a UAE trade licence in the last two years has seen the phrase AML/CFT on a form, in a supervisor’s circular, or in the training slide deck a compliance consultant sent over. The AML half gets explained often enough. The CFT half almost never does, and it quietly gets treated as a subset of the same thing — which is where the trouble starts, because the two halves detect completely different behaviour and a programme tuned only for one will miss the other entirely.

AML and CFT meaning, in plain terms

AML stands for anti-money laundering and CFT for countering the financing of terrorism. AML targets money that came from a crime and is being made to look clean. CFT targets money — often lawfully earned — heading toward terrorism. UAE law regulates both under Federal Decree by Law No. 10 of 2025.

That is the definition. The rest of this page is about why the distinction changes what you actually have to build, and where UAE law puts the specific deadlines.

The one difference that changes everything

Think of the two regimes as following money in opposite directions.

Money laundering runs backwards. The funds already exist, they came from something illegal, and the whole exercise is disguising that origin. The UAE Government portal sets out the offence in Article 2 terms: a person commits money laundering where they know, or should reasonably suspect, that money comes from illegal activities and they intentionally convert or transfer it to hide its source, conceal details such as its origin or ownership, use or keep it, or help someone involved in the crime avoid detection or punishment. Every one of those verbs is about the past.

Terrorist financing runs forwards. The money may be perfectly clean at the point you see it. Somebody’s salary, a trading profit, a genuine-looking charitable donation. What makes it criminal is the destination. Nothing about the funds themselves is anomalous, and no amount of source-of-funds questioning will surface it, because the honest answer to “where did this come from” is boring and true.

This produces a detection problem that most compliance programmes are not designed for. Anti-money-laundering controls are built around size and anomaly — the transaction that does not fit the customer profile, the sudden wealth, the cash that arrives split into instalments to sit under a reporting threshold. Terrorist financing frequently involves sums small enough that none of those rules fire. A monitoring engine tuned entirely to large-value laundering will run clean for years while sitting on exactly the pattern CFT exists to catch.

The UAE AML/CFT framework as it stands in August 2026

The UAE rewrote its AML/CFT statute in 2025. If your policy document, your consultant’s deck or a template you downloaded still cites the 2018 framework, it is citing law that has been replaced. Worth knowing: not every government page has caught up either, and you will still find official pages citing the older instruments.

Everything in the table below was checked against the cited primary source on 3 August 2026.

What the 2025 law penalises, and who imposes it

This is the section most AML pages get wrong, and the error is always the same shape: a criminal fine imposed by a court gets reprinted as though a supervisor could hand it to you at an inspection. The Decree by Law separates the two completely, and the difference is roughly twentyfold.

Administrative penalties sit in Chapter Seven. Article 16 gives the Supervisory Authority — the Central Bank for financial institutions, the Ministry of Economy and Tourism for the DNFBP categories — the power to run risk assessments and desk or field inspections. Article 17 sets out what it may then do. Criminal penalties sit in Chapter Twelve and belong to the Public Prosecution and the courts.

Every figure below is quoted from the official English text of Federal Decree by Law No. 10 of 2025 as published in the Central Bank of the UAE Rulebook, read on 4 August 2026.

Article 33 is the one to sit with, because it is the CFT half of the regime carrying a criminal charge rather than an administrative one. Ignoring a freezing instruction is not a filing failure that attracts a fine from your supervisor. It is an offence, and Article 37(4) goes further: where the Article 33 crime jeopardises the security or interests of the State, it is treated as an offence affecting the internal and external security of the State.

Two structural points sit underneath the table. Article 25 says the penalties apply “without prejudice to any more severe penalty provided for in any other law”, so nothing here is a ceiling on total exposure. And Article 39 leaves the detailed violations schedule to a Cabinet resolution, which is why the specific fine attached to a specific failure — a missing goAML registration, an absent risk assessment — is set administratively rather than in the Decree by Law itself. If you need the amount for one named violation, ask your supervisor for the schedule it applies. We are not going to guess it for you.

Targeted financial sanctions are where CFT actually bites

If you strip UAE CFT obligations down to the one thing a supervisor will test hardest, it is sanctions screening — and specifically what happens in the hours after a name matches.

The framework sits in Cabinet Decision No. 74 of 2020, and the Executive Office for Control and Non-Proliferation administers it. Two lists are in play. The UN Consolidated List comes from the UN Security Council. The UAE Local Terrorist List is domestic, and it is genuinely active rather than a historical artefact — the Executive Office has publicly announced designations, including 16 individuals and five entities over connections to Hezbollah.

The duties that follow a match are unusually specific for UAE compliance, which normally speaks in principles rather than clocks.

Freeze without delay, meaning within 24 hours. The Executive Office states that screening must be conducted immediately when the lists are updated, so that freezing measures can be implemented without delay, within 24 hours. That is not 24 working hours after somebody gets round to running the batch. It is why an annual or quarterly manual screening cycle structurally cannot meet the obligation.

File the name-match report within five business days. A confirmed or partial name match report goes through goAML within five business days from taking the measure. Partial matches count. The temptation to quietly dismiss a near-match and move on is exactly what the reporting duty removes.

Expect the freeze to last. Freezes have no time limit and remain valid until the designation is delisted or the Executive Office cancels the measure. You cannot release funds because a client is unhappy, or because a period has elapsed.

Screening tooling and process design matter more here than policy wording. Our comparison of PEP screening tools for UAE firms and the OFAC screening checklist for DNFBPs both go into what a workable cycle looks like, including the awkward question of who checks the alerts when the compliance officer is on leave.

A worked example where AML sees nothing and CFT sees plenty

Numbers make the divergence obvious. The following is an illustration constructed to show the mechanics, not a real client matter.

A Sharjah general trading company opened its account with an onboarding profile stating expected turnover of AED 40,000 a month. Over a 90-day review period, the expected activity is therefore AED 120,000. What the account actually shows is:

• 46 outbound transfers averaging AED 3,150 each, totalling AED 144,900, split across individual beneficiaries in four countries
• One payment of AED 18,000 to an organisation described as a charitable association, which does not appear on any register the firm can find

Total outflow is AED 162,900 against an expected AED 120,000 — about 36% above the stated profile.

Now run the two lenses over it.

The AML lens finds very little to grip. There is no cash. No single payment is large. Nothing was broken into instalments just under a threshold, because no individual transfer is anywhere near a threshold to begin with. The 36% variance against profile is the kind of drift a growing trading company produces legitimately every quarter. A monitoring rule set built around large-value laundering typologies would very plausibly produce no alert at all.

The CFT lens finds four problems at once. Forty-six transfers to individuals is not what a general trading company’s payment pattern looks like — suppliers are companies and there are rarely 46 of them. The beneficiaries have no evident commercial relationship to the licensed activity. The geographic spread has no stated business reason behind it. And a payment to an unregistered non-profit is the single most conventional terrorist-financing indicator there is, because non-profit channels are the classic route for moving small sums to a destination while giving the payment an innocent explanation.

The obligations that follow are concrete. Screen all 46 beneficiary names, the charitable association and its known officers against the UN Consolidated List and the UAE Local Terrorist List. If any name is a confirmed match, freeze within 24 hours and file the name-match report through goAML within five business days. Independently of any match, escalate the file to enhanced due diligence: establish the commercial rationale for individual beneficiaries, evidence the charitable payment, and get senior approval on record before the relationship continues. The tiering logic behind that decision is covered in our guide to SDD, CDD and EDD.

Note what is not required. Nobody has to close the account or refuse the payments. The duty is to understand the activity, document what you concluded and why, and report it if you cannot explain it. Plenty of files that open exactly like this one close normally, with a perfectly ordinary explanation on the record. What is not acceptable is not looking.

Where the two control sets diverge

Most of an AML/CFT programme is shared plumbing. Customer identification, beneficial ownership, record-keeping and reporting serve both halves. But four controls behave differently depending on which risk you are chasing.

Transaction monitoring thresholds. AML rules reward size and deviation. CFT rules need to catch fragmentation, velocity and destination concentration — patterns that are invisible to a value threshold. If every rule in your monitoring set has an amount in it, you have no CFT monitoring.

Source of funds versus destination of funds. AML asks where money came from and will accept a documented, lawful origin as reassurance. In CFT a lawful origin is not reassurance at all, because the funds usually are lawful. The equivalent CFT question is who ultimately receives this and what for.

Screening frequency. For AML purposes, screening at onboarding plus periodic review is defensible. For CFT it is not, because the lists change and the 24-hour freezing obligation attaches to the moment you could have identified the match. Screening has to run against list updates.

Sector risk weighting. Precious metals, real estate and complex corporate structures carry heavy AML risk. Money or value transfer services, charitable and non-profit flows, and cross-border remittance corridors carry heavy CFT risk. A firm can be low-risk on one axis and high on the other, and a single blended risk rating hides that.

What a working AML/CFT programme looks like

Strip out the acronyms and the obligations resolve into a short list of things that either happen or do not.

You register on goAML and keep the registration current. It is the Financial Intelligence Unit’s platform, built by the UN Office on Drugs and Crime, and you cannot file anything without it. The mechanics are in our goAML registration and login guide, and the annual renewal catches people out more often than the initial signup does.

You appoint a compliance officer with the seniority to stop a deal. The role carries personal accountability at inspection, and it is not a title you hand to whoever has capacity. What the role actually involves is set out in our MLRO job description and appointment letter guidance.

You write an enterprise-wide risk assessment that describes your business rather than a generic one, and it has to address terrorist financing as its own risk category rather than a footnote under laundering.

You run customer due diligence proportionate to risk, and you find the real human owner behind corporate customers. Beneficial ownership is a standalone filing duty as well — see UBO declaration and renewal.

You screen continuously and you keep the evidence of having screened, including the negative results.

You retain records and, more importantly, retain the reasoning. Inspectors are not looking for a passport photocopy. They are looking for what you concluded when you saw it.

Sector-specific builds differ in emphasis. We have separate walkthroughs for real estate agencies, gold and precious-metals dealers, auditors and accounting firms, corporate service providers and law firms.

The mistakes that show up at inspection

Almost nobody we review is knowingly moving criminal or terrorist money. The failures are administrative, and they repeat.

The CFT section is one paragraph. It says the firm screens against sanctions lists, and nothing else in the document is designed for terrorist-financing risk. An inspector reading it can tell in thirty seconds.

Screening was run at onboarding and never again. This is the single most common finding, and it is the one that directly conflicts with a 24-hour freezing obligation attached to list updates.

Partial matches are dismissed without a record. Somebody decided the name was probably a different person and moved on. There is nothing in the file showing the decision, the basis for it, or that anyone senior saw it.

The compliance officer cannot explain the firm’s own risk assessment. Inspectors do not read the manual and leave. They interview staff and pull files at random, which our Ministry of Economy inspection preparation playbook covers in detail.

Everything cites superseded law. Policies referencing only the 2018 framework signal that the document has not been touched since it was bought.

Which UAE authority actually supervises you

Firms often build an AML/CFT programme without knowing who will inspect it, which means they read the wrong circulars. The Decree by Law does not name one national regulator. Article 16 gives supervision to “the Supervisory Authority” for each sector, and in the UAE that resolves to several bodies with different guidance libraries.

Financial institutions — banks, exchange houses, finance companies, insurers and registered hawala providers — sit under the Central Bank of the UAE, whose Rulebook publishes sector guidance on transaction monitoring, sanctions screening, correspondent banking and politically exposed persons. The four DNFBP categories sit under the Ministry of Economy and Tourism. Firms licensed in the two common-law financial free zones answer to their own regulators instead: the Dubai Financial Services Authority in the DIFC, and the Financial Services Regulatory Authority in Abu Dhabi Global Market.

That split matters for a very ordinary reason. A Dubai property brokerage, a Sharjah gold trader and an Ajman corporate service provider all report suspicious transactions through the same goAML platform to the same Financial Intelligence Unit — but they are inspected by the Ministry of Economy and Tourism, against its guidance, on its cycle. A DIFC advisory firm doing similar work is inspected by the DFSA against a different rulebook. Neither the UAE Central Bank’s guidance nor the DFSA’s rulebook is the right primary reference for a mainland Dubai or Fujairah DNFBP, and using the wrong one is a common reason a manual reads impressively and still fails inspection.

The Executive Office for Control and Non-Proliferation sits across all of them on the CFT side. Its targeted financial sanctions instructions bind every regulated business in the UAE regardless of which authority licenses it, which is why the 24-hour freezing duty is the one obligation that reads identically in Abu Dhabi, Dubai and every northern emirate.

Where to start if this is new to you

Establish first whether your licensed activity puts you in a DNFBP category or under a financial-services regulator, because that determines who supervises you and which circulars bind you. Then check whether your goAML registration exists and is current. Then read your own risk assessment and ask whether a stranger could tell which company it describes.

Velmont Crest works as an accounting and compliance advisory practice supporting UAE businesses through exactly this work — AML compliance advisory, enterprise-wide risk assessments, policy and procedure drafting, screening process design, goAML support and inspection readiness. Our broader guides cover AML compliance in the UAE end to end, the plain-English meaning of AML on its own, and what an AML consulting engagement actually includes.

Accountability for the programme stays with the licensed business and its named officer, and that cannot be contracted out. What outside support does is build the thing properly, fit it to how the business really operates, and keep it current as the lists and the law move.

If you want your position reviewed, get a quote and tell us your licensed activity and which authority supervises you. That is usually enough to work out where you stand and what is missing.