UAE Federal Decree-Law 10 of 2025: Zero-Tolerance Reset

Executive Summary

The "wait and see" era for regulatory compliance in the United Arab Emirates has officially ended. On October 14, 2025, the legal and financial landscape of the region underwent a seismic shift with the enforcement of Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism, and Countering Proliferation Financing. This legislation is not a routine bureaucratic update; it represents a fundamental "hard reset" of the UAE’s risk environment, designed to cement the nation's status as a transparent, Tier-1 global financial hub following its strategic removal from the Financial Action Task Force (FATF) Grey List and the European Union’s high-risk country list.

This report provides an exhaustive, forensic analysis of the new legal architecture. It dissects the transition from the 2018 framework to the 2025 "Zero Tolerance" regime, examining the doubled corporate fines, the introduction of independent corporate criminal liability, the "forever" clause removing statutes of limitation, and the aggressive integration of tax evasion and crypto assets into the AML dragnet.

We analyze the profound implications for boards of directors, who now face unshielded liability, and for Designated Non-Financial Businesses and Professions (DNFBPs) such as real estate developers and corporate service providers, who are now on the front lines of enforcement. The analysis confirms that the UAE has moved from a period of regulatory implementation to an era of aggressive enforcement, backed by expanded powers for the Financial Intelligence Unit (FIU) and the courts.

1. The Geopolitical and Strategic Context: Why Now?

To understand the severity of Decree-Law No. 10 of 2025, one must first understand the geopolitical trajectory of the UAE. For decades, the UAE positioned itself as a commercial hub characterized by ease of doing business and low barriers to entry. However, as the nation matures into a global financial center rivaling London, New York, and Singapore, the priority has shifted from volume of capital to integrity of capital.

1.1 The Post-FATF Grey List Era

The issuance of the new AML law follows the UAE's successful exit from the FATF Grey List. This removal was not the end of the reform process but the beginning of a consolidation phase. The 2018 framework (Federal Decree-Law No. 20 of 2018) served its purpose in establishing the baseline, but the 2025 law is designed to demonstrate "effectiveness"—the key metric by which FATF evaluates jurisdictions.

The UAE leadership recognizes that to attract institutional capital—pension funds, sovereign wealth, and Fortune 500 treasuries—the jurisdiction must be viewed as hostile to illicit finance. Consequently, the 2025 law aligns the UAE with international best practices found in the UK and EU, specifically regarding the definitions of "knowledge" in financial crime and the scope of corporate liability.

1.2 A Unified National Strategy

The law establishes the Supreme Committee for the Supervision of the National Strategy for Anti-Money Laundering, signaling a coordinated, top-down approach to enforcement. This elevates AML from a regulatory operational task to a matter of national security and economic strategy. The creation of this committee ensures that enforcement is not siloed within the Central Bank but is synchronized across customs, state security, the Ministry of Justice, and international partners.

"The creation of a Supreme Committee also signals a more coordinated national approach, which will likely lead to increased scrutiny and enforcement. Proactive compliance is no longer optional: it's a strategic imperative."

2. The New Corporate Reality: Liability, Penalties, and the Boardroom

The most immediate and tangible impact of Decree-Law No. 10 of 2025 is the dramatic escalation of financial and criminal risk for legal entities. The legislation fundamentally alters the legal theory regarding corporate culpability, moving away from viewing financial crime solely as the act of a rogue employee and placing the onus squarely on the corporate structure itself.

2.1 Doubling Down: The New Fine Structure

Under the previous 2018 framework, the maximum fine for a legal entity was capped at AED 50 million. While substantial, this figure was often viewed by large multinational corporations as a manageable risk. The new law doubles this ceiling to AED 100 million.

This increase aligns the UAE with major global jurisdictions where punitive damages are designed to be existential threats to non-compliant firms. Critically, the law also introduces a provision that allows for fines equivalent to the value of the criminal property if that value exceeds the AED 100 million cap. This "value-based" sentencing means that if a bank or exchange facilitates a billion-dirham laundering scheme, the fine can scale to match the illicit flow, removing any theoretical cap on liability.

2.2 The Shift to Independent Corporate Criminal Liability

Perhaps the most critical legal shift is the independence of corporate prosecution. Previously, holding a company criminally liable often required the prior conviction of an individual manager or employee. This created a legal loophole: if the individual perpetrator fled the country, died, or could not be identified, the company might escape significant penalty.

The 2025 Doctrine: Legal entities can now be prosecuted independently. If a crime is committed in the company's name or for its benefit, the entity is liable regardless of the status of the individual perpetrator. This applies if the crime results from a lack of supervision or control by management.

This structural change means that prosecutors no longer need to find the "smoking gun" email from a specific manager. They only need to prove that the company's systems failed to prevent the crime or that the company benefited from the illicit activity.

2.3 Dissolution and Closure: The Ultimate Sanction

Beyond monetary fines, the law empowers the courts to order the dissolution of the legal person and the closure of its premises upon conviction. This is the corporate death penalty. For sectors like real estate or money exchange services, where the license is the primary asset, the threat of dissolution forces AML compliance to the top of the risk register.

2.4 Managerial Liability: The "Objective Knowledge" Test

While corporate liability has expanded, individual liability remains severe. Managers and representatives can face imprisonment of up to 10 years. Crucially, the evidentiary threshold for establishing guilt has been lowered.

Under the 2018 law, prosecutors often needed to prove "actual knowledge" that funds were illicit. The 2025 law introduces a "constructive knowledge" standard. Liability can be established if a "reasonable person" should have known based on objective factual circumstances.

Implication: A manager cannot turn a blind eye to red flags. If a transaction involves high-risk jurisdictions, unexplained wealth, or complex structuring that has no economic rationale, a court can infer that the manager knew of the illicit origin, simply because any competent professional would have known.

3. Redefining the "Predicate Offense": Tax, Trade, and Proliferation

To commit money laundering, one must handle the proceeds of a crime. The "predicate offense" is the underlying crime that generated the dirty money. The 2025 law radically expands what constitutes a predicate offense, effectively bringing tax optimization and trade compliance into the AML dragnet.

3.1 Tax Evasion is Now Money Laundering

The law explicitly lists "direct and indirect tax evasion" as a predicate offense. This is a massive shift for a jurisdiction that, until recently, had very few direct taxes.

The Nexus of Tax and Crime: With the introduction of Corporate Tax and VAT in the UAE, the definition of "criminal property" has expanded.

• Domestic Evasion: Funds saved by evading UAE Corporate Tax or VAT are now proceeds of crime. Using these funds in the banking system constitutes money laundering.
• International Evasion (Dual Criminality): The law applies to evasion committed outside the State, provided the act is punishable in both countries. If a foreign national evades taxes in their home country and moves those funds to the UAE, UAE banks and corporate service providers handling those funds are potentially facilitating money laundering.

3.2 Proliferation Financing (PF): A Standalone Offense

For the first time, "Countering Proliferation Financing" (financing weapons of mass destruction) is explicitly included in the law’s title and as a standalone offense, rather than being tucked under "illegal organizations".

The "Dual-Use" Trap: Proliferation financing is distinct from terrorism financing because it often involves state actors and "dual-use goods"—items like carbon fiber, specific aluminum alloys, or high-precision electronics that have legitimate civilian uses but are also critical for missile or nuclear programs.

• Trade Finance Impact: Banks and logistics companies must now implement screening not just for names (Sanctions) but for goods (Export Controls). They must ensure they are not financing or shipping items prohibited by UN Security Council Resolutions regarding proliferation.
• Strict Liability: The law imposes strict penalties for providing funds or financial services for the benefit of any person or organization designated on UN proliferation lists.

4. The Digital Asset Crackdown: Regulating the Virtual Frontier

The 2025 law ends the "Wild West" era for cryptocurrency in the region. It integrates Virtual Asset Service Providers (VASPs) fully into the AML framework, with specific provisions that mirror—and in some cases exceed—banking sector compliance.

4.1 The Travel Rule is Non-Negotiable

The UAE has strictly codified the FATF "Travel Rule" (Recommendation 16) into federal law. For any transfer involving virtual assets, the originator and beneficiary information must "travel" with the transaction, ensuring traceability across the blockchain ecosystem.

The AED 3,500 Threshold: The law sets a specific monetary threshold of AED 3,500 (approx. USD 950). For any transfer equal to or exceeding this amount, VASPs are mandated to capture and transmit specific data points.

Technical Compliance: This requirement effectively forces all UAE-licensed exchanges to implement interoperable messaging protocols (like IVMS 101) to share this data with counterparty exchanges. "Unhosted wallets" (private wallets not managed by an exchange) present a significant compliance challenge, often triggering enhanced due diligence (EDD) requirements.

4.2 The Death of Anonymity

Article 30 of the new law effectively prohibits "anonymity-enhanced virtual assets" (privacy coins like Monero or Zcash) that prevent the tracing of transactions. The regulator's stance is binary: if the asset's protocol prevents the identification of the beneficial owner, it cannot be traded on a UAE-licensed platform.

4.3 Unlicensed Operations as a Criminal Offense

Operating a VASP without a license is no longer just a regulatory violation; it is a specific criminal offense punishable by imprisonment and fines up to AED 10 million. This provision targets "shadow exchanges" and P2P operators who facilitate cash-to-crypto conversions outside the regulated banking system.

5. Enforcement Powers: The FIU Unleashed

The "news" isn't just about the rules, but the muscle behind them. The Financial Intelligence Unit (FIU) and public prosecutors have been granted sweeping new powers to investigate, freeze, and seize assets, removing procedural hurdles that previously slowed down enforcement.

5.1 The 30-Day Deep Freeze

Previously, authorities could freeze suspicious funds for a relatively short period (often 7 days) while seeking a court order. This tight timeline often allowed sophisticated launderers to move funds before a full case could be built.

The new law grants the FIU the power to freeze assets for 30 days without a court order.

Operational Impact:

• Investigation Window: This extension gives the FIU significantly more time to trace complex cross-border flows, request information from foreign counterparts, and analyze blockchain data without "tipping off" the suspect.
• Business Disruption: For a legitimate business caught in a "false positive" investigation (e.g., a trade company with a high volume of transactions with high-risk jurisdictions), a 30-day operational freeze on accounts can be catastrophic. This heightens the need for proactive, clean documentation to resolve inquiries quickly.

5.2 The "Forever" Clause: No Statute of Limitations

In a move that signals absolute zero tolerance, the new law removes the statute of limitations for money laundering and terrorism financing offenses.

Historical Context: Under the UAE Civil Code (Article 1036) and Commercial Code, limitation periods typically ranged from 3 to 10 years depending on the dispute type. The 2025 AML Law overrides this for financial crime.

Implication: A crime committed in 2026 can be prosecuted in 2046. There is no "safe harbor" of time. This requires businesses to fundamentally rethink their data retention policies. Maintaining records for merely 5 years (the standard minimum) may be insufficient to defend against a prosecution initiated 15 years later.

5.3 International Cooperation and Asset Recovery

The law modernizes the UAE's approach to cross-border enforcement. Crucially, it empowers UAE courts to implement foreign orders for provisional measures (freezing) or confiscation without the need to carry out a parallel local investigation.

If a UK court orders the freezing of assets belonging to a suspect, the UAE courts can now enforce that order directly. This streamlines the asset recovery process and removes the UAE as a potential "hiding place" for global illicit assets.

5.4 Protection for Undercover Operations

In a nod to the increasing sophistication of financial crime investigations, the law provides explicit legal protection for law enforcement agents conducting "Undercover Operations" or "Controlled Deliveries".

Controlled Delivery: This technique involves allowing a shipment of illicit goods or funds to pass through the territory under supervision to identify the ultimate beneficiaries. Legal Immunity: Article 28 ensures that officers involved in these operations are not criminally liable for handling illicit funds or goods, provided they do not incite the crime or exceed their powers. This encourages more aggressive, intelligence-led policing strategies.

6. Sector-Specific Compliance Implications

The impact of Decree-Law No. 10 is not uniform; it varies significantly by sector. Below is a breakdown of the specific pressure points for key industries.

6.1 Banking and Financial Institutions

• Pressure Point: Proliferation Financing. Banks must upgrade their trade finance screening systems to detect dual-use goods, not just sanctioned entities.
• Pressure Point: Tax Evasion. Wealth management divisions must scrutinize the source of wealth for clients from high-tax jurisdictions to ensure they are not facilitating tax crimes.

6.2 Real Estate (DNFBPs)

• Pressure Point: Cash Thresholds. The sector remains high-risk. Developers and brokers must rigorously apply CDD (Customer Due Diligence) and report transactions that appear structured to avoid reporting thresholds.
• Pressure Point: Beneficial Ownership. Real estate is a favored vehicle for concealing ownership. Agents must look past the "shell company" buyer to identify the ultimate natural person.

6.3 Corporate Service Providers (CSPs) and Lawyers

• Pressure Point: False Disclosures. Providing false or misleading beneficial ownership information is now a specific criminal offense. CSPs can no longer rely on client self-declarations; they must independently verify ownership structures.
• Pressure Point: Administrative Fines. The regulator (Ministry of Justice/Economy) has the power to suspend licenses and remove management for compliance failures.

6.4 Virtual Asset Service Providers (VASPs)

• Pressure Point: Travel Rule Implementation. The technological burden of complying with the AED 3,500 threshold is immense. VASPs must integrate with "Travel Rule Protocol" providers immediately.
• Pressure Point: Legacy Tokens. Exchanges must audit their listed assets to ensure none fall under the "anonymity-enhanced" ban.

7. Strategic Recommendations: From Compliance to Culture

The transition from the 2018 law to Decree-Law No. 10 of 2025 is a transition from "tick-box compliance" to "outcome-based effectiveness." For business leaders, this requires a shift in mindset.

7.1 Immediate Action Items

1. Re-assess the "Predicate" Risk: Conduct a gap analysis of your AML policy. Does it explicitly cover "Tax Evasion" and "Proliferation Financing"? If not, your framework is outdated.
2. Audit Third-Party Payments: With the lower "knowledge" threshold, scrutiny of payments from third parties unrelated to a contract is vital. This is a classic red flag for money laundering that can now lead to corporate liability.
3. Prepare for the Freeze: Treasury departments should have contingency plans for potential asset freezes. Diversifying banking relationships and maintaining transparent, auditable records of all inbound flows is essential to surviving a 30-day FIU freeze.
4. Digitize Compliance: For crypto and fintech firms, manual compliance is impossible. Automated transaction monitoring and Travel Rule solutions are no longer "nice to have"—they are the license to operate.

7.2 The Cultural Imperative

The most significant takeaway from the new law is the emphasis on accountability. The "Supreme Committee," the removal of limitation periods, and the independence of corporate liability all point to one conclusion: the UAE is building a system where financial crime has nowhere to hide.