What AML/CFT training does UAE law require?

UAE law requires regulated entities to include staff training in their internal anti-money laundering policies, and makes the compliance officer responsible for planning and documenting it. The obligation is set out in the executive regulations rather than the decree-law itself.

Article 19(1)(d) of Federal Decree-Law No. 10 of 2025 requires financial institutions, DNFBPs and virtual asset service providers to establish internal policies, controls and procedures approved by senior management, and leaves the minimum content of those policies to the executive regulations. Cabinet Resolution No. 134 of 2025 supplies that content in Article 21, which lists six required elements. Element five reads: "Preparation of anti-crime periodic programs and workshops to build the capacities and qualify those assuming the compliance function and other relevant employees."

Article 22 then requires each entity to appoint a compliance officer at management level with "appropriate competence and experience". One of the officer's five listed duties is "Developing, implementing, and documenting ongoing programs and training plans for employees of the establishment regarding all matters related to the Crime and methods of combating it." "The Crime" is defined in the decree-law, whose definitions apply to the resolution, and covers money laundering and its predicate offenses, terrorist financing, and proliferation financing.

As at September 2026, the governing texts are Federal Decree-Law No. 10 of 2025 and its executive regulations, Cabinet Resolution No. 134 of 2025. The UAE Financial Intelligence Unit (UAEFIU) lists both, after the earlier texts, on its Understanding the Law page. The repeals themselves are in Article 41(1) of the decree-law and Article 70 of the resolution.

Article 41(3) of the 2025 decree-law keeps regulations, resolutions and circulars issued under the 2018 law in effect, so far as they do not conflict, until replacements are issued. This matters for training content: some supervisory guidance still cites the 2018 law. For example, the CBUAE's role-based training best practices document names Federal Decree-Law No. 20 of 2018 as its legal basis. Training materials should cite the current law while still following guidance that has not yet been reissued.

The training obligation applies to three groups: financial institutions, DNFBPs, and virtual asset service providers. Within each entity, it covers the compliance function and "other relevant employees", which in practice means anyone whose role touches customers, transactions, screening or reporting.

Article 3 of Cabinet Resolution No. 134 of 2025 defines DNFBPs by activity and, in some cases, by threshold. Dealers in precious metals and stones are covered for cash transactions of AED 55,000 or more, and commercial gaming operators for transactions of AED 11,000 or more. Lawyers, notaries, independent legal professionals and accountants are covered when they prepare or carry out listed transactions for clients, such as buying and selling real estate or managing client funds. A firm that falls in scope only for some activities should still train the staff who carry out those activities.

Supervisory Authorities also hold a gatekeeping role over the people who run the program. Article 49(18) of the resolution requires them to keep an updated list of the compliance officers of supervised entities and to require the supervisor's prior approval before a compliance officer is appointed. The competence of that officer is therefore something a supervisor may test before any training plan is reviewed.

Yes. Unlike data protection, where some free zones have their own laws, federal AML/CFT law applies across the UAE, including the financial free zones. What changes in a free zone is the supervisor and the additional rulebook.

For international readers: the UAE has a federal legal system that applies onshore across the seven emirates, plus many free zones with their own licensing authorities. Two of them, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), are financial free zones with their own civil and commercial laws and their own financial regulators. The Dubai Financial Services Authority (DFSA) states that Federal Anti-Money Laundering Legislation applies directly in the DIFC under Articles 70 and 71 of the DIFC Regulatory Law, and that the DFSA administers it for firms in the center.

A DIFC firm therefore trains to both the federal texts and the DFSA's own AML module, which has a detailed training rule; see DFSA training and competence requirements. Onshore, the supervisor depends on the sector: the CBUAE supervises the banks, insurers and other institutions it licenses, while other federal and local authorities supervise DNFBPs and other sectors.

The CBUAE expects its licensed financial institutions to run a risk-based program in which every employee, from the board to external staff, receives training, and those in higher risk roles receive role-based training. Its expectations are set out in Best Practices for Licensed Financial Institutions on Implementing Role-Based AML/CFT/CPF Training, published in the CBUAE Rulebook.

The document says it does not create new regulation, but that it "sets out the expectations of the CBUAE for LFIs to be able to demonstrate compliance". Its main expectations are:

• A mix of training types: new hire training (including staff moving into new roles), annual enterprise-wide training, group training where relevant, localized training on UAE risks, board and senior management training, and role-based training.
• An annual training needs assessment drawing on the enterprise-wide risk assessment, regulatory and audit findings, and senior management feedback, with its methodology and outcomes documented. See how to conduct a training needs analysis.
• Minimum role groups: the board, owners and senior management; first line staff with heightened exposure; the compliance function; internal audit; and staff who test and tune financial crime systems and models.
• Board training on a need basis or at least annually, with a record of attendance and the material discussed.
• An annual training plan approved by the board, owners or senior management, stating participants, topics, delivery methods, objectives, minimum standards by role, frequency, and how employees will be assessed.
• Records and assessment: attendance for every participant, completion and pass or fail results reported to managers, follow up and escalation of non-completion, and retraining before reassessment when an employee fails.
• Third-party trainers subject to due diligence, with the compliance function vetting content so it reflects UAE requirements and the institution's own policies.
• Annual content review, or sooner after significant regulatory change, and refresher training when policies, risks or systems change.

The document also says assessments should ensure "participants do not receive credit for an AML/CFT/CPF training unless they have mastered the respective AML/CFT/CPF-related concepts". That is a competence standard, not a completion standard; the difference is explained in completion tracking vs competency verification.

Each legal or supervisory expectation can be translated into a measurable learning outcome and a piece of evidence a supervisor can inspect. The table below is an illustrative mapping, not a regulatory template; each entity should adapt it to its own risk assessment and supervisor.

Building this mapping once, and keeping it in a compliance obligations register, means a change in the law updates one row rather than every course. The method is described in how to map training to compliance obligations.

A training failure is a breach of the executive regulations, so it exposes the entity to the administrative penalties in Article 17 of Federal Decree-Law No. 10 of 2025. Those penalties apply to any violation of the decree-law, its executive regulations, or related decisions.

• A warning.
• An administrative fine of not less than AED 10,000 and not more than AED 5,000,000 for each violation, with an escalating fine for the same violation repeated within a year.
• Restricting the powers of, suspending, or requiring the replacement of board members, executives or managers proven responsible.
• Suspending or restricting the activity, prohibiting the violator from the sector for a set period, or revoking the license.

Supervisors may also order periodic reports on remediation and may publish the penalties they impose. Separately, Article 25 of Cabinet Resolution No. 134 of 2025 requires transaction and due diligence records to be kept for at least five years. The CBUAE asks that training records be retained for the duration set by UAE record-keeping requirements and made available for audit and examination; guidance on assembling them is in how to prepare training records for an audit.

Knowledge Foundry models the AML/CFT obligations, the roles they apply to, and the assessment points for each role as a structured framework before any course is written. When a text such as Cabinet Decision No. 10 of 2019 is repealed, the affected concepts and assessments are identified from the framework, so content citing the old law can be found and updated with a record of what changed.