Regulatory Compliance in the UAE: Banking Regulation, AML/CFT & Digital Identity

UAE banks must comply with Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025. Core requirements include: enterprise-wide ML/TF risk assessments, risk-based CDD and EDD including beneficial ownership verification, ongoing transaction monitoring and sanctions screening, and timely Suspicious Transaction Reports to the FIU. Maximum fines increased to AED 1 Billion under CB Law 2025 and AED 100 Million for AML violations.

CBUAE Notice 2025/3057 requires the complete phase-out of SMS and email one-time passwords (OTPs) by 31 March 2026. The mandate was structured in two enforcement phases: from July 2025, banks became fully liable to refund any 3DS fraud involving SMS OTP; from 31 March 2026, SMS and email OTPs must be fully eliminated with administrative penalties of up to AED 250,000 for significant violations. There are no announced extensions or grace periods. A limited exception exists for customers who refuse mobile apps, provided the bank obtains a written request and fraud liability is explicitly transferred to the customer.

Non-compliance operates at two levels. First, since July 2025, banks are fully liable to refund 100% of any 3DS fraud occurring while SMS OTP is still in use. Second, from 31 March 2026, administrative penalties of up to AED 250,000 (~68,000 USD) apply for significant violations. The CBUAE also conducts formal reviews every six months. Beyond direct fines, non-compliance can result in elevation of the institution’s risk profile in CBUAE dashboards, impact on operating licence, and reputational damage in a market where digital fraud complaints grew 73% in 2025.

CBUAE Notice 2025/3057 opens the door to more advanced authentication models including: biometric authentication with liveness detection, passkeys and FIDO2 standards, and adaptive risk-based authentication frameworks. Real-time fraud prevention including deepfake detection and video injection attack prevention are also part of the modern authentication stack expected by the CBUAE. The regulation explicitly requires phishing-resistant methods that cannot be intercepted like SMS OTPs.

The CBUAE has been unequivocal: the 31 March 2026 deadline is firm, with no extensions and no exceptions publicly announced. The regulator demonstrated its willingness to act in March 2025, when it imposed AED 2,621,000 in sanctions on five banks and two insurers for CRS/FATCA violations. The liability shift for 3DS fraud has been in effect since July 2025, meaning non-compliant banks are already absorbing direct financial losses.

From July 2025, banks became fully responsible for reimbursing any 3D Secure fraud that occurs while they are still using SMS OTP authentication. This converts every fraudulent transaction into a direct financial loss for the institution, regardless of whether the customer acted with negligence. The financial exposure from non-compliance began in July 2025, months before the full OTP ban of 31 March 2026.

Federal Decree-Law No. (10) of 2025 defines money-laundering, terrorism-financing and financing of illegal organisations. It specifies duties for Financial Institutions and DNFBPs, sets powers of competent authorities including the FIU and Central Bank, and requires risk-based CDD/EDD, beneficial ownership identification, wire transfer information, record-keeping for at least five years, and group-wide AML programmes.

Cabinet Resolution No. (134) of 2025 is the Executive Regulations of Federal Decree-Law No. (10) of 2025. It operationalises the Decree-Law by spelling out risk-based CDD and EDD requirements, procedures to identify and verify Beneficial Owners and treat PEPs, information that must accompany wire transfers in line with FATF Recommendation 16, record-keeping obligations for at least five years, and group-wide AML programmes covering branches and subsidiaries abroad.

Federal Decree-Law No. (30) of 2024 established the mandatory National KYC Digital Platform in the UAE. Financial service providers must be able to prove that the person claiming to be a customer is, in reality, that person, using biometrics with liveness checks, advanced injection attack protection, and verified data from official sources. Identity is defined not just by documents but also by device, IP and behavioural signatures.

The UAE has a multi-regulator model. CBUAE is the primary onshore regulator for banks, finance companies, exchange houses and payment institutions. SCA regulates securities markets and certain virtual-asset activities. DFSA supervises entities in DIFC. FSRA supervises entities in ADGM. VARA regulates virtual asset activities in Dubai (excluding DIFC). All translate Federal Decree-Law 10/2025 and Cabinet Resolution 134/2025 into sector-specific requirements.

Under Cabinet Resolution No. (134) of 2025, financial institutions must maintain records for at least five years after the end of a relationship or transaction. This applies to CDD/EDD documentation, transaction records, and Suspicious Transaction Reports submitted to the FIU.

Trade-Based Money Laundering (TBML) is the use of international trade transactions to disguise the proceeds of crime and move value across borders. It is a priority risk in the UAE given its position as a major global trade and re-export hub. Institutions must implement transaction monitoring capable of detecting TBML patterns and possible trade finance breaches.