The Virtual Assets Regulatory Authority (VARA) has issued a formal circular announcing the publication and enforcement of the UAE Federal Decree-Law No. (10) of 2025 on Anti-Money Laundering (AML), Combating the Financing of Terrorism (CFT), and Combating Proliferation Financing (CPF).
The law, which became effective on 14 October 2025, represents one of the UAE’s most significant updates to its financial crime framework—explicitly expanding regulatory oversight to include Virtual Asset Service Providers (VASPs).
VASPs Now Fully Within AML/CFT Regulatory Scope
For the first time, the federal AML framework expressly places virtual asset entities under the jurisdiction of supervisory authorities. According to VARA, the 2025 AML Decree-Law introduces:
- Updated preventive measures
- Enhanced transparency and beneficial ownership rules
- Stricter penalties and enforcement mechanisms
- Clear supervisory oversight obligations
This shift aligns the UAE with FATF-aligned global standards and responds to the rapid expansion of digital asset activity across the region.
Mandatory Compliance Actions: 60–120 Day Deadlines
VARA has outlined several compulsory steps that VASPs must complete, each with firm deadlines.
1. GAP Assessment (Within 60 Days)
Entities are required to conduct a comprehensive clause-by-clause GAP assessment comparing their existing AML/CFT/CPF frameworks with the requirements of the new law.
Submission must include:
- Completed GAP assessment
- Board-approved remediation plan with owners & target dates
- Evidence of immediate mitigations for identified high-risk gaps
2. Remediation & Training (90 Days)
VASPs must implement priority fixes and deliver staff-wide and role-based training aligned with the new legal obligations.
3. Full Closure of Remaining Gaps (120 Days)
A final plan completion report must be signed by the Compliance Officer and approved by the Board or the Audit/Risk/Compliance Committee.
4. Recordkeeping Obligations
Firms must retain all working papers, testing results, and relevant board minutes, and be prepared to provide these records upon request.
Enforcement Risks
VARA emphasizes that non-compliance may trigger enforcement actions under both federal AML laws and related regulations. This may include administrative penalties, licensing impact, or other supervisory measures.
Additionally, the authority confirms that further executive resolutions will be issued to expand and clarify operational obligations under the new federal law.
Strengthening the UAE’s Digital Asset Regulatory Landscape
The AML Decree-Law 2025 reinforces the UAE’s position as a globally compliant jurisdiction for virtual asset activity. By requiring structured GAP assessments and board-level remediation plans, the law elevates governance expectations for VASPs operating in Dubai.
For entities navigating this transition, early action, board involvement, and comprehensive documentation will be key to maintaining compliance.
To explore the full details, you may view the official circular and reference documents provided in the original release. Click here.
————
Disclaimer: The content of the above information is sourced (or provided), in entirety or in parts from an external source and the content may or may not be edited. The Wealth Today shall not be held liable for damages arising out of any action taken with respect to the use or consumption of information or service published above or anywhere else on the website. This website does not guarantee the accuracy, views, opinions, or any promises expressed in the above news. If you find any errors or discrepancies in the above information, you can write to us at editor@thewealth.today.
