What is the UAE's core anti-money-laundering law?

Federal Decree-Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing is the United Arab Emirates' primary anti-money-laundering (AML) law. Issued on 30 September 2025 and in force since 14 October 2025, it replaced Federal Decree-Law No. 20 of 2018. It criminalises money laundering and terrorist financing, brings virtual-asset service providers expressly within the perimeter of AML supervision, and sets the legal basis for customer due diligence, beneficial-ownership transparency, record-keeping and suspicious-transaction reporting.

The detail sits in the Executive Regulations, Cabinet Resolution No. 134 of 2025, published in the Official Gazette on 15 November 2025 and in force from 14 December 2025. They replace the 2019 regulations issued under the old law and carry the customer due-diligence thresholds and the virtual-asset travel rule described below. A licensed desk or bank absorbs most of this change on your behalf — when the rules tighten, it simply asks for more documentation before it settles your trade.

Which regulators enforce AML rules against crypto sellers?

Four bodies enforce AML rules against someone selling crypto in the UAE, and each covers a different part of the transaction. Knowing which one applies at a given step avoids confusion when a desk or bank asks a compliance question.

• CBUAE — supervises AML compliance at the banks that receive your AED settlement.
• VARA — supervises virtual-asset service providers in Dubai outside the DIFC, including OTC desks, through its Compliance and Risk Management Rulebook.
• CMA — the Capital Market Authority, the former SCA renamed on 1 January 2026, supervises virtual-asset activity elsewhere onshore, outside VARA's Dubai perimeter.
• FIU — the Financial Intelligence Unit receives suspicious-transaction reports from banks and licensed VASPs through the goAML system.

IWGT operates as a Broker-Dealer under VARA licence VL/24/12/002, so VARA's rulebook governs our AML controls directly, while CBUAE's rules govern the bank that credits your AED.

How has the FATF grey-list period shaped enforcement?

The FATF placed the UAE under increased monitoring — the grey list — at its March 2022 plenary, after the UAE made a high-level political commitment in February 2022 to strengthen the effectiveness of its AML/CFT regime. The FATF removed the UAE from the list on 23 February 2024, once the agreed action plan was complete.

UAE regulators have kept the stricter supervisory posture built during that period rather than relaxing it once the grey-list status ended. That includes CBUAE's scrutiny of banks handling crypto-linked settlements and VARA's compliance requirements for licensed Dubai VASPs.

What has changed in UAE AML requirements around 2025?

The single biggest change is the new decree-law itself. Federal Decree-Law No. 10 of 2025 took effect on 14 October 2025, its Executive Regulations followed on 14 December 2025, and VARA required every licensed Dubai VASP to run a gap assessment of its AML policies, systems and controls against the new law (circular of 24 November 2025). A second VARA circular, on 4 March 2026, set out how the Executive Regulations apply to virtual-asset activity in Dubai, including the new duty to assess proliferation-financing risk.

In practice, the direction of travel is consistent: larger or unusual crypto conversions draw closer enhanced due diligence checks, and banks ask more pointed questions before crediting proceeds from a virtual-asset sale. A desk keeping pace with this tightening is a sign of a properly supervised counterparty, not unnecessary friction.

How does enhanced due diligence fit into this framework?

Enhanced due diligence (EDD) is the deeper review a licensed desk or bank runs on a large or unusual crypto conversion, and it operates inside the AML framework above rather than as a separate rule. The Executive Regulations fix the point at which customer due diligence becomes mandatory for an occasional transaction — AED 55,000, in one transaction or several that appear linked — but the decision to escalate to enhanced due diligence is risk-based, so each institution sets its own bands above that floor.

At a desk whose minimum ticket is around 100,000 USDT, every trade sits well above that floor, so identity and source-of-funds review is part of onboarding rather than an exception, as of September 2026. Our full guide to enhanced due diligence on large crypto conversions covers the documents requested and realistic timelines in more depth.

What is the travel rule and how does it apply?

The travel rule requires a virtual-asset service provider to pass originator and beneficiary information along with a crypto transfer, the same way a bank wire carries sender and receiver details. The UAE Virtual Asset Travel Rule, issued under Cabinet Resolution No. 134 of 2025, applies it to every VASP in the country, including those in free zones and financial free zones; VARA's circular of 24 February 2026 sets out how licensed Dubai VASPs must implement it, alongside the FATF Travel Rule section of its Compliance and Risk Management Rulebook.

Originator and beneficiary information must accompany every in-scope transfer between VASPs whatever its size; once a client's transfers reach AED 3,500 in a day, the receiving VASP must also verify the beneficiary's identity if it has not done so before. If a desk cannot obtain the required counterparty information on an incoming transfer, it may ask you to route that leg through a different, compliant wallet or exchange rather than accept it as is.

What documents should you prepare before selling crypto?

A UAE-licensed desk asks for broadly the same documents under this framework regardless of size: a passport, proof of address issued within the last 90 days, and — for larger conversions — evidence of where the assets came from.

• Passport and proof of address for individuals; trade licence and ownership documents for companies.
• Exchange statements or wallet records showing how the crypto was acquired.
• A short written narrative connecting income or a prior transaction to the current holding, for larger conversions.

Our guide to building a source-of-funds file covers the documents in more depth, and our onboarding section lists what we ask for before a first trade.

What happens if a desk skips these checks?

A desk offering to skip AML checks at any size is not offering convenience — it is operating outside VARA's, the CMA's or CBUAE's supervision. Our guide to the real cost of no-KYC desks sets out what usually goes wrong.

Your bank still runs its own review of any large inbound transfer, regardless of what the sending desk checked. Working with a supervised counterparty gives your bank a paper trail to rely on instead of a reason to freeze the credit.

The bottom line on UAE AML rules for crypto sellers

Federal Decree-Law No. 10 of 2025 is now the backbone of UAE AML law, enforced through CBUAE, VARA, the CMA and the Financial Intelligence Unit. The FATF grey-list period closed in February 2024, but the tighter supervisory habits it produced were written into the 2025 law and its Executive Regulations rather than relaxed.

Re-check the CBUAE rulebook and VARA's circulars before you rely on a specific threshold for a decision. Beyond that, the practical response is the one that has applied since 2018: keep clean records and work only with a supervised counterparty.

This guide is informational and is not legal, tax or investment advice, nor an invitation to buy or sell any virtual asset. Rules and figures are as of September 2026 — re-check the sources before acting. Virtual assets may lose their value in full or in part and are subject to extreme volatility.