A UAE crypto AML policy is a board-approved set of internal policies, controls and procedures that a virtual asset service provider (VASP) must maintain under Federal Decree-Law No. 10 of 2025 and the rules of its own supervisor, whether that is VARA, the SCA, the FSRA or the DFSA. It must cover risk assessment, customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting, record-keeping and training. It must also be kept current and applied across the group. This article sets out what each element requires, who owns it and where enforcement exposure sits.
Regulatory Mandate
The UAE does not have a single crypto AML supervisor. The CBUAE's guidance describes a framework in which the SCA, VARA, the FSRA, the DFSA and the CBUAE each have a role. The SCA covers the federal territory and commercial free zones, VARA covers Dubai, the FSRA covers ADGM and the DFSA covers DIFC. The CBUAE supervises licensed financial institutions and registered hawala providers, including the services they provide to VASPs.
The statutory base is the federal AML/CFT law. The current instrument is Federal Decree by Law No. (10) of 2025, which addresses anti-money laundering, counter-terrorist financing and proliferation financing. Article 20 prohibits any natural or legal person from carrying on VASP activities without a licence, registration or enrolment from the competent authority or relevant supervisory authority.
At emirate level, the VARA Regulations designate VARA as a Supervisory Authority under the federal AML/CFT laws for all VASPs and virtual asset activities in Dubai. VARA may supervise compliance, and it must promptly report suspected money laundering to the relevant authority.
The practical consequence is that a policy is never written against the federal law alone. It is written against the federal law and the rulebook of the authority that licenses you. For an overview of how the five regulators divide the market, see our guide to crypto regulations in the UAE.
Licensable Activities
An AML policy is mandatory for any entity carrying out a covered VASP activity. Under the federal law, the covered activities are the following, each conducted as a business on behalf of others:
- Exchange between virtual assets and fiat currencies.
- Exchange between one or more forms of virtual assets.
- Transfer of virtual assets.
- Safekeeping or administration of virtual assets.
- Participation in and provision of financial services related to an issuer's offer or sale of a virtual asset.
The CBUAE guidance lists the same five activities. Founders often assume that a non-custodial model or a protocol front end sits outside this list. That conclusion has to be tested against the facts of the activity, not the marketing description. Whether you exchange, transfer or administer assets for others is a question of control and function.
Licensing and AML are connected. A business that is not yet licensed is not exempt from the law: operating without authorisation is itself an offence, covered under enforcement below. Our notes on the UAE VASP licence and the VARA licensing process explain how the AML framework is assessed at application stage, and the page on VARA's rules for transfer, exchange and settlement covers the activity-specific controls.
Capital and Prudential Standards
Capital is not an AML requirement as such, but a compliance function is a cost line, and supervisors assess whether the firm can fund it. Capital adequacy and prudential modelling should therefore include the staffing of the MLRO function, screening and analytics tooling, and the cost of independent review. Minimum capital and reserve figures differ by regulator and by licensed activity, so they are set out in the relevant rulebook and application guidance rather than here. We cover the cost drivers in our VASP licence cost breakdown.
Two AML points belong in any prudential model:
- Fines are a quantifiable exposure. Administrative fines under the federal law reach AED 5,000,000 per violation, and the maximum for unlicensed activity is higher (see Enforcement Exposure below).
- Recurring review cycles carry cost. Quarterly risk assessment updates, annual board reviews and eight-year record retention all need budget and storage capacity from the first year of operation.
Governance and Control Requirements
Governance is where AML policies most often fail on inspection, because the document exists but ownership is unclear. The requirements allocate responsibility as follows.
Senior management and board
Under Article 19 of the federal law, VASPs must establish internal policies, controls and procedures that are approved by senior management. They must let the firm manage and mitigate identified risks, be reviewed and updated continuously, and apply to all branches and majority-owned subsidiaries. Under VARA's framework, the board must formally approve the Business Risk Assessment (BRA), which VARA's guidance expects to be updated at least quarterly. The VARA Compliance and Risk Management Rulebook also states that the board must review the performance of the VASP at least annually.
The MLRO
VASPs must appoint a Money Laundering Reporting Officer who has at least two years of experience handling AML/CFT matters and is a Fit and Proper Person, with the appointment reviewed annually, per the same rulebook. The MLRO is responsible for developing and implementing AML/CFT policies and procedures and for ensuring that the board and staff are properly trained.
For a group, the point is structural. The MLRO needs authority, access to the board and resources that match the risk profile. A policy that names an MLRO but gives that person no escalation route will not read as supervision-ready.
Training
VASPs must provide AML/CFT training to all staff on a regular basis and monitor compliance with established procedures. Training starts at the beginning of employment and continues on an ongoing basis. Keep attendance logs and testing results, because they are the first evidence an examiner asks for.
AML/CFT and Travel Rule Implications
The policy itself should be organised around the controls below. Each maps to a requirement in the federal law or the VARA rulebooks.
Business risk assessment
The BRA drives everything else: customer segments, products, geographies, delivery channels and virtual asset types. It is board-approved and refreshed on VARA's quarterly minimum. Monitoring scenarios and thresholds should trace back to its findings.
Customer due diligence and beneficial ownership
Under VARA's Client Due Diligence rulebook, VASPs must verify the identity of the client and its ultimate beneficial owners before or during the establishment of a business relationship. CDD is required for occasional transactions of AED 3,500 or more.
Enhanced due diligence applies to high-risk clients and politically exposed persons. It requires additional identification information, verification of source of funds and source of wealth, enhanced monitoring and senior management approval. The first transaction must be carried out through an account at a licensed institution in a FATF-equivalent jurisdiction.
Corporate clients need a documented ownership chain down to natural persons. The federal law also introduces a penalty for false or inaccurate beneficial owner information given when a competent authority requests it, so your onboarding file standards matter as much as your policy wording.
Sanctions screening
The VARA Compliance and Risk Management Rulebook requires automated screening systems that flag transactions involving designated entities under UNSC sanctions frameworks or the federal AML/CFT laws. The systems must operate in real time and be updated regularly with the latest lists. Assets of designated entities must be frozen immediately. Manual screening on a periodic batch basis does not meet this standard.
Transaction monitoring and the Travel Rule
VARA's AML/CFT Controls rulebook expects effective controls and systems that can adequately manage AML/CFT risk, including distributed ledger analytics tools and other investigative capabilities to monitor and screen transactions. Where relevant, monitoring scenarios and thresholds should address FATF virtual asset red flags.
On the Travel Rule, the policy should state how originator and beneficiary information is collected, transmitted and received for virtual asset transfers, how counterparty VASPs are assessed, and how transfers to and from unhosted wallets are handled. Check the current text of your supervisor's rulebook for the exact data fields and thresholds before finalising this section, because they are set at authority level.
Suspicious transaction reporting through goAML
Under Article 18 of the federal law, VASPs must notify the Financial Intelligence Unit without delay and directly when they suspect, or have reasonable grounds to suspect, that a transaction or funds represent proceeds of crime. This applies regardless of value and goes through the electronic system the Unit designates, goAML. The policy should set internal escalation timelines, the MLRO's decision authority and the rule against tipping off.
Record-keeping
VASPs must keep all AML/CFT records, including virtual asset transaction records, CDD records, ongoing monitoring records and suspicious transaction reports, for no less than eight years, according to the VARA rulebook. Retention should be retrievable, not merely stored.
Technology and Custody Controls
An AML policy that ignores the technology stack is a paper exercise. Align the document with the actual systems:
- Analytics and screening. Blockchain analytics must be integrated into onboarding and ongoing monitoring, not run ad hoc. Sanctions screening must be automated and real time.
- Wallet and custody model. Define which wallets the firm controls, how deposits and withdrawals are screened, and who can approve exceptions. Safekeeping and administration are themselves covered activities, so the custody model decides which controls apply.
- Segregation of client assets. Client assets should be separated from the firm's own in both the legal and the operational record, and the AML policy should reference how reconciliation breaks are escalated.
- Privacy-enhancing assets. The federal law introduces a specific penalty for VASPs that offer anonymity-enhanced cryptocurrencies or otherwise prevent authorities from tracing transactions. Listing policies should state clearly how such assets are assessed and whether they are supported.
- Data and audit trail. Every alert, decision and override should be logged so that the file shows why a customer was cleared or reported.
Our page on virtual asset custodian services covers the custody side in more detail.
Enforcement Exposure and Penalty Framework
Penalties come from two directions: the federal law and the licensing authority.
Under Article 17 of the federal law, the supervisory authority may impose administrative fines from AED 10,000 up to AED 5,000,000 for each violation. Other measures include warnings, prohibition from the sector, restriction of board powers, suspension of personnel, suspension or restriction of activity and revocation of the licence. The maximum penalty for a VASP operating without a licence or registration is AED 10,000,000.
Note the phrase "for each violation". A systemic failure, such as screening gaps across thousands of onboarded customers, can be framed as many violations. Measures against board powers and named individuals also make this a personal issue for directors and the MLRO.
Supervision readiness means being able to produce, on request:
- The current board-approved policy and BRA, with minutes showing approval.
- MLRO appointment evidence, including experience and fit and proper status.
- Training records for all staff.
- Samples of CDD and EDD files, including beneficial ownership and source of wealth evidence.
- Screening and monitoring configuration, alert logs and goAML submission records.
- Eight years of retained records, retrievable.
For how VARA approaches inspections and sanctions, see our analysis of VARA's supervision and enforcement.
Practical Structuring Considerations
Choose the policy architecture first. A single group policy with jurisdiction-specific annexes works better than separate documents for VARA, ADGM and DIFC entities. The federal law requires policies to apply to all branches and majority-owned subsidiaries, so a group framework is the natural design. Annexes then capture each authority's rulebook differences, such as the DFSA's AML module or the FSRA's virtual asset framework.
Tie the policy to the licence perimeter. Map each product to one of the five covered activities and then to the licence category. An activity added after authorisation, such as a new custody service, needs the policy and BRA updated before launch.
Put governance in the document. Name the board committee that oversees AML, the reporting line of the MLRO, escalation thresholds and the cycle for the BRA, policy review and board performance review.
Build the evidence trail in parallel. Examiners test operation, not drafting. Run a mock file review before the authority does.
Plan for multi-regulator groups. Firms licensed in more than one jurisdiction should assess where management decisions are made and which authority supervises each decision. Our pages on regulatory compliance for virtual asset platform operators and for virtual asset brokers show how requirements differ by business model, and the UAE virtual asset AML guide and the article on the role of AML in virtual assets go deeper on controls.
Our Perspective
In our work, the AML policies that survive supervision share one trait: they describe the business that actually exists. Founders often adopt a template, then launch a product the template never contemplated.
We advise that the policy, the business risk assessment and the licence application are drafted together. They answer the same question: what risks does this firm take, and what controls does it run against them? When the three documents disagree, the regulator notices.
Our lawyers are crypto-native, so we can read the wallet architecture and the rulebook in the same meeting. That matters because most control gaps sit between the technical design and the legal text, and closing them early is cheaper than remediating after an inspection.
We also advise groups that hold licences in several regimes. A single governance framework with authority-specific annexes keeps the board's oversight coherent and the MLRO's workload manageable.
CRYPTOVERSE
Support With Your AML Framework
We draft and review AML/CFT policies, business risk assessments and governance frameworks for VASPs at application stage and during live supervision. Our AML/CTF and risk management service covers policy drafting aligned with FATF standards and UAE federal AML law, and our VASP licensing team aligns the policy with your licence application.
If you are preparing for a licence application or an examination, contact us through the Cryptoverse Legal site to discuss your structure.
FAQ
Does a crypto business in the UAE need its own AML policy?
Yes. Federal Decree-Law No. 10 of 2025 requires VASPs to maintain internal policies, controls and procedures approved by senior management. They must be reviewed continuously and applied across branches and majority-owned subsidiaries. Your licensing authority's rulebook adds specific requirements.
Who is responsible for the AML policy?
Senior management approves it and the board approves the business risk assessment. The MLRO develops and implements the policy and must have at least two years of AML/CFT experience and be a Fit and Proper Person. Responsibility for training staff also sits with the MLRO.
How long must AML records be kept?
VARA's Compliance and Risk Management Rulebook requires AML/CFT records, including transaction records, CDD files, monitoring records and suspicious transaction reports, to be retained for no less than eight years.
What are the penalties for non-compliance?
Supervisory authorities may impose administrative fines of AED 10,000 to AED 5,000,000 per violation, plus measures such as activity restrictions and licence revocation. Operating without a licence or registration carries a maximum penalty of AED 10,000,000.
How are suspicious transactions reported?
VASPs notify the Financial Intelligence Unit without delay through goAML when they suspect, or have reasonable grounds to suspect, that funds are proceeds of crime. The duty applies regardless of transaction value.
Sources
- CBUAE guidance on risks related to virtual assets and VASPs
- Federal Decree by Law No. (10) of 2025, MOET publication
- Federal Decree by Law No. (10) of 2025, MOET text on goAML reporting
- Federal Decree by Law No. (10) of 2025, MOJ publication
- VARA Virtual Assets and Related Activities Regulations
- VARA Compliance and Risk Management Rulebook
- VARA Rulebook, Client Due Diligence
- VARA Rulebook, AML/CFT Controls