Financial crime investigations in the UAE are subject to a strict legal and regulatory framework, including Federal Decree-Law No. 10 of 2025 on Combating Money Laundering Crimes, Combating the Financing of Terrorism and the Financing of Arms Proliferation, its Implementation Regulations under Cabinet Resolution No. 134 of 2025 and the Federal Decree-Law No. 31 of 2021 on the Crimes and Penalties Law, as amended. These laws cover conduct such as money laundering, terrorist financing, proliferation financing, fraud, bribery, breach of trust, forgery, suspicious transactions, misuse of company funds and concealment of criminal proceeds.
For companies, directors and senior officers, this means that financial crime risk is no longer limited to internal compliance. Weak due diligence, poor records, unexplained payments, false invoices or failure to report suspicious activity may expose the company and its management to regulatory action, freezing measures, criminal investigation and reputational harm.
The foundation of corporate criminal exposure in the UAE is Federal Decree-Law No. 31 of 2021 on the Crimes and Penalties Law, as amended. Article 39 provides that the mental element of a crime consists of either intent or fault. Intent arises where a person knowingly commits, or omits, an act criminalised by law with the purpose of producing a criminal result. Fault, on the other hand, may arise from negligence, inattention, recklessness, rashness or failure to comply with applicable laws, regulations, rules or orders. In financial crime matters, this distinction is important because failures in supervision, compliance controls or statutory reporting may become relevant when assessing culpability.
Corporate criminal liability is covered under Article 66 of the Crimes and Penalties Law. It provides that, except for government bodies and public authorities, companies can be held criminally liable for offences committed by their representatives, directors or agents when acting in the company’s name or on its behalf. Where such liability is established, the company may be subject to fines, confiscation and other criminal measures prescribed by law. The individual who committed the offence may also face separate criminal punishment.
Article 66(2) limits the type of punishment that may be imposed on a company. Since a legal person cannot be imprisoned, the penalty is generally restricted to a fine, confiscation and other criminal measures provided by law. Where the underlying offence carries imprisonment or another non-financial penalty, the company’s punishment is limited to a fine of up to AED 5 million, unless a specific law provides otherwise. This does not prevent separate criminal proceedings or punishment against the individual director, manager, representative or agent who committed the offence.
With regard to AML/CFT, Article 4 of Federal Decree-Law No. 10 of 2025 further stipulates that a legal person may be held criminally liable where any crime under the Decree-Law is committed intentionally in its name or for its account, without prejudice to the personal criminal liability of the perpetrator.
The Federal Decree-Law No. 10 of 2025 framework expands the scope of financial crime risk in the UAE. Article 1 defines predicate crimes to include terrorist financing, financing the proliferation of arms, and direct and indirect tax evasion. It also recognises money laundering carried out through digital systems, virtual assets or encryption technologies. Article 3 further addresses terrorist financing and the financing of arms proliferation by covering the direct or indirect provision, collection or making available of funds, including through digital systems, virtual assets or encryption technologies. For companies, this widens the compliance focus beyond ordinary money laundering risks to include suspicious cross-border payments, sanctions exposure, weapons-related transactions, dual-use goods and other high-risk financial activity.
Article 2 of Federal Decree-Law No. 10 of 2025 provides further detail on the ways knowledge can be established with regard to money laundering. A person can be liable where they know, or where their knowledge is supported by sufficient evidence or circumstantial evidence, that the funds are derived from a predicate crime. It also reiterates that money laundering is a separate offence for which it is not necessary to have been convicted of the underlying crime and that knowledge can be inferred from the factual and objective circumstances of the case.
The 2025 AML/CFT framework also increases financial and managerial exposure for legal entities. Under Article 27 of Federal Decree-Law No. 10 of 2025, a legal person may face a fine ranging from AED 5 million to AED 100 million, or a fine equal to the value of the criminal property, whichever is greater, where money laundering, terrorist financing or proliferation financing is committed by its representatives, directors or agents acting on its behalf or in its name. Article 27(5) also makes provision for the punishment of the person who was actually in charge of the management of the legal person if they were aware of the crime and the offence happened due to a breach of their duties as managers. Board oversight, internal reporting, escalation and effective compliance controls are therefore key to reducing both corporate and individual exposure.
Article 20 of Federal Decree-Law No. 10 of 2025 prohibits any natural or legal person from carrying out financial activities, designated non-financial businesses and professions (DNFBPs) activities or virtual asset service provider activities without the required licence, registration or authorisation. Breach of this requirement is penalised under Article 32 by imprisonment and a fine ranging from AED 200,000 to AED 10 million, or either penalty. Article 29 separately addresses tipping off, by penalising any person who alerts another person or discloses information relating to suspicious transactions or ongoing investigations. It also penalises intentional or grossly negligent failure to comply with duties relating to seized or frozen funds, with aggravated penalties where such conduct results in the proceeds being lost, destroyed or no longer capable of seizure.
The Federal Decree-Law No. 32 of 2021 on Commercial Companies also strengthens the accountability of directors and managers. In accordance with Article 84, a manager of a limited liability company may be personally liable to the company, partners and third parties for fraud, abuse of power, violation of applicable law, breach of the company’s memorandum or appointment contract or gross error. Any attempt to exclude this liability shall be deemed void. This provision is important in financial crime cases because directors and managers cannot just rely on the company’s separate legal personality when their own conduct, supervisory failures or abuse of authority causes loss or legal exposure.
Financial crime investigations in the UAE may involve several authorities, including the Financial Intelligence Unit (FIU), the Central Bank of the UAE, sector regulators and the Public Prosecution. Financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers must report suspicious transactions or funds immediately to the FIU under Article 18 of Federal Decree-Law No. 10 of 2025. These reports must include available information about the transaction and the relevant parties, and further information must be provided if requested by the FIU. The provision also recognises professional confidentiality for lawyers, notaries, other legal professionals and independent legal auditors in specific circumstances. Separately, Article 5 gives the Chief of the FIU the power, without prior notice, to suspend suspicious transactions for up to 10 working days and to freeze funds suspected of being related to a crime for up to 30 days, subject to the procedures and extensions provided under the law.
Federal Decree-Law No. 10 of 2025, Article 6 states that the Public Prosecution or the competent court may, without prior notice, order the identification, tracing, evaluation, seizure or freezing of criminal funds or assets, or their equivalent value, until the investigation or trial is concluded. It also provides for measures to prevent handling and disposal of such assets and to protect the rights of bona fide third parties. A decision on seizure or freezing may be contested before the competent criminal court by any interested party. The grievance shall be decided within 14 working days. The Court’s decision is final, and if the grievance is rejected, a new grievance can generally only be filed after three months, unless there is a serious new reason.
UAE companies and directors now need to do more than basic compliance when it comes to financial crime investigations. Poor internal controls, poor record-keeping, unclear beneficial ownership structures, suspicious transactions, and failure to respond to regulatory concerns can expose the company and its management to serious legal risk under the new AML/CFT framework.
So a strong compliance framework is not just a regulatory necessity, but a critical defence mechanism. Companies should keep clear audit trails, conduct regular internal checks, verify counterparties and ultimate beneficial owners, keep records of transactions and ensure that suspicious activity is identified and reported. In cases where the crime is proven and where criminal property is mixed with legitimate funds, Article 31 allows confiscation of the criminal property or equivalent value in funds. Clear audit trails and proper documentation are therefore essential.
