What has changed in the UAE’s AML/CFT/CPF framework for VASPs?
Federal Decree-Law No. (10) 2025 on Anti-Money Laundering, Combating the Financing of Terrorism, and Proliferation Financing took effect on 14 October 2025. It expressly brings VASPs under direct AML/CFT/CPF supervisory oversight, aligning with FATF standards and strengthening virtual asset regulation.
Summary
- Direct Regulatory Oversight: All VASPs in Dubai now fall under the direct supervisory authority of VARA, requiring strict alignment with UAE AML/CFT/CPF frameworks and global FATF standards.
- The Mandatory Gap Assessment: Decision-makers must oversee a comprehensive, clause-by-clause review of their current compliance framework, specifically evaluating internal controls, governance, and AML policies against the new 2025 Decree-Law.
- Time-Sensitive Submissions: Your business has a 60-calendar-day window from the notification date to submit a formal GAP Assessment Report and a Board-approved remediation plan detailing specific milestones and risk-based mitigations.
- Aggressive Implementation Timelines: To maintain operational continuity, priority control fixes and role-based AML training must be completed within 90 days, with all remaining gaps closed and certified by the Compliance Officer within 120 days.
- Strategic Risk Mitigation: Proactive compliance is essential to avoid significant penalties, enforcement actions, or operational restrictions that could impact your business standing under Federal AML laws.
Who does this apply to?
All VASPs operating in the Emirate of Dubai fall within scope and must meet the updated obligations set by VARA.
What are the enhanced expectations for VASPs?
VASPs must comply with:
- Stronger preventive measures
- Expanded beneficial ownership and transparency requirements
- Heightened penalties and exposure
- Formalized supervisory scrutiny by the regulator
What is the mandatory GAP assessment and what should it cover?
It’s a comprehensive, clause-by-clause review of your current compliance framework against the 2025 AML Decree-Law. It must assess:
- Policies and procedures
- Systems and internal controls
- Governance and oversight mechanisms
The mapping should explicitly reference preventive measures, supervisory obligations, and penalties requirements.
When is the GAP Assessment Report due and what must be submitted?
Within 60 calendar days from the date of the VARA circular/notification, VASPs must submit:
- A clause-by-clause GAP assessment
- A Board-approved remediation plan (with owners, milestones, timelines)
- Evidence of immediate, risk-based mitigation for high-risk gaps
What are the remediation and training timelines?
- Within 90 days:
- Implement priority control fixes
- Deliver targeted, role-based AML/CFT training, including for senior management
- Within 120 days:
- Close remaining gaps
- Submit a completion confirmation signed by the Compliance Officer
- Obtain Board / Audit & Risk Committee approval
What records must VASPs maintain for inspection?
- Detailed working papers- Testing and validation evidence
- Board minutes approvals
All documentation must be readily available for regulatory inspection.
What are the consequences of non-compliance?
Failure to meet these obligations may trigger enforcement actions under the Regulations and Federal AML/CFT laws, including significant penalties and potential operational restrictions.
How can VASPs practically approach the GAP assessment?
Consider the following steps:
- Appoint a project lead and secure Board sponsorship.
- Inventory policies, procedures, systems, and governance documents.
- Perform clause-by-clause mapping against the 2025 AML Decree-Law.
- Identify high-risk gaps and apply immediate risk-based mitigations.
- Develop a remediation plan with clear owners, milestones, and timelines.
- Roll out targeted, role-based training (including senior management).
- Prepare and submit the 60-day package; track 90- and 120-day commitments.
- Maintain complete working papers, testing evidence, and Board approvals for inspection readiness.
How can Affiniax Partners help?
Affiniax Partners specializes in AML, VARA compliance, and risk advisory for virtual asset businesses. We provide end-to-end support for the mandatory GAP assessment, remediation planning, training, and regulatory submission readiness.
