CBUAE AML Guidelines 2026: What UAE Financial Institutions Must Know After the April Update

1. Proliferation Financing Risk Assessment and Mitigation

One of the most significant additions in the April 2026 CBUAE AML guidelines is the standalone guidance on proliferation financing (PF), the financing of the development, manufacture, acquisition, or transfer of weapons of mass destruction (WMDs) and their delivery systems.

Previously, proliferation financing was treated as a subset of broader AML/CFT frameworks. The April 2026 update elevates it to a distinct compliance obligation with its own risk assessment requirements. UAE licensed financial institutions must now:

• Conduct a dedicated proliferation financing risk assessment as part of their business-wide risk assessment.
• Identify clients, transactions, and counterparties with exposure to PF risks, including dual-use goods trading, arms brokering, and transactions involving sanctioned jurisdictions.
• Implement targeted financial sanctions (TFS) screening specifically calibrated for PF risks.
• Document their PF risk assessment methodology and review it whenever risk indicators change.

This is particularly relevant for trade finance teams, commodity traders, and institutions with cross-border payment corridors linking to higher-risk jurisdictions.

2. Trade-Based Money Laundering (TBML) and Transshipment Risks

The CBUAE’s updated guidance on trade-based money laundering UAE reflects the UAE’s unique position as a global re-export hub. The UAE processes significant volumes of international trade, including gold, oil, commodities, electronics, and dual-use goods, making trade finance a high-risk channel for financial crime.

Under the April 2026 CBUAE AML regulations, licensed financial institutions supporting import-export activity, commodity trade, freight-linked payments, and cross-border settlement flows must now implement:

• Deeper visibility into trade patterns, understanding the economic rationale behind trade flows, not just processing payment instructions
• Counterparty due diligence on trade transactions, verifying the identity and legitimacy of buyers, sellers, freight forwarders, and intermediaries in trade chains
• Documentation review assessing shipping documents, invoices, bills of lading, and trade finance instruments for inconsistencies that may indicate over- or under-invoicing, phantom shipments, or multiple invoicing
• Transshipment risk controls apply enhanced scrutiny to transactions involving the UAE as a transshipment point for goods destined for sanctioned jurisdictions or high-risk counterparties.
• Tighter integration between trade compliance and financial compliance functions, breaking down the traditional separation between trade finance teams and AML compliance departments.

For institutions active in commodity trade finance, particularly those handling gold, oil, and electronics, this guidance demands an operational review of existing trade monitoring systems and controls.

3. Correspondent Banking AML Requirements 2026

The CBUAE’s updated guidance on correspondent banking AML UAE addresses one of the highest-risk areas in international finance. Correspondent banking relationships where a UAE bank provides services to a foreign bank create significant exposure to financial crime risks that are difficult to monitor directly.

Under the April 2026 CBUAE guidelines on AML CFT, UAE licensed financial institutions must strengthen their correspondent banking frameworks by:

• Applying enhanced due diligence (EDD) to all respondent institutions, going beyond basic KYC to understand the respondent’s ownership structure, regulatory environment, AML/CFT program quality, and risk appetite
• Identifying and managing nested relationships where the respondent bank itself provides services to third-party banks, creating layers of indirection that obscure the ultimate source of funds
• Maintaining ongoing monitoring that reflects the actual risk profile of each correspondent relationship, not just conducting due diligence at onboarding and leaving it static
• Documenting the rationale for accepting, continuing, or exiting correspondent banking relationships with institutions in higher-risk jurisdictions

Institutions that currently manage correspondent banking relationships through static periodic reviews must upgrade to dynamic, risk-based monitoring with documented reassessment triggers.

4. Customer Due Diligence (CDD) and KYC Update 2026

The CBUAE’s updated CDD and KYC guidance formalizes the shift from one-time onboarding verification to continuous, dynamic customer due diligence. This is one of the most operationally significant changes in the April 2026 CBUAE AML guidelines for day-to-day compliance operations.

Key requirements under the updated CBUAE CDD guidance include:

• Dynamic risk-based CDD customer risk profiles must be reassessed throughout the relationship, not just at onboarding. Trigger events, such as significant changes in transaction behaviour, new business activities, or changes in ownership, must prompt a CDD review.
• Real-time transaction-monitoring automated systems with anomaly-detection capabilities are now the expected standard, not a best-practice recommendation.
• Digital onboarding standards for institutions using digital KYC processes, electronic identity verification, including video verification or biometric checks, must meet CBUAE-specified standards.
• Updated record-keeping obligations: all CDD documentation must be retained for a minimum of five years from the end of the business relationship or transaction completion, stored securely and retrievable within regulator-specified timeframes.
• Enhanced due diligence (EDD) triggers are now required for PEPs, correspondent banking relationships, customers from high-risk jurisdictions, cross-border corridors identified as higher risk, and complex or unusual transactions.

For fintech businesses and digital banks, the digital onboarding standards section of this guidance is particularly important. The CBUAE now expects biometric or video-based verification, where appropriate generic document upload processes may no longer meet the standard.

5. Risk-Based Approach and Institutional Risk Assessment

The CBUAE’s best-practice manual on implementing a risk-based approach provides detailed guidance on how licensed financial institutions should develop their risk assessment methodologies, conduct business-wide risk assessments, and apply the risk-based approach in practice.

Key elements include:

• Risk assessment methodology documentation: institutions must be able to evidence how they identified, assessed, and rated their AML/CFT/CPF risks, not just state conclusions
• Proportionate control allocation: higher-risk relationships, products, and geographies must receive demonstrably more intensive controls; simplified procedures must be documented and justified
• Regular review cycle: institutional risk assessments must be reviewed at defined intervals and following significant business changes, regulatory updates, or emerging risk indicators
• Board and senior management engagement: risk assessment findings must be reported to and acknowledged by senior management, with clear accountability for remediation of identified gaps

This guidance directly addresses a pattern the CBUAE has identified in inspections: institutions that have risk assessments on paper but whose actual operational controls do not reflect the risks they have identified.

6. Role-Based AML Training Requirements 2026

The CBUAE’s updated best-practice guidance on role-based AML training UAE introduces the most significant change to staff training obligations since the previous framework. Generic annual e-learning delivered uniformly to all staff is now explicitly insufficient.

Under the April 2026 CBUAE AML guidelines, training must be:

• Role-specific what a front-line teller needs to know differs fundamentally from what a trade finance officer, compliance analyst, or senior manager needs to know. Training must be calibrated to each role’s actual AML/CFT/CPF exposure and responsibilities.
• Regular, documented training logs must record the date, content, delivery method, staff member, role, and assessment outcomes for each training session.
• Updated for regulatory changes, including Federal Decree-Law No. 10 of 2025, Cabinet Resolution 134 of 2025, and the April 2026 guidance package, all constitute material regulatory changes that require training updates.
• Senior management accountability board members and senior management must receive training appropriate to their oversight responsibilities, not exemptions from the training obligation.
• Inspection-ready training records must be immediately producible during regulatory inspections and must clearly demonstrate that all staff with AML/CFT/CPF responsibilities have received current, role-appropriate training.