Chapter 5 sets out the UAE rules against money laundering and terrorist financing, from the offences themselves to the checks, reports and penalties that apply to firms and individuals. It carries 14 of the 100 exam questions, and many of its rules are decisions: whether CDD applies, whether to report, and what must never be disclosed.
This chapter covers the UAE anti-money laundering and counter-terrorist financing framework as the study material presents it: Federal Decree-Law No. 20 of 2018, read with its implementing regulation, Cabinet Decision No. 10 of 2019. It begins with the two offences, then turns to what financial institutions and designated non-financial businesses and professions must do: assess risk, carry out customer due diligence, find beneficial owners and PEPs, refuse prohibited business, report suspicion and keep records. The penalties section is full of figures that are easy to mix up. The chapter ends with the SCA market abuse rules and accepted practice on conflicts of interest. Both laws have since been replaced, but the exam is based on the earlier rules.
Money laundering, as Article 2 of the Decree-Law defines it, is about criminal proceeds. Converting or transferring them is laundering when the person knows where they came from and means to hide or disguise that origin. The offence is wider than moving money: knowingly acquiring, possessing or using proceeds is caught too, and purely domestic conduct counts. Laundering stands alone as a crime, so nobody has to be punished for the original offence first, and a sentence for that offence does not rule out a separate one for laundering. Terrorist financing looks the other way, at where funds are going. Providing or collecting money with intent or knowledge that it will support terrorism, wholly or partly, is enough, even if the money was earned lawfully and has not yet been spent.
The duties fall on financial institutions, such as banks, insurers and exchange houses, and on DNFBPs, the designated non-financial businesses and professions, for example real estate brokers and agents, precious metals dealers, lawyers and accountants. Each firm assesses its own money laundering and terrorist financing risks and keeps that assessment, with its supporting data, ready for supervisors on request. Its internal policies, controls and procedures need senior management approval and should fit the firm's risks and the nature and scale of its business. Directions from the competent UAE authorities that give effect to UN Security Council decisions must be applied without delay, to existing relationships as well as new ones. The pattern repeats: weigh the risk, identify the customer, watch the account and report anything suspicious.
CDD combines verifying identity from reliable, independent sources, screening against prohibited lists and assessing the customer's risk. CDD is due for a business relationship from the outset, at any value, with verification before or while it is set up. Finishing verification later is allowed only for low-risk cases, provided it is finished promptly, the delay avoids disrupting normal business and the risk is controlled. Occasional customers have amount triggers, and suspicion or doubtful identity data triggers CDD at any amount. Customers taken on before the rules are covered too, timed by risk and importance. For a company, look through every corporate layer to the individuals behind it, beginning with any natural person who holds a controlling ownership stake of at least 25%, whether alone or jointly. Senior managers are verified only as a fallback.
Some business is banned outright rather than made subject to extra checks. A firm may not deal with a shell bank, wherever it is licensed, and may not open or keep an account that is anonymous, uses a false name or pseudonym, or carries only a number in place of the holder's name. No internal register or senior sign-off cures either breach. Where the required CDD cannot be completed, the firm must not open the account, begin the relationship or execute the transaction, and it must consider whether an STR is needed. A restricted account is still a relationship. By contrast, customers from high-risk countries, foreign PEPs and reliance on a regulated third party are all permitted once the right controls are in place.
A PEP is a person with a prominent public function, now or in the past, in the UAE or another country: for example a head of state or government, a senior politician or government official, a senior judge or military officer, or a senior executive of a state-owned company. Seniority and the state link both matter. The definition extends to direct family (spouse, children, children's spouses and parents) and to known close associates, such as joint owners of a legal person. Firms must take steps to establish if a customer, or a customer's beneficial owner, is a PEP. The status signals corruption and bribery risk, not wrongdoing, and is not a ban. For life and family takaful policies, insurers check the beneficiary and the beneficiary's beneficial owner too, and tell senior management before payout if either is a PEP.
A report is triggered by reasonable grounds to suspect a link to crime. Proof is not needed, no minimum amount applies, and attempted transactions count. Staff escalate concerns internally to the compliance officer, who reviews the data and decides whether to report. The report goes to the Financial Intelligence Unit (FIU) without delay, through its electronic system or another approved route. Reporting in good faith brings no administrative, civil or criminal liability for the firm, its board members, employees or authorised representatives, and it does not breach banking or contractual confidentiality. The firm must answer the FIU's follow-up requests. Lawyers have a narrow exemption for information received while assessing a client's legal position, representing them in court, arbitration or mediation, or advising on proceedings. Telling anyone that a report is planned or made is tipping off.
A firm may rely on a third party for CDD only if that party is regulated and supervised, the CDD information arrives immediately and copies of documents are available without delay; responsibility stays with the firm. New products, practices and delivery channels need a risk assessment before launch. Controls include an independent audit function, employee screening and ongoing, documented training, and they reach branches and majority-owned subsidiaries, including those abroad. The compliance officer reviews possible suspicious transactions, reviews the internal rules, runs training and gives the supervisor and the FIU the data and access they request. Records, from CDD files and correspondence to ID copies, STRs and analysis, are kept for a minimum of five years after the transaction completes or the relationship ends, organised so that transactions can be traced.
Two systems run side by side. Under Article 14, a supervisory authority imposes administrative sanctions: a warning, a fine, restricting directors' and managers' powers, restricting or suspending the activity, barring the violator from the sector and cancelling the licence. It can also require regular reports on how a violation is being corrected. Courts impose criminal penalties, each offence with its own band, shown in the table below. An attempt to launder carries the full penalty, and a court may reduce or remove a terrorist financing sentence where the offender's information leads to disclosure of the offence or to the prosecution or arrest of offenders. When a court convicts a legal person, a summary of the judgment is published at that party's expense, and a terrorist financing conviction adds dissolution and closure of its offices.
Article 16 of the SCA trading regulations treats a run of illusory trades designed to suggest an active market as deception, and dealings aimed at moving a price to draw others in are void. The Regulations as to Disclosure and Transparency, in Article 37, make spreading misleading rumours and dealing on undisclosed information gained through your position punishable by prison, a fine or both, and the deals are void. The SCA can also fine an investor, bar them from trading, or both. On conflicts, Chinese walls must be kept effective and monitored, and the rules apply where at least one side carries on a regulated activity or one connected with it. Investment research has its own rules on analysts' dealing, draft review, pay conflicts and promises of favourable coverage.
A short revision checklist written by Bourse Prep from the syllabus and from our verified question bank. Use it to check yourself after studying the chapter. It does not replace the official workbook. Unfamiliar term? See the UAE FRR glossary.
The figures in this chapter that the exam material states, each with the rule it belongs to. Learn the figure and its owner together. Test yourself on them in Rules Lab.
| What | Figure | Context |
|---|---|---|
| CDD trigger for an occasional transaction | AED 55,000 | at or above, single or apparently linked transactions |
| CDD trigger for an occasional wire transfer | AED 3,500 | at or above; suspicion or doubtful identity data trigger CDD at any amount |
| Beneficial ownership controlling interest | 25% | held alone or jointly by a natural person |
| Minimum record retention | 5 years | counted from when the transaction completes or the relationship ends |
| Compliance officer's reports to senior management | Every six months | copies go to the supervisory authority |
| Administrative fine | AED 50,000 to AED 5,000,000 | per violation, imposed by the supervisory authority |
| Basic money laundering: prison | Up to 10 years | an attempt carries the same penalty |
| Basic money laundering: fine | AED 100,000 to AED 5,000,000 | with or instead of imprisonment |
| Aggravated money laundering: fine | AED 300,000 to AED 10,000,000 | together with temporary imprisonment |
| Terrorist financing | Life, or at least 10 years, plus AED 300,000 to AED 10,000,000 | imprisonment and fine together |
| Legal person fine | AED 500,000 to AED 50,000,000 | where its representatives, managers or agents intentionally offend in its name or for its account |
| Failure to report a suspicion: fine | AED 100,000 to AED 1 million | imprisonment and/or fine; gross negligence in procedures is also covered |
| Tipping off | At least 6 months and/or AED 100,000 to AED 500,000 | imprisonment, fine or both |
| Misleading rumours or dealing on undisclosed information | 3 months to 3 years and/or AED 100,000 to AED 1 million | under the SCA disclosure rules; the deals are void |
| SCA bar on trading | Up to 1 year | counted from when the SCA decides |
Places where the syllabus draws a line between two rules that sound alike. They are not predictions about any exam.
The supervisor's administrative fine runs from AED 50,000 to AED 5,000,000 per violation and needs no court. Criminal fines are set by a court and differ by offence: AED 100,000 to AED 5,000,000 for basic laundering, AED 300,000 to AED 10,000,000 for aggravated laundering and terrorist financing, and AED 500,000 to AED 50,000,000 for a legal person. Identify who imposes the penalty, and for what, before choosing a band.
AED 55,000 and AED 3,500 tell a firm when an occasional transaction needs CDD. They say nothing about suspicion. An STR is due whenever there are reasonable grounds to suspect, whatever the amount and even if the transaction was only attempted. CDD for a business relationship is due from the outset at any value, so the amount triggers matter only for occasional customers.
Laundering starts from criminal proceeds and asks whether the person dealt with them knowing their origin, typically to hide it. Terrorist financing starts from the destination and asks whether the person provided or collected funds intending or knowing they would support terrorism. Clean money can finance terrorism, and the funds need not have been used yet.
Where there are reasonable grounds to think that CDD would alert the customer, the firm should not carry it out. That protects the investigation from tipping off; it is not a reason to drop the case. The STR must still be filed, and it must explain why the CDD was not done.
The aggravated band covers a launderer who misuses the influence or power of their profession, who uses an organised crime group or a non-profit organisation to commit the offence, or who has offended before. The amount laundered and a cross-border route are not on that list. Laundering in a company's name brings the separate legal person fine rather than aggravation.
The beneficial ownership test looks first for a natural person with a controlling interest of 25% or more. A signatory, an account opener or a manager is not the beneficial owner just because they act for the company. Senior management officers are checked only if the controlling owner's identity cannot be confirmed, or that person proves not to be the beneficial owner, and if CDD still cannot be completed the firm must not take the customer on.
The exam tests the rules in the study material for syllabus version 4.2. Where the law has changed since, Bourse Prep keeps the exam answer and notes the change separately. The regulator is the authority on current law. All regulatory updates explained.
This is the law the exam tests. Federal Decree-Law No. 10 of 2025 took its place on 14 October 2025, with some penalties and article numbers changed, but the exam is still based on the earlier law.
The CDD, PEP, STR, internal control and record-keeping rules taught here come from Cabinet Decision No. 10 of 2019. Cabinet Decision No. 134 of 2025 took its place on 14 December 2025, but the exam is still based on the earlier rules.
For the exam, basic laundering carries up to 10 years' imprisonment, a fine of AED 100,000 to AED 5,000,000, or both. Under the 2025 law, in force from 14 October 2025, the maximum term and the fine range are unchanged but a minimum term of one year is added; the exam still tests the earlier rule.
For the exam, the fine is AED 300,000 to AED 10,000,000. From 14 October 2025 it is AED 1 million to AED 10 million, but the exam still tests the earlier range.
For the exam, a legal person faces a fine of AED 500,000 to AED 50,000,000. From 14 October 2025 the range is AED 5 million to AED 100 million; the exam still tests the earlier range.
For the exam, a court that convicts a legal person is required to have a summary of the judgment published, with the convicted party paying. From 14 October 2025 the court may, rather than must, make that order; the exam still tests the mandatory rule.
Study tools for the rules in this chapter: side-by-side comparisons, decision paths and procedures. More are collected in Rules Lab.
A member of staff notices a transaction, or an attempted one, that does not fit what the firm knows about the customer.
A report made in good faith carries no administrative, civil or criminal liability and does not breach banking or contractual confidentiality.
A customer with no business relationship with the firm asks for a one-off transaction.
These amount tests are only for occasional transactions; CDD for a business relationship is due from the outset, at any value.
| Foreign PEP | Domestic or international-organisation PEP | |
|---|---|---|
| Identifying the PEP | Firm must take steps to establish if a customer, or a customer's beneficial owner, is a PEP | The same duty to identify applies |
| Senior management approval | Always, before starting the relationship or continuing an existing one | Where the relationship is high risk |
| Source of funds | Reasonable measures to establish it, always | Where the relationship is high risk |
| Ongoing monitoring | Always enhanced | Enhanced where the relationship is high risk |
| Who approves | The firm's own senior management; neither the FIU nor a supervisor pre-clears customers | The same, whenever the extra measures apply |
| Status of the relationship | Permitted with these controls; PEP status is a risk factor, not a prohibition | Permitted; the extra measures depend on the risk |
The learning objectives for this element, as the CISI UAE Financial Rules and Regulations syllabus, Version 4.2, effective 10 September 2023 lists them. Every question in our bank is mapped to one of them.
There are 97 questions on this chapter in the Bourse Prep bank. Filter practice to Chapter 5 and review your errors by section: offences and CDD, then PEPs, prohibitions and STRs, then penalties. Before answering a penalty question, name the conduct and who imposes the sanction, and only then pick the band. When you miss one, read the explanation for the option you chose, because many of the wrong figures belong to a different rule in this same chapter.
15 questions from all eight chapters. The answer is only revealed once you have committed to one.
Start the free UAE FRR demo