AML Compliance for UAE Exchange Houses: 2026 Guide - ADZ | Corporate Consulting Services

Last updated: June 2026.

AML compliance for UAE exchange houses sits at the sharp end of the country’s financial crime regime. Exchange houses move cash and cross-border remittances at high volume, which makes them attractive to launderers and a priority for supervisors. This guide explains what the Central Bank of the UAE (CBUAE) expects from money exchange and remittance businesses under Federal Decree-Law No. 10 of 2025, and how to build a programme that holds up under inspection.

Quick Answer: Are exchange houses regulated for AML in the UAE?

Yes. Exchange houses are licensed financial institutions supervised by the Central Bank of the UAE. Under Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, they must run customer due diligence, sanctions and PEP screening, transaction monitoring, and suspicious transaction reporting through goAML, and keep records for at least five years. Registered hawala providers must also register with the CBUAE.

Key Takeaways

Financial institutions, not DNFBPs: Exchange houses are CBUAE-licensed financial institutions, so they carry the full obligations placed on licensed financial institutions, not the lighter DNFBP set.
Cash and corridors drive the risk: High cash volume, remittance corridors, and third-party transfers are the typologies supervisors watch most closely.
Screening is continuous: Customers and counterparties must be screened against the UAE Local Terrorist List and the United Nations Consolidated List, with freezing without delay on a match.
Hawala has its own rule: Registered Hawala Providers must register with the CBUAE and report through goAML.
Reporting route: Suspicious transaction reports go to the UAE Financial Intelligence Unit through the goAML portal, and tipping off is a criminal offence.
Penalty exposure: Administrative fines under Article 17 of Federal Decree-Law No. 10 of 2025 run from AED 10,000 to AED 5,000,000 per violation, with suspension and licence withdrawal on top.

Who regulates exchange houses for AML in the UAE?

The Central Bank of the UAE licenses and supervises exchange houses, money service businesses, and registered hawala providers. The CBUAE sets the AML/CFT rules these businesses follow, inspects them, and imposes penalties for failures. Because an exchange house is a financial institution under UAE law, its obligations are heavier than those placed on Designated Non-Financial Businesses and Professions such as dealers in precious metals and stones.

The legal framework

The rules sit in a stack. Federal Decree-Law No. 10 of 2025 is the primary AML/CFT statute, in force since 14 October 2025, and it replaced Federal Decree-Law No. 20 of 2018. Cabinet Decision No. 134 of 2025, the executive regulations, took effect on 14 December 2025. On top of these sit the CBUAE’s own AML/CFT regulations and guidance for licensed financial institutions. For the parent statute in detail, see our guide to Federal Decree-Law No. 10 of 2025.

Instrument	Role for exchange houses
Federal Decree-Law No. 10 of 2025	Primary AML/CFT framework: FIU powers, STR duty, penalties
Cabinet Decision No. 134 of 2025	Executive regulations: CDD, beneficial ownership, five-year records
CBUAE AML/CFT regulations and guidance	Sector rules and supervisory expectations for licensed financial institutions
Cabinet Decision No. 74 of 2020	Targeted financial sanctions and the freeze-without-delay duty

Why exchange houses carry higher money laundering risk

Exchange houses handle the two ingredients launderers want: cash and movement. A typical branch takes physical cash, converts currency, and sends value across borders in minutes. That speed and reach is the service customers value, and it is also what makes the sector a target. Supervisors expect the controls to match that risk, not a generic template.

Risk driver	What it looks like on the counter
Cash intensity	Large or frequent cash transactions with thin economic rationale
Remittance corridors	Transfers to higher-risk jurisdictions or conflict-affected regions
Structuring	Several smaller transfers split to stay under reporting or CDD thresholds
Third-party transfers	A sender funding transfers for people with no clear relationship
Hawala overlap	Unregistered value transfer competing with, or hidden inside, the formal channel

Core AML obligations for exchange houses

The duties below apply to every licensed exchange house. They are built on a risk-based approach, which means the depth of each control should reflect the risk you have documented in your enterprise risk assessment.

1. Appoint a compliance officer and an MLRO

Every exchange house must appoint a Money Laundering Reporting Officer with the seniority to act independently. The MLRO decides on suspicious transaction reports, sanctions matches, and the relationship with the CBUAE and the FIU. The role and its reporting lines must be documented and resourced.

2. Customer due diligence and beneficial ownership

Identify and verify customers, and identify the beneficial owner where the customer is a legal person, using the 25% ownership or control test. Walk-in remittance customers still need identification, and repeat customers need monitoring across transactions, not just at the first visit. Higher-risk relationships move to enhanced due diligence, with source-of-funds checks.

3. Sanctions and PEP screening

Screen customers, senders, and beneficiaries against the UAE Local Terrorist List and the United Nations Consolidated List, and connect to the alert system so listings reach you as they change. A confirmed match triggers a freeze without delay and a report. Our guide to targeted financial sanctions sets out the steps in full.

Screening too slow or too noisy? First Compliance runs sanctions and PEP screening against 1,800+ sanction lists and 5.5M+ PEP records, with goAML-ready reporting. See how First Compliance works.

4. Transaction monitoring

Monitoring is where exchange house programmes are won or lost. Rules should target the sector typologies: structuring under thresholds, rapid send-and-receive patterns, and corridors that do not fit the customer profile. For practical rule design and false-positive control, see our AML transaction monitoring guide.

5. Suspicious transaction reporting through goAML

When a transaction cannot be explained, the MLRO assesses whether grounds for suspicion exist and, if they do, files a report through the goAML portal. The test is suspicion, not proof. For the filing mechanics, see our UAE STR filing guide.

6. Record-keeping and training

Keep customer records, transaction data, and internal analysis for at least five years, and make them retrievable on request. Train counter staff, tellers, and managers on red flags, escalation, and the tipping-off rule, because the first sign of a laundering attempt usually shows at the counter.

Registered hawala providers

Hawala and other informal value transfer providers operate inside a specific UAE regime. Registered Hawala Providers must register with the CBUAE, apply the same core AML controls, and report suspicious activity through goAML. Treating hawala as outside the rules is one of the clearest ways to attract enforcement, because the activity is squarely inside the AML perimeter.

Red flags for exchange houses and remittance businesses

A customer who breaks a large transfer into several smaller ones across a day or a week.
Remittances to a corridor with no link to the customer’s stated profile or residence.
A sender funding transfers for multiple unrelated beneficiaries.
Reluctance to provide identification, or providing documents that do not reconcile.
Cash volumes that do not match the customer’s stated occupation or income.
Sudden changes in transfer patterns after a long period of steady activity.

Penalties for non-compliance

The CBUAE can fine, suspend, or withdraw a licence. For an exchange house, the licence is the business, so an AML failure is not a fine to absorb, it is a threat to the right to operate.

Consequence	Detail
Administrative fine	AED 10,000 to AED 5,000,000 per violation under Article 17 of Federal Decree-Law No. 10 of 2025
Supervisory action	Warning, restriction, suspension, or withdrawal of the licence
Criminal exposure	Money laundering offences can carry higher court-imposed fines on legal persons and custodial sentences on individuals
Correspondent risk	Loss of banking and correspondent relationships following enforcement

Facing a CBUAE inspection? ADZ runs independent AML/CFT audits and gap analyses for UAE-regulated financial institutions. Book an independent AML audit and fix the gaps before an inspector finds them.

Building the enterprise risk assessment

Every control in an exchange house programme should trace back to a documented risk assessment. The CBUAE expects the assessment to cover customers, products, delivery channels, and geographies, and to be specific to your business rather than a copied template. A branch network in cash-heavy districts has a different profile from a digital remittance app, and the assessment should say so.

Geography deserves particular attention. Map your remittance corridors and rate each one for risk, using credible sources on jurisdiction risk and sanctions exposure. Where a corridor carries higher risk, the assessment should drive tighter thresholds and closer monitoring for transfers along it. Update the assessment when you add a corridor, a product, or a payment method, and review it at least once a year.

The assessment is also the document that defends your decisions. When an inspector asks why a control is set the way it is, the answer should be in the risk assessment. A programme that cannot explain its own thresholds tends to lose that conversation.

Correspondent banking and counterparty risk

Exchange houses depend on banking and correspondent relationships to settle and move funds. Those relationships come with their own due diligence expectations. Your correspondents will assess your AML controls, and a weak programme can cost you the banking access the business runs on. This is one of the practical reasons AML quality is a commercial issue, not only a regulatory one.

Apply due diligence to the counterparties and agents you work with, understand who they are and who controls them, and monitor the activity that flows through them. An agent network spreads your reach, and it spreads your risk, so the controls over agents should match the volume and the corridors they handle.

A Day-1 AML build checklist for exchange houses

Whether you are licensing a new exchange house or rebuilding an existing programme, the sequence below sets out the core build. Each step should be operational, not just written.

Complete an enterprise-wide money laundering and terrorist financing risk assessment, including a corridor-by-corridor view.
Appoint an MLRO and document the compliance reporting lines and resourcing.
Write AML/CFT policies and procedures mapped to the risk assessment.
Stand up CDD and KYC for walk-in and repeat customers, with beneficial ownership identification for legal persons.
Connect sanctions and PEP screening, and register for the alert system so listings reach you in time.
Configure transaction monitoring rules for structuring, rapid send-and-receive, and corridor mismatches.
Register with the goAML portal and test the reporting workflow before you need it.
Train counter staff, tellers, and managers on red flags, escalation, and the tipping-off rule.
Build a five-year record-keeping and retrieval system.
Run an independent gap review before launch, and on a regular cycle afterward, ahead of any inspection. Our guide on preparing for a UAE AML inspection sets out what supervisors look for.

How ADZ supports exchange houses

ADZ is a UAE-based practitioner firm. We build and run compliance programmes rather than only writing about them. For an exchange house that means advisory support to design the programme around your risk assessment, First Compliance software for sanctions and PEP screening, transaction monitoring, and goAML reporting, and Compliance 360 training to bring counter staff and managers up to the standard the CBUAE expects. If you would like a mapping of your obligations, our advisory team can help.

Independent audit and ongoing assurance

Supervisors expect an exchange house to test its own programme, not just run it. An independent AML audit reviews whether the controls you designed are working in practice, from CDD files and screening alerts to monitoring rules and STR quality. The value is in finding the gaps before an inspector does, while you still have time to fix them.

An audit looks at evidence, not intentions. It samples real customer files, checks whether high-risk cases received enhanced due diligence, reviews how sanctions and PEP alerts were resolved, and tests whether suspicious activity was reported on time. The output is a list of findings ranked by risk, with practical remediation steps. Running this on a regular cycle, and after any major change to products or corridors, keeps the programme honest between supervisory visits.

For a money exchange or remittance business, assurance is also a commercial safeguard. Correspondent banks ask about your AML controls, and a clean independent review is one of the strongest signals you can give them that the relationship is low risk to maintain.

Frequently Asked Questions

Are exchange houses DNFBPs in the UAE?

No. Exchange houses are licensed financial institutions supervised by the Central Bank of the UAE, not Designated Non-Financial Businesses and Professions. They carry the full set of AML/CFT obligations placed on financial institutions.

Who supervises AML for money exchange and remittance in the UAE?

The Central Bank of the UAE. It licenses exchange houses and registered hawala providers, sets their AML/CFT rules, inspects them, and imposes penalties for breaches.

Do hawala providers have to register?

Yes. Registered Hawala Providers must register with the Central Bank of the UAE, apply core AML controls, and report suspicious activity through the goAML portal.

How do exchange houses report suspicious transactions?

Through the goAML portal of the UAE Financial Intelligence Unit. The MLRO assesses the grounds for suspicion, files the report with a clear narrative and supporting evidence, retains the acknowledgment, and must not tip off the customer.

What records must an exchange house keep?

Customer identification records, transaction data, internal analysis, and correspondence, for at least five years from the end of the relationship or the date of the transaction, retrievable on request.

What are the penalties for AML breaches?

Administrative fines under Article 17 of Federal Decree-Law No. 10 of 2025 run from AED 10,000 to AED 5,000,000 per violation, alongside suspension or withdrawal of the licence. Money laundering offences can also carry criminal penalties.