TRW & Co · AML, sanctions and investigations
AML Training in the UAE: Legal Requirements and a Sample Annual Plan
AML training UAE requirements apply to every bank, DNFBP and virtual asset firm. The 2025 AML law and its executive regulation require trained staff; supervisors expect role-based, annually refreshed, tested and recorded training. This guide explains who must be trained, what to cover, how to evidence it and offers a sample annual plan.
Key pointSupervisors now test whether training changes behaviour, not just whether it was delivered: they interview front-line staff and compare training records with the quality of internal suspicion reports.
At a glance
Legal basis
Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, effective 14 December 2025, require reporting entities to maintain trained staff as part of their internal controls.
Role-based content
Central Bank guidance issued in August 2025 expects separate training for the board, front line, compliance team, internal audit and staff who tune monitoring systems.
Annual training plan
Supervisors expect a documented, management-approved annual plan setting audiences, topics, delivery methods, minimum standards, dates and assessment criteria, driven by a training needs assessment.
Tipping off focus
Disclosing that a suspicious transaction report has been or will be made is a criminal offence; front-line staff need approved wording for paused or delayed transactions.
Records retained
Keep dates, attendees, materials and test results with your AML records; federal rules require at least five years and ADGM guidance points to six years.
Swipe or scroll →
The short answer: is AML training UAE law mandatory?
Yes. AML training UAE obligations apply to every financial institution, designated non-financial business or profession (DNFBP) and virtual asset service provider. The federal AML law and its executive regulation require reporting entities to keep staff trained on their policies, red flags, reporting duties and the ban on tipping off, and every supervisor checks training records during inspections.
The legal duty itself is short. What turns it into a working programme is supervisory guidance: training must be role-based, refreshed at least annually, tested, recorded and approved by senior management. A one-hour generic video, repeated every year for every employee, is unlikely to satisfy an examiner in 2026.
This guide explains where the duty comes from, who must be trained on what, how to record it, and how the rules differ onshore, in the free zones and in the DIFC and ADGM. It ends with a sample annual training plan you can adapt.
The legal framework behind AML training UAE requirements
The starting point is Federal Decree-Law No. (10) of 2025 on anti-money laundering, combating the financing of terrorism and proliferation financing, which replaced the 2018 law in October 2025. It requires financial institutions, DNFBPs and virtual asset service providers to put in place internal policies, controls and procedures proportionate to their risks, and staff training is one of those controls. Our guide to the 2025 UAE AML law covers the wider changes.
The detail sits in Cabinet Resolution No. (134) of 2025, the executive regulation, which took effect on 14 December 2025 and replaced Cabinet Resolution No. 10 of 2019. Like its predecessor, it expects reporting entities to run ongoing training programmes so that employees understand the law, the firm's procedures, the indicators of suspicion and their own reporting obligations.
Supervisory guidance fills in the detail
Each supervisor translates the legal duty into expectations. The most detailed is the Central Bank of the UAE's Best Practices on Implementing Role-Based AML/CFT/CPF Training, issued in August 2025. It does not create new obligations, but it explains how the Central Bank expects existing ones to be met: an annual training needs assessment, a board-approved annual training plan, content tailored to each line of defence, effectiveness testing and retained records.
In the DIFC, the DFSA's AML module requires firms to ensure that officers, managers and employees are adequately informed and trained on their AML policies and procedures. In ADGM, the FSRA's governance quick guide for DNFBPs calls for initial training and training at least annually, with additional training for customer-facing staff and logs of dates, content and attendees.
| Business type and location | Supervisor | What the supervisor expects to see |
|---|---|---|
| Banks, exchange houses, finance companies, insurers, payment and stored-value providers (onshore) | Central Bank of the UAE | Training needs assessment, board-approved annual plan, role-based modules for each line of defence, testing and records |
| Securities and investment firms (onshore) | Capital Market Authority | Training proportionate to risk, covering policies, red flags and reporting |
| Real estate brokers, precious metals dealers, accountants, corporate service providers | Ministry of Economy and Tourism | Documented training for staff and the compliance officer, available at inspection |
| Lawyers and legal consultants | Ministry of Justice | Training for those handling covered transactions and client money |
| Virtual asset service providers in Dubai | VARA | Training built into the compliance and risk management framework |
| DIFC firms and DNFBPs | DFSA | Adequate training of officers, managers and employees under the AML module |
| ADGM firms and DNFBPs | Financial Services Regulatory Authority (FSRA) | Initial and at least annual training, extra for customer-facing staff, training logs |
Commercial free zone companies outside the DIFC and ADGM generally fall under the federal rules and their sector supervisor, not a separate free zone training regime. If you are unsure who supervises you, start with our AML compliance practice or the guide to DNFBP obligations.
Who must be trained, and on what
The single biggest shift in supervisory thinking is from "everyone does the same course" to role-based training. Different people make different decisions, so they need different knowledge. A useful map follows the three lines of defence plus the board.
Board, owners and senior management
Directors approve the risk assessment, the risk appetite and the compliance budget. They need to understand the firm's main money laundering, terrorist financing and proliferation financing exposures, the findings of the enterprise-wide risk assessment, open audit and inspection findings, and their own personal exposure. The 2025 law lets managers be held personally liable where an offence results from a breach of their duties, which makes board training a matter of self-protection as well as governance. See our guide to directors' duties and liability.
Front-line and customer-facing staff
Relationship managers, brokers, cashiers, sales teams and onboarding staff are where suspicion is first noticed and where tipping off most often happens. Their training should focus on customer due diligence, recognising red flags in their own product line, internal escalation and what they may and may not say to a customer once a concern is raised.
The compliance officer and second line
The compliance officer (MLRO) and their team need deeper, technical training: changes to the law and regulation, alert adjudication, writing a good suspicious transaction report, sanctions and proliferation financing controls, responding to law enforcement requests and the firm's risk methodology. Supervisors expect the compliance officer's own professional development to be documented.
Internal audit, IT and support functions
Internal audit needs to know how to test the design and effectiveness of the AML programme. Staff who configure, tune or validate screening and monitoring systems need to understand what the rules are meant to catch. The Central Bank guidance also expects IT and other support functions to be covered in the annual plan, and HR should know how to handle internal suspicions without alerting the subject.
What an effective AML training UAE programme covers
Content should be tailored to your products, customers, delivery channels and geographies, and should reflect the National Risk Assessment and any sector risk assessment. Within that, five topics belong in almost every AML training UAE programme.
Red flags specific to your business
Generic indicators ("unusual transactions") teach little. Use your own typologies: a buyer paying for property through several unrelated third parties, gold purchased in cash just below a reporting threshold, a trade customer whose invoices do not match shipping volumes, or a corporate client whose ownership chain changes repeatedly without commercial reason. Draw examples from FIU typology reports and your own past internal reports, anonymised.
Internal escalation and suspicious transaction reporting
Staff must know exactly how to raise an internal suspicion report, to whom, in what form and how quickly, and that the compliance officer, not the employee, decides whether to file a suspicious transaction report with the UAE Financial Intelligence Unit through goAML. They should also understand that reporting in good faith is protected. Our guide to goAML registration and suspicious transaction reporting explains the filing side.
Tipping off
It is a criminal offence to disclose, directly or indirectly, that a report has been or will be made or that an investigation is under way. Tipping off rarely looks deliberate: it is a relationship manager explaining a delay as "compliance is looking at this", or an operations team telling a client which document triggered a review. Training should include approved wording for delays and role-play of difficult customer calls.
Targeted financial sanctions and proliferation financing
Staff who onboard customers or process payments must know that a confirmed match against the UAE Local Terrorist List or the UN Consolidated List requires freezing without delay and reporting, and how to escalate potential matches. Proliferation financing is now a standalone pillar of the law, so trade, logistics and dual-use goods red flags belong in the curriculum. See our guide to targeted financial sanctions and screening.
Customer due diligence and record-keeping
Front-line staff should know when standard, simplified and enhanced due diligence apply, how to identify beneficial owners, how to treat politically exposed persons and what records to keep. Federal rules require due diligence and transaction records to be kept for at least five years; ADGM's guidance points to a longer six-year period for its firms. Our guide to customer due diligence and EDD goes deeper.
A sample annual plan for AML training UAE compliance
The Central Bank expects an annual training plan that sets out participants, topics, objectives, delivery methods, minimum standards by role, dates and assessment criteria. The plan below is an illustrative template for a mid-sized reporting entity; scale it to your size and risk.
| Timing | Audience | Module | Format | Evidence kept |
|---|---|---|---|---|
| On joining, before customer contact | All new joiners | AML basics, firm policy, internal reporting route, tipping off | E-learning plus policy attestation | Completion record, test score, signed attestation |
| Quarter 1 | Board and senior management | Risk assessment results, regulatory changes, personal liability, inspection findings | Live briefing | Board minutes, slides, attendance |
| Quarter 1 to 2 | Front-line and onboarding staff | Product-specific red flags, CDD and EDD, PEPs, sanctions escalation | Workshop with case studies | Attendance, scenario test results |
| Quarter 2 | Compliance team | STR quality, goAML, TFS and PF updates, law enforcement requests | External or specialist session | CPD log, materials, certificates |
| Quarter 3 | Operations, finance, IT, HR | Payment and screening controls, data, internal investigations without tipping off | Targeted e-learning | Completion and test records |
| Quarter 4 | All staff | Annual refresher with new typologies and lessons from the year's internal reports | E-learning with assessment | Completion rate, pass rate, follow-up for failures |
| As triggered | Affected teams | New product, new law, audit or inspection finding, role change | Ad hoc briefing | Trigger log and attendance |
Two features make a plan credible. First, it is driven by a documented training needs assessment linked to the enterprise-wide risk assessment. Second, it is approved by the board or senior management and tracked by a named owner, usually the compliance officer.
How to build an AML training programme that withstands inspection
- Map roles to risk. List every role, the AML decisions it makes and the risks it touches, using your enterprise-wide risk assessment as the base.
- Run a training needs assessment. Identify gaps from audit findings, inspection reports, the quality of internal suspicion reports and any repeated control failures.
- Write the annual plan. Set audiences, modules, formats, minimum standards per role, dates and pass marks, and have it approved by the board or senior management.
- Build or source content. Use UAE law and your own cases. If you use an external provider, vet its expertise and check that materials reflect the 2025 law, not the 2018 regime.
- Deliver and test. Combine e-learning with live sessions for higher-risk roles, and test understanding with scenario questions rather than recall quizzes.
- Record everything. Keep dates, attendees, materials, test results and follow-up actions in a form you can produce quickly to a supervisor.
- Measure effectiveness. Track completion and pass rates, but also the number and quality of internal suspicion reports and repeat findings.
- Review and refresh. Update content when the law, products, risk assessment or typologies change, and at least once a year.
AML training UAE records: what inspectors ask for
During an inspection, supervisors commonly ask for the training policy, the needs assessment, the annual plan with evidence of its approval, materials, attendance and completion data, test results and evidence that non-completers were followed up. They may also interview front-line staff to see whether training has stuck: a broker who cannot explain how to escalate a concern undermines a perfect completion rate.
Keep training records with the rest of your AML records and for at least the same retention period. Digital learning platforms make this easier, but export reports periodically so records survive a change of provider.
The most persuasive training evidence is a link between training and behaviour. If internal suspicion reports rose after a red-flag workshop, or a repeated onboarding error disappeared after targeted training, record it. Supervisors are increasingly testing whether a programme works, not just whether it exists.
Illustrative scenario: a real estate brokerage
This scenario is illustrative; the parties are generic. A Dubai brokerage with a dozen agents has an AML policy and a compliance officer, and every agent completed a generic online course two years ago. During a supervisory inspection, the inspector asks two agents what they would do if a buyer wanted to pay part of the price through a company owned by a relative. Neither mentions the compliance officer or the internal reporting form, and one says he would ask the buyer directly whether the money was "clean".
The brokerage receives findings on training and on the internal reporting process. Its remediation plan includes a training needs assessment, a short live workshop built around property-specific red flags, third-party payments and tipping off, approved wording for agents to use when a deal is paused, a refresher every year and an attendance and test log. Six months later, agents are raising internal reports, the compliance officer is documenting decisions, and the next inspection has a different conversation. For sector detail, see our guide to AML in UAE real estate.
Common AML training mistakes and how to avoid them
Using the same generic course for everyone
A single off-the-shelf course is efficient but rarely sufficient. Supervisory guidance expects content tailored to the firm's products, customers and channels, and to each role. A treasury dealer, a cashier and a board member face different risks and make different decisions. Keep a common baseline module for all staff, then add role-specific modules for higher-risk functions. Document why each audience receives what it receives, so you can explain the design to an inspector.
Content still built on the 2018 law
Materials that cite only Federal Decree-Law No. 20 of 2018 and Cabinet Resolution No. 10 of 2019 now look stale. The 2025 law made proliferation financing a standalone pillar, widened predicate offences to include tax evasion, lowered the knowledge threshold and increased penalties for companies. Update references, examples and the consequences section, and retrain the compliance team first so that they can answer questions accurately.
Testing recall, not judgement
Multiple-choice questions about definitions show that someone read the slides; they do not show that the person would act correctly. Use short scenarios drawn from your own business: a customer who refuses to explain a source of funds, a sanctions near-match, a request to split payments. Set a pass mark, require re-training for failures and use aggregated results to target the next year's content.
Forgetting the board and the support functions
Firms often train customer-facing staff thoroughly but give directors a slide in an annual board pack. Supervisors expect senior management to understand the risk assessment and their oversight duties, and the Central Bank guidance specifically covers IT and support functions. HR, finance and IT staff can all see red flags or create tipping-off risk, especially during internal investigations or when handling data requests.
No record of who was trained and when
If it is not recorded, it did not happen as far as an inspector is concerned. Keep attendance, dates, materials and results for every session, including live briefings, and track completion for new joiners and staff who change roles. Gaps in records are among the easiest findings for a supervisor to make and among the easiest for a firm to avoid.
Cross-border groups and what to do next
Groups headquartered abroad often roll out a global AML course. That is a sound base, but it should be supplemented with UAE-specific content: goAML reporting, the UAE sanctions lists and freezing obligations, local tipping-off rules, threshold reporting for sectors such as precious metals and real estate, and the identity of the local supervisor. Where staff in the UAE serve customers in Bangladesh, India, the UK, Singapore or the wider GCC, add the red flags associated with those corridors.
To bring your AML training UAE programme up to date, we suggest four steps: confirm your supervisor and its guidance, benchmark your current programme against the 2025 law and that guidance, approve a role-based annual plan, and set up records you can produce on request. Embedding training in your wider employment policies also helps make completion a condition of role changes and performance reviews.
TRW & Co advises on the legal side: gap analyses against the 2025 law, policies and procedures, tipping-off and escalation protocols, board briefings and tailored workshops, and support during inspections and remediation. Where AML work sits alongside accounting, bookkeeping or audit support, that work is delivered with our group company A&A Consultancy, while TRW & Co covers the legal and regulatory side. Where representation before UAE courts is required, we work alongside locally licensed advocates. To discuss your AML training UAE needs, contact our Dubai team at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Is AML training mandatory in the UAE?
Yes. Federal Decree-Law No. 10 of 2025 and its executive regulation, Cabinet Resolution No. 134 of 2025, require financial institutions, DNFBPs and virtual asset service providers to maintain internal controls that include training staff on AML obligations. Supervisors such as the Central Bank, the Ministry of Economy and Tourism, the DFSA and the FSRA all check training during inspections. The law does not prescribe a single course, so the programme must be proportionate to the firm's size and risk, but having no documented training at all is a clear compliance failure.
02How often must staff receive AML training?
New joiners should be trained before they deal with customers, and existing staff should receive refresher training at least annually. ADGM guidance for DNFBPs expressly calls for initial and at least annual training, and the Central Bank expects an annual training plan based on a yearly needs assessment. Additional training should be triggered by new products, changes in the law, audit or inspection findings and role changes. Higher-risk roles, such as the compliance team and relationship managers, usually need more frequent and deeper sessions.
03What topics should AML training cover?
At minimum: the UAE AML law and the firm's own policies, customer due diligence and enhanced due diligence, red flags specific to the firm's products and customers, the internal route for raising suspicions, suspicious transaction reporting through goAML, the prohibition on tipping off, targeted financial sanctions and freezing obligations, proliferation financing and record-keeping. Board training should also cover the risk assessment results, regulatory changes and directors' oversight responsibilities and personal exposure.
04Can we use an online course from an international provider?
Yes, as part of the programme, but it should rarely be the whole programme. Supervisors expect content tailored to UAE law and to your business. A global course may not cover goAML, the UAE Local Terrorist List, local freezing duties, sector threshold reports or the 2025 law. The Central Bank's guidance also expects firms to carry out due diligence on external training providers and to check that materials reflect UAE requirements. Supplement a global course with UAE-specific modules and live sessions for higher-risk roles.
05What training records do supervisors expect?
Supervisors typically ask for the training policy, needs assessment, approved annual plan, materials, attendance and completion data, test results and evidence that people who failed or missed training were followed up. Keep these with your other AML records for at least the applicable retention period: at least five years under the federal rules, with ADGM guidance referring to six years for its firms. Make sure records can be produced quickly, and export them regularly if they sit on a third-party learning platform.
06Does the compliance officer need separate training?
Yes. The compliance officer and their team need deeper, technical training than other staff, covering changes in law and guidance, alert adjudication, writing quality suspicious transaction reports, sanctions and proliferation financing controls, and how to respond to requests from the FIU and law enforcement. Supervisors expect this professional development to be documented. In smaller firms where the compliance officer has other roles, it is especially important to show they have the knowledge to perform the function independently.
Sources and official materials
- Federal Decree-Law No. (10) of 2025 on AML, CFT and proliferation financing — The federal AML law requiring internal controls, including staff training
- Cabinet Resolution No. (134) of 2025 (executive regulation) — Executive regulation effective 14 December 2025
- CBUAE: Best Practices on Implementing Role-Based AML/CFT/CPF Training (August 2025) — Role-based training, annual plan, delivery, assessment and records
- DFSA: AML, CTF and sanctions regulatory framework — DIFC AML module and training of officers and employees
- ADGM: AML/CFT governance framework quick guide for DNFBPs — Initial and annual training, training logs and record retention in ADGM
- UAE Financial Intelligence Unit — Receives suspicious transaction reports through goAML
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
