The UAE Cabinet Resolution No. (134) of 2025 Regarding the Executive Regulations of Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing (134/2025 Cabinet Resolution) mandates the appointment by Licensed Financial Institutions (LFIs) of a Compliance Officer (CO) at the management level who must, among other things, have independence in decision-making[1]. The 134/2025 Cabinet Resolution does not expressly or impliedly permit or prohibit an outsourcing or delegation of the CO’s functions or responsibilities. In any event, before appointing their COs, LFIs must obtain the prior approval of the appointment by their respective supervising authorities.[2]
The Operational Risk Management Regulation (C 1/2026 Effective from 14/9/2026) (2026 ORM Regulation) applies to the LFIs that are juridical persons (that is, banks, (re)insurance companies, and other financial institutions, including those which carry on all or a part of their activities and business in accordance with the rules and principles of Islamic Sharia) which are either incorporated in the UAE or a branch or subsidiary in the UAE of a financial institution incorporated outside the UAE or in Financial Free Zones. The 2026 ORM Regulation stresses that, as a general principle, an LFI must not overly rely on outsourcing and maintain sufficient staff, expertise, and resources of its own to perform effectively and to manage the activities for which it is licensed,[3] but does not go as far as to prohibit any outsourcing. It does state all LFIs are required to implement a comprehensive framework to manage operational risk and operational resilience and sets out in detail the minimum requirements in this regard. These include the requirement for an LFI’s Master System of Record to be continuously maintained and stored within the UAE (subject to a conditional exception made for branches of foreign financial institutions), including in the case of outsourcing, risk assessment of the proposed arrangement with a third-party service provider and conducting appropriate due diligence on it, mandatory provisions for outsourcing contracts, and the obligation to maintain adequate resources to manage and monitor third-party service arrangements and to have the related control measures addressed in its internal control system (the minimum but not an exhaustive scope of which is set out in the 2026 ORM Regulation). The Central Bank of the UAE (CBUAE) may issue standards or guidelines that further elaborate on the requirements of this regulation. These are not yet publicly available. There are however existing standards and guidelines that remain in force, which will have of course been taken fully into account by LFIs by now when considering the extent to which they can justify and are permitted to contract with third-party service providers to perform any of the tasks of their COs.
Under the Joint Guidance on the AML/CFT/CPF Compliance Officer/Money Laundering Reporting Officer Function in the United Arab Emirates Supervisory Sub-Committee (2025 Joint Guidance), an LFI must not outsource the role of the CO nor the entire compliance function under any circumstances. The 2025 Joint Guidance permits an LFI to outsource specific AML compliance tasks, such as the Enhanced Due Diligence, AML/CFT Training, Framing AML/CFT Controls, System Support, subject to the prior receipt of a Letter of No Objection from the CBUAE as its supervisory authority.[4] The 2025 Joint Guidance also seems to permit delegation of responsibilities of the CO to a manager or staff member with other responsibilities, except where they concern day-to-day responsibility for sales and/or customer business development management[1], and the other role and function strict criteria are satisfied.The 2025 Joint Guidance represents, as it says, a unified framework for the appointment, authority, and responsibilities of the CO (or Money Laundering Reporting Officer) across the UAE’s sectors regulated by regulated, registered, and supervised by the CBUAE, among other supervisory authorities, and their expectations for regulated entities to be able to demonstrate compliance with its provisions.
Several other relevant frameworks currently exist, both issued before and in the implementation of the Federal Decree by Law No. (20) of 2018 Regarding Anti-Money Laundering, the Financing of Terrorism, and the Financing of Illegal Organizations, as amended, which has itself been repealed by the Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing.
The Internal Controls, Compliance and Internal Audit Standards (C 161/2018 STA Effective from 30/10/2018) permit outsourcing by banks of specific tasks of the compliance function, but not the function itself, and subject to appropriate oversight by the head of compliance[2] and other conditions.
Under the Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business (N 35/2018 STA), the exchange houses must appoint a CO who must be given the specific responsibility of managing its AML/CFT compliance function[3]. The role of Compliance Officer must not be combined with any other functions of the licensee.[4]
The Guidance for the Insurance Sector (Effective from 31/10/2022) envisages an outsourcing or agency scenario, whereby the outsourced entity applies CDD or other AML/CFT measures on behalf of the delegating insurer, in accordance with the insurer’s internal policies and procedures, and is subject to the insurer’s control of the effective implementation of those policies and procedure by the outsourced entity, including the inclusion of an outsourced entity in its own AML/CFT program and internal control processes, and monitoring of such entity for compliance with its internal AML/CFT policies and procedures. Outsourced entities should also be subject to the employee and agent screening and monitoring checks.
The Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations Guidelines for Financial Institutions (Effective from 13/7/2023) (2023 CBUAE Guidelines) recognise, as does the 2025 Joint Guidance, that there may be governance issues within some LFIs that may operate as small or mid-sized businesses which may result in a delegation of the role of the CO[5]. While making it clear that is not a valid reason for a non-compliance with law and regulations, the 2023 CBUAE Guidelines set out the necessary steps for such LFIs to take to mitigate it.
The onus of ensuring and demonstrating robust measures have been taken and the documentation is put in place to ensure compliance with statutory obligations, including law and the 2026 ORM Regulation, and frameworks and guidelines, lies with LFIs. It would be prudent for LFIs to ensure they are in compliance by 14 September 2026 when the Operational Risk Management Regulation comes into effect.
[1] Articles (21) and (22) of the 134/2025 Cabinet Resolution.
[2] Paragraph 18 of Article (49) and (22) of the 134/2025 Cabinet Resolution.
[3] Paragraph 13.2. of the 2026 ORM Regulation.
[4] Clause 4.2. of the 2025 Joint Guidance.
[5] Clause 3.1. of the 2025 Joint Guidance.
[6] Paragraph 11, Article (3), and paragraph (6) of Article (6) of the Internal Controls, Compliance and Internal Audit Standards (C 161/2018 STA Effective from 30/10/2018).
[7] Paragraph 16.4.1 of the Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business.
[8] Paragraph 16.4.7 of the Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business.
[9] Paragraph 8.6 of 2023 CBUAE Guidelines.
The UAE Federal Decree by Law No. (36) of 2023 Regarding the Regulation of Competition (2023 Competition Law) has been in force for a while. There has, however, been, to an extent, a lack of further details to enable its effective implementation. These have since been rolled out, including by the UAE Cabinet Resolution No. (59) of 2026 Regarding the Executive Regulations of Federal Decree by Law No. (36) of 2023 Regarding the Regulation of Competition, the UAE Cabinet Resolution No. (105) of 2026 Regarding the Fees Prescribed for the Implementation of Federal Decree by Law No. (36) of 2023 Regarding the Regulation of Competition, and ministerial decisions and guidelines by the UAE Ministry of Economy & Tourism.
The requirement to comply with this body of UAE law and regulations extends to any person, its associated person or any association of such persons, regardless of its legal form, including the head office of the undertaking or branches of its representative office,[1] in relation to any activity it/they carry out that relates to any production, distribution or supply of products and goods or provision of services in the UAE[2], to the use of intellectual property rights inside and outside the UAE, and to such activities if practiced outside the UAE but affecting competition in the UAE.[3]
It would be advisable for the affected businesses to conduct a thorough analysis of the scope of this important and significantly developed body of law and regulations and the effect it has on their current or proposed arrangements, including
and either comply with it (with application fees for any required exemptions being relatively modest), or face fines, claims for damages, and a potential criminal action. There are limited exceptions provided for by the 2023 Competition Law and limited exemptions by the UAE Ministry of Economy & Tourism in place (Regulation of competition Legislations | Ministry of Economy & Tourism - UAE). The requirement for compliance with this body of law and regulations should not be underestimated.
[1] Definition of the term “undertaking” in Article (1) of the 2023 Competition Law refers.
[2] Definition of the term “economic activity” in Article (1) of the 2023 Competition Law refers.
[3] Article (3) of the 2023 Competition Law but subject to exclusions under its Article (4).