Transaction monitoring in the UAE: what the rules require

Article 8 of Cabinet Resolution No. 134 of 2025 requires financial institutions, DNFBPs and virtual asset service providers to monitor every business relationship on an ongoing basis. That has two parts:

• Scrutinising transactions throughout the relationship, to make sure they are consistent with what you know about the customer, their business and their risk, including the source of funds where necessary.
• Keeping due diligence up to date, by reviewing records, with particular attention to high risk customers.

Monitoring is risk based. Under Article 5, where risks are high, enhanced due diligence includes increasing the degree and level of ongoing monitoring and selecting transaction patterns that need further review. Where risks are low and simplified measures apply, the frequency of monitoring can be reduced, unless a crime is suspected.

Politically exposed persons get closer attention: Article 16 requires enhanced ongoing monitoring of relationships with foreign PEPs, and of domestic PEPs where the relationship is high risk.

The Ministry of Economy and Tourism's 2026 DNFBP guidelines describe four methods, used alone or combined depending on the size and complexity of the business:

• Threshold based: set values, volumes or frequencies that trigger a review when exceeded, rated to the customer's risk and reviewed as their activity changes.
• Transaction type: rules for inherently higher risk transactions, such as cash, payments to third parties and cross border wire transfers.
• Geographic: flag transactions involving high risk jurisdictions, including those under international sanctions and on the FATF lists, kept up to date as those lists change.
• Customer based: closer scrutiny of the nature, volume, frequency and reason for transactions of customers rated high risk.

Whether monitoring is automated, semi automated or manual, the guidelines require the systems and procedures to be documented, reviewed periodically for effectiveness, and approved by senior management, with clear responsibility for oversight and action. Thresholds and methods should also be documented and agreed by senior management.

Separately, Article 17 of Cabinet Resolution No. 134 of 2025 requires every reporting entity to set its own indicators of suspicion and keep them updated as methods of crime change.

Under Article 18, if you suspect or have reasonable grounds to suspect that a transaction, an attempted transaction or funds are linked to a crime, whatever the amount, you must file a suspicious transaction report with the Financial Intelligence Unit immediately, through goAML, and respond promptly to requests for more information.

Do not tell the customer. Warning a person or disclosing that a transaction is under review is a criminal offence under Article 29 of Federal Decree Law No. 10 of 2025.

Two DNFBP sectors also have reports triggered by the transaction itself, under the 2026 MoET guidance:

• Real estate (REAR): a freehold purchase or sale where payment includes cash of AED 55,000 or more, any part is paid in a virtual asset, or any funds were converted from or to a virtual asset.
• Precious metals and stones (DPMSR): cash transactions of AED 55,000 or more with resident or non-resident individuals, and transactions of AED 55,000 or more with companies, in cash or by wire.

Both are required even when there are no red flags. If the transaction is also suspicious, the STR is filed as well. Details are on our pages for real estate and precious metals and stones.

Transaction monitoring looks for suspicious behaviour. Sanctions screening looks for designated names, and it has its own triggers (every list update, every new counterparty) and its own reports, the CNMR and PNMR, which are not STRs. A good monitoring setup runs both. See how to screen against the UAE Local Terrorist List.

• Record each customer's expected activity at onboarding, so there is something to compare against.
• Set rules and review frequency by risk rating, and write down why.
• Route every alert to a case with a decision, a reason and a name.
• Keep monitoring records for at least five years, as Article 25 requires for transaction records.

RiskLens360 combines transaction monitoring with sanctions screening, case management and goAML ready reporting. Request a demo.