Individual Accountability in AML: Why the Institution Getting Fined Is No Longer the Whole Story

For years, regulatory enforcement in AML followed a familiar pattern. A bank was found to have weak controls, the regulator issued a fine, the institution absorbed the cost, and the individuals who had actually approved the account or cleared the alert rarely appeared in the story at all. That pattern is now changing, and nowhere faster than in the UAE, where a sweeping legal reform has made individual accountability, not just institutional liability, a central pillar of enforcement.

The Law, and When It Actually Took Effect

The UAE's new anti-money laundering framework is Federal Decree-Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing, published in the Official Gazette on 30 September 2025 and in force from 14 October 2025. It repeals Federal Decree-Law No. 20 of 2018 in its entirety (Article 41). The Executive Regulations implementing it, Cabinet Resolution No. (134) of 2025, followed on 14 December 2025. Every specific article and figure below is drawn directly from the published text of the law, as reflected in the Central Bank of the UAE's own Rulebook.

What Actually Constitutes Individual Fault

The law creates two distinct layers of personal exposure, and it's worth being precise about the difference between them.

The underlying money laundering offence, under Article 2, is committed by anyone who "knows, or [has] sufficient indications or evidence to believe" that funds derive from a predicate offence and who then converts, conceals, acquires, or otherwise deals with those proceeds. That "sufficient indications" wording is a lower bar than proof of actual intent, and several law firms tracking the reform have described it as pushing the threshold toward a "knew or should have known" standard.

Separately, and more specifically relevant to executives and compliance officers, Article 27(5) addresses the manager or director of a company where the company itself has committed money laundering, terrorism financing, or proliferation financing. It states that "the person responsible for the actual management of the legal person shall be punished by imprisonment and a fine, or by either of the two penalties, if it is proven that they were aware thereof and that the commission of such Crime was due to their breach of the duties of their position." This is a narrower test than Article 2's: it requires proof of actual awareness, combined with a personal breach of duty that caused the offence — not simply working at a company where something went wrong.

The Penalties on the Table

The law sets out penalties in layers, depending on who is being punished and for what. Individuals convicted of money laundering itself face, under Article 26, imprisonment of one to ten years, plus a fine of AED 100,000 to AED 5,000,000, or an amount equal to the value of the criminal property, whichever is greater. Where aggravated circumstances apply — the offender abused a position of professional authority, acted through a non-profit organization or organized criminal group, or has a prior conviction — Article 26(2) raises that to temporary imprisonment plus a fine of AED 1,000,000 to AED 10,000,000, or twice the value of the criminal property.

For legal entities whose representatives commit the offence on their behalf, Article 27(1) sets a fine of AED 5,000,000 to AED 100,000,000, or the value of the criminal property, whichever is greater. Managers and directors personally, under Article 27(5), face imprisonment, a fine, or both — the law does not fix a separate numerical range for this specific clause, leaving the exact penalty to the court within the framework set elsewhere in the law.

Short of criminal prosecution, Article 17 gives supervisors a set of administrative penalties: a warning; a fine of AED 10,000 to AED 5,000,000 per violation; barring the person from the relevant sector; restricting the powers of board members or executives found responsible, including installing a temporary supervisor; suspending or requiring the replacement of named directors or executives; suspending the license itself; or revoking it outright. Fines increase for repeated violations within a year, and the regulator may publicize the penalty.

No Limitation Period Changes the Calculation Entirely

Article 37(2) states plainly that criminal proceedings for money laundering, terrorism financing, and proliferation financing "shall not lapse by prescription," and that the penalties themselves, along with any related civil claims, do not expire with time either. For anyone in a compliance or management role, that removes the idea of a deferred or time-limited risk entirely — a decision made today can, in principle, still be examined years later.

A Real Case That Shows Where Enforcement Is Already Heading

The clearest illustration of this shift arrived before the new law was even in force, under the UAE's separate Central Bank Law. On 20 May 2025, the Central Bank of the UAE announced a AED 200 million fine against an unnamed exchange house for "significant failures" in its AML/CFT framework, issued under Article 137 of Decretal Federal Law No. 14 of 2018 (the Central Bank Law). Alongside the institutional fine, the CBUAE separately imposed a personal fine of AED 500,000 on the branch manager involved, and permanently banned that individual from holding any position at a licensed financial institution in the UAE — reported at the time by The National.

The timing matters: this personal sanction predates Federal Decree-Law No. 10 of 2025 by nearly five months, showing that regulators were already moving toward individual accountability under existing powers, well before the new law gave that instinct a formal legislative basis.

Why the UAE Is Moving Quickly Right Now

This isn't happening in isolation. The UAE was removed from the Financial Action Task Force's "grey list" of jurisdictions under increased monitoring on 23 February 2024, and its next full FATF mutual evaluation — the fifth-round assessment testing whether these reforms translate into real enforcement, not just stronger statutes — is scheduled for June 2026. Firms tracking the space, including DLA Piper, have noted the new law's arrival is deliberately timed in the run-up to that evaluation.

Not a UAE-Only Story

Holding named individuals personally accountable for institutional AML failures isn't a UAE invention. The UK's Senior Managers and Certification Regime has applied a similar logic for over a decade, attaching personal responsibility to specific senior roles rather than leaving liability solely with the institution. What's distinct about the UAE's version is how many tools are arriving together — a lower knowledge threshold for the underlying offence, a specific personal-liability clause for managers, administrative powers to remove executives directly, and no limitation period on any of it — all landing within a matter of months of each other.

Looking Ahead

As enforcement activity in the UAE continues at pace — six exchange houses fined a combined AED 12.3 million in June 2025 alone, according to Herbert Smith Freehills Kramer's tracking of CBUAE actions — the practical takeaway for compliance officers and senior managers is straightforward: the file that once protected the institution and the file that protects you personally are no longer automatically the same document, and under a law with no expiry date on liability, that gap is one worth closing now rather than later.