UAE AML Crypto Compliance: Federal Law and VARA Requirements
UAE AML Crypto Compliance: Federal Law and VARA Requirements
UAE AML Framework for Crypto Businesses
The UAE applies a dual-layer AML framework for virtual asset businesses: Federal AML Law (Federal Decree-Law No. 20/2018) applies universally, while VARA adds VASP-specific requirements for Dubai mainland operations. Both layers must be satisfied simultaneously.
Core AML Obligations
- Customer identification and verification (KYC)
- Enhanced due diligence for high-risk customers and PEPs
- Ongoing transaction monitoring and suspicious transaction reporting
- Record-keeping for minimum 5 years
- Regular AML training for employees
- Independent AML audit at least annually
VARA-Specific AML Requirements
VARA licensees must maintain an AML program that meets both Federal AML standards and VARA's enhanced requirements, which include real-time transaction monitoring, cross-border transfer screening, and quarterly compliance reporting to VARA.
Suspicious Transaction Reporting
File STR with the UAE Financial Intelligence Unit (FIU) within 24 hours of identifying suspicious activity. VARA must also be notified. Failure to report carries severe penalties including license revocation and criminal prosecution.
Frequently Asked Questions
Does the UAE apply the FATF Travel Rule?
Yes. The UAE Central Bank and VARA require VASPs to comply with the FATF Travel Rule for all virtual asset transfers, with no de minimis threshold for domestic transfers.