Month: June 2026

UAE ESG Reporting Is Now a Compliance Obligation: What Businesses Must Do After the May 2026 Deadline

UAE ESG Reporting Is Now a Compliance Obligation: What Businesses Must Do After the May 2026 Deadline

ESG Reporting Platform Dubai

For years, ESG reporting in the UAE was voluntary. Businesses that disclosed their environmental, social, and governance performance did so as a signal to investors, not because the law required it. That era is over. If your organisation operates in a regulated sector and you are still trying to understand what the post-May 2026 landscape means for you, working with an ESG reporting platform in Dubai is no longer optional. It is where compliant, audit-ready businesses are starting.

Federal Decree-Law No. 11 of 2024 on the Reduction of the Effects of Climate Change entered into force on 30 May 2025, with a full compliance deadline of 30 May 2026. It applies to all public and private entities in the UAE, including free zones and state-owned enterprises, that generate greenhouse gas emissions. If your organisation has not yet acted, the question is no longer whether to comply. It is how quickly you can close the gap.

Does This Apply to Your Business? Understanding Who Is In Scope

This is where many businesses get the picture wrong, in both directions. Some assume the law only targets oil, gas, and heavy industry. Others assume it catches every business equally regardless of size or sector. Neither is accurate.

The law applies to all mainland and free zone entities across industrial, commercial, and service sectors, with no minimum revenue threshold. Applicability is determined by the nature of your business activities and the volume of emissions generated, not by company size or turnover.

In practical terms, this means:

The law primarily targets high-emission sectors including logistics, shipping, manufacturing, real estate developers, and energy-intensive operations. These businesses face the most immediate, clearly defined obligations and are where enforcement attention is concentrated first.

Businesses in high-emission sectors, as defined by the upcoming executive regulations, are required to comply from their assigned reporting year. Smaller businesses and lower-emission service sector firms may have voluntary pathways initially but should prepare for eventual inclusion.

So if you run a small professional services firm, you are technically in scope because every business generates some Scope 1 and Scope 2 emissions, but active enforcement is not currently directed at low-emission service businesses. The more immediate pressure for those businesses will likely come from clients, particularly large corporates and financial institutions, who need to account for supply chain emissions in their own Scope 3 reporting.

If you operate in financial services, fintech, real estate, logistics, manufacturing, construction, or any regulated sector, your obligations are direct, immediate, and enforced.

What the Law Requires

For in-scope businesses, the core obligations under Federal Decree-Law No. 11 of 2024 are:

  • Measurement and documentation of Scope 1 and Scope 2 GHG emissions
  • Registration on the national Measurement, Reporting, and Verification (MRV) platform
  • Use of MOCCAE-approved methodologies, primarily ISO 14064 or the GHG Protocol
  • Independent third-party verification by a MOCCAE-accredited verifier before submission
  • A structured, documented emissions reduction plan
  • Retention of all supporting data and calculations for a minimum of five years for regulatory review

Self-reported data alone does not satisfy the law. Emissions reports must be independently verified by a MOCCAE-accredited third-party verifier before submission.

On Scope 3: Federal Decree-Law No. 11 currently mandates Scope 1 and Scope 2 reporting. However, MOCCAE has indicated the framework will expand, and businesses should begin cataloguing Scope 3 data now, as Scope 3 visibility will be essential for future compliance cycles and green financing assessments.

Penalties for Non-Compliance

Administrative fines range from AED 50,000 to AED 2,000,000 depending on the nature, severity, and impact of the violation. MOCCAE and other authorised bodies enforce the law through regular inspections, detailed audits, and mandatory corrective orders. For repeat offences within two years of a prior conviction, fines may be doubled.

Beyond financial penalties, appearing on a regulatory adverse list carries long-term consequences for banking relationships, investor confidence, and contract eligibility, particularly for businesses serving government entities or regulated counterparties.

What In-Scope Businesses Must Do Now

If your compliance programme is incomplete, these are the priority actions:

Action Detail
Emissions inventory Establish a verified Scope 1 and Scope 2 GHG inventory
MRV platform registration Register with MOCCAE’s national platform if not completed
Methodology alignment Use ISO 14064 or GHG Protocol as approved by MOCCAE
Framework alignment Align disclosures with IFRS S1/S2, ISSB, TCFD, or GRI
Third-party verification Engage a MOCCAE-accredited independent verifier
Reduction plan Document a structured, time-bound emissions reduction strategy
Records retention Maintain all supporting data for a minimum of five years

Companies commonly underestimate three implementation challenges: ESG data fragmentation across departments, Scope 3 emissions complexity, and greenwashing risk from vague disclosures without data backing. Each requires a systematic approach, not a one-time document exercise.

Why Regulated Businesses Need an ESG Reporting Platform in Dubai

ESG sustainability software Dubai

Manual ESG data collection across departments is one of the most common bottlenecks compliance teams face. Spreadsheets pulling from separate HR, facilities, and procurement systems create version control problems, audit trail gaps, and verification failures that a MOCCAE-accredited verifier will flag immediately.

An ESG reporting platform in Dubai built for the UAE regulatory environment removes these bottlenecks by centralising data collection, automating emissions calculations, and generating audit-ready outputs aligned with applicable frameworks.

For regulated businesses managing AML, KYC, sanctions screening, and ESG obligations simultaneously, the operational value of an integrated compliance platform is significant. First Compliance’s Regulatory Reporting module is designed to handle exactly this kind of multi-framework environment, connecting data across your compliance obligations and reducing the manual burden on your team.

Selecting the right compliance platform is not just a technology decision. It is a risk management decision. Organisations relying on fragmented manual processes face higher exposure to data inaccuracies, missed deadlines, and third-party verification failures.

The Enforcement Phase Has Begun

The May 30, 2026 deadline has passed. For financial institutions, real estate developers, logistics operators, and all regulated businesses in the UAE, the obligation is now active and enforceable. Every week without a compliant emissions inventory, a registered MRV account, or a verified reduction plan increases both penalty exposure and the cost of remediation.

First Compliance is ready to support your team through this transition. Whether you are building a programme from scratch or strengthening an existing one, our platform and our specialists are built for this environment. Schedule a free demo today.

Frequently Asked Questions

Does Federal Decree-Law No. 11 of 2024 apply to free zone companies?

 Yes. The law explicitly covers all mainland and free zone entities operating in the UAE. Free zone registration does not exempt a business from its obligations under the Climate Change Law.

 Scope 1 covers direct emissions from sources your business owns or controls, such as company vehicles and fuel combustion. Scope 2 covers indirect emissions from purchased electricity and cooling. Scope 3 covers all other indirect emissions across your value chain, including those from suppliers and clients. The law currently mandates Scope 1 and Scope 2 reporting, with Scope 3 anticipated from 2027.

 No. Self-reported data alone does not satisfy the requirements of Federal Decree-Law No. 11 of 2024. All submissions must be independently verified by a MOCCAE-accredited third-party verifier before they are considered compliant.

 Administrative fines range from AED 50,000 to AED 2,000,000 per violation. Repeat offences within two years can double the penalty. Additional consequences include business suspension, loss of operating licences, mandatory corrective action, and placement on a regulatory adverse list.

 It centralises your emissions data collection, automates calculations using MOCCAE-approved methodologies, maintains a five-year audit trail, and generates verification-ready reports aligned with required frameworks including IFRS S1/S2, TCFD, and GRI. For businesses managing multiple compliance obligations, an integrated platform reduces duplication, eliminates manual errors, and ensures nothing falls through the gaps.

Proliferation Financing Is Now a Standalone Offence in the UAE: What Your Compliance Programme Needs to Add

Proliferation Financing Is Now a Standalone Offence in the UAE: What Your Compliance Programme Needs to Add

Compliance Monitoring Software in Dubai

The UAE’s financial crime framework has undergone its most significant overhaul in years. For compliance officers, MLROs, and senior management at financial institutions and DNFBPs, one change in particular demands immediate attention. Article 3 of Federal Decree-Law No. 10 of 2025 introduces proliferation financing as a standalone criminal offence for the first time, making it illegal to finance, without authorisation, arms or weapons of mass destruction. Proliferation financing now sits alongside anti-money laundering and counter-terrorist financing as one of the three principal offences under UAE law. If your compliance programme has not been updated to reflect this, it is no longer fit for purpose. Compliance monitoring software in Dubai built to manage the full AML/CFT/CPF framework is now a baseline requirement, not a competitive advantage.

What Federal Decree-Law No. 10 of 2025 Actually Changed

Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing was issued in October 2025 and became effective on 14 October 2025. It repeals and replaces Federal Law No. 20 of 2018, ushering in a stricter and more comprehensive regime.

The key changes compliance teams need to understand are:

  • Proliferation financing is now recognised as a standalone criminal offence under Article 3, covering the financing of weapons of mass destruction, dual-use goods, and related technologies.
  • The law marks a shift from a reactive, compliance-tick-box regime into a proactive, intelligence-driven ecosystem. It integrates proliferation financing controls so that financing of weapons of mass destruction and related dual-use materials falls squarely within the compliance regime.
  • The law also introduces personal liability for managers, lowers the knowledge threshold for offences, and widens the regulatory perimeter to capture virtual asset service providers.
  • Criminal proceedings for money laundering, terrorism financing, and proliferation financing can now be initiated at any time, regardless of how many years have passed since the offence occurred. Past violations can be prosecuted indefinitely, creating permanent legal risk.

Who is in Scope

The businesses directly regulated under Federal Decree-Law No. 10 of 2025 are financial institutions, designated non-financial businesses and professions (DNFBPs), virtual asset service providers (VASPs), and some non-profit organisations with cross-border funding risks.

DNFBPs include real estate brokers and agents, lawyers, auditors, accountants, notaries, and dealers in precious metals and stones. Regulators segment oversight by sector: the CBUAE covers banks and finance, the Securities and Commodities Authority covers capital markets, the Insurance Authority covers insurance, the Ministry of Economy covers DNFBPs, and DIFC and ADGM authorities cover their respective free zones.

If your business falls into any of these categories, your compliance obligations under the new law are active, enforced, and carry personal liability for senior management.

What Your Compliance Programme Must Now Include

The introduction of proliferation financing as a standalone offence means your existing AML/CFT framework needs specific additions. A programme built for the 2018 law is not sufficient under Federal Decree-Law No. 10 of 2025. All regulated entities, including financial institutions, DNFBPs, and VASPs, are required to identify, assess, and mitigate proliferation financing risks within their AML/CFT compliance framework. The specific additions your programme must now address:
Compliance Area What Is Required
Risk assessment Update your enterprise-wide risk assessment to include a dedicated proliferation financing risk category
Policies and procedures Revise AML/CFT policies to explicitly reference CPF obligations and red flags
Sanctions screening Implement targeted financial sanctions screening specifically for PF-related designations
Customer due diligence Reassess CDD procedures to identify customers and transactions with proliferation financing exposure
Transaction monitoring Update monitoring rules and typologies to flag PF red flags, including dual-use goods transactions
Staff training Train employees on identifying PF-specific suspicious activity and their reporting obligations
Record keeping Document all compliance activities including CDD, monitoring, and reports
Beneficial ownership Tighten beneficial ownership verification, particularly for complex or layered structures

Industry advisers highlight the need to re-assess risk appetites, enhance screening and transaction monitoring systems, revisit governance arrangements, and ensure that management information and escalation processes reflect the heightened liability environment.

The Penalties and Personal Liability Exposure

The consequences of non-compliance under the new law are significantly more severe than under the 2018 framework.

Businesses must upgrade systems, governance, and internal controls immediately to avoid fines of up to AED 100 million and potential dissolution.

Senior officers can face personal prosecution, asset freezing, travel bans, and imprisonment for failure to comply with AML obligations. The introduction of personal liability is one of the most significant practical shifts in the new law. Compliance is no longer solely a corporate obligation. It is a personal one for every director and senior manager at a regulated entity.

Why Compliance Monitoring Software in Dubai Is Now a Necessity

AML Compliance Monitoring Software in Dubai

The expanded scope of Federal Decree-Law No. 10 of 2025 places demands on compliance programmes that manual processes simply cannot meet. Proliferation financing risk assessment requires real-time sanctions screening, transaction monitoring calibrated to PF typologies, documented CDD trails, and audit-ready records maintained indefinitely given the removal of the statute of limitations.

Compliance monitoring software in Dubai designed for the UAE’s regulatory environment gives compliance teams the infrastructure to meet these requirements systematically rather than reactively. At First Compliance, our platform covers every dimension of this framework:

For regulated businesses managing three distinct criminal offence categories simultaneously, the operational case for integrated compliance monitoring software in Dubai has never been clearer.

Act Now, Not After an Inspection

The inclusion of proliferation financing as a standalone offence creates a new risk profile that directors must be mindful of when conducting business in the UAE. Directors must ensure there are adequate AML, CFT, and proliferation financing procedures in place to deal with greater scrutiny and oversight.

Every regulated business in the UAE now operates under a three-offence compliance obligation. The firms that update their frameworks now, with the right compliance monitoring software in Dubai supporting their teams, will be the ones that face inspections with confidence rather than exposure.

First Compliance is ready to support your team through this transition. Schedule a free demo to see how our platform covers every requirement of Federal Decree-Law No. 10 of 2025.

Frequently Asked Questions

What is the difference between proliferation financing and terrorist financing under the new law?

 Terrorist financing involves providing funds to support terrorist acts or organisations. Proliferation financing specifically covers the financing of the development, production, acquisition, or transfer of weapons of mass destruction, including nuclear, chemical, biological, and radiological weapons, as well as dual-use goods and related technologies. Under Federal Decree-Law No. 10 of 2025, both are now standalone criminal offences alongside money laundering.

 Yes. DIFC and ADGM authorities are specifically named as supervisory bodies under the new framework, and the law applies to all regulated entities operating in the UAE regardless of whether they are mainland or free zone registered.

 Dual-use goods are items, materials, software, or technologies that have legitimate civilian applications but can also be used in the development of weapons of mass destruction. Transactions involving dual-use goods are a key proliferation financing red flag under the new law and must be captured within your transaction monitoring typologies and CDD procedures.

 The law has been in force since 14 October 2025 and the executive regulations under Cabinet Resolution No. 134 of 2025 became applicable from 14 December 2025. Compliance obligations are active now. Any regulated entity that has not yet updated its risk assessment, policies, and screening systems is already operating outside the requirements of the law.

 It automates the screening of customers and transactions against PF-specific sanctions lists, flags dual-use goods transactions through configurable monitoring rules, maintains a documented audit trail for every CDD and risk assessment decision, and generates the regulatory reports required for FIU submission. For senior management facing personal liability under the new law, an auditable, systematic compliance record is not just operationally useful. It is a legal protection.

Why UAE Gaming Operators Need a Reliable AML Screening Solution in Dubai

Why UAE Gaming Operators Need a Reliable AML Screening Solution in Dubai

AML screening solution Dubai

The UAE established the General Commercial Gaming Regulatory Authority (GCGRA) in September 2023, transforming from a jurisdiction with a total prohibition on gambling into one of the most closely watched gaming licensing destinations in the world.

Under Federal Decree-Law No. 10 of 2025, gaming operators are now formally classified as Designated Non-Financial Businesses and Professions (DNFBPs). This triggers the full spectrum of UAE anti-money laundering and counter-terrorism financing obligations. Deploying a robust AML screening solution in Dubai is a prerequisite for licensing, not an afterthought.

At First Compliance Solution, we help gaming operators, technology vendors, and key persons build the compliance infrastructure the GCGRA demands. This guide covers everything you need to know.

Part 1: The UAE Gaming Market in Context

From Prohibition to a Federal Licensing Regime

The UAE Penal Code previously prescribed fines of up to AED 20,000 and up to two years’ imprisonment for gambling participants, and up to ten years’ imprisonment for organisers.

The regulatory shift was driven by economics. Research indicated that even a 1.6% gaming contribution to GDP could generate approximately USD 6.6 billion annually, a meaningful diversification of the UAE’s economic base beyond oil and tourism.

On 3 September 2023, WAM (Emirates News Agency) announced the GCGRA’s establishment by federal decree, with a mission to “create a socially responsible and well-regulated gaming environment, ensuring that all participants adhere to strict guidelines and comply with the highest standards.” The GCGRA’s founders framed this not as an abandonment of cultural values, but as a responsible entertainment framework built on player safety, financial crime prevention, and responsible gaming.

Key Milestones

January 2024: Mahzooz and Emirates Draw paused operations to pursue GCGRA licensing.
July 2024: The Game LLC received the UAE’s first Lottery License.
November 2024: The UAE national lottery launched, including the AED 100 million “Lucky Day” jackpot.
October 2024: Wynn Resorts received the UAE’s first casino license for a USD 3.9–5 billion integrated resort on Al Marjan Island, Ras Al Khaimah, opening early 2027.
December 2024: The GCGRA issued a Consumer Advisory Notice warning against unlicensed operators.
April 2025: The GCGRA signed an MOU with New Jersey gaming regulators for cross-border regulatory cooperation.
Late 2025: Play971 became the UAE’s first licensed online gaming and sports betting platform.
1 June 2026: Federal Decree-Law No. 25 of 2025 came into effect, making GCGRA-licensed gaming contracts enforceable in UAE civil courts for the first time.
Morgan Stanley estimates the UAE gaming market could generate USD 3–5 billion in gross gaming revenue annually, making a GCGRA licence one of the most commercially significant regulatory permits available in the industry right now.

Part 2: The GCGRA's Structure and Mandate

The GCGRA is headquartered in Abu Dhabi and holds exclusive federal jurisdiction to regulate, license, and supervise all commercial gaming activities across all seven emirates. It operates with three core mandates: establishing and enforcing regulatory standards, overseeing financial crime prevention, and promoting responsible gaming through evidence-based player protection programmes.

The Four Categories of Regulated Gaming

Internet Gaming: Online casino games, eSports betting, and fantasy sports across all digital platforms. The definition is intentionally broad to accommodate new formats as they emerge.

Land-Based Gaming Facilities: Physical casinos, gaming floors, and slot halls. Wynn Al Marjan Island is the flagship project, with further licences expected.

Sports Wagering: Regulated betting on sporting events under GCGRA technical standards.

Lotteries: The GCGRA intends to maintain one official lottery. Existing games like Big Ticket and Dubai Duty Free may continue under GCGRA supervision, but no new lottery licences will be granted.

Technical Standards

The GCGRA has partnered with Gaming Laboratories International (GLI) to adopt GLI-19 (Interactive Gaming Systems) and GLI-33 (Event Wagering Systems) as its technical benchmarks.

Operating Without a Licence

Engaging in, conducting, or facilitating commercial gaming in the UAE without a GCGRA licence is illegal. Penalties include heavy fines, imprisonment, and business closure.

AML compliance software

Part 3: GCGRA Licensing - Types, Eligibility, and Process

Who Must Apply?

Every business and individual involved in any aspect of commercial gaming must obtain the appropriate licence before commencing activities, not just operators.

Licence Types

Entity Licences cover Gaming Operators, Gaming-Related Vendors and Suppliers, and Key Persons at the corporate level.

Individual Licences cover Key Persons (individuals) and Gaming Employees involved in the operation, supervision, or management of a licensed entity.

A single gaming operation may require multiple licence types. A resort operating a casino floor with proprietary software would need both a Gaming Facility Operator licence and a Gaming Technology Supplier licence.

Eligibility Requirements

The GCGRA evaluates all applicants against standards of integrity, financial capacity, and operational competence. Core criteria include a clean regulatory record across all operating jurisdictions, sufficient financial resources, and a detailed business plan incorporating responsible gaming frameworks, an AML compliance programme, and technical infrastructure specifications.

The Six-Step Licensing Process

Step 1: Intake Form. Submit the GCGRA Intake Form with company information, ownership structure, key persons, and intended licence types.

Step 2: Initial Screening and Portal Access. The GCGRA conducts preliminary screening. If in scope, the applicant gains access to the licensing portal.

Step 3: Full Documentation Submission. Submit corporate filings, AML/KYC policies, technical certifications, a responsible gaming programme, and key personnel documentation.

Step 4: Suitability Investigation. The GCGRA conducts background checks, financial verification, and operational capability assessments.

Step 5: Assessment and Approval. No formal deadline is set, but the GCGRA is committed to a smooth process. Applicants should plan for several months.

Step 6: Ongoing Monitoring. Licensing is not a one-time event. Operators face continuous compliance obligations and regular GCGRA engagement.

Documentation Checklist

● Constituent documents and certificate of registration
● Detailed business plan with financial forecasts and organisational charts
● AML/CFT compliance programme documentation
● Responsible gaming programme
● Technical specifications and independent laboratory certifications
● Key personnel backgrounds and declarations
● Proof of financial stability
● Local representative contact details

Part 4: AML/CFT Compliance Under the GCGRA

Gaming Operators Are Now DNFBPs

Cabinet Resolution No. 134 of 2025 formally includes gaming operators in the DNFBP definition under Article 3, Item 1. The AML threshold is a single or linked transaction at or above AED 11,000. At that level, the full UAE AML/CFT compliance framework applies.

Federal Decree-Law No. 10 of 2025 replaced the 2018 AML law, coming into effect on 14 October 2025. Cabinet Resolution No. 134 of 2025 followed on 14 December 2025 as its implementing regulation.

This is a significant structural shift for the gaming industry. Operators that previously had no formal AML obligations now sit within the same regulatory perimeter as financial institutions and real estate brokers. An effective AML screening solution in Dubai is not a compliance add-on for gaming businesses. It is the backbone of a licensable operation.

The Legal Framework at a Glance

● Federal Decree-Law No. 10 of 2025 on Combating Money Laundering, Terrorist Financing, and Proliferation Financing
● Cabinet Resolution No. 134 of 2025 (Executive Regulations)
● FATF Recommendation 22 (Enhanced CDD for casinos)
● The 2025 Commercial Gaming Policy Paper (GCGRA sector-specific guidance)
● Cabinet Decision No. 74 of 2020 (Targeted Financial Sanctions)

Core AML Obligations for Gaming Operators

  1. Customer Due Diligence (CDD): Operators must verify customer identities at onboarding. For online platforms this means Emirates ID verification with Arabic OCR and tamper detection, alongside international documents for expatriate and tourist users, and beneficial ownership identification under Cabinet Decision No. 109 of 2023.
  2. Enhanced Due Diligence (EDD): EDD is mandatory for Politically Exposed Persons (PEPs) and their associates, high-value customers, clients from high-risk jurisdictions, and customers displaying unusual transactional behaviour.
  3. Sanctions Screening: Operators must screen against the UAE Local Terrorist List and the UN Security Council Consolidated List under Cabinet Decision No. 74 of 2020. This must happen in real time, not as a periodic batch process. Any AML screening solution in Dubai deployed for gaming must cover both lists with continuous monitoring.
  4. Suspicious Transaction Reporting (STR): All STRs must be filed with the UAE Financial Intelligence Unit via the goAML platform. The GCGRA supervises reporting culture but does not receive STRs directly.
  5. Five-Year Record Retention: All CDD records, transaction records, and compliance documentation must be retained for a minimum of five years and made available to supervisory authorities on request.
  6. Enterprise-Wide Risk Assessment (EWRA): Operators must continuously assess and document ML/TF/PF risks across customer types, products, geographies, and delivery channels, aligned with the 2024 UAE National Risk Assessment.
  7. Designated MLRO: Every licensed operator must appoint a qualified Money Laundering Reporting Officer. Boards and senior management carry explicit responsibility for AML/CFT oversight.
  8. Staff Training: All relevant staff must receive regular, documented AML/CFT training covering gaming-specific typologies including structuring, chip washing, and layering through gaming platforms.

Part 5: Why a Dedicated AML Screening Solution in Dubai Is Central to Gaming Compliance

Gaming platforms process high transaction volumes, serve high-net-worth and international clientele, handle cash-equivalent instruments, and are attractive to those seeking to launder proceeds through the apparent legitimacy of winnings. Manual screening cannot meet the speed, accuracy, or scale that the GCGRA and Federal Decree-Law No. 10 of 2025 require.

The UAE national lottery operator, The Game LLC, is the clearest market example. The company deployed an AI-powered screening system that screens participants against PEP databases, sanctions lists, and adverse media reports to ensure no high-risk individuals can access lottery services. The system was integrated in under 11 weeks.

This is the standard the GCGRA expects. Any operator that approaches screening as a manual or ad hoc process will not survive regulatory scrutiny. A purpose-built AML screening solution in Dubai is the only practical answer.

What the Screening Solution Must Cover

PEP Screening: Real-time detection of domestic and foreign Politically Exposed Persons and their networks. Both PEP categories require EDD including source of wealth and source of funds verification. PEP status is time-bound and must be monitored continuously.

Sanctions Screening: Coverage across 1,300+ global watchlists and 200+ sanctions lists, including UAE-specific lists, UN consolidated lists, and enforcement databases.

Adverse Media Screening: Negative news monitoring identifies customers connected to financial crime or reputational risk who may not yet appear on formal sanctions lists.

Transaction Monitoring: Continuous monitoring for structuring, unusual deposit and withdrawal patterns, rapid chip conversion, and other gaming-specific money laundering typologies.

goAML Integration: The solution must support timely, high-quality STR submissions to the UAE FIU through the goAML portal.

Name Screening at Onboarding: Automated name screening at the point of customer registration is the first line of defence. Speed and accuracy here directly determine how much manual review burden the compliance team carries downstream.

Part 6: Responsible Gaming Obligations

The GCGRA treats responsible gaming as a core regulatory pillar. Every licensed operator must submit a Responsible Gaming Programme covering the following:
Self-exclusion mechanisms allowing players to voluntarily exclude
Deposit and loss limits configurable daily, weekly, and monthly
Cooling-off periods enforced at the platform level
Age verification with all marketing restricted to persons aged 18 and over, with no targeting of minors or vulnerable individuals
Staff training on identifying and assisting problem gamblers
Dedicated Responsible Gaming Officer responsible for programme oversight and GCGRA liaison

Part 7: Cybersecurity and Technical Compliance

GCGRA compliance extends to platform integrity and data protection. Mandated controls include:
● Platform penetration testing and vulnerability assessments
● Random Number Generator (RNG) certification by a GCGRA-approved laboratory
● Secure encryption for player data and financial transactions
● Payment system integrity controls
● Incident response plans for cybersecurity breaches and data protection incidents
● Player data protection in compliance with UAE data privacy law

Part 8: Enforcement and Penalties

The GCGRA has modelled its enforcement powers on regulators from New Jersey and Las Vegas. Non-compliance carries serious consequences.

Financial Penalties: Fines calibrated to the severity and duration of the breach. Under the broader UAE AML framework, administrative fines can reach AED 5,000,000 per violation.

Licence Suspension or Revocation: Serious or persistent AML failures or unlicensed operation can result in immediate suspension or permanent revocation.

Criminal Liability: Operating without a licence or facilitating unlicensed gaming may constitute a criminal offence. Violations of licensing requirements under Federal Decree-Law No. 10 of 2025 carry fines of not less than AED 200,000 and up to AED 10,000,000, plus potential imprisonment.

Cross-Border Enforcement: The GCGRA’s MOU with New Jersey regulators and its FATF-aligned framework enable active cooperation with international counterpart authorities.

Operators should also note that AML failures specifically trigger the harshest regulatory responses. A gap in your sanctions screening process, a missed PEP match, or a failure to file an STR are not minor administrative infractions in the UAE. They are grounds for licence revocation. This is precisely why selecting and deploying the right AML screening solution in Dubai must happen before you go live, not after your first supervisory review.

Part 9: The June 2026 Civil Code Reform

Federal Decree-Law No. 25 of 2025 (effective 1 June 2026) removed Articles 1012–1019 from the UAE Civil Transactions Law, eliminating the civil-law basis that treated gaming contracts as void. GCGRA-licensed gaming contracts are now enforceable in UAE civil courts for the first time. Unregulated gaming remains illegal.

For operators, this means contractual certainty with vendors, suppliers, and players, and a materially reduced risk profile for institutional investors. It also signals that the UAE is committed to building a permanent, mature gaming jurisdiction rather than a transitional regulatory experiment.

Part 10: Building Your Compliance Programme - A Practical Framework

Governance: Appoint a qualified MLRO with appropriate seniority. Establish Board-level AML/CFT oversight with documented accountability and a compliance committee with regular reporting lines.

Risk Assessment: Conduct an EWRA covering customer, product, geographic, and delivery channel risk. Map it to the UAE National Risk Assessment 2024 and the 2025 Commercial Gaming Policy Paper. Review annually or following material business changes.

Customer Onboarding and KYC: Deploy identity verification for Emirates IDs and international documents. Implement real-time PEP, sanctions, and adverse media screening at onboarding. Build risk-based CDD profiles with clear EDD triggers. The onboarding workflow is where your AML screening solution in Dubai does its most critical work. Get it right from the start.

Transaction Monitoring: Deploy a system with gaming-specific typology rules. Set thresholds aligned with the AED 11,000 DNFBP trigger. Integrate STR workflows directly with goAML.

Policies and Procedures: Document all AML/CFT policies in line with Cabinet Resolution No. 134 of 2025 and the 2025 Commercial Gaming Policy Paper. Review and approve annually at senior management level.

Trainin: Deliver regular, documented training to all relevant staff. Include gaming-specific typologies and case studies. Maintain training records for GCGRA inspection.

Regulatory Reporting: Register on goAML before commencing operations. Establish clear escalation and investigation procedures. Retain all records for a minimum of five years.

Ready to Build Your GCGRA-Compliant AML Programme?

Whether you are planning your GCGRA licence application, building your AML/CFT framework from scratch, or stress-testing an existing programme against Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, First Compliance Solution is your partner.

Contact us today for a confidential consultation. Our specialists will assess your compliance posture, identify gaps against GCGRA and UAE AML requirements, and design a tailored roadmap to full regulatory readiness.

This blog is intended for informational purposes and does not constitute legal advice. First Compliance Solution recommends engaging specialist advisors for all GCGRA licensing and AML compliance matters.

Scroll to top