The UAE established the General Commercial Gaming Regulatory Authority (GCGRA) in September 2023, transforming from a jurisdiction with a total prohibition on gambling into one of the most closely watched gaming licensing destinations in the world.

Under Federal Decree-Law No. 10 of 2025, gaming operators are now formally classified as Designated Non-Financial Businesses and Professions (DNFBPs). This triggers the full spectrum of UAE anti-money laundering and counter-terrorism financing obligations. Deploying a robust AML screening solution in Dubai is a prerequisite for licensing, not an afterthought.

At First Compliance Solution, we help gaming operators, technology vendors, and key persons build the compliance infrastructure the GCGRA demands. This guide covers everything you need to know.

First Compliance is a KHDA-approved training provider in Dubai, delivering professional development and certification programmes rooted in real-world compliance experience. As regulatory expectations continue to rise across the region, the quality of training has become a strategic priority for individuals and organisations alike. Our programmes are built and delivered by practitioners who have worked inside the compliance challenges our clients face every day, and our use of automated compliance software as part of that learning experience ensures professionals leave genuinely prepared, not just certificated.

The UAE has firmly established itself as one of the most active and tightly regulated jurisdictions for virtual assets in the world. As of 2026, crypto businesses operating anywhere in the Emirates are dealing with a rapidly evolving compliance landscape that touches everything from licensing requirements and transaction monitoring to risk assessments and anti-money laundering controls. Whether you are running a crypto exchange in Dubai mainland, a custodial service in the DIFC, or a payments platform onshore, understanding your regulatory obligations is no longer optional. It is a condition of staying in business.

This blog breaks down the key regulatory developments from VARA and the DFSA, the AML requirements that now apply to virtual asset service providers (VASPs) across the UAE, and how a purpose-built AML screening solution in Dubai can help your business meet these obligations without the operational chaos that often comes with compliance at scale.

The UAE’s exit from the FATF grey list in 2024 was a significant milestone, but it came with a clear expectation: the UAE had to prove that its supervisory regime was genuinely effective, not just compliant on paper. The CBUAE responded in 2025 with one of its most aggressive enforcement campaigns to date, issuing large fines, licence revocations, restrictions, and personal sanctions against individuals in senior compliance roles.

Insurance companies are fully in scope. The CBUAE requires them to run comprehensive AML/CFT programmes covering customer due diligence, enhanced due diligence, suspicious transaction reporting, and sanctions screening, and insurers remain responsible for all of these controls even when certain functions have been delegated to agents or brokers.

FATF was established in 1989 at the G7 Summit in Paris. The original concern was specific: drug trafficking profits were flooding into the global banking system, and no coordinated international mechanism existed to stop it.

The founding logic was simple but powerful. Criminal networks only survive because they can move, hide, and spend the money they make. Disrupt their access to the financial system and you disrupt the enterprise itself.

The mandate has grown significantly since 1989:

Kuwait will remain on the Grey List until FATF conducts an on-site visit and verifies that each item has been fully and effectively addressed.

Grey-listed jurisdictions are not subject to FATF calls for enhanced due diligence or countermeasures. Instead, they are placed under increased monitoring, meaning they must demonstrate measurable progress in implementing FATF recommendations.

Despite the absence of mandatory countermeasures, greylisting has real consequences for businesses dealing with these countries:

Listed: October 2024

Regional Body: MENAFATF

Algeria was added to the grey list with an action plan specifying improvements around implementing risk-based supervision, establishing a framework for basic and beneficial ownership information, enhancing its suspicious transaction reporting procedures, applying financial sanctions for terrorism financing, and conducting oversight of the country’s non-profit sector.

Progress note: At the February 2026 Plenary, FATF made the initial determination that Algeria has substantially completed its action plan and warrants an on-site assessment to verify that the implementation of AML/CFT reforms has begun and is being sustained. Algeria is one of the closest countries to exiting the list.

The UAE’s removal from the FATF grey list in February 2024 marked a turning point, but it also came with an implicit expectation: that the country would continue strengthening its AML/CFT architecture rather than ease off once the immediate pressure had passed. Federal Decree-Law No. 10 of 2025 is the legislative centerpiece of that continued commitment.

The new law addresses gaps that the 2020 Mutual Evaluation identified, incorporates the findings of the UAE’s third National Risk Assessment published in April 2025, and aligns domestic legislation more closely with the FATF’s evolving global standards. It also reflects the realities of a financial landscape that looks very different from 2018, including the rapid growth of virtual assets, the increasing sophistication of financial crime, and the UAE’s expanded role as a global trading and investment hub.

The obligations introduced under Federal Decree-Law No. 10 are not achievable through manual processes alone. The volume, complexity, and speed of data required to meet the new law’s expectations demand a technology-led approach. This is where investing in robust AML compliance software becomes not just useful but essential. A capable platform enables regulated entities to:

• ● Screen customers and transactions against hundreds of global and local sanctions lists in real time
  ● Apply dynamic, risk-based scoring to customer profiles that updates automatically as new information emerges
  ● Monitor transactions continuously for patterns consistent with money laundering, proliferation financing, or tax evasion
  ● Generate and file Suspicious Transaction Reports within the required timeframes
  ● Maintain auditable records of every compliance decision for regulatory inspection
  ● Produce management information and board-level reporting on compliance performance
  ● Document the application of a risk-based approach in a format assessor can verify

Without the right technology embedded in your operations, the gap between what the law now requires and what your organization can demonstrate is likely to be significant.

The 2020 Mutual Evaluation exposed significant weaknesses in the UAE’s AML/CFT system, ultimately leading to grey listing. Since then, the UAE has enacted sweeping reforms. Federal Decree-Law No. 10/2025, which came into effect on 14 October 2025, repealed and replaced the 2018 AML law, introducing standalone offences for proliferation financing, expanding predicate offences to include tax evasion, and explicitly covering digital systems and virtual assets.

The UAE has also launched a national strategy for AML, CTF and proliferation financing for 2024 to 2027, developed on the basis of its third National Risk Assessment, published in April 2025.

Despite this progress, regulators will expect to see that reforms are not just enacted on paper but embedded in day-to-day institutional practice. That distinction, between formal compliance and operational effectiveness, is precisely where the 2026 evaluation will probe hardest.

Institutions should use the months ahead to close gaps before assessors arrive. The following steps are non-negotiable:

• ● Conduct an internal gap analysis against FATF’s 40 Recommendations and the 11 IOs
  ● Update your Business Risk Assessment (BRA) to reflect the 2025 National Risk Assessment findings
  ● Review and stress-test your transaction monitoring rules for false negative rates and STR conversion quality
  ● Ensure beneficial ownership records are accurate, verified, and accessible in real time
  ● Document your risk-based approach to CDD with clear escalation procedures for high-risk customers
  ● Align policies with Federal Decree-Law No. 10/2025, particularly on proliferation financing and virtual assets
  ● Train staff across all levels, including front-line teams, on updated typologies and red flags
  ● Prepare an evidence pack for each IO your organisation is relevant to

Effective compliance monitoring software in Dubai is no longer a nice-to-have at this stage. It is the infrastructure that makes all of the above achievable, auditable, and demonstrable to assessors.

Organised by DNY Communications in collaboration with First Compliance by Adil Zone, this exclusive workshop addresses one of the most critical challenges facing compliance professionals today: “Mastering Advanced Due Diligence in the Age of AI.“

As artificial intelligence continues to transform the compliance landscape, organizations must adapt their Enhanced Due Diligence (EDD) frameworks to leverage these powerful technologies while maintaining robust governance and risk management practices.