Legal Framework for Money Exchange Operations in the UAE

Money exchangers and remittance houses in the UAE operate within a strict legal and regulatory framework designed to safeguard the financial system, protect customers, and prevent misuse for money laundering or terrorist financing. The framework rests on two complementary pillars: (a) the Central Bank of the UAE (CBUAE) licensing and supervision regime for exchange businesses; and (b) the UAE’s anti-money-laundering / counter-terrorist financing (AML/CFT) laws and implementing regulations. Together, they define who may operate, how they must operate, and the compliance systems they must maintain. 

CBUAE licensing & supervisory regime (exchange business rules) 

The CBUAE is the licensing and prudential supervisor for exchange houses. Its rulebook and dedicated “Regulations regarding Licensing and Monitoring of Exchange Business” set out the core licensing conditions, permissible activities, fit-and-proper requirements for owners and management, capital and prudential safeguards, and ongoing reporting and inspection powers. 

Key regulatory features include: 

• • Licensing requirement & permitted activities – An entity must obtain a licence from CBUAE to carry out exchange business (foreign currency exchange, money remittances, WPS payroll services, etc.). The Regulations define the scope of permitted activities and require prior approval for any expansion. Rulebook 

• • Capital and financial safeguards – Minimum capital and, in some cases, security deposits or capital buffers are required depending on the category and scale of services provided (the CBUAE Rulebook sets out the relevant standards). Rulebook+1Rulebook+1 

• • Fit & proper and governance – Directors, senior management and beneficial owners must satisfy “fit and proper” criteria (honesty, competence, experience). The CBUAE expects robust governance, internal controls, and independent compliance functions. Rulebook 

• • Operational & prudential requirements – Licensed exchanges must maintain proper accounting records, internal audit, IT resilience, data protection and business continuity plans; they are subject to on-site inspections and periodic reporting to the Central Bank. Guidance and sector-specific manuals are available from the CBUAE. Rulebook 

• • Emirati partner requirements: To license an exchange house, there is a mandatory requirement to have a UAE national holding a majority shareholding in the exchange house. 

Practical implication: new entrants or acquirers must factor in capital requirements, compliance staffing, and the lead time for CBUAE review when planning market entry. 

This blog is a part of our General Corporate and Commercial Advisory Services and Setting Up or Acquiring a Money Exchange in the UAE: Legal, Regulatory & Strategic Guide Blogpost.

UAE AML/CFT law — Decree-Law No. 20 (2018) and implementing rules 

The second pillar is the UAE’s AML/CFT legal architecture. The Federal Decree-Law No. (20) of 2018 (and subsequent amendments) establishes the broad criminal and regulatory framework for combating money-laundering and terrorist financing. Its implementing regulations (Cabinet Decision No. 10 of 2019) set out detailed obligations for “obliged entities” — a category that explicitly includes exchange houses and remittance service providers. Central Bank of the UAEUAE Legislation 

Core AML/CFT obligations for exchange businesses include: 

• • Customer Due Diligence (CDD) and KYC – Verify customer identity at onboarding (and enhanced due diligence for higher-risk customers), identify and verify beneficial owners of corporate customers, and keep CDD records for prescribed retention periods. 

• • Ongoing monitoring & transaction scrutiny – Continuous monitoring of transactions to detect unusual or suspicious patterns (amounts, frequency, destination corridors). Exchanges must have automated or manual monitoring rules and escalation procedures. 

• • Suspicious Transaction Reporting (STR) – Timely reporting of suspicious activity to the UAE Financial Intelligence Unit (FIU). Failure to report can result in criminal and administrative penalties. 

• • Sanctions & PEP screening – Screening against domestic and international sanctions lists; enhanced scrutiny of politically exposed persons (PEPs). 

• • Record-keeping & reporting – Maintain transaction, client and audit logs and produce regulator-required reports. 

• • AML compliance program & officer – Appoint a qualified compliance officer, implement written AML policies and procedures, provide staff training, and undergo independent audits of the AML program. 

Cabinet Decision No. 10 (2019) provides the implementing detail: definitions of obliged persons, CDD thresholds, reporting timelines and enforcement mechanisms. It is a practical rulebook for compliance teams at exchange houses. UAE Legislation 

Interaction between CBUAE rules and AML framework 

Exchange houses thus operate at the intersection of prudential licensing rules and AML obligations: 

• The CBUAE licensing process assesses AML systems as part of the fitness and suitability and operational readiness checks. An applicant with weak AML controls is unlikely to obtain or retain a licence. Rulebook+1Rulebook+1 

• The AML law imposes criminal liability and administrative fines for breaches (e.g., failure to report suspicions, poor CDD, facilitating illicit transfers). This means compliance lapses can lead to both regulatory enforcement by the Central Bank and criminal prosecution under federal law. Central Bank of the UAEUAE Legislation 

• CBUAE guidance for licensed exchange houses supplements the Regulations with sector-tailored expectations—e.g., recommended monitoring technologies, record formats and sample policies—so operators should use the guidance as the practical roadmap for meeting regulatory expectations. Rulebook 

Corporate governance, beneficial ownership & transparency 

As part of AML/CFT and licensing, exchange houses must identify and disclose real (beneficial) owners of legal entities and maintain transparent corporate records. The UAE’s beneficial ownership and company-registry rules require accurate disclosure to the regulator and create an enforcement risk for shell or nominee arrangements. Transparency obligations protect the sector’s integrity and ensure regulators can trace ultimate controllers. UAE LegislationRulebook 

Compliance program — practical checklist for exchange operators 

Operators and acquirers should ensure the following are in place before opening or taking on an exchange business: 

1. CBUAE-compliant licence application & business plan (capital, premises, IT). Rulebook 
2. Robust AML policies (CDD, EDD, transaction monitoring, STR reporting, sanctions screening). Central Bank of the UAEUAE Legislation 
3. Qualified AML/Compliance Officer and trained staff (documented training logs). Rulebook 
4. Automated monitoring & record-keeping systems capable of producing regulator reports. Rulebook 
5. Independent audit & governance (internal audit function and board oversight). Rulebook 
6. Vendor/agent due diligence (for cash collection, payout agents or technology providers). Rulebook 

Enforcement environment & penalties 

Non-compliance attracts a spectrum of sanctions: licence suspension/revocation by the CBUAE, substantial administrative fines, freezing of funds, and criminal prosecution under the federal AML law. Regulators have increased supervisory intensity in recent years, so ongoing investment in compliance is non-negotiable. Central Bank of the UAERulebook 

Conclusion — legal takeaways for entrants and acquirers 

Operating a money exchange in the UAE requires two simultaneous mindsets: (1) satisfy CBUAE’s prudential and licensing standards (capital, governance, operations); and (2) build a robust AML/CFT program aligned with Federal Decree-Law No. 20 of 2018 and the Cabinet Decision implementing regulations. For acquirers, AML and regulatory due diligence is often the critical make-or-break factor—legacy compliance gaps can be expensive and difficult to remediate. Engage experienced local counsel and compliance specialists early in the process to structure the licence application, remediate deficiencies, and design a sustainable compliance architecture.