Regulatory Update October 2026 – ME Region

On 1 October, the Dubai Financial Services Authority (‘DFSA’) announced amendments to several Rulebook modules following consultation on the proposals set out in Consultation Papers 172 and 174.

The amendments affect the Prudential – Investment, Insurance Intermediation and Banking Business Module (‘PIB’), which came into force on 2 October 2026, as well as changes to the Conduct of Business (‘COB’) Module, Islamic Finance Rules (‘IFR’), and the Glossary Module (‘GLO’), which will come into force on 1 January 2027.

Key regulatory changes which came into force on 2 October 2026 include:

• PIB
  • form B110 has been renamed, and its scope expanded from reporting only capital ratios to reporting capital resources and capital requirements
  • forms B130D (Settlement Risk) and B140H (Credit Valuation Adjustment) no longer apply to firms in Prudential Category 3A
  • form B290 is a new return covering non-bank liquidity requirements for domestic firms in Prudential Categories 3A, 3B, 3C and 4
  • form B400 is a new return relating to safeguarded assets, applicable to all prudential categories of domestic firms and branches
  • forms B180 (Expenditure Based Capital Minimum) and B120 (Capital Resources) have been removed

Key proposed regulatory changes which will come into force on 1 January 2027 include:

• COB
  • requirement for insurers or insurance intermediaries who propose a Takaful product to a Retail Client to provide specific disclosures which includes: the contractual relationship between the Takaful fund and the operator; how the operator’s fees and profit share are calculated; how any surplus in the Takaful fund will be distributed; and circumstances in which participants may be required to make additional contributions to the Takaful fund
  • removal of the specific disclosure requirements applicable to credit ratings of structured financial products
  • additional guidance on credit rating agencies disclosures
• IFR
  • addition of a new rule to clarify the application of Shari’a laws onto the financial products in line with the Law Regulating Islamic Financial Business 2004
  • clarification that an Authorised Person is treated as operating in accordance with Shari’a where it represents that all or part of its business activities are conducted on a Shari’a-compliant basis
  • the rule also applies where an Authorised Person provides a financial service relating to a product that is marketed as Islamic or Shari’a-compliant
  • Fund Managers are within scope where they manage a fund that is held out as Islamic or Shari’a-compliant
  • additional guidance on application of Shari’a law in relation to marketing of financial products
  • deletion of Chapter 2 Islamic Finance
• GLO
  • Addition of definition of Takaful.

Firms should review the amendments to assess any impact on their business operations, compliance arrangements, client interactions, prudential obligations, and Islamic finance activities.

You can read the amended DFSA’s Rulebooks in full here.

On 5 October, the DFSA published a Feedback Statement setting out its response to comments received on Consultation Paper No. 174, which proposed amendments relating to Crypto and Investment Tokens, Credit Rating Agencies, and prudential reporting requirements.

Following its review of stakeholder feedback, the DFSA decided not to proceed with the proposed Crypto and Investment Token-related amendments at this stage and will consider those proposals further in light of the feedback received during the consultation process. The Regulator noted that any future steps regarding the token-related proposals will be communicated separately. As such, the Feedback Statement focuses solely on the finalised Credit Rating Agency and prudential reporting reforms. As a reminder, the prudential reporting amendments apply from 2 October 2026, and the Credit Rating Agency related amendments apply from 1 January 2027, which provides Credit Rating Agencies with sufficient time to implement the amended requirements.

You can read the DFSA’s Feedback Statement in full here.

On 20 October, the DFSA issued two alerts. The first alert pertained to “Adaa Financial Services”, which falsely claimed to be regulated by the DFSA. The firm’s DFSA licence was withdrawn in 2017, and the Dubai International Financial Centre (‘DIFC’) entity was dissolved in 2019. The DFSA warns investors not to engage with or transfer funds to any party connected with this entity.

The second alert was regarding a cryptocurrency recovery scam in which fraudsters were impersonating the DFSA using fake investigation notices, forged documents, and unofficial contact details to obtain funds, cryptocurrency, or personal information from victims.

The DFSA reminded firms and investors to verify the regulatory status of entities through its public register and exercise caution when dealing with unsolicited communications, particularly those requesting payments, cryptocurrency transfers, or sensitive personal information.

You can read the DFSA’s alerts in full here.

On 26-27 October, the third edition of the Dubai AI Festival was held at the Dubai World Trade Centre under the theme “Where Intelligence Meets Opportunity.” The event brought together policymakers, technology leaders, investors, founders, financial institutions and innovators from more than 100 countries to discuss the future of artificial intelligence.

The festival featured over 150 speakers, 500 investors, 200 exhibitors, and more than 50 roundtables and workshops. Discussions focused on key topics including AI adoption, governance, investment, infrastructure, ethics, and the future of work. Participants explored the evolving AI landscape and examined the transition from AI experimentation to large-scale implementation across industries.

You can read the Dubai World Trade Centre’s announcement in full here.

On 30 October, the DFSA, in collaboration with the Cambridge Digital Innovation and Regulation Initiative (C:>DIR), published an insights paper “Frontier and Agentic AI: Cyber Resilience in the Financial Sector”. The paper examines how emerging forms of artificial intelligence may impact cyber resilience, operational resilience, and risk management within financial institutions.

The paper explores how frontier AI could accelerate cyber-related activities and how agentic AI systems, which are capable of taking actions through connected tools under delegated authority, may alter the cyber risk landscape. The analysis highlights the potential for AI-enabled activities to become faster, more adaptive, and more difficult to monitor, investigate, and remediate following a cyber incident.

The publication considers cyber resilience through four key dimensions:

• the ability of firms to identify and mitigate significant cyber threats before they result in material harm
• understanding dependencies on shared technologies, service providers, and supply chains, including indirect third-party relationships
• ensuring that AI-enabled systems operate within clearly defined mandates and appropriate governance frameworks
• maintaining the ability to reconstruct events, control ongoing activity, and restore critical operations following an incident.

The paper also highlights the growing importance of managing operational dependencies arising from shared AI models, cloud infrastructure providers, identity management services, software components, and recovery arrangements. These dependencies may create concentration and resilience risks that are not always apparent through direct supplier relationships alone.

The DFSA noted that the insights paper forms part of its broader efforts to assess the implications of emerging technologies for the financial services sector and to encourage firms to strengthen their cyber resilience, governance, operational resilience, and third-party risk management frameworks as AI adoption continues to expand.

You can read the DFSA’s paper in full here.

On 1 October, the Abu Dhabi Global Market Registration Authority (‘ADGM RA’) published its regulatory priorities for 2026-2027, providing firms, advisers and other stakeholders with greater visibility into the RA’s supervisory, monitoring and enforcement focus areas for the year ahead.

The publication outlines the key areas that will be subject to increased regulatory attention and is intended to enhance transparency, promote understanding of regulatory expectations and assist stakeholders in allocating compliance resources effectively.

The RA’s priorities focus on the following ten key areas:

• accuracy and timeliness of annual filings and licence renewals
• audit quality and corporate reporting
• beneficial ownership transparency
• anti money laundering/combatting the financing of terrorism (‘AML/CFT’) and targeted financial sanctions compliance by Designated Non-Financial Businesses and Professions (‘DNFBPs’)
• standards applicable to Company Service Providers (‘CSPs’)
• responsible innovation and emerging technologies
• consumer protection
• unlicensed activities
• misleading claims regarding ADGM licence status
• timely, proportionate enforcement action.

You can read the ADGM RA’s regulatory priorities in full here.

On 6 October, the Financial Services Regulatory Authority (‘FSRA’) issued Consultation Paper No. 5 of 2026 “DeFi Risk Management Guidance”, seeking feedback on proposed decentralised finance (‘DeFi’) Risk Management Guidance. The draft guidance sets out the FSRA’s supervisory expectations for how Authorised Persons and Recognised Bodies should identify, assess, monitor and manage risks arising from their involvement with DeFi arrangements in connection with regulated activities or regulatory functions.

Decentralised finance refers to financial services and applications that operate on blockchain networks using smart contracts, without relying on traditional intermediaries such as banks, brokers or exchanges. DeFi enables activities such as lending, borrowing, trading and asset management through decentralised protocols and platforms. As these arrangements are often governed by code and distributed networks, they can present unique operational, governance, cybersecurity and financial crime risks for firms that engage with them.

The proposed guidance was developed in response to the growing interest in DeFi and the FSRA’s continued engagement with digital asset markets. It builds on the FSRA’s Discussion Paper No. 1 of 2022, which examined DeFi-related opportunities, risks and potential regulatory approaches. While the new guidance does not introduce a specific regulatory framework for DeFi, it aims to provide practical risk management and governance expectations for firms engaging with DeFi-related activities.

You can read the FSRA’s consultation paper in full here and feedback was welcome until 6 November.

On 9 October, the FSRA published Consultation Paper No. 6 of 2026 proposing amendments to its fees framework. The proposals build on the FSRA’s comprehensive fee review undertaken in 2023 and follow Consultation Paper No. 4 of 2023, which sought to update fees that have largely remained unchanged since the ADGM’s establishment in 2015.

The consultation includes proposals to:

• revise application fees and annual supervision fees for Recognised Bodies and operators of Multilateral Trading Facilities (‘MTFs’) and Organised Trading Facilities (‘OTFs’), and introduce an annual supervision fee for securities admitted to the Official List
• increase the fee payable for late regulatory filings
• clarify the fees applicable when varying a Financial Services Permission (‘FSP’) to include Virtual Assets (‘VAs’), Fiat-Referenced Tokens (‘FRTs’) or Spot Commodities (‘SCs’), and when adding regulated activities to conduct Islamic Financial Business
• introduce guidance relating to supplementary fees for certain change-in-control applications
• provide guidance on applications to vary an FSP within 12 months of obtaining a licence
• implement a number of miscellaneous amendments to the fees framework
• set out the proposed implementation approach for the finalised changes.

The proposals are intended to ensure that the FSRA’s fee structure remains aligned with the scope and complexity of its regulatory activities and reflects the continued development of the ADGM financial services ecosystem.

You can read the FSRA’s consultation paper in full here and feedback was welcome until 6 November.

On 8 October, the FSRA issued a public warning regarding an entity known as Takeo Investments, which previously operated through the website https://takeoinvestments.com. The FSRA advised that the website is no longer operational and noted concerns that the entity may have made false and misleading claims suggesting an association with the ADGM.

The FSRA stated that Takeo Investments is not, and has never been, authorised by the FSRA to carry on any Regulated Activity in or from ADGM, nor has it ever been incorporated in ADGM or licensed to conduct any commercial activities within the jurisdiction.

The FSRA reminded firms and investors that only entities holding a valid FSP may undertake regulated activities in the ADGM and encouraged stakeholders to verify a firm’s regulatory status through the FSRA public register before entering into any arrangements. The FSRA also noted that the ADGM RA public register should be consulted to confirm whether an entity is incorporated or registered in the ADGM.

You can read the FSRA’s alert in full here.

On 15 October, the FSRA held a supervision outreach session as part of its ongoing engagement with the financial services industry in the ADGM. The FSRA encouraged participation by Senior Executive Officers (‘SEOs’), Principal Representatives, Compliance Officers, and Money Laundering Reporting Officers (‘MLROs’).

The session provided firms with insights into the evolution of the FSRA’s supervisory approach, key supervisory outcomes and findings from 2026, strategic supervisory priorities for 2027, thematic review observations, and sector-specific regulatory developments. The outreach also gave firms a forward-looking perspective on emerging regulatory and supervisory expectations relevant to businesses operating within the ADGM.

On 22 October, the FSRA issued a Dear SEO Letter titled “Local Substance Thematic Review Survey”, informing firms of the launch of a thematic review of local substance arrangements across FSRA Authorised Firms.

The review forms part of the FSRA’s ongoing supervisory programme and is intended to enhance the regulator’s understanding of firms’ local substance arrangements within the ADGM.

In particular, the FSRA is seeking information regarding firms’ operational, management, control and administrative arrangements, including:

• location of key personnel
• decision-making processes and governance arrangements
• extent to which regulated activities are conducted from within ADGM
• firms’ overall operational presence and substance within the jurisdiction.

To support the review, the FSRA requested that all Authorised Firms complete the ADGM Local Substance Thematic Review Survey and submit their responses by 6 November 2026. The survey can be accessed via the link shared in the Dear SEO Letter.

This thematic review reflects the FSRA’s continued focus on ensuring that Authorised Firms maintain adequate local substance, effective governance, and appropriate oversight of regulated activities within the ADGM. Firms may wish to review their operating models, governance frameworks, staff locations, and decision-making processes to ensure these arrangements are appropriately documented and can be clearly demonstrated to the regulator.

On 23 October, the ADGM RA issued Consultation Paper No. 7 of 2026 seeking feedback on proposed amendments to the Commercial Licensing Regulations and related Rules to introduce a dedicated regulatory framework for business centre service providers operating within ADGM.

Key proposals include:

• designating the provision of business centre services as a controlled activity requiring appropriate licensing
• introducing specific licensing conditions and regulatory requirements for applicants and existing business centre operators
• amending the:
  • Commercial Licensing Regulations (Controlled Activities) Rules
  • Commercial Licensing Regulations (Conditions of Licence and Branch Registration) Rules
  • Commercial Licensing Regulations (Fees) Rules
• establishing a clearer supervisory framework for business centres operating in the ADGM.

The proposals are expected to be relevant to existing and prospective business centre operators, firms and individuals using business centre services, company service providers, and other stakeholders that may be affected by the proposed regulatory framework.

You can read the ADGM RA’s consultation paper in full here and comments were welcome until 6 November.

On 26 October, the FSRA announced its annual outreach session, which will take place on 12 November 2026.

The session will cover a range of supervisory and regulatory topics, including:

• evolution of supervision
• Approved Persons, change in control and variation of permission requests
• thematic review findings and common themes
• markets and securities
• financial technology (‘FinTech’) and virtual assets
• cross-border regulatory cooperation panel
• Q&A.

The outreach session will provide firms with insights into the FSRA’s supervisory priorities, key thematic findings, and developments across the markets and virtual assets sectors.

On 28 October, the ADGM RA published its guidance on crypto mining activities in and from the ADGM, following stakeholder consultation undertaken through Discussion Paper No. 1 of 2026, issued in January 2026. This guidance applies to crypto mining as a commercial activity licensed by the RA. It does not extend to activities that fall within the regulatory perimeter of the FSRA.

Crypto mining, defined for the purposes of the guidance as the process of “verifying transactions on a decentralised ledger or infrastructure network in return for rewards in the form of digital assets generated through a consensus mechanism”, is not a regulated activity in the ADGM. However, it falls within the scope of the ADGM Commercial Licensing Regulations 2025. Accordingly, any person seeking to conduct crypto mining activities in or from the ADGM must obtain the appropriate commercial licence issued by the Registration Authority, as no person may carry on a business activity in or from the ADGM without the requisite licence.

Entities conducting crypto mining activities that involve third-party capital or digital assets should assess whether their activities constitute a regulated activity under the Financial Services and Markets Regulations 2015 and FSRA rules. Where applicable, an FSRA financial licence may be required in addition to an ADGM commercial licence.

Key policy principles for responsible mining operations under this guidance expect crypto mining entities to maintain robust cybersecurity, operational resilience, and physical security measures, aligned with recognised international standards. While standalone crypto mining activities are generally outside the ADGM and UAE AML/CFT regulatory framework, entities that also conduct Virtual Asset Service Provider (‘VASP’) activities may be subject to applicable AML/CFT obligations and FSRA requirements. Regardless of regulatory status, all crypto mining entities are expected to meet the guidance’s transparency, disclosure, and record-keeping expectations.

The guidance further outlines the licensing requirements, key licence conditions and ongoing obligations applicable to crypto mining entities, as well as the Registration Authority’s supervisory approach, including its expectations for ADGM-registered headquarters overseeing global crypto mining operations.

You can read the ADGM RA’s Guidance here.

On 28 October, the FSRA issued Notice FSRA/FCCP/206/2026, “Transfers of Virtual Assets and Fiat-Referenced Tokens and the Travel Rule,” reminding Authorised Persons and Recognised Bodies of their obligations under Section 10.3 of the Anti-Money Laundering and Sanctions Rulebook (‘AML’). The notice reiterates the requirements applicable to the transfer of Virtual Assets and Fiat-Referenced Tokens, including compliance with the travel rule, subject to the scope and exclusions set out in AML Rule 10.3.1.

The notice provides practical guidance on:

• governance and control frameworks to support compliance with the travel rule for Virtual Asset and Fiat Referenced Tokens transfers
• risk-based controls for managing transfers with incomplete required information
• management and documentation of transfers involving unhosted wallets.

You can read the FSRA notice in full here.

On 30 October, the FSRA issued a statement confirming that it is aware of the security incident involving Binance, which resulted in unauthorised withdrawals of assets from the exchange. The FSRA stated that it is engaging closely with Binance and monitoring developments in relation to the incident. The regulator further emphasised that protecting client interests and maintaining the integrity and orderly functioning of markets remain its key priorities.

You can read the FSRA’s statement in full here.

On 2 October, the UAE Financial Intelligence Unit (‘UAE FIU’) and the Virtual Assets Regulatory Authority (‘VARA’) signed a Memorandum of Understanding (‘MoU’) aimed at strengthening cooperation in combating financial crime involving virtual assets.

The MoU established a framework for enhanced coordination, information sharing, and the exchange of expertise and financial intelligence between the two authorities, in accordance with applicable legal and confidentiality requirements. The objective is to strengthen their ability to identify, assess, and mitigate financial crime risks associated with virtual assets.

The MoU demonstrates the continued focus of UAE authorities on strengthening the oversight of virtual asset-related activities and enhancing cooperation between regulators and financial intelligence authorities. Firms operating in the virtual asset sector, as well as financial institutions exposed to virtual asset activity, should ensure that their AML/CFT frameworks remain robust and appropriately address risks associated with virtual assets, including customer due diligence, transaction monitoring, sanctions screening, and suspicious transaction reporting.

You can read the FIU’s announcement in full here.

On 6 October, the VARA issued a circular “Reserve Assets Audit Reports” following a thematic review of all proof of reserve assets reports submitted during 2025.

The circular clarifies VARA’s minimum regulatory expectations regarding the independent audit of reserve assets and aims to promote a consistent, robust and sufficiently detailed approach to assessing and verifying client virtual asset safeguarding arrangements. VARA stated that the guidance is intended to strengthen the quality and consistency of independent assurance provided over the existence, custody, reconciliation and protection of client virtual assets.

The circular should be read alongside the applicable VARA Rulebooks and any reporting requirements or instructions issued by VARA from time to time. Firms subject to the requirements should review their reserve asset audit arrangements to ensure they meet VARA’s supervisory expectations and provide adequate assurance over client asset protection.

You can read the VARA’s circular in full here.

On 7 October, the UAE FIU hosted a virtual awareness session for Compliance Officers and Money Laundering Reporting Officers of financial institutions on the implementation of Targeted Financial Sanctions (‘TFS’) and related reporting requirements.

The session covered the following topics:

• regulatory expectations relating to TFS compliance
• reporting obligations
• practical implementation considerations for financial institutions.

Recommended actions for firm include:

• confirm registration with the Executive Office for Control and Non-Proliferation (‘EOCN’) Notification Alert System and that alerts reach the right inboxes
• verify screening covers all four triggers, UBOs and transaction parties, and runs from the first minute of business after weekends and holidays
• configure screening to match on key identifiers first, so alias-only hits are not reported as matches
• restrict Confirmed Named Match Reports/Partial Name Match Reports (‘CNMR/PNMR’) filings to UN and UAE Local list matches
• handle Office of Foreign Assets Control (‘OFAC’) and European Union hits under internal policy
• implement freezing measures immediately upon a confirmed match, and track the 5 business-day CNMR/PNMR deadline
• keep partial matches suspended until the EOCN responds, whilst never closing them internally as false positives
• extend ownership and control checks to catch entities over 50% owned or controlled by a designated person, and power of attorney holders acting for one
• attach supporting documents to every report including ID, account summaries, frozen balances, know your customer, invoices and trade documents
• base proliferation financing (‘PF’) or terrorist financing (‘TF’) Suspicious Transactions Reports/ Suspicious Activity Reports (‘STRs/SARs’) on behavioral red flags, not nationality, and choose the TF or PF reason correctly
• refresh staff training on PF/TFS red flags, including dual-use goods and transshipment routes.

On 8 October, the Central Bank of the UAE (‘CBUAE’) hosted its second Climate Forum in Abu Dhabi. The Forum brought together representatives from central banks, regulatory authorities and financial institutions to strengthen the financial sector’s resilience to climate-related risks and support the transition to a sustainable economy.

The forum served as a platform for collaboration and knowledge sharing on sustainable finance, including the development of regulatory frameworks and banking practices that enhance financial institutions’ ability to manage climate risks and support net-zero objectives.

Discussions focused on the strategic implications of climate change, transition plans across economic sectors and their financing, public-private sector cooperation, sustainable finance priorities, the role of climate data in regulatory and financial decision-making, and the impact of climate-related risks on monetary policy and banking supervision.

The CBUAE also hosted its inaugural Climate Research Seminar on 9 October in collaboration with the Centre for Economic Transition Expertise at the London School of Economics and Political Science. The seminar explored recent research on climate change, sustainable investment and monetary policy, with the aim of supporting the development of evidence-based financial and banking policies.

You can read the CBUAE’s announcement in full here.

On 13 October, the UAE FIU issued its H1 2026 Feedback Report, providing Reporting Entities with valuable insights into the quality and effectiveness of suspicious activity reporting across Financial Institutions, DNFBPs and VASPs.

The report highlights common reporting deficiencies, good practices and recurring challenges identified during the period, while also providing statistical analysis and sector-specific observations. It includes two case studies demonstrating the role of financial intelligence, domestic and international cooperation, and timely reporting in combating cross-border financial crime and fraud.

In addition, the report contains key findings from the FIU’s strategic analysis on the misuse of virtual assets in financial crime, alongside an overview of outreach and engagement activities undertaken during the first half of 2026.

The report is available to registered users via the goAML portal.

On 13 October, the CBUAE and the National Bank of Georgia signed a MoU aimed at strengthening financial and supervisory cooperation between the two jurisdictions.

Under the MoU, the two authorities will collaborate on:

• monetary policy matters
• foreign exchange operations and reserve management
• supervision and oversight of financial institutions and activities
• payment systems and financial market infrastructure
• FinTech development and innovation
• enhancing the efficiency, security and resilience of cross-border payments.

The agreement also provides for the exchange of information and expertise, capacity-building initiatives, working visits, joint studies and research, and the establishment of working groups in areas of mutual interest.

You can read the CBUAE’s announcement in full here.

On 14 October, the UAE FIU issued Regulation No. (1) of 2026 concerning the System Governing the Postponement or Suspension of Suspicious Transactions and the Freezing of Funds, implementing the requirements of Federal Decree-Law No. (10) of 2025. The Regulation establishes a formal framework for the timely postponement or suspension of suspicious transactions and the freezing of funds, strengthening the UAE’s AML/CFT regime and enhancing measures aimed at asset preservation, intervention, and the recovery of criminal proceeds.

The regulation was published in Official Gazette No. 833 on 14 October 2026 and will enter into force on 14 December 2026, providing reporting entities with a two-month implementation period to assess the new requirements and make any necessary enhancements to their AML/CFT frameworks.

Firms are encouraged to evaluate the impact of the regulation on their financial crime compliance frameworks and implement any necessary controls, systems, and oversight measures to support the timely identification, suspension, postponement, and reporting of suspicious transactions, where applicable.

You can read the FIU’s new regulation in full here.

On 14 October, the EOCN hosted a webinar introducing its EOCNLearn e-learning platform, which has been developed to enhance industry awareness and understanding of TFS and Counter-Proliferation Financing (‘CPF’) obligations.

The platform is available to regulated entities and relevant personnel across the UAE and provides structured, self-paced training designed to support compliance with the UAE’s sanctions and proliferation financing framework.

Key features include:

• users must first create an account and verify their email address before the account is reviewed and approved by the EOCN
• account approvals are generally processed within 24 business hours of a completed registration request
• the platform enables users to track learning progress, access course materials, receive announcements and download completion certificates
• certificates are issued following successful completion of the assessment and a post-course feedback survey.

The platform currently offers two training courses:

• guidance on TFS
  • overview of the UAE TFS framework
  • legal and regulatory basis for sanctions implementation
  • screening and monitoring obligations
  • asset freezing without delay
  • reporting obligations
  • governance and record-keeping requirements
• guidance on CPF
  • introduction to proliferation financing risks
  • stages and typologies of proliferation financing
  • UAE export control framework
  • due diligence requirements
  • proliferation financing red flag indicators.

The EOCNLearn platform provides a useful resource for Compliance Officers, MLROs, sanctions teams and other relevant employees to strengthen their understanding of UAE sanctions and proliferation financing requirements. Firms may wish to consider incorporating completion of the relevant modules into their annual AML/CFT and sanctions training programmes and maintaining training records as evidence of staff competency and awareness.

The EOCN also advised firms to ensure that registration emails from the platform are not blocked by internal email filtering systems and to retain copies of completion certificates for audit and regulatory purposes.

On 28 October, the VARA issued a circular outlining good practices for VASPs in relation to their public disclosure obligations. The guidance follows a thematic review of VASPs’ compliance with VARA’s disclosure requirements and highlights both areas of good practice and common deficiencies observed during the review.

VARA emphasised that public disclosures should be treated as an ongoing regulatory obligation rather than a one-time licensing exercise. VASPs are required to ensure that disclosures relating to their regulatory status, licensed virtual asset activities, licence conditions, responsible individuals, risk disclosures, and other regulatory information remain accurate, complete, accessible, and up to date.

The thematic review identified several areas for improvement, including incomplete disclosures, information that was difficult to locate, inconsistencies between disclosures and operating models, and failures to update disclosures following changes to business activities or operating arrangements. VARA also noted that some firms lacked adequate governance and oversight mechanisms to support ongoing compliance with disclosure requirements.

The circular sets out supervisory expectations and examples of good practice, including:

• assigning clear ownership and accountability for disclosures
• maintaining a register of disclosure obligations
• incorporating disclosure reviews into compliance monitoring programmes
• ensuring that material business changes trigger an assessment of whether public disclosures require updating.

You can read the VARA’s circular in full here.

During October and November 2026, the AML/CFT Supervisory Subcommittee (‘SSC’) will deliver a series of industry outreach sessions for ADGM-regulated Financial Institutions, VASPs and DNFBPs. The programme is designed to enhance awareness of AML/CFT/TFS regulatory obligations, emerging financial crime risks and supervisory expectations, while promoting best practices across the regulated population.

The outreach programme is set to cover a broad range of topics relevant to the UAE AML/CFT framework and evolving financial crime threats, including:

• virtual assets and financial innovation, with a focus on travel rule implementation, wire transfer requirements and challenges arising from emerging technologies
• cross-border money laundering and trade-based money laundering, including key typologies, red flags and effective risk mitigation practices
• money mule activity, highlighting recent typologies, supervisory findings, transaction monitoring expectations and reporting obligations
• Customer Due Diligence (‘CDD’) survey outcomes and Simplified Due Diligence Measures, with sector-specific sessions for banks, exchange houses, finance companies and other regulated sectors
• unlicensed financial activity, focusing on identification methods, regulatory consequences and financial crime risks associated with unauthorised business activities
• professional money laundering and professional enablers, including the role of intermediaries and facilitators in complex money laundering schemes
• gold trading and associated ML/TF/PF Risks, addressing vulnerabilities within the precious metals and stones sector and expectations for dealers in precious metals and stones
• transaction monitoring and STR quality, providing guidance on effective monitoring frameworks, alert management and high-quality suspicious transaction reporting
• AML control weaknesses in the insurance sector, highlighting sector-specific findings, common deficiencies and supervisory expectations for insurers, intermediaries and brokers.

Collectively, the outreach sessions reinforce the regulator’s expectations regarding effective AML/CFT governance, customer due diligence, transaction monitoring, sanctions compliance, suspicious activity reporting, and the adoption of risk-based controls proportionate to emerging money laundering, terrorist financing and proliferation financing risks. The programme also encourages firms to review the effectiveness of existing AML/CFT frameworks, strengthen control environments and ensure alignment with evolving regulatory expectations and international standards.

The sessions demonstrate continued supervisory focus on emerging threats, including virtual assets, money mule activity, trade-based money laundering and professional facilitators of financial crime, while emphasising the importance of robust governance, technology-enabled monitoring, staff training and timely regulatory reporting.

On 7 October, the Middle East and North Africa Financial Action Task Force (‘MENAFATF’) concluded its Workshop on Applications and Capacity Building, held in Kuwait from 5 to 7 October 2026, with participation from member states, international organisations, and financial crime experts.

The workshop focused on three key areas:

• financial fraud and illicit financial flows
• asset recovery
• use of technology in terrorist financing.

Discussions highlighted the importance of enhancing fraud detection capabilities, strengthening parallel financial investigations, improving mechanisms for tracing and recovering criminal proceeds, and reinforcing domestic and cross-border cooperation in relation to asset recovery, including digital assets and virtual currencies.

Participants also examined the challenges posed by technological innovation and emerging terrorist financing risks, emphasising the need for ongoing risk assessments, updated detection methodologies, and greater use of advanced analytics, emerging technologies, and artificial intelligence in financial crime prevention.

The workshop concluded with the adoption of a series of recommendations aimed at strengthening national AML/CFT capabilities, improving investigative and asset recovery frameworks, addressing technology-driven risks, and enhancing regional and international cooperation. MENAFATF also noted that certain outcomes of the workshop will contribute to the FATF 2026-2028 roadmap on combating fraud, further supporting international efforts to address financial crime.

You can read the MENAFATF’s announcement in full here.

In October, the United Nations Security Council (‘UNSC’) Committee published several updates to its sanction list.

On 5 October, the UNSC Committee established pursuant to Resolution 1518 (2003) removed Logarcheo S.A. from its sanctions list. As a result, the entity is no longer subject to the asset freeze and other measures imposed under the Committee’s sanctions regime.

On 15 October, the UNSC ISIL (Da’esh) and Al-Qaida Sanctions Committee announced amendments to three entries on its sanctions list. The updates relate to two designated individuals, Mounir El Motassadeq and Noor Wali Mehsud, and the designated entity Tehrik-e Taliban Pakistan. The amendments update identifying and background information associated with the listings, while the relevant sanctions measures, including asset freeze, travel ban, and arms embargo requirements, remain in effect.

On 24 October, the UNSC ISIL (Da’esh) and Al‑Qaida Sanctions Committee removed three individuals from the ISIL (Da’esh) and Al‑Qaida Sanctions List following its consideration of delisting requests submitted by the designating State. As a result, the asset freeze, travel ban, and arms embargo measures previously applicable to these individuals no longer apply.

The individuals removed from the sanctions list are:

• Shafi Sultan Mohammed Sultan Al‑Ajmi (QDi.338)
• Bassam Ahmad Al‑Hasri (QDi.399)
• Iyad Nazmi Salih Khalil (QDi.400).

On 26 October, the UNSC ISIL (Da’esh) and Al‑Qaida Sanctions Committee amended three entries on its sanctions list.

The updates reflect changes to identifying and background information associated with their listings relating to the following designated individuals:

• Emilie Edwige Konig (QDi.340)
• Oumar Diaby (QDi.342)
• Peter Cherif (QDi.376)

The applicable sanctions measures, including the asset freeze, travel ban, and arms embargo, remain in force.

On 29 October, the UNSC Committee established pursuant to Resolution 1988 (2011) amended five entries on its 1988 Sanctions List.

The updates relate to the designated individuals:

• Abdul Latif Mansur (TAi.007)
• Abdul Ghani Baradar (TAi.024)
• Amir Khan Motaqi (TAi.026)
• Abdul-Haq Wasseq (TAi.082)
• Khairullah Khairkhwah (TAi.093).

The amendments update identifying and biographical information associated with the listings, while the applicable sanctions measures, including the asset freeze, travel ban, and arms embargo, remain in effect.

Firms should ensure that their sanctions screening systems, customer databases, and related controls are updated to reflect the delistings and various amendments.

You can read the UNSC’s sanctions update here, here, here, here, and here.

On 30 October, the Financial Action Task Force (‘FATF’) updated its list of jurisdictions under increased monitoring (the “Grey List”) and removed Bulgaria, Côte d’Ivoire, Democratic Republic of Congo, and Monaco following the successful completion of their respective action plans and verification of improvements to their AML/CFT frameworks. No new jurisdictions were added to the Grey List.

You can read the amended FATF Grey List here.

On 1 October, the DFSA announced a fine of US$ 109,200 against Vault Wealth Limited, an FSRA-authorised firm in the ADGM, for conducting regulated financial services activities in and from the DIFC without DFSA authorisation.

The DFSA found that employees provided investment advice and arranged investment deals from a DIFC office between February and May 2024, despite management being aware that a DFSA licence was required. The case reinforces that authorisation by the FSRA does not permit firms to conduct regulated activities in or from the DIFC and that the appropriate DFSA authorisation must be obtained before undertaking such activities. Management’s awareness of the licensing requirements and failure to address compliance concerns were considered aggravating factors in determining the penalty.

You can read the DFSA’s announcement in full here.

On 9 October, the ADGM RA announced enforcement action against PKF Accountants and Business Advisers LLP and its registered audit principal, Saranga Omprakash Lalwani, imposing total financial penalties of US$ 100,000 following deficiencies identified during an audit inspection.

The action arose from an on-site inspection conducted by the RA to assess compliance with the ADGM Companies Regulations (Auditors) Rules 2023 and the quality of audit work performed by the firm. The RA identified significant deficiencies in an audit conducted for an ADGM-registered entity, including failures to conduct the audit and prepare the audit report in accordance with the International Standards on Auditing, as well as a failure to exercise due skill, care and diligence.

The RA imposed a financial penalty of US$ 65,000 on the firm and US$ 35,000 on Ms Lalwani. The findings included deficiencies in the assessment of fraud risks, failure to obtain sufficient and appropriate audit evidence, inadequate audit documentation, and insufficient evidence demonstrating the audit principal’s involvement and oversight of the audit process.

The enforcement action highlights the RA’s continued focus on audit quality and compliance with applicable auditing standards and professional obligations within ADGM.

You can read the ADGM RA’s article in full here.

On 26 October, the DFSA imposed a financial penalty of US$ 210,000 (AED 771,330) on Gary Joseph Peters for providing false, misleading and deceptive information to the DFSA and for failing to comply with a requirement to produce documents.

In addition to the financial penalty, the DFSA prohibited Mr Peters from holding office or being employed by a DFSA-authorised firm or fund and restricted him from performing any function in connection with the provision of financial services in or from the DIFC.

The DFSA found that Mr Peters falsely denied, during a compulsory interview, having prior criminal convictions involving fraud and dishonest conduct, in contravention of Article 66 of the Regulatory Law 2004. The regulator also determined that Mr Peters failed to provide documentation supporting the qualifications he claimed to hold, despite repeated requests, constituting a breach of Article 69 of the Regulatory Law 2004.

The DFSA concluded that, in light of his criminal convictions and regulatory breaches, Mr Peters was not a fit and proper person to perform any function in connection with the provision of financial services in or from the DIFC.

You can read the DFSA’s announcement in full here.

28 October, the DFSA imposed a financial penalty of US$ 585,825 (AED 2,149,977) on Moody’s Investors Service Middle East Limited for breaches relating to data confidentiality and information security controls.

The DFSA found that the firm failed to maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not improperly disclose confidential data. Between December 2023 and May 2026, the firm reported seven inadvertent data disclosure incidents to the DFSA, four of which involved the disclosure of confidential information to external recipients.

According to the DFSA, the incidents were attributable to several control weaknesses, including the removal of a data security tool without an immediate replacement, inadequate systems and controls to prevent and detect data breaches, and ineffective disciplinary processes for employees responsible for the breaches.

The firm agreed to settle the matter and qualified for a discount under the DFSA’s settlement framework. Absent the settlement discount, the DFSA would have imposed a financial penalty of US$ 836,892.

You can read the DFSA’s announcement in full here.

On 30 October, the CBUAE imposed a financial penalty of AED 200Mn on a branch of a foreign bank licensed in the UAE following supervisory examinations that identified significant and repeated deficiencies in its AML/CFT controls, governance and compliance management arrangements, and sanctions framework.

In addition, the CBUAE imposed individual penalties of AED 500,000 on the bank’s Chief Executive Officer and AED 300,000 on its Head of Compliance and Money Laundering Reporting Officer for failing to adequately discharge their responsibilities.

The CBUAE also directed the bank to implement a mandatory remediation programme, subject to independent validation, and to undertake fit and proper reassessments of the Chief Executive Officer and Chief Compliance Officer.

You can read the CBUAE’s announcement in full here.

In October, the ADGM RA issued three financial penalties and one decision notice in respect of ADGM-registered entities.

The RA imposed financial penalties on Ocorian Corporate Services (ME) Limited and Kalantar Business Law Group Ltd. for breaches relating to beneficial ownership requirements, including failures to maintain complete and accurate beneficial ownership records and failures to keep a complete record of their own beneficial owners.

Separately, the RA issued a decision notice against Evinops Limited for failing to comply with its statutory filing obligations, including the timely submission of accounts and other required reports.

You can read the RA’s announcement in full here.

In October, the Capital Market Authority (‘CMA’) issued a number of investor alerts warning the public against dealing with entities that are not licensed or authorised to conduct regulated financial activities or provide financial services in the UAE.

The alerts related to the following entities:

• HOXTON FX LTD and the website hoxtonfx.com

The CMA urged investors to verify the regulatory status of firms before entering into any agreements or transferring funds and reiterated that these entities are not authorised to carry out regulated financial activities or provide related services.

You can read the CMA’s announcement in full here.