AML for Virtual Asset Service Providers (VASPs)

1. Introduction

The virtual assets (VA) industry has transformed how value is stored and transferred globally—but it has also introduced significant money laundering (ML) and terrorist financing (TF) risks. In response, the United Arab Emirates (UAE) has taken a pioneering approach by establishing a comprehensive regulatory framework for Virtual Asset Service Providers (VASPs), ensuring that innovation and compliance progress hand in hand.

The UAE’s commitment to combat financial crime in the digital asset space aligns with the Financial Action Task Force (FATF) recommendations, which recognize VASPs as part of the broader financial sector requiring Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) oversight.

________________________________________

2. Defining VASPs under UAE Law

According to Cabinet Decision No. (111) of 2022 on the Regulation of Virtual Assets and Related Activities, a Virtual Asset Service Provider (VASP) is any entity conducting one or more of the following activities:

• Exchange between virtual assets and fiat currencies.

• Exchange between one or more forms of virtual assets.

• Transfer of virtual assets.

• Safekeeping or administration of virtual assets or instruments enabling control over them.

• Participation in, or provision of, financial services related to virtual asset offerings.

This broad definition brings crypto exchanges, wallet providers, custodians, token issuers, and trading platforms within the UAE’s AML/CTF regulatory perimeter.

________________________________________

3. Regulatory Authorities Overseeing VASPs

The UAE has multiple regulators overseeing AML compliance for virtual asset businesses, depending on the jurisdiction:

Regulator Jurisdiction / Scope

Securities and Commodities Authority (SCA) Oversees virtual asset activities onshore and in non-financial free zones.

Dubai Virtual Assets Regulatory Authority (VARA) Regulates VASPs operating within Dubai (except DIFC).

Abu Dhabi Global Market (ADGM) Regulates VASPs under the Financial Services Regulatory Authority (FSRA).

Dubai International Financial Centre (DIFC) Oversees crypto asset businesses through the Dubai Financial Services Authority (DFSA).

Financial Intelligence Unit (FIU) Receives and analyzes suspicious transaction/activity reports from all VASPs.

These regulators coordinate closely with the Central Bank of the UAE (CBUAE) and National Anti-Money Laundering Committee (NAMLC) to maintain consistency and global alignment.

________________________________________

4. Core AML Obligations for VASPs

All licensed VASPs must adhere to the following AML/CTF compliance obligations:

a. Customer Due Diligence (CDD)

VASPs must identify and verify customer identities before initiating any business relationship or transaction, using reliable and independent documentation.

Key requirements include:

• Identifying natural and legal persons, including beneficial owners (UBOs).

• Assessing the nature and purpose of the virtual asset activity.

• Performing Enhanced Due Diligence (EDD) for Politically Exposed Persons (PEPs) and high-risk jurisdictions.

• Continuous monitoring of wallet addresses and transaction behaviors for unusual activity.

b. Record Keeping

VASPs must maintain records of customer information, wallet details, and transaction histories for at least five (5) years, readily accessible for regulatory inspection or investigation.

c. Risk-Based Approach (RBA)

VASPs must categorize clients and activities based on risk exposure and apply proportionate controls—enhanced monitoring for high-risk clients and simplified measures for low-risk profiles.

d. Sanctions Screening

VASPs must implement automated sanctions screening systems against UN, UAE, and OFAC lists to prevent dealings with designated individuals or entities.

________________________________________

5. Transaction Monitoring and Blockchain Analytics

VASPs must deploy transaction monitoring systems integrated with blockchain analytics tools to detect suspicious transactions, such as:

• High-value or rapid transfers between unrelated wallets.

• Transactions routed through mixers/tumblers or privacy coins.

• Use of non-custodial wallets in high-risk jurisdictions.

• Patterns inconsistent with a customer’s known activity profile.

Blockchain analysis solutions (e.g., Chainalysis, Elliptic, TRM Labs) help VASPs trace fund origins, detect illicit activities, and generate evidence for Suspicious Transaction Reports (STRs).

________________________________________

6. Reporting Obligations (goAML Platform)

VASPs must register with the goAML system and report transactions as required under UAE law:

Report Type Purpose Timeline Authority

Suspicious Transaction Report (STR) Report any transaction suspected of ML/TF Immediately UAE FIU (via goAML)

Suspicious Activity Report (SAR) Report abnormal or inconsistent activity As soon as identified UAE FIU

Threshold Transaction Report (TTR) Report cash transactions ≥ AED 55,000 Periodically UAE FIU

Sanctions Report Dealings with listed or frozen entities Immediately UAE FIU / Regulator

Failure to comply can result in administrative fines up to AED 5 million, license revocation, or criminal liability under Federal Decree-Law No. 20 of 2018.

________________________________________

7. Governance and MLRO Appointment

Each VASP must appoint a Money Laundering Reporting Officer (MLRO) with appropriate experience and authority to:

• Oversee compliance operations and training.

• Evaluate internal alerts and report STRs/SARs.

• Coordinate with regulators and the FIU.

• Conduct periodic risk assessments and independent audits.

The MLRO must have direct access to senior management and the ability to act independently.

________________________________________

8. AML Training and Awareness

All employees involved in virtual asset operations—onboarding, custody, trading, or technology—must receive regular AML training.

Training programs should cover:

• UAE AML/CFT legal framework and reporting requirements.

• FATF guidelines for virtual assets and VASPs.

• Red-flag indicators and typologies specific to crypto transactions.

• Use of blockchain analytics tools.

This ensures staff can detect, escalate, and report potential ML/TF risks effectively.

________________________________________

9. Penalties and Enforcement Actions

The UAE has demonstrated zero tolerance for AML breaches in the crypto and fintech sectors. Penalties for VASPs may include:

• Fines ranging from AED 100,000 to AED 5 million.

• Suspension or cancellation of VASP licenses.

• Public disclosure of violations to deter misconduct.

• Referral to Public Prosecution for intentional non-compliance.

Recent enforcement actions reflect the UAE’s proactive stance in ensuring that innovation in virtual assets is matched by strong regulatory compliance.

________________________________________

10. Conclusion

The UAE has established itself as one of the world’s most progressive jurisdictions for virtual assets, balancing innovation with integrity.

For VASPs, compliance with AML laws is not merely a legal obligation—it’s a business imperative. Implementing robust KYC measures, blockchain analytics, training programs, and reporting mechanisms ensures alignment with global best practices and builds long-term trust with regulators and clients alike.

________________________________________

About Sheikh Anwar Accounting & Auditing LLC

Sheikh Anwar Accounting & Auditing LLC is a UAE-based professional firm providing AML advisory, regulatory compliance audits, MLRO outsourcing, and training services to VASPs, financial institutions, and DNFBPs across the UAE.

We assist clients in designing, implementing, and maintaining AML frameworks in accordance with FATF standards, VARA, SCA, and CBUAE regulations.

________________________________________

📞 Contact Us

Sheikh Anwar Accounting & Auditing LLC

📍 Office No. M-35, Dubai Creek Tower, Deira, Dubai, UAE

📧 info@sa-auditors.com

🌐 www.sa-auditors.com

📞 +971 52 692 7072