Foreign Exchange Regulation in UAE: Currency Controls and Compliance
The UAE regulates foreign exchange less by limiting the movement of money than through the institutions that move it, licensing exchange houses and requiring remittances to be screened, recorded and reported when they look suspicious.
The dirham's peg to the US dollar operates without a general restriction on moving capital in or out, so the controls that matter sit on the institutions handling the currency. Covered here: how the Central Bank licenses and supervises exchange houses, the financial crime duties attached to that licence, and how remittances are screened for high-risk destinations.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
A site supervisor in Sharjah has used the same exchange house counter for three years. On the fourth or fifth of every month he hands over AED 2,200 in cash and sends it to his mother's account in Kochi, always the same beneficiary, always the same branch. In February the pattern changes. On a Tuesday he sends AED 8,500 to a name in a country neither he nor that counter has dealt with before. On the Thursday he sends AED 9,000 to a different name in the same country. The following Monday he sends AED 7,400 to a third name there. He pays cash each time, and each time he gives the same explanation: a relative is buying a vehicle.
Nothing the customer has done is forbidden. He needed nobody's permission for any of the three transfers, and the AED 24,900 that left over six days was his own money, converted into a currency he was free to buy. The obligations created that week belong to the exchange house. It has to decide whether it still understands who it is dealing with, whether the explanation it was given fits what it can actually see, and whether the sequence should go to the Financial Intelligence Unit as a suspicious transaction report. If it decides wrongly, the consequences fall on the licence and on the people who hold it.
That allocation is the design of the whole regime. The United Arab Emirates does not regulate foreign exchange mainly by telling people how much money they may move or where they may move it to. It regulates the institutions standing between the customer and the transfer: who may operate a counter, what they must know about the person in front of them, what they must record, and what they must report when a transaction stops fitting the customer they thought they had. Understanding the rules therefore means understanding a licence and its conditions rather than a schedule of permitted amounts.
Related Services: Explore our Data Regulation Compliance Advisory and Crypto Regulation Compliance Advisory services for practical legal support in this area.
The peg, and what it removes the need for
The dirham is pegged to the US dollar. That single decision explains much of what the UAE does not do. A country holding an exchange rate by administrative fiat has to ration hard currency, and rationing produces the apparatus familiar from jurisdictions with genuine capital controls: approval forms for outward payments, allocation of foreign currency by purpose, ceilings on what a resident may hold. The UAE holds its rate by standing ready to exchange at it, which is a question of reserves rather than of permissions.
Federal Law No. 14 of 2018 sets out the powers and functions of the Central Bank of the UAE, including its supervision of banks and financial institutions and its responsibility for monetary policy. Defending the peg is what makes reserves a live regulatory concern, and it is the reason the Central Bank keeps discretionary room to intervene in currency markets or impose temporary measures if a shock demands it. But that discretion sits in reserve. In ordinary conditions there is no general restriction on capital entering or leaving the country, no approval to obtain before an outward investment, and no cap on what a resident may remit.
Where the control actually sits
Because the movement of money is largely unrestricted, everything the regime wants to achieve has to be achieved at the point where money changes hands or changes currency. That point is a licensed institution: a bank or an exchange house. The controls attach to it, and they are of three kinds. There is a licence, which decides who may stand at that point at all. There are financial crime duties written into the licence, which decide what the institution must know and record. And there is a screening and reporting obligation on transfers, which decides what happens when a transaction looks wrong.
They are cumulative: an exchange house that satisfies the capital and governance conditions of its licence but cannot show a working monitoring system has not half-complied, it has failed in the part that supervisors examine most closely.
Alignment with international standards
The UAE's rules in this area are not written in isolation. They track the standards of the Financial Action Task Force on financial crime, the Basel Committee on Banking Supervision on prudential matters, and the work of the International Monetary Fund. The Central Bank also exchanges information with foreign regulators, which matters practically: a transfer that looks unexceptional viewed from a single counter in Deira may already be part of a pattern known to a regulator at the receiving end.
Licensing and supervision of exchange houses
Exchange houses do a large share of the country's currency conversion and outbound remittance business, particularly for individual customers who do not hold, or do not wish to use, a bank relationship. None of that business may be carried on without a licence from the Central Bank.
The application is not a formality. The Central Bank examines the applicant's financial standing, the integrity and record of the people who will manage the business, and the compliance infrastructure the applicant proposes to run. Capital adequacy requirements apply, and they vary with the scope of the activities the applicant wants authorised, so a house intending to handle outbound remittances to a wide range of destinations is not assessed against the same expectations as one proposing a narrower business.
What an applicant is really being asked to show
Consider an investor who wants to open a house serving expatriate workers sending money home. The capital question is answered with a balance sheet. The harder question is the compliance one, because the answer has to be a system rather than a policy document. The Central Bank is asking whether this applicant will be capable of noticing the customer described at the start of this article: whether the monitoring proposed would surface three cash transfers to three unfamiliar names in six days, whether a human being would then look at them, and whether that person would have the authority and the training to stop the fourth.
An applicant who cannot show that is refused; one that shows it on paper and does not operate it afterwards has a different problem. The failure the regulator names explicitly is a system that does not catch repeated transactions structured to stay beneath the levels at which the house would otherwise review them.
Supervision after the licence is granted
A licence is a continuing relationship, not a permission granted once. Licensed houses are subject to ongoing Central Bank supervision and to periodic audit. They must maintain internal controls and keep records that let an examiner reconstruct what happened at a counter and why. Breach exposes the house to penalties, to suspension, and to revocation of the licence itself, which for a business whose entire activity is licensed means closure.
Owners who treat the compliance function as administrative overhead tend to discover at examination that it is the part of the business the supervisor was measuring.
The financial crime duties attached to the licence
Federal Decree-Law No. 20 of 2018 on anti-money laundering and combating the financing of terrorism supplies the substantive obligations that the licence carries. For a currency business they come down to three linked requirements: know the customer, watch what the customer does, and report what does not fit.
Customer due diligence
The house must identify its customer and understand the business it is doing for them before the relationship becomes routine. The value of that work is not the file it produces; it is the baseline it establishes. Monthly transfers of AED 2,200 to one beneficiary in India are only recognisable as a pattern because the house recorded who the customer was and what he ordinarily did. Without a baseline there is no anomaly, only transactions.
Transaction monitoring
Monitoring is the requirement to keep looking after onboarding. Banks and exchange houses run automated systems that flag transactions on defined characteristics: structuring, meaning the division of a larger sum into smaller transfers to stay below the levels that would trigger review; frequent transfers to new or high-risk recipients; and remittance behaviour that does not match the profile already held for that customer. The system's output is an alert, not a conclusion. What it buys is human attention, directed at the accounts most likely to deserve it.
Suspicious transaction reporting
Where review does not dispel the concern, the institution must report the matter to the Financial Intelligence Unit as a suspicious transaction report. Alongside that sits a record-keeping duty covering transfers and the compliance work done around them, which is what allows the FIU and the supervisor to see a chain that no single institution could see alone.
Two points are worth stating plainly to management. Filing is not an accusation against the customer, and the standard that triggers it is suspicion rather than proof; waiting for certainty is itself a failure. And the duty belongs to the institution, so a compliance officer who is overruled by a commercial colleague has not transferred the exposure anywhere. Firms that get this wrong tend to have made the reporting decision a negotiation. Firms that get it right have made it a process with one owner and a written trail.
Screening remittances and high-risk destinations
The UAE is one of the world's major remittance corridors, and that volume is what makes the channel attractive to people with money to move quietly. Screening is what separates the two populations without stopping the legitimate one.
Enhanced due diligence
Standard due diligence is not enough in defined situations. Where a transfer involves a politically exposed person, a sanctioned individual, or a country subject to embargo, the institution must go further: verify the source of the funds and establish the beneficiary's identity to a higher standard than routine onboarding requires. A house processing a large transfer towards a sanctioned jurisdiction has to be able to see through attempts to disguise who is really receiving the money or where it really came from. Getting that wrong can bring criminal liability, not merely a supervisory finding.
What a monitoring system is looking for
| Signal | Why it draws attention | What the institution does next |
| Transfers broken into smaller amounts | Consistent with an attempt to stay below internal review levels | Manual review of the sequence rather than the individual transfer |
| Frequent transfers to new or high-risk recipients | Beneficiaries added faster than an ordinary relationship explains | Question the purpose; verify beneficiaries |
| Activity inconsistent with the customer profile | Value or destination departs from the recorded baseline | Refresh due diligence; establish source of funds |
| Counterparty is a PEP, sanctioned person, or embargoed jurisdiction | Category defined as high risk | Enhanced due diligence before proceeding |
| Concern survives review | The explanation does not account for what is visible | Suspicious transaction report to the FIU |
Return to the Sharjah counter with that grid. Three of the five rows are already lit: the sequence sits below the level at which the house reviews single transfers, the beneficiaries are new, and the activity does not resemble three years of AED 2,200 to one relative. The vehicle explanation is not absurd, but it does not explain three different names. A house that files, and records why, has done its job whether or not anything was wrong. A house that lets the pattern pass because the customer is familiar has taken on an exposure that will surface at the next examination, and by then it will be reconstructed from its own records.
False positives are a compliance problem too
Screening systems that flag too much are not conservative, they are broken. Alerts that nobody can work through are alerts that go unexamined, and a backlog is precisely what an examiner will read as a system running without human judgment behind it. Calibration is part of the obligation, not a commercial concession against it.
Where corporate and banking law meet the currency desk
Foreign exchange activity does not sit in a compartment of its own. It runs through the company that carries it on and, for banks, through prudential regulation as well. Advice on either side usually has to be given with the other in view, which is why banking and finance and corporate law questions arrive together in this area.
Directors and governance
Company law imposes duties on directors and officers that reach currency operations directly. They are expected to manage currency risk prudently and to keep the company compliant with the law that applies to it, and they can be liable when they do not. In practice that means a governance line: a compliance officer with a defined mandate and a reporting route to the board or senior management, an audit or risk committee that actually reviews currency exposures and compliance reporting, and training that reaches the staff at the counter rather than stopping at the head office.
The prudential layer for banks
Banks carry the additional weight of prudential regulation: capital adequacy, liquidity, and risk management requirements that bear on foreign exchange positions. They must hold capital sufficient to cover currency risk, operate internal controls that prevent unauthorised dealing, and report their exposures to the Central Bank so that regulatory limits can be observed rather than merely stated. Supervisors expect measurement and management of these risks, including stress testing and scenario analysis, since the peg stabilises the dirham against the dollar and does nothing at all for exposures in other currencies.
Enforcement
The Central Bank and other authorities enforce through inspection, audit, and investigation. Outcomes range from fines through suspension and revocation of a licence to criminal prosecution, and where an exchange house has facilitated money laundering the exposure is not confined to the entity: charges may follow against its management personally.
There is no large body of reported case law here, so the working guidance comes from elsewhere. Enforcement actions show what the Central Bank is currently unwilling to tolerate, and recent ones have concentrated on AML and CTF failures. Guidance notes and supervisory expectations also shift, and a compliance programme written once and left alone drifts out of line with them quietly, usually to be discovered by an examiner rather than by the firm. An inspection or enforcement process already under way is a matter for specialist banking and regulatory counsel at once, not after the first response has been filed.
Practical steps
- Establish the baseline, then keep it current. Due diligence that is never refreshed stops describing the customer, and monitoring against a stale profile detects nothing.
- Assess your own risk honestly. Identify where the business is exposed: destination countries, cash intensity, customer types, and any dealings touching sanctioned or embargoed jurisdictions.
- Calibrate the monitoring system and staff it. Rules that generate alerts nobody reviews are worse than fewer, better-aimed rules.
- Give the reporting decision one owner. Suspicion is the trigger; the compliance function should be able to file without commercial sign-off.
- Keep records that reconstruct the decision. An examiner will ask not only what was reported but what was reviewed and not reported, and why.
- Train the counter. The first observation of an unusual pattern is almost always made by a person, not a system.
- Write compliance into contracts. Agreements with counterparties, agents, and corporate clients should commit them to AML and CTF obligations, allocate responsibility if an investigation follows, and settle how information will be shared consistently with data protection duties.
- Plan for disputes. Blocked, delayed, or reversed transfers generate claims from customers and counterparties; agreeing the forum and the procedure in advance is cheaper than arguing about it during an investigation.
Conclusion
The absence of exchange controls in the UAE is often described as freedom of movement for capital, and for the customer at the counter that is broadly what it is. For the institution serving him it is the opposite of a light touch. Because the state does not screen transfers by permission, it screens them through licensed intermediaries, and the whole regulatory weight of the system rests on those intermediaries knowing their customers, watching what those customers do, and reporting what they cannot explain.
For any business handling currency in or through the UAE, the practical question is rarely whether a payment is allowed. It is whether the firm could show a supervisor, months later and from its own records, why it treated a given transaction the way it did.
Disclaimer
This article is for informational purposes only and does not constitute legal advice.
