How long must businesses retain AML records in the UAE?
Under the Executive Regulations of the UAE AML law, financial institutions, designated non-financial businesses and professions, and virtual asset service providers must retain all records, documents, and data relating to financial and cash transactions and commercial dealings for a period of not less than five years from the date the transaction was completed or the business relationship was terminated.
The same five-year minimum applies to records obtained through customer due diligence, ongoing monitoring, account files, business correspondence, copies of identification documents, suspicious transaction reports, and related recordings. Where an inspection, investigation, or court judgment is involved, the retention clock runs from the most recent of those events. Records must be organised so that individual transactions can be reconstructed, and they must be made available to the competent authorities promptly upon request. This obligation is also anchored in the primary law, which requires entities to retain all transaction records and keep them immediately available.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025, Article 25 — five-year record-keeping requirement.
· Federal Decree-Law No. 10 of 2025, Article 19 — obligation to retain records and data.
For more details, consult the full text of Cabinet Resolution No. 134 of 2025 or seek guidance from your AML compliance officer.