The 2025 instruments and the insurance perimeter

Within three months, both the sectoral framework governing insurance business supervised by the Central Bank and the federal framework on anti-money laundering, the financing of terrorism and proliferation financing were replaced. Federal Decree-Law No. 6 of 2025 commenced on 16 September 2025. Federal Decree-Law No. 10 of 2025 commenced on 14 October 2025, and its executive regulations, Cabinet Resolution No. 134 of 2025, on 14 December 2025. Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 have been repealed.

Instruments issued before that period are not necessarily displaced, but the two preserving provisions are not identically drafted. Article 41(3) of Decree-Law No. 10 of 2025 preserves the former executive regulations, resolutions and circulars insofar as they do not conflict with the current framework and until they are replaced. Article 183(1) of Decree-Law No. 6 of 2025 preserves regulations, decisions, standards, guidelines and circulars issued under Decree-Law No. 14 of 2018 and Decree-Law No. 48 of 2023 until replacement instruments are issued, and Article 183(2) preserves the established meanings of definitions and technical terms used in them. The preserving provision in Decree-Law No. 6 of 2025 is expressed by reference to the instruments and the two former sectoral laws under which they were issued, rather than as an open rule for any earlier document.

Each such instrument accordingly has to be read against the current text rather than assumed to have lapsed or assumed to survive.

How Article 2 classifies a person

Article 2 of the executive regulations defines a financial institution by reference to the activities a person carries on, as a commercial activity, for the benefit of or on behalf of a customer. Insurance appears expressly at paragraph 12: subscription to, or savings in, life insurance policies and other types of investment-related insurance, including those provided by insurance agents and brokers.

The definition is activity-based, but what it classifies is the person, not an isolated transaction. Two consequences follow, and they run in opposite directions.

A pure non-life operator is not brought within paragraph 12 merely by holding an insurance licence. Conversely, a person carrying on life or investment-related insurance falls within the definition, and the regulations contain no provision expressly carving that person’s other business lines back out. For a composite operator the classification question is therefore about the person as a whole, and it is not answered by pointing to the class of business generating a particular placement.

The analysis is also not confined to paragraph 12. The other activities listed in Article 2 have to be considered on their own terms, and paragraph 14 reserves a power to determine further financial activities by resolution of the supervisory authority in coordination with the National Committee.

Agents and brokers are expressly included where they provide the business described in paragraph 12. General non-life insurance is not identified there, and insurance and reinsurance intermediaries are not enumerated as designated non-financial businesses and professions in Article 3 in that capacity. Article 3 likewise reserves, at paragraph 6, a power to designate further businesses and professions. Absence from the enumerated lists is accordingly a present position rather than a permanent exclusion.

Reinsurance is not expressly mentioned in paragraph 12 at all. Its treatment should not be stated as resolved by that paragraph.

The international standard, and its limits as a guide

The FATF definition covers the underwriting and placement of life insurance and other investment-related insurance, including the relevant activities of insurers and intermediaries. Non-life insurance falls outside that minimum definition of financial institutions, although jurisdictions may impose broader domestic requirements.

The national position therefore has to be determined from the domestic instruments and the applicable supervisory material, not inferred from the minimum international perimeter.

What the boundary of paragraph 12 does not mean

It does not leave non-life insurers, reinsurers or intermediaries without obligations of this kind.

For entities licensed and supervised by the Central Bank, the sectoral framework has to be considered alongside Article 2. The Central Bank’s guidance for the insurance sector states that, unless otherwise noted, it applies to all insurance and reinsurance companies, agents and brokers licensed and supervised by the Central Bank, while its substantive treatment concentrates on life and investment-related products. The Rulebook currently lists that guidance as in force, effective from 31 October 2022, and its stated legal basis includes a provision of Cabinet Decision No. 10 of 2019 — an instrument that has since been repealed. That combination is exactly what the preserving provisions address, and it is a reason to establish the position of a supervisory instrument rather than infer it from its date.

The position differs in the financial free zones. Article 2 of Decree-Law No. 6 of 2025 expressly provides that the Decree-Law does not apply to the financial free zones in the State or to financial institutions regulated by the authorities of those zones. The framework applicable to an institution supervised by the Dubai Financial Services Authority or the Financial Services Regulatory Authority therefore has to be considered separately, and the Central Bank sectoral material cannot be carried across.

That exclusion should not be read further than it goes. The Decree-Law contains separate provisions on cooperation between the Central Bank and the authorities of the financial free zones, and on activities of Central Bank licensed institutions connected with those zones. The Article 2 exclusion does not mean the Decree-Law is irrelevant to every arrangement with a financial free zone element.

Targeted financial sanctions obligations under the domestic regime arise independently of the class of insurance and are not confined to persons within paragraph 12.

A file note should therefore distinguish between classification as a financial institution under Article 2, obligations arising from the applicable sectoral framework, and targeted financial sanctions requirements. It should not record pure non-life business as falling within paragraph 12; equally, it should not infer from paragraph 12 that a licensed non-life operator has no obligations of this kind.

Selected operative provisions within the Article 2 perimeter

Most of what follows carried over in substance from the previous regime. It is set out because the article numbering has changed, not because the requirements are new.

Triggers and thresholds. Article 7 requires customer due diligence on commencement of a business relationship, where a crime is suspected, and where doubts arise as to the accuracy or adequacy of identification data previously obtained. Financial institutions apply it in addition to occasional transactions of AED 55,000 or more, whether single or apparently linked, and to occasional wire transfers of AED 3,500 or more.

Beneficial ownership. Article 10(1) sets out a sequence for customers that are legal persons. Under paragraph (a), the natural person who ultimately owns, individually or jointly with another person, an actual controlling ownership interest or shares of 25 per cent or more. Under paragraph (b), where that person cannot be identified, or doubt remains that the holder of the interest or controlling shares is the beneficial owner, or no natural person exercises control through an ownership interest, the natural person exercising legal or actual control over the legal person, or control by any other means, whether directly or indirectly. Under paragraph (c), where no natural person is identified under paragraphs (a) and (b), the relevant natural person or persons holding a senior management position. Recording each stage of the analysis and the evidence supporting the conclusion is good practice rather than an express requirement of the Article.

Listed counterparties. Article 11 provides limited relief where the customer, or the controlling owner, is a company listed on a securities market subject to disclosure requirements ensuring sufficient transparency as to beneficial ownership, and for a subsidiary falling within the wording of that Article. The English wording describing the subsidiary is not free from ambiguity, and a position taken on it should follow the Arabic text.

Reliance on a third party. Article 20 permits reliance for specified due diligence measures only, and on conditions: account is taken of country risk; the third party is regulated and supervised and subject to due diligence and record-keeping requirements; the necessary identification data is obtained immediately; arrangements exist for copies of supporting documents to be provided without delay; and responsibility for accuracy remains with the party relying. Further conditions apply where the third party belongs to the same group. An outsourcing or agency arrangement under the institution’s own control is not reliance within the Article.

Policy beneficiaries. Under Article 12, where the beneficiary of a life or investment-related policy is designated by name, the name is obtained on designation. Where designation is by category or description, sufficient information is obtained to permit identification at the time of payment. Verification of identity occurs at payment or when rights under the policy are exercised. Where a high-risk beneficiary is a legal person or legal arrangement, enhanced measures at that point extend to identifying and verifying that beneficiary’s own beneficial owner.

Existing relationships. Article 13 requires measures to be applied to relationships existing at commencement, at times determined by materiality and risk, and requires confirmation that data obtained under the previous regulations remains adequate.

Retention. Article 25 contains two rules rather than one. Transaction and commercial records are retained for not less than five years from completion of the transaction or termination of the business relationship. Due diligence, monitoring, account, correspondence, identification and analysis records are retained for not less than five years calculated from the most recent of the events specified in that provision.

What the file should demonstrate

A file should be able to demonstrate three matters. First, how the person was classified under Article 2 of Cabinet Resolution No. 134 of 2025, including the activity and the paragraph relied upon. Second, the legal or supervisory source of each measure applied: the federal framework on anti-money laundering, the financing of terrorism and proliferation financing; the applicable sectoral framework or supervisory instrument; or the targeted financial sanctions regime. Third, where Article 13 applies to customers and existing business relationships, when the measures were applied, how the timing was determined by materiality and risk, and how the adequacy of data obtained earlier was assessed.

Without a documented basis for applying a measure, it may be difficult to demonstrate after the event that the measure was required by law or by the institution’s own assessment of risk, rather than applied as a matter of routine.

This note sets out general observations on the applicable regulatory framework and practice and does not address the circumstances of any particular entity. It does not constitute legal advice and should not be relied upon as such. The positions described reflect the regulatory framework as at the date of the latest revision stated above. Any English translation of UAE federal legislation cited in this note should be read subject to the authoritative Arabic text, which prevails in the event of inconsistency.