UAE Imposes AED 200 Million Fine on Foreign Bank, with Personal Penalties for CEO and MLRO

The Central Bank of the United Arab Emirates (CBUAE) has imposed a financial penalty of AED 200 million on the UAE branch of an unnamed foreign bank following significant and repeated failures in its anti-money laundering and counter-terrorist financing (AML/CFT), governance, compliance management and sanctions frameworks. In an important aspect of the enforcement action, the regulator also imposed separate financial penalties on the branch’s Chief Executive Officer (CEO) and Head of Compliance and Money Laundering Reporting Officer (MLRO), reinforcing the principle that responsibility for regulatory compliance can extend beyond the financial institution itself.

The CEO received an individual penalty of AED 500,000, while the Head of Compliance and MLRO was fined AED 300,000. The three penalties amount to AED 200.8 million in total, with the individual sanctions imposed separately from the AED 200 million institutional penalty. The regulator stated that the executives had failed to fulfil the responsibilities and functions associated with their respective positions.

The CBUAE did not disclose the identity of the bank or the individuals concerned. Nor did it publish a detailed breakdown of the specific deficiencies attributed to each executive. The announcement therefore establishes that the regulator found failures in the performance of their respective responsibilities, but does not establish that either individual personally engaged in money laundering, knowingly facilitated sanctions evasion or was convicted of a criminal offence.

The enforcement action also includes measures intended to address the underlying weaknesses. The bank has been instructed to implement a mandatory remediation programme subject to independent validation. In addition, the CBUAE has ordered fit-and-proper reassessments of the CEO and Chief Compliance Officer. These assessments introduce a further dimension of regulatory scrutiny, as the suitability of the individuals to continue performing senior functions will be reconsidered. The announcement does not, however, confirm that either executive has been dismissed, prohibited from working in the financial sector or automatically disqualified from their position.

The case highlights the different but complementary responsibilities of senior management and the compliance function. A CEO is expected to ensure that the institution has an effective governance structure, appropriate risk management arrangements, adequate resources and functioning internal controls. The Head of Compliance and MLRO, meanwhile, is responsible for overseeing the institution’s financial-crime compliance arrangements, exercising independent judgement, monitoring relevant risks and ensuring that suspicious activity is appropriately assessed and reported.

The CBUAE's regulatory expectations place particular importance on the independence and authority of the compliance function. The MLRO must have sufficient seniority, access to relevant information, adequate resources and the ability to raise concerns with senior management and the governing body. A compliance officer cannot effectively perform these responsibilities if their position is merely nominal or if commercial considerations prevent them from exercising independent judgement.

At the same time, responsibility for an institution's AML/CFT framework cannot be transferred entirely to the MLRO. Senior management remains accountable for the overall operation of the business, including ensuring that compliance recommendations are properly considered and that identified weaknesses are addressed. Where management decides not to follow a recommendation concerning a high-risk customer or activity, the reasoning and measures taken to manage the associated risk should be appropriately documented.

The CBUAE's 2026 joint guidance on the compliance officer and MLRO function provides further context for these expectations. It addresses areas including customer due diligence, transaction monitoring, suspicious transaction and activity reporting, sanctions compliance, enterprise-wide risk assessments, employee training and the design and implementation of AML/CFT and counter-proliferation financing programmes. It also emphasises the importance of documented escalation procedures and appropriate reporting to senior management.

Although these requirements provide a framework for understanding the responsibilities of the two sanctioned executives, the CBUAE has not disclosed which particular controls or procedures were deficient at the bank. It would therefore be premature to conclude that the penalties resulted from a specific failure, such as inadequate transaction monitoring, failure to submit suspicious transaction reports or interference with the MLRO's independence.

The enforcement action is particularly relevant to foreign banks operating through branches in the UAE. Group-wide AML policies and procedures may provide a foundation for compliance, but they do not automatically demonstrate that local regulatory requirements and risks have been adequately addressed. Local management must be able to show that the institution's controls operate effectively in the UAE, that responsibilities are clearly allocated and that weaknesses identified by internal or external reviews are properly resolved.

For financial institutions, the case reinforces the importance of maintaining evidence that compliance arrangements operate in practice rather than existing solely in approved policies and procedures. This includes records of material risk assessments, decisions concerning high-risk customers, escalations to senior management, suspicious activity reporting, sanctions screening performance, compliance testing and remediation activities. Findings should have clearly assigned owners, appropriate deadlines and documented evidence that corrective measures have been implemented and independently tested where necessary.

Boards and senior executives should also ensure that the compliance function has sufficient staffing, appropriate reporting lines and direct access to decision-makers. Equally, MLROs and compliance officers should maintain records of significant decisions, recommendations and escalations, particularly where they identify weaknesses that require management intervention. Such documentation can help demonstrate how responsibilities were exercised and whether concerns were brought to the attention of the appropriate individuals.

The latest action follows an earlier CBUAE enforcement case in May 2025, when an exchange house received a penalty of AED 200 million and a branch manager was personally fined AED 500,000 and prohibited from holding a position at any licensed financial institution in the UAE. In June 2026, another foreign bank branch was fined AED 20 million for repeated AML/CFT and sanctions control failures, while its Head of Compliance and MLRO received a separate personal penalty of AED 300,000. The October 2026 action extends this pattern by imposing individual penalties on both the CEO and the Head of Compliance/MLRO of the same institution.

The latest enforcement decision sends a clear message that the CBUAE's supervisory approach extends beyond identifying institutional weaknesses to examining whether the individuals responsible for managing and overseeing those functions have fulfilled their duties. For CEOs, directors, compliance officers and MLROs, the implications are significant: holding a senior or designated compliance position carries responsibilities that must be supported by effective oversight, appropriate decision-making and demonstrable action when deficiencies arise.

As regulatory scrutiny continues to focus on the effectiveness of AML/CFT and sanctions controls, financial institutions should ensure that accountability is clearly allocated throughout their governance structures. The existence of an AML policy or the appointment of an MLRO is not, by itself, sufficient. Institutions and their senior personnel must be able to demonstrate that the framework is properly resourced, independently operated, regularly tested and capable of addressing identified weaknesses.

By fLEXI tEAM