AML/CFT Regulatory Compliance

AML (Anti-Money Laundering) and CFT (Countering the Financing of Terrorism) compliance is a legal requirement for all financial institutions, DNFBPs, and VASPs operating in the UAE. This includes real estate agents, precious metals dealers, lawyers, accountants, banks, money exchangers, insurance companies, and crypto businesses. Non-compliance can result in fines up to AED 5 million and criminal prosecution.

An AML/CFT policy is a formal written document setting out the measures, controls, and procedures an entity has implemented to prevent money laundering and terrorism financing. It must cover six core areas: ML/TF risk identification and assessment, Customer Due Diligence measures, suspicious transaction monitoring and STR reporting, AML/CFT governance, record-keeping requirements, and international financial sanctions compliance.

goAML is the UAE Financial Intelligence Unit's (FIU) platform for submitting Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs). All regulated entities — DNFBPs, financial institutions, and VASPs — must register on the goAML portal. It is also a mandatory requirement for opening corporate bank accounts in the UAE.

Yes. Appointing an AML Compliance Officer (also called MLRO) is mandatory under UAE law for all regulated entities. The MLRO oversees AML/CFT governance, reports suspicious transactions to the FIU via goAML, manages the compliance programme, and provides staff training. We offer outsourced MLRO services for businesses without an in-house compliance officer.

A BRA is a formal evaluation of your organisation's ML/TF risks based on customer risk, product/service risk, geographic risk, and transaction/delivery channel risk. It is a mandatory requirement under UAE AML regulations and forms the foundation of your entire AML/CFT compliance programme.

Customer Due Diligence (CDD) is the standard process of verifying customer identity and understanding the business relationship. Enhanced Due Diligence (EDD) applies to high-risk customers — including PEPs, customers from high-risk jurisdictions, or those conducting unusual transactions. EDD requires deeper scrutiny, senior management approval, and ongoing enhanced monitoring.

Under UAE AML/CFT regulations, all records, KYC files, transaction documents, and STR-related files must be retained for a minimum of 5 years from the end of the business relationship or the date of the transaction. Failure to maintain adequate records is itself a regulatory violation subject to penalties.

UAE AML policy requirements include: collecting and verifying customer KYC information; ongoing transaction monitoring; identifying and reporting suspicious transactions via goAML; implementing risk-based CDD, EDD, and SDD procedures; screening customers against international and UAE sanctions lists; maintaining records for a minimum of 5 years; appointing a qualified MLRO; providing regular AML/CFT training to all relevant staff; and conducting periodic internal or independent AML audits.