AML Business Risk Assessment (EWRA) Services in UAE

    AML Business Risk Assessment Services in the UAE

    Contact Us Now

    Every part of your anti-money laundering (AML) programme depends on one question: where is your business most exposed to money laundering, terrorist financing and proliferation financing? Your policies, customer due diligence, screening, monitoring, training and staffing should all follow from the answer.

    A business risk assessment is the written record of where your business is most exposed to financial crime. It is a structured money laundering risk assessment of your whole business, not of individual customers, that measures your inherent risk, tests how well your controls reduce it and shows the residual risk you are left with. We help UAE businesses carry out this assessment properly, with a clear method, real data and conclusions their supervisor can follow.

    Key Points at a Glance

    A business risk assessment, also called an enterprise-wide risk assessment (EWRA), is the foundation of every UAE anti-money laundering and countering the financing of terrorism (AML/CFT) programme. The points below summarise what the law requires and what a credible assessment contains:

    • A business risk assessment is mandatory under Federal Decree-Law No. 10 of 2025 (FDL 10/2025), Article 19(1)(a) and Cabinet Resolution No. 134 of 2025 (CR 134/2025), Article 5(1).
    • The assessment must consider customer, geographic, product, service, transaction and delivery channel risks, and the results of the National Risk Assessment (CR 134/2025, Article 5(1)).
    • A credible money laundering risk assessment moves from inherent risk to controls to residual risk.
    • Every risk score in a business risk assessment should be documented so it can be explained and repeated.
    • The findings of the assessment should drive your policies, customer risk scoring, monitoring, training and resources.
    • The assessment must be updated on an ongoing basis (CR 134/2025, Article 5(1)(b)), and good practice is a full refresh at least annually and after major changes.
    • Every engagement starts with a free consultation, so the scope is clear before you commit.
    • The fee for a business risk assessment is AED 3,700 to AED 11,000 (USD 1,000 to USD 3,000), depending on the nature and scope of the work.
    • A business risk assessment is delivered in 20 to 30 working days from receipt of the complete information.
    • Three rounds of revisions and a 40-minute structured walkthrough are included.
    • The deliverables include the completed EWRA report, the risk assessment chart, the risk assessment methodology, a risk appetite statement and a remediation action plan.
    • An optional 10-hour ongoing consulting package to keep your EWRA up to date is available and charged separately.
    • Our CAMS-certified team has completed 50+ EWRAs and 30+ EWRA updates across 10+ sectors.

    What Is a Business Risk Assessment?

    A business risk assessment, also called an enterprise-wide risk assessment (EWRA), a business-wide risk assessment, ML/FT risk assessment, or an entity-wide risk assessment, is the documented study of the money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks your business faces as a whole. It shows where the business is most exposed, how well its controls reduce that exposure and what residual risk remains. UAE supervisors expect the assessment to be specific to the business and supported by its own data.

    A business risk assessment is different from three other exercises it is often confused with:

    • A customer risk assessment, which rates each individual client. Customer ratings are an input to the business risk assessment, not a replacement for it.
    • A general business or enterprise risk assessment, which looks at commercial, operational or strategic risks. The AML business risk assessment focuses specifically on financial crime.
    • A supervisory survey, such as the annual risk assessment survey issued by the Ministry of Economy and Tourism (MoET). Your own assessment must exist regardless of any survey.

    When Do You Need a Business Risk Assessment?

    A UAE business needs a business risk assessment once it falls within the AML/CFT framework as a Financial Institution, DNFBP or VASP, because the duty in FDL 10/2025, Article 19(1)(a) applies from that point. After the first assessment, the business must keep it current. The most common triggers for a first business risk assessment or a complete rebuild are:

    • Starting or licensing a business that falls within the Financial Institution, DNFBP or VASP categories
    • Registering on goAML for the first time
    • Receiving notice of a supervisory inspection or a request for your risk assessment
    • Audit, health check or inspection findings that your current assessment is missing, outdated or generic
    • Entering a new sector, market or customer segment
    • Launching new products, delivery channels or technologies (CR 134/2025, Article 24)

    The Risk Factors We Assess

    CR 134/2025, Article 5(1)(a) requires businesses to consider all relevant risk factors, including customer, geographic, product, service, transaction, technology, and delivery channel risks, before setting their overall risk level. Our money laundering risk assessment scores each factor separately and adds technology risk under CR 134/2025, Article 24. Each risk factor is explained below.

    Customer risk

    Customer risk in a business risk assessment measures how the types of customers you serve could expose you to money laundering, terrorist financing or proliferation financing. Factors include residence and nationality, occupations and business activities, politically exposed persons (PEPs), complex ownership structures, non-resident clients and other high-risk customer segments. The assessment looks at the share of each segment in your customer base, not just whether it is present, to score overall customer risk.

    Geographic risk

    Geographic risk covers the countries linked to your customers, beneficial owners, counterparties, sources of funds and operations. Jurisdictions identified as high-risk or under increased monitoring raise the score, as does exposure to countries subject to sanctions. The assessment records which countries drive the rating and what share of customers or transaction value they represent.

    Product and service risk

    Product and service risk measures how attractive your products and services are to criminals. Features that raise the risk include cash intensity, high value, portability, anonymity, speed, cross-border use and links to virtual assets. Each product or service line is scored separately, so controls can focus on the riskiest offerings.

    Transaction risk

    Transaction risk looks at how money moves through your business. The assessment considers payment methods, transaction sizes and frequency, third-party payments and patterns such as structuring or the rapid movement of funds. Cash and cross-border payments usually score higher than bank transfers from the customer's own account.

    Delivery channel risk

    Delivery channel risk measures how you establish and manage customer relationships. Face-to-face, non-face-to-face and intermediated relationships, including introducers, agents and online onboarding, each carry a different level of risk. Channels where you do not meet the customer, or where you rely on a third party for due diligence, usually need stronger controls.

    Technology risk

    Technology risk covers the new or developing technologies used in your products, services or processes. CR 134/2025, Article 24 requires these risks to be identified and assessed before a new product, business practice, delivery mechanism or technology is launched or used. The business risk assessment brings these individual assessments together, so their combined effect on the business is visible.

    Our Methodology: Inherent Risk, Controls, Residual Risk

    A credible money laundering risk assessment follows a clear, repeatable method. Our methodology has three stages: inherent risk, control effectiveness and residual risk. Each stage is explained below.

    Stage 1: Inherent risk

    Inherent risk is your exposure to ML, TF and PF before any controls are applied. We score each risk factor using data from your business and the findings of the National Risk Assessment and relevant sectoral assessments. Where data is limited, expert judgement is used and the basis is recorded.

    Stage 2: Control effectiveness

    Control effectiveness measures how well your AML/CFT controls reduce inherent risk in practice. We assess each control that mitigates the risks, including governance, customer due diligence (CDD), screening, monitoring, reporting, training, record-keeping and independent review. Controls are rated on design and operation, with evidence where available.

    Stage 3: Residual risk

    Residual risk is the risk that remains after your controls are taken into account. We combine inherent risk and control effectiveness to calculate residual risk for each category and overall. The results are compared with your risk appetite to identify where action is needed.

    Every score is documented with its reasoning, so the assessment can be explained to senior management, auditors and supervisors, and repeated next year using the same method.

    Build a risk assessment you can explain line by line.

    Talk to our team.

    Contact Us Now

    What Data Does a Money Laundering Risk Assessment Use?

    A strong money laundering risk assessment relies on facts from your own business, not assumptions. Using real data shows the supervisor that each score is grounded in evidence. Depending on what is available, we use:

    • Customer numbers by type, nationality, residence and risk rating
    • Numbers of PEPs and high-risk customers
    • Transaction volumes and values by product, channel and payment method
    • Cash transaction data and threshold reports filed on goAML, the reporting platform of the UAE Financial Intelligence Unit (FIU), such as Dealers in Precious Metals and Stones Reports (DPMSRs) and Real Estate Activity Reports (REARs)
    • Screening statistics, including partial and confirmed matches
    • Internal suspicion reports, suspicious transaction reports (STRs), suspicious activity reports (SARs) and other goAML reports filed
    • Audit, health check and inspection findings
    • Training completion rates

    Business Risk Assessment by Sector

    A money laundering risk assessment must reflect the risks of your sector, because CR 134/2025, Article 5(2) requires businesses to take sectoral assessments into account. We tailor the risk factors, weightings and data sources to each sector we serve. The sector-specific risks we examine most closely are set out below.

    Dealers in precious metals and stones

    A business risk assessment for dealers in precious metals and stones (DPMS) typically focuses on high-value, portable goods, cash payments and walk-in customers. Scrap and bullion trade and international supply chains add geographic and proliferation financing exposure. The assessment also tests whether cash thresholds and DPMSR reporting work in practice.

    Real estate agents and brokers

    A business risk assessment for real estate agents and brokers typically covers cash and virtual asset payments, foreign and corporate buyers and off-plan resales. The use of third parties to fund purchases is a key risk factor because it can hide the true source of funds. The assessment also reviews how buyer due diligence and REAR reporting work in practice.

    Trust and company service providers

    A business risk assessment for trust and company service providers (TCSPs) typically covers complex ownership structures, nominee arrangements and non-resident clients. Introducer relationships are assessed closely because the provider may rely on a third party for part of its due diligence. The assessment also considers how transparent beneficial ownership is across the structures you form or manage.

    Accountants, auditors and lawyers

    A business risk assessment for accountants, auditors and lawyers typically focuses on the services provided and whether the firm handles client money. The risk profiles of client sectors matter, because a practice that serves high-risk sectors takes on part of their exposure. The assessment separates the activities that fall within the AML/CFT framework from other professional work, so controls are applied where they are needed.

    Virtual asset service providers (VASPs)

    A business risk assessment for virtual asset service providers (VASPs) typically covers product speed, privacy features, cross-border flows and peer-to-peer activity. Technology risks from new tokens, wallets and platforms are assessed under CR 134/2025, Article 24. The assessment also reviews how transaction monitoring and sanctions screening cover virtual asset transfers.

    Financial institutions

    A business risk assessment for financial institutions typically covers products, delivery channels, correspondent relationships, wire transfers and trade finance. Each business line is assessed separately because retail, corporate and treasury activities carry different risks. The results are then combined into an entity-wide view for senior management.

    Linking the EWRA to Your AML Programme

    A business risk assessment should not sit in a drawer once it is approved. CR 134/2025, Article 5(2) requires businesses to mitigate the risks they identify, so supervisors expect each finding to be reflected in a control. The findings of the assessment should shape:

    • Your AML policy and procedures, with stronger controls in higher-risk areas
    • Your customer risk methodology, with weightings that reflect identified risks
    • Your screening and monitoring setup, targeting the highest-risk products and channels
    • Your training plan, focusing on the roles exposed to the greatest risk
    • Your compliance resources and budget
    • Your decisions on new products, markets and customer segments

    We include a section in the report showing how each significant finding should flow into these controls.

    How Often Should a Business Risk Assessment Be Updated?

    CR 134/2025, Article 5(1)(b) requires the business risk assessment to be updated on an ongoing basis, so an assessment that is never revisited quickly falls out of compliance. In practice, we recommend updating your money laundering risk assessment at these points:

    • At least annually, as part of your compliance cycle
    • When the National Risk Assessment or sector assessments are updated
    • When you launch new products, services, channels or technologies
    • When you enter new markets or customer segments
    • After significant audit, health check or inspection findings
    • After major changes in law or supervisory guidance

    Common Weaknesses We Fix

    Supervisors often find the same gaps when they review a business risk assessment during an inspection. When we review existing assessments, these are the weaknesses we fix most often:

    • Assessments copied from templates that do not reflect the business
    • No reference to the National Risk Assessment
    • Missing risk categories, especially delivery channel and technology risk
    • Controls rated effective with no supporting evidence
    • No residual risk calculation, or no link between residual risk and actions
    • No record of senior management review
    • The same assessment reused for several years

    How to Do a Money Laundering Risk Assessment: Step by Step

    A money laundering risk assessment is carried out in nine steps, from defining the scope to monitoring actions and updating the assessment. Each step builds on the one before it. The steps are:

    1. Define the scope: the entities, business lines, products and locations covered.
    2. Gather information: national and sector risk assessments, typologies, your own data and previous assessments.
    3. Identify threats and vulnerabilities: how criminals could misuse your products, services and channels.
    4. Score inherent risk for each risk factor using an agreed scale and documented reasoning.
    5. Identify and assess controls, testing whether they are designed well and operate in practice.
    6. Calculate residual risk and compare it with your risk appetite.
    7. Agree actions for any risk above appetite, with owners and deadlines.
    8. Document the assessment, obtain senior management review and approval, then communicate the results.
    9. Monitor actions and update the assessment as the business and risks change.

    We guide you through each step, or carry out the assessment with input from your team, depending on the time and resources you have available.

    Who Should Be Involved?

    A business risk assessment is usually led by the Compliance Officer, with input from senior management, front-line managers, finance and operations, IT and internal audit. No single person sees every risk in the business, so involving these groups makes the assessment more accurate. Each group contributes the following:

    • Senior management, who understand strategy, products and risk appetite
    • Front-line managers, who know how customers behave and where pressures arise
    • Finance and operations, who understand payment flows and transaction data
    • IT, who can explain systems, data quality and technology risks
    • Internal audit or an external reviewer, who can comment on control effectiveness

    We run short workshops with these stakeholders, which improves the quality of the assessment and builds shared ownership of the results.

    Proliferation Financing Risk

    Proliferation financing risk must be assessed alongside money laundering and terrorist financing risk, because FDL 10/2025 defines the Crime to include all three. Your assessment should consider how your business could be used to supply goods, services or funds to persons involved in weapons of mass destruction programmes, or to evade related sanctions. For many UAE businesses, proliferation financing exposure comes from trade links, dual-use goods, front companies and links to particular jurisdictions. We include a dedicated proliferation financing section in every assessment.

    Engagement, Timeline and Fees

    A business risk assessment with goAML Registration starts with a free consultation and ends with a reviewed EWRA report and a structured walkthrough. The terms below apply to every business risk assessment engagement.

    Free consultation

    Every business risk assessment engagement starts with a free consultation. The consultation is an introductory call to understand your business, your sector and your current AML/CFT framework. It defines the scope of the work and the information we will need from you.

    Information we need from you

    A business risk assessment is built on your own documents and data. After the free consultation, we send an information request covering:

    • Your business profile and trade licence
    • A description of your business activities
    • The past year's data on geographies, customers, products, services and delivery channels
    • Regulatory reporting data, including reports filed on goAML
    • Data on PEPs, sanctions matches and adverse media hits
    • Details of the AML/CFT controls you have deployed
    • Your past EWRA, AML/CFT policy and procedures
    • Training records
    • The Compliance Officer's CV

    Once we have reviewed the information, we interview key staff to understand how your business and controls work in practice.

    Timeline

    A business risk assessment takes 20 to 30 working days from receipt of the complete information. Where the work falls within that range depends on its nature and scope. Interviews with key staff are scheduled within this period.

    Fees

    The fee for a business risk assessment is AED 3,700 to AED 11,000 (USD 1,000 to USD 3,000). The fee depends on the nature and scope of the work. The free consultation defines that scope, which determines where your fee falls within the range.

    What is included

    Every business risk assessment includes three rounds of revisions and a 40-minute structured walkthrough. The revisions let you correct facts and refine the assessment before it is finalised. The walkthrough explains the methodology, the risk ratings and the risk appetite statement, so your team can maintain the assessment.

    Ongoing support after delivery

    After delivery, you can add a 10-hour ongoing consulting package to keep your EWRA up to date. The package is charged separately from the business risk assessment fee. The hours can be used to update the assessment as your business, risks or regulatory requirements change.

    How to Get Started

    Getting started with a business risk assessment takes six steps, from your first contact to the final report. The steps are:

    1. Contact us and book a free introductory call to discuss your business and the scope of the work.
    2. Receive our information request, then submit the documents and data listed above.
    3. We review the information and interview key staff to understand how your business and controls work in practice.
    4. We identify and assess your ML, TF and PF risks, identify your controls and carry out a qualitative review of how well they work.
    5. We identify residual risk and your risk appetite and, where residual risk is above appetite, help you deploy additional controls.
    6. We deliver the EWRA report with the risk assessment chart, methodology and risk appetite statement, then complete up to three rounds of revisions and the 40-minute walkthrough.

    What You Receive

    Every business risk assessment engagement ends with a set of documents your team can use, update and show to the supervisor. The deliverables are:

    • A documented risk assessment methodology
    • A completed business risk assessment covering inherent risk, controls and residual risk
    • A risk assessment chart summarising the risk ratings for each risk category
    • A risk appetite statement
    • A remediation and improvement action plan
    • Guidance on updating policies, customer risk scoring and training
    • A schedule for annual and trigger-based updates

    Put a clear, data-driven risk assessment at the centre of your AML programme.

    Book a free consultation.

    Contact Us Now

    Our Business Risk Assessment Track Record

    goAML Registration has carried out business risk assessments for UAE businesses across many sectors. Our business risk assessment track record includes:

    50+

    EWRAs completed

    30+

    EWRA updates delivered

    10+

    sectors served

    Each business risk assessment is built from the client's own data and interviews, not reused templates.

    What our clients say about our business risk assessment

    Clients describe our business risk assessment work in their own words:

    "goAML Registration conducted an EWRA for us. The entire process was smooth, right from engagement to the EWRA report. We highly recommend them for ML/FT risk assessment."

    Compliance Officer, law firm

    "They conducted a business risk assessment for us and helped us design a risk appetite statement and identify, assess and evaluate risks and controls. They also helped us deploy controls to bring the net risk within our risk appetite."

    Compliance Officer, trust and company service provider

    Why Choose Us for Your Risk Assessment

    goAML Registration's CAMS-certified professionals carry out every money laundering risk assessment with a documented methodology, real data and input from the people who run your business. Our experience with goAML reporting and health checks means we know which risks supervisors focus on and which controls most often fail. The result is an assessment that is specific to your business, easy to explain and simple to update next year.

    FAQs About Business Risk Assessments

    These are the questions UAE business owners and Compliance Officers ask most often about the business risk assessment. Each answer gives the short answer first and then explains it.

    Is a business risk assessment mandatory in the UAE?

    Yes. FDL 10/2025, Article 19(1)(a) and CR 134/2025, Article 5(1) require Financial Institutions, DNFBPs and VASPs to identify, assess, document and update their money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks. The written assessment must be retained and provided to the authorities on request. A business that cannot produce a documented, current assessment during an inspection is likely to receive a supervisory finding.

    Is a business risk assessment the same as an EWRA?

    Yes. Business risk assessment, enterprise-wide risk assessment (EWRA) and business-wide risk assessment are different names for the same obligation. FDL 10/2025 and CR 134/2025 do not use any of these labels; CR 134/2025, Article 5 simply requires businesses to identify, assess and document their crime risks. What matters to the supervisor is the content of the assessment, not its title.

    What is the difference between inherent and residual risk?

    Inherent risk is your exposure before controls. Residual risk is what remains after your controls are taken into account. For example, a business that accepts cash has high inherent transaction risk, but cash limits, source-of-funds checks and threshold reporting can reduce its residual risk. The gap between the two shows how much work your controls are doing.

    Do we need to refer to the UAE National Risk Assessment?

    Yes. CR 134/2025, Article 5(1) requires businesses to take the results of the National Risk Assessment into account when they identify and assess their risks. CR 134/2025, Article 5(2) also requires them to consider the National Risk Assessment and sectoral assessments when they mitigate those risks. A business risk assessment should therefore show which National Risk Assessment findings apply to your sector and how each one affects your own risk scores.

    Who should approve the business risk assessment?

    Senior management should review and approve the business risk assessment, while the Compliance Officer usually prepares or oversees it. CR 134/2025, Article 5(2)(a) requires the policies, controls and procedures that respond to the identified risks to be approved by senior management, so it makes sense to sign off the assessment and the policies together. A record of the review, such as management or board minutes, gives the supervisor evidence that the findings were understood.

    How long does a money laundering risk assessment take?

    A business risk assessment takes 20 to 30 working days from receipt of the complete information. Where the work falls within that range depends on its nature and scope. Interviews with key staff take place during this period, so staff availability also affects timing.

    How much does a business risk assessment cost?

    A business risk assessment costs AED 3,700 to AED 11,000 (USD 1,000 to USD 3,000). The fee depends on the nature and scope of the work. The free consultation defines that scope before you commit.

    What is included in a business risk assessment?

    A business risk assessment includes the completed EWRA report, the risk assessment chart, the risk assessment methodology, a risk appetite statement and a remediation action plan. The engagement also includes three rounds of revisions and a 40-minute structured walkthrough of the report. Where residual risk is above your risk appetite, we help you deploy additional controls.

    What is included in the free consultation?

    The free consultation is an introductory call about your business, your sector and your current AML/CFT framework. The call defines the scope of the business risk assessment and the information we will need. After the call, we send an information request listing the documents and data required.

    Is support included after delivery?

    Ongoing support is not included in the business risk assessment fee. After delivery, you can add a 10-hour ongoing consulting package, charged separately, to keep your EWRA up to date. The three rounds of revisions and the 40-minute walkthrough are part of the original engagement.

    Can we use a template or do the risk assessment ourselves?

    A template on its own is not enough. A template cannot reflect your own customers, products, delivery channels and controls, which CR 134/2025, Article 5(1)(a) requires the assessment to consider. You can carry out the assessment in-house if your team has the expertise and the data, but it must follow a documented methodology and be retained under CR 134/2025, Article 5(1)(b).

    Can a small business use a simpler risk assessment?

    Yes. CR 134/2025, Article 5(1) requires risk assessment proportionate to the nature and size of the business. A small DNFBP can use a shorter assessment, provided it covers all required risk factors and is documented. Proportionate does not mean optional, so the supervisor will still expect evidence behind each risk score.

    Does the assessment cover terrorist financing and proliferation financing?

    Yes. A complete assessment covers money laundering, terrorist financing and proliferation financing, each with its own threats and indicators. CR 134/2025, Article 5(1) refers to crime risks, and FDL 10/2025 defines the Crime to include money laundering, terrorist financing and proliferation financing.

    What is risk appetite?

    Risk appetite is the level of residual risk your senior management is willing to accept. Risks above appetite need further controls or a change in business activity. The risk appetite statement should be approved by senior management and reviewed together with the business risk assessment.