AML Policy, Controls and Procedures Documentation Services in the UAE

The governance section of an AML policy sets out the roles of senior management, the Compliance Officer, deputies and staff, the reporting lines, who approves the policy and how often it is reviewed. Senior management approves the AML policy and remains accountable for it, while the Compliance Officer runs the framework day to day under CR 134/2025, Article 22. The policy should name who acts when the Compliance Officer is absent and how compliance matters are reported to the owners or board. Clear governance shows a supervisor that AML responsibilities are assigned, understood and overseen.

The risk assessment section of an AML policy explains how the business-wide risk assessment is performed and updated, how the National Risk Assessment is considered and how each customer is risk-rated. CR 134/2025, Article 5 sets the obligation to identify and assess money laundering, terrorist financing and proliferation financing risks and to apply controls in proportion to them. The customer risk-rating method should list the factors used, such as customer type, geography, product and delivery channel, and show how each rating changes the level of due diligence. Under a risk-based approach, higher-risk customers receive more scrutiny and lower-risk customers are not burdened with unnecessary checks.

The customer due diligence (CDD) section of an AML policy covers the identification and verification of individuals, companies and legal arrangements, beneficial ownership to the 25% threshold under CR 134/2025, Article 10, the purpose of the relationship and ongoing monitoring. CDD procedures under CR 134/2025, Articles 6 to 15 should state which documents are accepted, how they are verified and when CDD must be completed. The policy should also explain what happens when CDD cannot be completed, including declining or ending the relationship and considering an STR. Existing customers need a CDD refresh schedule based on their risk rating.

The due diligence section of an AML policy should explain when enhanced measures apply, what they involve, when simplified measures may be used and who approves high-risk relationships. Enhanced due diligence under CR 134/2025, Article 5(2)(c) typically includes source of funds and source of wealth checks, senior management approval and closer ongoing monitoring. Simplified due diligence under CR 134/2025, Article 5(3) is only available where lower risk has been identified and there is no suspicion of money laundering, terrorist financing or proliferation financing. The policy should list the triggers for each, so staff do not have to make the decision alone.

The PEP section of an AML policy explains how politically exposed persons (PEPs), their family members and close associates are identified, approved and monitored, in line with CR 134/2025, Article 16. The PEP procedure should cover foreign PEPs, domestic PEPs and people with prominent roles in international organisations. For higher-risk PEP relationships, the policy should require senior management approval, checks on source of funds and source of wealth, and enhanced ongoing monitoring. Staff also need clear guidance on how PEP status is detected at onboarding and during the relationship, including through screening tools.

The targeted financial sanctions (TFS) section of an AML policy covers screening against the UAE Local Terrorist List and the UN Security Council Consolidated List, freezing without delay, and Confirmed Name Match Report (CNMR) and Partial Name Match Report (PNMR) filing under Cabinet Resolution No. 74 of 2020 and EOCN guidance. The sanctions procedure should state when screening takes place: at onboarding, before transactions and whenever the lists are updated. The procedure should explain how potential matches are investigated, how confirmed matches are frozen and reported, and how partial name matches are resolved. Registering for EOCN notification alerts, as set out in the EOCN Guidance on Targeted Financial Sanctions, helps make sure list updates reach your team promptly.

The transaction monitoring section of an AML policy explains how unusual activity is identified, which sector-specific red flags apply and how alerts are reviewed and recorded. Transaction monitoring procedures should define what is unusual for your business, such as activity inconsistent with a customer's profile, unexplained third-party payments or transactions split to stay below reporting thresholds. Each alert should be reviewed, documented and either closed with a reason or escalated to the Compliance Officer. The red flag list should be specific to your sector and refreshed when new typologies or guidance are published.

The escalation and reporting section of an AML policy explains how staff raise concerns, how the Compliance Officer decides whether to report, how suspicious transaction reports (STRs), postponement suspicious transaction reports (PSTRs) and suspicious activity reports (SARs) are filed on goAML and how tipping off is avoided. Under FDL 10/2025, Article 18 and CR 134/2025, Articles 17 to 19, suspicious transactions must be reported to the FIU without delay. The procedure should include an internal suspicion report form, a timeline for the Compliance Officer's decision and a record of the reasons for reporting or not reporting. Staff must also understand that tipping off a customer is prohibited and is an offence under FDL 10/2025, Article 29.

An AML policy should cover the threshold and sector reports that apply to your business, such as the Dealers in Precious Metals and Stones Report (DPMSR), the Real Estate Activity Report (REAR), the High-Risk Country Transaction Report (HRC) and the High-Risk Country Activity Report (HRCA). These goAML report types sit alongside STRs and SARs and are triggered by specific transactions or high-risk country links rather than by suspicion alone. The AML policy should explain which reports apply to your sector, what triggers each one and who files it on goAML. Covering these reports in the policy helps prevent missed filings, which supervisors treat as a reporting failure.

The high-risk countries section of an AML policy sets out the measures for customers and transactions linked to countries identified as high-risk. CR 134/2025, Article 23 requires enhanced measures, and any countermeasures called for, on relationships and transactions linked to high-risk countries. The policy should reference the FATF lists and any instructions issued by UAE authorities, and explain how staff check a customer's country exposure. The policy should also describe when HRC or HRCA reports must be filed on goAML.

The record-keeping section of an AML policy requires records to be kept for at least five years under CR 134/2025, Article 25, and organised so that transactions can be reconstructed. Records include CDD documents, transaction records, screening results, internal suspicion reports, STRs and training logs. The policy should state where records are stored, who can access them and how quickly they can be produced when the FIU or a supervisor asks for them. Good record-keeping also strengthens your position in an inspection, because it proves that controls were actually performed.

The training and screening section of an AML policy sets out who is trained, how often and on what, and how new employees are screened for fitness and propriety. AML training should cover the law, the AML policy, sector red flags, sanctions screening and how to escalate a concern, with extra depth for front-line and compliance staff. Training records should show attendance, dates and assessment results. Employee screening procedures, required by CR 134/2025, Article 21, should apply at hiring and can be repeated for sensitive roles.

The independent audit section of an AML policy explains how the effectiveness of the AML framework is tested and how findings are tracked to closure. CR 134/2025, Article 21 requires an independent audit function to test the policies, controls and procedures. The audit can be performed internally or by an external provider, as long as it is independent of the people who run the controls. Findings should be recorded, assigned to an owner with a deadline and reported to senior management until they are closed.

An AML policy for dealers in precious metals and stones typically covers cash transaction controls, DPMSR reporting for transactions of AED 55,000 or more, walk-in customer procedures, buy-back and refund checks and supply-chain due diligence. Dealers in precious metals and stones handle high-value, portable goods and frequent cash payments, which makes the sector attractive for money laundering. The AML policy should explain how cash payments are identified, how linked transactions are combined and how customers paying in cash are verified. Sanctions screening of both suppliers and customers is also essential where goods are sourced from or sold to higher-risk jurisdictions.

An AML policy for real estate agents and brokers typically covers buyer and seller due diligence, payment method checks, REAR reporting for cash and virtual asset transactions, handling of off-plan resales and checks on corporate buyers. Real estate transactions can move large values in a single deal, so the AML policy must identify both the parties and the source of funds behind each purchase. Procedures should cover payments from third parties, offshore companies and virtual assets, and how agents identify the beneficial owners of corporate buyers. The policy should also explain what the brokerage does when a buyer or seller will not provide the information requested.

An AML policy for trust and company service providers typically covers due diligence on complex structures, nominee arrangements, beneficial ownership tracing, introducer relationships and ongoing monitoring of administered entities. Trust and company service providers create and manage structures that can be misused to hide ownership, so their AML policy must focus on transparency. Procedures should explain how beneficial owners are traced through each layer, how nominee directors and shareholders are disclosed and how the purpose of each structure is understood. Ongoing monitoring should confirm that the ownership and activities of administered entities still match the information on file.

An AML policy for accountants and auditors typically covers client and engagement acceptance, handling of client money, company formation and bookkeeping services, and red flags identified during accounting or audit work. Accountants and auditors fall within scope when they prepare for or carry out specified activities for clients, such as managing client funds, forming or managing companies, or advising on the purchase or sale of a business. The AML policy should define which engagements are in scope, require CDD before the work starts and explain how unusual transactions spotted in client records are escalated. Accountants and auditors supervised by the Ministry of Economy and Tourism should also reflect the Ministry's guidance and circulars in their procedures.

An AML policy for lawyers typically covers matter and client acceptance, handling of client and escrow funds, property and corporate transactions, and the scope of legal professional privilege under FDL 10/2025, Article 18(2). Lawyers and legal consultants fall within scope when they prepare for or carry out specified activities for clients, such as buying or selling real estate, managing client money or creating and managing companies and legal arrangements. The AML policy should explain where privilege applies and where it does not, so that suspicious transactions outside privileged advice are still reported to the FIU without delay. Escalation procedures must protect client confidentiality, prevent tipping off and reflect the guidance of the Ministry of Justice as the supervisory authority for lawyers.

An AML policy for VASPs typically covers wallet screening, blockchain analytics, travel rule information, high-volume digital onboarding and transaction monitoring scenarios for virtual asset transfers. VASPs carry out the virtual asset activities set out in CR 134/2025, Article 4, and must meet the VASP-specific obligations and licensing requirements in CR 134/2025, Article 36. The AML policy should explain how customers are verified remotely, how transfers to and from unhosted wallets are assessed and how exposure to mixers, privacy coins and high-risk exchanges is managed. Procedures should also reflect the rulebooks and guidance of your supervisor, such as VARA or the Capital Market Authority (CMA).

An AML policy for financial institutions typically covers correspondent banking, money or value transfer services, wire transfers, group-wide programmes and automated transaction monitoring. Financial institutions must apply the specific obligations in CR 134/2025, Articles 26 to 33, covering correspondent banking relationships, MVTS, originator and beneficiary information on wire transfers, and financial groups with foreign branches and subsidiaries. The AML policy should set out how monitoring scenarios and screening thresholds are calibrated, tested and approved, and how alerts are worked within defined timelines. Procedures should also reflect the requirements of your supervisor, such as the Central Bank, the CMA, the DFSA or the FSRA.

Every engagement can begin with a free AML policy gap analysis. You receive a gap analysis document that highlights the regulatory requirements that apply to your business and shows where your current policy falls short. The gap analysis helps you decide whether you need a full rewrite or a targeted update, and it forms the basis of your fee quote.

To draft your AML policy, we ask you to share the following documents and information at the start of the engagement:

• Your trade licence
• Your existing AML policy and procedures, if any
• Your ML/FT risk assessment document, if available
• Your business profile, including activities, products, customer types and locations
• A description of your current business practices, such as how customers are onboarded and how payments are received
• Details of the tools you use, such as your POS system, CRM, accounting system, core banking platform and screening software
• Availability for a 20-minute interview with management or your Compliance Officer

Once we receive these documents, our team drafts the AML policy, controls and procedures for you. The ML/FT risk assessment is not part of the AML policy fee. If you do not yet have one, our Business Risk Assessment service is available separately.

A complete AML policy and procedures pack is delivered within 15 to 20 working days. The timeline runs from the date we receive the information listed above, so sharing complete documents early keeps the project on schedule. Where your engagement falls within this range depends on the size of your business, the number of products and sectors involved and how quickly drafts are reviewed.

The fee for AML policy, controls and procedures documentation ranges from AED 3,750 to AED 11,000 (USD 1,000 to USD 3,000). The final fee depends on your sector and the nature and scope of work, such as the complexity of your business and whether we are drafting a new policy or updating an existing one. We confirm the fee before the engagement starts, so there are no surprises.

Every AML policy engagement includes three rounds of revisions on the draft documents. Your management, Compliance Officer and staff can review each draft and request changes before the policy is finalised. The revision rounds make sure the final AML policy reflects how your business actually works.

Every AML policy engagement includes a walkthrough training session for your team. The session explains what the policy requires, how each procedure works in practice and what has changed from your previous documents. Staff finish the session knowing how to apply the AML policy in their daily work, and you can keep the attendance record as evidence for your supervisor.

After delivery, your AML policy will need to change as your business and the regulatory environment change. We help with policy revisions for changes in your business, new technology, UAE regulatory changes and FATF-related changes, such as updates to the FATF lists of high-risk and monitored jurisdictions. These revisions are offered at an additional cost and are quoted separately based on the extent of the change.

After delivery, you can choose an ongoing consulting support package of 10 hours. Within those hours, our team supports you with questions from your supervisor or auditor, clarifications on how to apply the policy and day-to-day compliance queries. Support beyond the scope of the package, and formal policy revisions, are quoted separately.

We consider the tools your business already uses, such as your POS system, CRM, accounting system, core banking platform, screening software and goAML account, when wording the policy and procedures. Each procedure refers to the steps staff actually follow in those tools, rather than to generic processes. Tool-specific procedures make the AML policy easier to apply day to day and easier to evidence during an inspection.

Every AML policy engagement is handled in strict confidence. All documents and information you share, including your trade licence, risk assessment and details of your customers and business practices, are handled under our stringent privacy and data protection policy. You can review our privacy and data protection policy before sharing any documents with us.