In-house AML Compliance Department Setup Services in the UAE

Governance of an AML compliance function means board or senior management oversight, a compliance charter, terms of reference and a schedule of periodic compliance reports. CR 134/2025, Article 21 requires internal policies, controls and procedures to be approved by senior management. Clear governance shows supervisors who owns each decision and how management stays informed.

goAML registration and access means an active goAML account with the AML Compliance Officer and authorised users set up correctly. goAML is the FIU's reporting platform and the channel for every suspicious transaction report and threshold report the business files. Registration details must be kept current, especially when the Compliance Officer or authorised users change.

The risk assessment element of a compliance function covers a current business-wide risk assessment and a customer risk rating methodology. The business-wide risk assessment identifies the money laundering, terrorist financing and proliferation financing risks of your customers, products, channels and geographies. The customer risk rating methodology then decides which customers need simplified, standard or enhanced due diligence.

AML/CFT/CPF policies, controls and procedures set out how the business meets each legal obligation and must be approved by senior management under CR 134/2025, Article 21. The policies, controls and procedures must be proportionate to the identified risks and to the nature and size of the business. CR 134/2025, Article 21 also requires the policies, controls and procedures to be reviewed and updated on an ongoing basis.

Customer due diligence operations cover onboarding checks, beneficial ownership verification, enhanced due diligence (EDD) for higher-risk customers and periodic reviews. Customer due diligence operations need clear forms, checklists and approval levels so that every file is handled the same way. Incomplete customer due diligence files are a frequent cause of supervisory findings.

Screening covers sanctions, politically exposed person (PEP) and adverse media checks on customers and related parties, such as beneficial owners and authorised signatories. Screening procedures must explain how staff handle partial and confirmed matches, including escalation to the AML Compliance Officer and any reports required through goAML. Screening is repeated when sanctions lists are updated and when customer information changes.

Monitoring and reporting covers transaction monitoring, internal escalation of unusual activity, Suspicious Transaction Report (STR) and Suspicious Activity Report (SAR) decisions and threshold reporting such as DPMSR and the Real Estate Activity Report (REAR). The AML Compliance Officer decides whether to notify the FIU or to retain the matter with documented reasons, as CR 134/2025, Article 22(2) requires. All reports to the FIU are filed through goAML.

The training element of a compliance function is a documented training plan and attendance records covering the AML Compliance Officer, the deputy and all relevant staff. CR 134/2025, Article 22(4) makes the AML Compliance Officer responsible for developing, implementing and documenting ongoing training programmes. Training should be refreshed when the law, the business's risks or its procedures change.

Record keeping means retaining customer due diligence files, transaction records, Suspicious Transaction Reports and related analysis for at least five years, as required by CR 134/2025, Article 25. The five-year period generally runs from completion of the transaction or termination of the business relationship, and in some cases from a later event such as completion of an inspection or investigation. Records must be organised so that individual transactions can be reconstructed and made available to the authorities promptly on request.

Independent review means an independent audit function that tests the effectiveness and adequacy of the business's AML policies, controls and procedures, as required by CR 134/2025, Article 21(6). Independent review can be performed by internal audit or an external reviewer, provided the reviewer is independent of the compliance work being tested. Independent review findings should be reported to senior management with an action plan and deadlines.

We confirm your licensed activities, your supervisory authority and the specific requirements that apply to your Compliance Officer and compliance arrangements. Supervisory authorities can differ in their rules on approval, residency and full-time status for Compliance Officers. Confirming these rules first prevents rework later.

We define the roles, headcount, reporting lines and segregation of duties appropriate to your size and risk. The organisation design sets out who prepares, reviews and approves each compliance task. Smaller businesses may combine roles, while larger businesses may need a dedicated team.

We support candidate assessment, prepare the appointment documents and assist with any notification or approval required by your supervisor. The appointment documents include the job description, appointment letter and evidence of competence and experience. The appointment pack also records the officer's independence, reporting line and deputy arrangements.

We help register the business on goAML, or update the existing registration with the new Compliance Officer and users. Each authorised user receives the correct goAML role so reports can be filed without delay. We also check that the registration details match your trade licence and current management.

We prepare or update the business risk assessment, AML policy and procedures, forms and registers. Core documentation is tailored to your licensed activities, customers and risk profile rather than copied from a generic template. Each document is prepared ready for senior management approval.

We set up CDD, screening, monitoring, escalation and reporting workflows, and advise on whether software is needed. Each workflow names the person responsible, the evidence to keep and the escalation route. Where software is recommended, we explain the selection criteria so you can compare providers.

We train the Compliance Officer, deputy and staff, and hand over a compliance calendar so recurring tasks are never missed. Training covers the duties under CR 134/2025, Article 22, your procedures and goAML reporting. The compliance calendar lists recurring reviews, reports and training dates for the year ahead.

Every AML compliance department setup engagement starts with a free consultation call. On the call, we discuss your licensed activities, your supervisory authority and how compliance is handled today. The consultation call lets us understand your requirements before we confirm the scope, fee and timeline.

An AML compliance department setup typically takes 30 to 90 working days, counted from the date we receive your documents. The timeline depends on the nature and scope of work and on the jurisdiction, including any supervisory approval needed for the Compliance Officer appointment. Recruiting a new Compliance Officer, if required, can also affect the timeline.

The fee for an AML compliance department setup ranges from AED 4,000 to AED 20,000 (USD 1,100 to USD 5,400). The fee depends on the scope of work agreed after the free consultation call. The scope of work is drawn from the deliverables listed under What You Receive that your business actually needs.