A practical guide to compliance controls and inspection readiness
UAE reporting entities need AML controls that work in daily operations. Management must understand the risks, staff must follow the procedures and the compliance team must keep evidence of its decisions. This guide explains the main areas to review through short explanations and practical bullet points.
Understand the legal framework and business scope
Federal Decree Law No 10 of 2025 and Cabinet Resolution No 134 of 2025 form the current federal framework for combating money laundering, terrorist financing and proliferation financing. Preventive duties apply to reporting entities within scope; they do not apply identically to every UAE business. [1,2]
- Confirm whether your firm operates as a financial institution, DNFBP or virtual asset service provider.
- Identify your supervisory authority and check the rules for your activities and jurisdiction.
- DNFBP means Designated Non Financial Business or Profession. Relevant sectors include real estate agents and brokers, precious metals and stones dealers, independent accountants and auditors, and trust and company service providers. [3]
Understand how supervision works
The Ministry of Economy and Tourism uses risk based monitoring and on-site and off-site inspections within its jurisdiction. The Central Bank describes a data-driven supervisory approach for its licensed financial institutions. Firms should prepare reliable records and show how their controls work in practice. [3,4]
- Practical step: organise the evidence behind your risk ratings and compliance decisions.
- Practical step: compare information across customer files and resolve unexplained inconsistencies.
- Practical step: assign a person to coordinate inspection requests and track deadlines.
Keep policies current and usable
Article 21 requires senior management approval of internal policies and controls that match the business size, activities and identified risks. Firms must review and update them on an ongoing basis. [2]
- Explain how staff accept customers, monitor transactions and escalate concerns.
- Review procedures when the business changes or new requirements apply.
- Give staff clear instructions they can follow during real customer transactions.
Assess risks and apply proportionate checks
A risk based approach directs more attention to situations that create greater exposure. A low risk label should reflect a reasoned assessment rather than a convenient shortcut. [5]
- Assess customer, geographic, service, payment and delivery channel risks.
- Document the factors behind each customer risk rating.
- Apply stronger measures when the risk increases and review ratings when circumstances change.
Verify customers and beneficial owners
Customer due diligence helps the firm understand who it serves and why the relationship makes commercial sense. Beneficial ownership checks identify the people who ultimately own or control a corporate customer. [5]
- Verify identity using reliable evidence and check representatives’ authority.
- Review corporate ownership and control information.
- Apply enhanced measures for higher risk relationships and the required checks for politically exposed persons.
- Practical step: explain gaps in an ownership chain before approving the relationship.
Monitor transactions and assess concerns
Ongoing monitoring helps firms recognise activity that does not fit the customer’s profile. The compliance officer must assess concerns and decide whether the circumstances require reporting. [5,6]
- Review unusual payment patterns, unexpected third party payments and unexplained changes.
- Record the evidence, analysis and decision for each concern.
- Escalate unresolved issues through the internal reporting process.
- Practical step: test a sample of closed alerts to check whether the explanation supports closure.
Screen sanctions and review geographic exposure
Sanctions compliance and country risk assessment serve different purposes. Firms must follow applicable targeted financial sanctions requirements and apply the measures required for high risk jurisdictions. [2,5]
- Screen relevant parties against applicable UN and UAE sanctions lists.
- Keep screening arrangements and list update processes effective.
- Review current official directions on high risk countries and apply required countermeasures.
- Practical step: document how staff assess potential matches and escalate them promptly.
Empower the compliance officer and management
Article 22 requires a competent compliance officer at management level with independence in decision making. Effective oversight also requires management to provide resources and address control failures. [6,7]
- Give the officer access to relevant records and systems.
- Record significant compliance issues and management decisions.
- Track corrective actions and escalate overdue work.
Maintain goAML access and report promptly
Reporting entities use goAML to submit relevant reports to the UAE Financial Intelligence Unit. Registration supports reporting; the firm still needs a working process for recognising and assessing suspicion. [5]
- Maintain registration and ensure authorised personnel can access the system.
- Submit the appropriate suspicious transaction or suspicious activity report without delay when required. [1]
- Keep reporting information confidential and avoid tipping off the customer. [1]
Train staff and test the controls independently
Article 21 includes staff screening, periodic training and an independent audit function that tests the adequacy and effectiveness of AML controls. These checks help management see whether the written procedures work in practice. [2]
- Train staff on risks relevant to their roles and keep attendance records.
- Use practical scenarios and check understanding.
- Maintain independent testing and track findings to closure.
- Check the applicable supervisory requirements; do not assume every firm must obtain the same external annual AML audit.
Keep evidence and understand enforcement consequences
Maintain records that explain customer checks, transaction reviews, training and reporting decisions. Article 25 sets a minimum five year retention framework with different starting points and later events that can affect retention. Article 17 allows warnings, fines from AED 10,000 to AED 5 million per violation and other measures, including activity restrictions or licence revocation. The applicable rules and facts determine the outcome. [1,2]
- Practical step: maintain an indexed compliance folder with access controls.
- Practical step: reconcile relevant accounting, tax and customer information and investigate inconsistencies. Corporate tax duties remain separate from AML duties.
- Practical step: review weaknesses now and assign owners and deadlines for improvement.
Alore Advisors supports accounting and compliance enquiries. Visit www.aloreadvisors.com to discuss your business needs.
AML penalties under Federal Decree Law No 10 of 2025
The tables distinguish supervisory sanctions from criminal offences. All article references below refer to Federal Decree Law No 10 of 2025. Apply the complete provision and any relevant sector penalty schedule to the facts of a case. [1]
Administative Sanctions
| Breach or offence | Penalty or consequence | Article |
| Breach of AML law regulations or related decisions | Warning; fine of AED 10,000–5 million per violation; sector bans, management restrictions, suspension or restriction of activities, or licence revocation, as applicable. | 17(1) |
| Repeat of the same violation within one year | The supervisory authority may impose an incremental administrative fine. It may also publish sanctions and require remediation reports. | 17(2)–(4) |
Criminal Penalties
| Breach or offence | Penalty or consequence | Article |
| Money laundering | Imprisonment for 1–10 years AND a fine of AED 100,000–5 million, or the relevant criminal property value, whichever is greater. | 26(1) |
| Aggravated money laundering | Temporary imprisonment AND AED 1–10 million, or twice the relevant criminal property value, whichever is greater. Applies to the aggravating circumstances listed in the article. | 26(2) |
| Terrorist financing | Life imprisonment or temporary imprisonment of at least 10 years AND AED 1–10 million, or twice the relevant criminal property value, whichever is greater. | 26(3) |
| Proliferation financing | Temporary imprisonment AND AED 1–10 million, or twice the relevant criminal property value, whichever is greater. | 26(4) |
| Legal person committing money laundering terrorist financing or proliferation financing | AED 5–100 million, or the criminal property value, whichever is greater, where representatives, directors or agents act on its behalf or in its name. | 27(1) |
| Legal person committing specified other offences | AED 200,000–10 million for offences under Articles 28, 29, 30, 32, 33, 34 or 35 in the circumstances specified. | 27(2) |
| Deliberate or grossly negligent breach of suspicious reporting duties under Article 18 | Imprisonment AND/OR a fine of AED 100,000–1 million. | 28 |
| Tipping off or unlawful disclosure of suspicious transaction inquiries | Imprisonment AND/OR a fine of at least AED 50,000. | 29(1) |
| Specified breaches involving entrusted funds or seizure and freezing orders | Imprisonment AND/OR at least AED 50,000. If the breach prevents seizure or destroys or reduces proceeds, at least 1 year in prison AND a fine equal to the proceeds, with a minimum AED 100,000. | 29(2)–(3) |
| Regulated activities without the required licence registration or enrolment | Imprisonment AND/OR AED 200,000–10 million for breaching Article 20. | 32 |
| Breach of targeted financial sanctions instructions | Imprisonment AND/OR a fine of at least AED 20,000. | 33 |
| Intentionally false or misleading beneficial owner information | Imprisonment AND/OR a fine of at least AED 20,000. | 35(1) |
| Breach of preventive obligations specified in Article 35(3) | Imprisonment AND/OR a fine of at least AED 10,000. Applies to Article 19(1) and Article 19(2)(a), (c) and (d). | 35(3) |
How to read the table
AND means the provision requires both sanctions; AND/OR means imprisonment, the fine, or both. A minimum fine does not imply that the article specifies a maximum. Temporary imprisonment is a statutory category; do not assign it an invented duration.
Courts may also order confiscation under Article 31. Article 27 requires dissolution and closure for a legal person convicted of terrorist or proliferation financing and permits them in specified other cases. Article 36 addresses deportation. More severe penalties under other laws remain possible under Article 25. This table summarises selected provisions rather than every offence. [1]
Cabinet Resolution No 134 of 2025 sets preventive controls, including policies, reporting and record keeping. The criminal amounts above come from the Decree Law; do not treat them as a fixed fee for each missing policy or document.
Legal references and further reading
- Federal Decree Law No 10 of 2025
- Cabinet Resolution No 134 of 2025
- Ministry of Economy and Tourism AML supervision
- Central Bank AML supervision
- Ministry AML obligations and DNFBP FAQs
- Duties of the compliance officer Article 227 Ministry guidance on compliance administration
- Duties of the compliance officer Article 22