A practical guide to AML/CFT/CPF governance, risk controls and audit readiness

UAE businesses must do more than prepare accurate financial statements. Where anti-money laundering (AML) requirements apply, they must also maintain effective controls that help prevent money laundering, terrorist financing and proliferation financing (ML/TF/PF). During an audit or compliance review, auditors may examine whether the business has designed, implemented and maintained controls that address its actual risks.

A written policy alone does not demonstrate effective compliance. Businesses need to show that management approves the framework, employees follow documented procedures, the company checks customers appropriately, and responsible staff monitor and escalate unusual activity. This article explains the areas that auditors may examine and the records that help businesses demonstrate a functioning AML framework.

What does AML compliance mean in the UAE?

AML compliance refers to the policies, procedures and controls that help an organisation identify, assess and mitigate the risk that criminals may use its products, services or business relationships to move or conceal illicit funds. The wider UAE framework also addresses the financing of terrorism and proliferation.

Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 form key parts of the current UAE framework. The precise obligations depend on the entity’s regulated status, sector, activities and applicable supervisory requirements. Financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers should assess the rules that apply to them.

A risk-based AML framework commonly includes:

• Written AML/CFT/CPF policies and procedures approved by senior management.
• Documented business-wide or enterprise-wide risk assessments.
• Customer identification and know-your-customer (KYC) checks.
• Customer due diligence (CDD) proportionate to the customer’s risk profile.
• Enhanced due diligence (EDD) where the business identifies higher risks.
• Ongoing monitoring of customer relationships and transactions.
• Targeted financial sanctions screening and appropriate escalation procedures.
• Record retention, employee training and suspicious activity reporting where required.

Why do auditors review AML policies?

Auditors and compliance reviewers examine AML policies to understand whether the business has translated its legal and regulatory responsibilities into practical controls. They may assess the design of those controls, test how staff apply them and inspect evidence that the business updates its approach when risks or regulatory expectations change.

• Governance and accountability: management assigns responsibility, approves policies and oversees compliance.
• Risk assessment: the business identifies customer, geographic, product, service, delivery-channel and transaction risks.
• Customer checks: staff verify customer and beneficial-owner information using reliable sources.
• Ongoing monitoring: the business identifies unusual activity and reviews customer information when necessary.
• Sanctions compliance: staff screen relevant parties and act on applicable targeted financial sanctions.
• Reporting and escalation: employees know how to raise concerns and the business follows applicable reporting duties.
• Record keeping: the business retains clear, accessible evidence of the checks and decisions it makes.

How do auditors assess AML controls?

Auditors evaluate whether AML controls operate effectively and comply with UAE legislation by conducting a structured compliance review.

According to Federal Decree-Law No. (10) of 2025 and the implementation requirements under Cabinet Resolution No. (134) of 2025, auditors can assess the following areas:

1. Governance and internal controls

Auditors may review the organisation chart, management approvals, compliance-officer appointment, board or senior-management oversight, and the process for reviewing AML policies. They may also check whether the business assigns clear responsibilities to the people who perform customer checks, monitor transactions and escalate concerns.

2. Business-wide risk assessment

The business should document how it identifies and evaluates its exposure to financial-crime risks. Auditors may examine customer types, countries and geographic exposure, products and services, transaction patterns, delivery channels and the frequency with which the business updates its assessment.

3. KYC and customer due diligence

Auditors may sample customer files to check whether the business collected and verified required identity information, identified beneficial owners where applicable, understood the purpose and intended nature of the relationship, assigned a risk rating and refreshed information when needed. The business should apply enhanced checks when the risk assessment calls for them.

4. Transaction monitoring and suspicious activity escalation

Auditors may examine how the business identifies unusual activity, records internal alerts, investigates concerns, documents decisions and submits reports to the competent authority through the applicable channel when the law requires it. Staff should understand the internal escalation process and avoid alerting customers where the law prohibits tipping-off.

5. Training and periodic review

The business should provide role-appropriate AML training and retain evidence of attendance and content. Management should also review policies and controls periodically, and after material changes to the business, risk profile or regulatory requirements.

What AML records should a business maintain?

Depending on the entity’s legal obligations and risk profile, useful records may include:

• Current AML/CFT/CPF policy manual and version history.
• Management approval records and compliance governance documents.
• Business-wide risk assessment and periodic review records.
• Customer onboarding forms, identity evidence and beneficial ownership information.
• Customer risk ratings, CDD and EDD records.
• Sanctions screening results, alerts and resolution notes.
• Transaction monitoring reports and investigation files.
• Internal escalation records and suspicious activity reporting evidence, where applicable.
• Compliance-officer appointment details and relevant communications.
• Employee training materials, attendance records and assessments.
• Internal audit reports, compliance testing results and remediation trackers.

How does goAML support AML compliance?

Where the relevant UAE rules require registration or reporting, the goAML platform supports the submission of suspicious transaction or activity reports to the Financial Intelligence Unit. Businesses should confirm whether registration and reporting obligations apply to their activities, keep access and user details current, train relevant employees and retain supporting records. Registration alone does not establish compliance; the business must also maintain effective internal processes for identifying, assessing and escalating concerns.

Can weak AML controls affect an audit?

Yes. Weak or poorly documented controls can lead auditors or reviewers to report gaps in governance, risk assessment, customer due diligence, sanctions screening, transaction monitoring, training or record keeping. The relevant supervisory authority may also take action where a business fails to meet applicable legal requirements. The nature and consequences of any finding depend on the facts, the entity’s regulatory status and the applicable law.

How can businesses improve AML audit readiness?

1. Compare current policies and procedures with the latest requirements that apply to the business.
2. Update and document the business-wide risk assessment.
3. Assign clear responsibilities to senior management, the compliance officer and operational teams.
4. Test a sample of customer files for complete KYC, CDD and beneficial ownership records.
5. Review sanctions screening and transaction-monitoring processes.
6. Check that staff understand escalation and reporting procedures.
7. Deliver refresher training and keep attendance evidence.
8. Resolve control gaps, assign owners and track corrective actions to completion.
9. Arrange an independent AML compliance review before an external audit or regulatory inspection.

UAE regulatory Key references

Businesses should consult the official UAE legislation and the guidance issued by their relevant supervisory authority. Always confirm the latest legislation, commencement provisions, sector-specific rules and supervisory guidance before relying on this general overview.

• UAE Ministry of Justice – Cabinet Resolution No. 134 of 2025: https://www.moj.gov.ae/assets/6b3e3bf7/cabinet-resolution-no-134-of-2025-regarding-the-executive-regulations-of-federal-decree-law-no-639053857268671601.aspx
• UAE Ministry of Economy – AML legislation and guidance: https://www.moec.gov.ae/
• UAE Legislation portal: https://uaelegislation.gov.ae/

How Alore Advisors can support your business

Alore Advisors helps businesses strengthen their compliance processes and prepare for audit and regulatory reviews. Our support can include:

• Reviewing and updating AML policies and procedures.
• Assessing AML governance and internal controls.
• Reviewing business-wide risk assessments.
• Evaluating KYC, CDD and EDD processes.
• Reviewing beneficial ownership and record-keeping practices.
• Assessing transaction-monitoring and escalation procedures.
• Supporting compliance gap assessments and remediation planning.
• Providing practical AML awareness and staff training.

Contact Alore Advisors to discuss your business activities, applicable compliance obligations and the steps you can take to improve AML audit readiness.

Frequently asked questions

Why do auditors review AML policies?

Auditors review AML policies to assess whether the business has suitable controls to identify, manage and report financial-crime risks in line with the requirements that apply to it.

What does AML compliance involve in the UAE?

It may involve risk assessments, management-approved policies, KYC and customer due diligence, ongoing monitoring, sanctions screening, employee training, record keeping and suspicious activity reporting where required.

How do auditors test AML controls?

They may inspect policies, interview responsible staff, sample customer files, review risk assessments, test monitoring and escalation procedures, and examine training and reporting records.

Which AML documents should a business keep?

Relevant records may include the AML manual, risk assessment, customer onboarding and due diligence files, beneficial ownership information, screening results, monitoring records, training evidence and internal review reports.

Can weak AML controls create regulatory exposure?

Yes. A failure to meet applicable obligations can lead to audit findings, remediation requirements, increased supervisory attention and potential regulatory action, depending on the circumstances.

Disclaimer:

This article is intended as general information, not legal advice or a formal compliance opinion.

Alore Advisors | Accounting, Tax and Business Advisory

www.aloreadvisors.com