Documentation

Because UAE supervisory authorities inspect the written record, not your general good-faith conduct. An inspector reviewing a customer file checks whether the risk rating, beneficial ownership look-through, and screening result were actually recorded — not whether you personally believe the work was done well. A business that performs CDD correctly but never documents it is, from the inspector's perspective, indistinguishable from a business that skipped CDD altogether, because there is no evidence to examine either way.

At minimum: a board-approved AML/CFT policy and procedures manual, a documented business-wide risk assessment, the Compliance Officer/MLRO appointment record, CDD files for customers with beneficial ownership identification, sanctions/PEP screening evidence, staff training attendance records, and — where applicable — the internal escalation trail and goAML submission confirmation for any STR/SAR filed. The exact depth expected scales with the size and complexity of the business, but every category above should exist in some form for any in-scope entity.

The risk assessment and CDD advisory engagements design and implement the underlying methodology — what risk factors matter, how customers are categorised, what triggers enhanced due diligence. Documentation is the discipline of capturing, organising, and maintaining the written evidence that this methodology was actually applied to real customers and real decisions, in a form that can be retrieved and produced on request. You can have a well-designed methodology and a poorly documented file, or vice versa — the two are related but distinct pieces of work.

Not necessarily. Retention alone does not satisfy the obligation if the entity cannot locate and produce the relevant record within the timeframe a supervisory authority gives during an inspection. A record technically kept somewhere — in an unindexed folder, a departed employee's inbox, or scattered across different staff members' files — that cannot be retrieved on request reads, on inspection, almost identically to a record that was never kept.

UAE AML law requires customer identification records, CDD documentation, and transaction records to be retained for a minimum prescribed period following the end of the business relationship or the date of the transaction, and produced to the competent authority on request. The precise retention period and any sector-specific variation should be confirmed against the current Cabinet Decision text and any applicable sector-regulator rulebook, since retention requirements are refined periodically through amendments.

An outdated Register of Beneficial Owners — one that does not reflect a share transfer, new investor, or change in control that has already happened — is a common and specifically-tested inspection finding under Cabinet Decision No. 58 of 2020 and the AML/CFT framework more broadly. It signals that the entity's documentation is not being maintained in step with actual business events, which supervisors treat as a governance gap in its own right, separate from any issue with the underlying transaction record.

Yes. The absence of a match is itself something that needs to be recorded — the fact that screening was run, on what date, against which list, and with what result — because an inspector cannot distinguish 'screening happened and found nothing' from 'screening never happened' unless the negative result is logged as clearly as a positive one would be.

A disposition note is the documented decision made about a specific sanctions or PEP screening alert — whether it was cleared as a false positive, escalated for further review, or confirmed as a genuine match requiring action. Without it, an alert log shows that the screening tool generated a warning but does not show that a human being actually reviewed and decided what to do about it, which is the substantive step an inspector is testing for.

Where genuine training occurred without contemporaneous documentation, PNPC works with the entity to reconstruct as accurate a record as possible — confirmed dates, content covered, and attendee names based on available evidence such as calendar invites, presentation materials, or attendee recollection — while being transparent that a reconstructed record is weaker evidence than a contemporaneous one, and building a forward process so this gap does not recur.

Both, depending on scope. Where a genuine policy and methodology already exist but the supporting paper trail is missing or disorganised, the engagement focuses on capture, indexing, and retrieval design. Where the underlying policy itself is missing, outdated, or was copied from an unadapted template, PNPC drafts or substantially revises it as part of the same engagement — documentation and the substance behind it are scoped together where the gap analysis shows both are needed.

A typical inspection involves reviewing the policy and risk assessment documents for currency and completeness, then pulling a sample of individual customer files to test whether the documented procedure was actually followed — checking the risk rating assigned, the beneficial ownership look-through, the screening evidence, and any escalation trail. Inconsistency between the written policy and what the sampled files actually show is the most common and most damaging type of finding.

PNPC prioritises the document categories most likely to be tested first — the policy manual, risk assessment, MLRO appointment record, and a representative sample of customer files — and can typically produce an inspection-ready core file within one to two weeks on a compressed timeline, with the fuller file (complete customer base indexing, full training history reconstruction) continuing in parallel.

Both models exist. A one-time build is appropriate where a business needs its current gap closed and is confident it can maintain the file going forward. Most PNPC clients, however, take the ongoing retainer option, since the annual review cycle, event-driven updates (Compliance Officer changes, ownership changes, new Cabinet Decisions), and continuous capture of new customer files and screening results are what keep a documentation set from drifting back into disorganisation within a year or two of the initial build.

No. Complete, accurate, and current documentation materially improves the entity's position on inspection and is the strongest evidence a business can offer that its programme actually operates, but the inspecting authority retains full discretion over its findings, and even well-documented programmes can receive observations or findings based on the specific facts reviewed. No adviser can guarantee a regulatory outcome that depends on the supervisor's own judgment.

goAML registration and Compliance Officer activation give the entity the ability to file reports; documentation is the separate record proving the risk assessment, policies, CDD, screening, and training that should sit behind that registration actually exist and are current. The two are commonly engaged together, since a goAML registration with no documented programme behind it is precisely the 'registered but hollow' pattern supervisory authorities flag most often on inspection.

For clients with entities spanning both India and the UAE, our Dubai team leads the UAE AML/CFT documentation build directly, while our India offices coordinate any parallel India-side compliance record-keeping under the same engagement — so a group operating in both jurisdictions maintains a consistent documentation methodology rather than two disconnected filing systems built by unrelated advisers.