Setup of AML Software

No. Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations are technology-neutral — they require that screening, monitoring, and record-keeping obligations are actually met, not that a specific vendor's product is used. In practice, meeting those obligations consistently and at scale is very difficult without software once an entity has more than a handful of customers, but the choice of tool is the entity's own, subject to it actually covering the entity's risk profile.

Having a subscription and having a correctly configured tool are different things. The most common gap PNPC finds when reviewing an existing screening tool is that it only checks at onboarding with no periodic re-screening scheduled, or that its thresholds were left at generic vendor defaults never calibrated to the entity's actual customer base and transaction sizes. A setup or reconfiguration engagement reviews what the tool is actually doing against what your written AML policy says it should be doing.

Sanctions and PEP screening checks a customer's or counterparty's identity against reference lists — the UN Consolidated Sanctions List, the UAE Local Terrorist List, and PEP databases — typically at onboarding and periodically thereafter, to confirm you are not dealing with a designated or high-risk individual. Transaction monitoring is a separate, ongoing function that watches the pattern of a customer's actual activity — transaction size, frequency, and structuring — against their expected profile, to flag behaviour inconsistent with what was expected at onboarding, regardless of whether the customer's identity screens clean.

At minimum, screening should run at onboarding and then on a periodic re-screening cycle thereafter, since sanctions and PEP designations change and a name that was clean at onboarding can be listed later. The appropriate cadence depends on the entity's risk assessment — higher-risk customer categories may warrant more frequent re-screening than lower-risk ones — but onboarding-only screening with no ongoing cycle is a recognised gap.

It depends on the entity's activity and risk profile rather than headcount alone. A corporate service provider with a modest customer base may reasonably rely on sanctions/PEP screening plus manual review of the limited transaction volume it actually sees, while a financial institution, exchange house, or high-volume DNFBP handling client funds typically needs configured transaction-monitoring rules because manual review of volume at that scale is not realistically consistent. PNPC scopes this based on the entity's documented risk assessment, not a fixed rule.

No. Screening and monitoring software generates alerts — potential matches or unusual patterns — but a human, typically the Compliance Officer or a delegated reviewer, must investigate each alert, determine whether it is a genuine match or a false positive, and record the disposition. Software flags; it does not decide. The investigation and documented decision are what a supervisory authority actually reviews.

False-positive volume is usually a calibration problem, not an inherent feature of screening software — overly broad name-matching thresholds, screening against irrelevant list categories, or monitoring rules set without reference to actual transaction sizes all inflate false positives. Proper calibration to the entity's real customer base and transaction profile, combined with periodic recalibration as volumes and patterns change, keeps the alert queue manageable enough that genuine reviews actually happen.

No. Screening and monitoring software identifies and helps investigate potential concerns, but the actual STR or SAR filing is submitted through the FIU's goAML platform by the entity's designated Compliance Officer, based on a human judgement that reasonable grounds for suspicion exist. PNPC configures the internal workflow so that a confirmed suspicious alert has a clear, documented path to goAML filing, but the filing decision and submission remain the Compliance Officer's responsibility.

At minimum, the UN Security Council Consolidated Sanctions List and the UAE Local Terrorist List. Depending on the entity's cross-border customer or transaction exposure, additional coverage of other major international sanctions regimes may form part of a properly risk-calibrated setup. The right combination depends on the entity's actual customer geography, not a fixed universal list.

PNPC advises on selection criteria — list-source coverage, screening cadence capability, monitoring rule flexibility, case-management and audit-trail functionality, and cost proportionate to the entity's volume — and can coordinate with vendors during implementation, but final vendor selection and contracting is the entity's own commercial decision. We are not a technology reseller and do not receive vendor commissions on any recommendation.

The written AML/CFT policy states, in narrative form, what screening and monitoring the entity performs, at what frequency, and how alerts are escalated. The software configuration is the technical implementation of that same narrative. When the two are built together, an inspector reviewing the policy document and then testing the actual system finds them consistent; when they are built separately — often because the policy was drafted by one adviser and the software configured independently, or years apart — the mismatch is a recurring and easily identified inspection finding.

Keep a configuration record describing which list sources are active, the screening cadence, the transaction-monitoring rules and thresholds applied and why, staff training records on the configured system, and a sample of alert investigation logs demonstrating the triage workflow in practice. This sits alongside, and should cross-reference, the broader AML risk assessment and policy documentation.

PNPC recommends an initial review at 60–90 days post-go-live to catch early miscalibration (excessive false positives or an unexpectedly quiet alert queue), followed by at least an annual review aligned with the broader AML/CFT risk assessment refresh, and an ad hoc review whenever there is a material change in transaction volume, customer mix, or applicable list-source guidance.

For a genuinely very small entity with a small, stable, low-risk customer base, a documented manual process can be defensible if it is actually followed consistently, evidenced, and re-run at an appropriate cadence — the law does not mandate software specifically. In practice, manual processes degrade quickly as volume grows or staff turn over, and the evidentiary burden of proving consistent manual checks were performed is harder to satisfy on inspection than a system-generated log.

PNPC's engagement is the advisory, selection-support, and configuration work — assessing needs, advising on vendor options, calibrating settings to the entity's risk profile, designing the alert-triage and goAML escalation workflow, and training staff. The software subscription itself is contracted directly between the entity and the chosen vendor; PNPC is not the software provider.