AML/CFT Software Advisory & Setup

Under UAE Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations, obligations extend beyond banks and financial institutions to Designated Non-Financial Businesses and Professions (DNFBPs) — real estate brokers and agents involved in property transactions, dealers in precious metals and stones above specified transaction thresholds, company service providers (including those forming companies, acting as registered agents, or providing nominee director/shareholder services), independent lawyers and notaries when conducting specified financial or property transactions on a client's behalf, and accountants providing specified services. The exact obligations and their intensity depend on the entity's specific activity and its own documented risk-based assessment.

For a very small, low-volume DNFBP, a well-documented and consistently applied manual screening and record-keeping process can, in principle, satisfy the risk-based proportionality principle underpinning UAE AML/CFT regulation. In practice, manual processes struggle to keep pace with continuously updated sanctions and PEP lists, and become genuinely difficult to defend under inspection once transaction or customer volume grows. PNPC assesses proportionality as part of the initial scoping — we do not recommend software procurement as a default answer for every entity regardless of scale.

goAML is the electronic platform operated by the UAE's Financial Intelligence Unit (FIU), housed within the UAE Central Bank, through which regulated entities file Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other statutory AML/CFT disclosures. Entities falling within scope of UAE AML/CFT law — including DNFBPs — are generally required to register on goAML and designate a Compliance Officer authorised to file reports through the platform. PNPC coordinates registration for entities not yet registered and, for those already registered, ensures the internal alert workflow maps cleanly to the goAML filing process.

A Money Laundering Reporting Officer (MLRO), referred to under UAE regulation as the Compliance Officer, is the individual designated within a regulated entity as responsible for the AML/CFT programme, including reviewing internal alerts, deciding whether to file an STR/SAR, and liaising with the FIU and relevant supervisory authority. UAE AML/CFT regulations require regulated entities, including DNFBPs above the applicable scope, to appoint and register a Compliance Officer. The appointment should be senior enough to have genuine authority within the organisation and free from conflicts that would compromise independent judgement on suspicious activity decisions.

We start from the entity's documented risk-based assessment — its customer base, transaction profile, geographic exposure, and sector-specific typologies — rather than a generic vendor comparison. A real estate brokerage handling occasional high-value transactions has different screening cadence needs than a precious metals trader processing frequent cash transactions. We shortlist 2–3 platforms genuinely proportionate to the entity's actual risk and scale, present a written cost-benefit comparison, and are not tied to a single vendor relationship that would bias the recommendation.

Sanctions and PEP screening checks a customer's identity — at onboarding and on an ongoing basis — against UN Security Council sanctions lists, the UAE's Local Terrorist List, and databases of Politically Exposed Persons, to confirm the entity is not knowingly dealing with a sanctioned or high-risk individual or organisation. Transaction monitoring is a separate, ongoing function that reviews the pattern of a customer's actual transactions — value, frequency, counterparties, structuring behaviour — for activity inconsistent with their declared profile or indicative of money-laundering typologies, regardless of whether the customer appears on any sanctions list. Both are required components of a functioning AML/CFT programme; neither substitutes for the other.

UN Security Council sanctions lists, the UAE's Local Terrorist List, and major commercial PEP databases are updated frequently — sometimes multiple times within a single week. A properly configured screening platform updates its underlying list data automatically and re-screens the existing customer base on a defined cadence (commonly overnight or in near-real-time for continuously updated platforms), not just at the point of onboarding. PNPC confirms the update frequency and re-screening cadence as part of software evaluation, since a platform that only screens at onboarding leaves a business exposed to a customer who becomes designated after the relationship is already established.

An uncalibrated system — using default vendor thresholds not tailored to the entity's actual customer base — commonly generates a high volume of false-positive alerts, which either overwhelms the compliance officer or, worse, trains staff to dismiss alerts too quickly, increasing the risk that a genuine alert gets missed in the noise. PNPC's configuration process specifically tests the system against a sample of the entity's real historical data before go-live and recalibrates thresholds during the post-go-live review period to bring the false-positive rate to a manageable, defensible level.

No properly designed AML/CFT programme allows software to file an STR/SAR automatically without human review. The software's role is to flag alerts for investigation and, where relevant, to structure the case management record; the decision on whether an alert rises to the level of genuine suspicion warranting a filing remains a judgement call made by the trained Compliance Officer, based on the totality of the evidence. PNPC designs the workflow so the software supports that judgement with structured information — it does not replace it.

Yes, this is one of the more common engagements we see. A business purchases a platform, applies the vendor's default settings, and either never trains staff properly on it or never revisits the configuration as the business has grown. PNPC can conduct a configuration and effectiveness review of an existing system, identify gaps against the entity's current risk profile, and recalibrate or reconfigure the platform without necessarily requiring a full new software procurement.

All customer, transaction, and configuration data reviewed during an AML/CFT software engagement is handled under a signed engagement letter and confidentiality terms, accessed only by the specific PNPC team members assigned to the engagement. Where sample transaction data is used for configuration testing, PNPC works with the entity to anonymise or minimise personally identifiable information wherever the testing objective allows it.

Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions provide for a range of administrative and criminal sanctions for non-compliance, including substantial administrative fines that can apply per violation, suspension or revocation of licences for regulated entities, and criminal liability — including imprisonment in serious cases — for individuals involved in money-laundering offences or in wilful failure to report. The precise penalty in any given case depends on the nature and severity of the violation and is determined by the relevant supervisory authority or the courts; PNPC does not quote specific fine amounts as these are set and applied by the regulator based on the facts of each case.

For a single-entity DNFBP with a moderate customer base and an already-completed risk-based assessment, PNPC's engagement — from initial scoping through go-live — typically takes 5–6 weeks. Entities that do not yet have a documented risk-based assessment or an appointed Compliance Officer should expect that foundational governance work to be sequenced first, which extends the overall timeline. Larger or higher-risk entities, such as precious metals traders with high transaction volumes, typically require 8–10 weeks to reach a properly calibrated, tested configuration.

While DNFBPs make up a large share of PNPC's AML/CFT software advisory clients, the same advisory and configuration discipline applies to any UAE-regulated entity with AML/CFT obligations, including smaller finance companies, exchange houses, and insurance intermediaries regulated by the UAE Central Bank, and entities within DIFC or ADGM subject to those centres' own AML/CFT frameworks. The specific supervisory authority, reporting channel, and regulatory expectations differ by category, and PNPC scopes the engagement to the entity's actual regulator from the outset.

PNPC's engagement can be scoped either as a defined software selection, configuration, and go-live project, or as an ongoing retainer that includes periodic recalibration, independent effectiveness review, staff training refreshers, and advisory support through supervisory inspections. Many clients start with the initial setup and move to an ongoing advisory retainer once the system is live and the compliance function's needs become clearer in practice.

A risk-based approach — the foundational principle underlying UAE and international AML/CFT regulation — means an entity applies AML/CFT controls proportionate to the actual money-laundering and terrorist-financing risk it faces, rather than applying a uniform, one-size-fits-all control regardless of risk level. In practical terms, a higher-risk customer segment (cash-intensive transactions, complex ownership structures, higher-risk geographies) warrants more intensive screening and monitoring than a lower-risk segment. Software configuration must reflect this — applying uniform default settings across all customers regardless of risk level either wastes compliance resource on low-risk relationships or under-scrutinises genuinely higher-risk ones.

Many screening and monitoring platforms offer integration options — API connections, batch data uploads, or plug-ins for common CRM and accounting platforms — that reduce manual re-entry of customer and transaction data. The feasibility and cost of integration depends on the specific platforms involved on both sides. PNPC assesses integration feasibility as part of the software shortlisting process and factors the setup effort into the overall cost-benefit comparison presented to the client.

UAE AML/CFT regulations expect regulated entities to provide ongoing AML/CFT training to relevant staff, not a one-time induction session. PNPC's setup engagement includes tool-specific training for the Compliance Officer and frontline staff who will use the platform directly, and we recommend a periodic refresher — commonly annual — that covers both general AML/CFT awareness and any changes to the configured system, typologies, or regulatory guidance since the last session.

A UAE branch or subsidiary of a foreign group often already operates under a group-mandated AML/CFT platform selected by the parent company. In this scenario, PNPC's role typically shifts to confirming the group platform's configuration is properly localised to UAE regulatory requirements — UAE-specific sanctions lists, goAML reporting integration, and Ministry of Economy or relevant local supervisor expectations — rather than a fresh platform selection exercise. For groups with an India-linked entity, PNPC can coordinate this localisation review through our Chennai, Bangalore, Hyderabad, and Dubai offices.

KYC is the process of verifying a customer's identity and understanding the nature of their intended relationship with the business, typically at onboarding — collecting identity documents, verifying beneficial ownership for corporate customers, and understanding the customer's expected transaction profile. AML/CFT software builds on the KYC data collected: sanctions and PEP screening checks the identity data gathered during KYC, and transaction monitoring compares actual activity against the expected profile established at KYC. Weak or incomplete KYC data undermines the software's effectiveness regardless of how well the screening and monitoring tool itself is configured.

Yes. Where the risk-based assessment or a screening/monitoring alert identifies a customer requiring Enhanced Due Diligence — a Politically Exposed Person, a customer from a higher-risk jurisdiction, or a complex ownership structure — PNPC advises on the additional verification steps, source-of-funds and source-of-wealth documentation, and senior management approval process that EDD requires under UAE AML/CFT regulation, and helps configure the software's case management workflow to capture this documentation properly.

PNPC charges a fixed, agreed advisory fee for the scoping, selection, configuration, and go-live phases of the engagement, scoped to the entity's size, customer volume, and risk complexity, confirmed in writing before work begins. This advisory fee is separate from the software vendor's own licensing cost, which PNPC helps the client evaluate and negotiate but does not itself charge for. Ongoing retainer pricing for periodic review and advisory support is quoted separately once the initial scope is agreed.

That is a legitimate outcome of a proper scoping exercise for a genuinely small, low-volume entity. PNPC can instead help design and document a proportionate manual screening and record-keeping process, along with clear criteria for when the business should revisit the software question as volumes or risk exposure grow. We do not recommend software procurement where the entity's actual documented risk profile does not justify it.

Yes, indirectly but materially. A regulated entity that can demonstrate a properly configured, actively used AML/CFT programme — screening records, monitoring history, case management logs, and clean goAML filing history — presents a materially stronger compliance posture to an acquirer, investor, or banking partner during due diligence than one relying on undocumented manual processes. PNPC can format the AML/CFT programme's documentation specifically for a due diligence data room when a transaction is anticipated.

PNPC's compliance advisory team monitors updates from the Ministry of Economy, the UAE Central Bank, the Financial Intelligence Unit, and relevant free zone regulators, and factors regulatory changes into the periodic effectiveness reviews conducted for clients on an ongoing retainer. Where a regulatory change materially affects screening obligations, reporting timelines, or supervisory expectations, PNPC proactively flags the change and, where relevant, recommends a configuration update.

The first step is a scoping conversation to confirm the entity's regulatory category, the applicable supervisory authority, and whether a documented risk-based assessment, AML/CFT policy, and Compliance Officer appointment already exist. From there, PNPC proposes a sequenced plan — governance and policy foundation first if it is missing, followed by proportionate software selection and configuration — rather than jumping straight to a technology purchase.

Tipping off is the offence of disclosing to a customer, directly or indirectly, that they are or may be the subject of a suspicious transaction report or an ongoing investigation — a prohibition set out under UAE AML/CFT law that applies regardless of the reporting entity's good intentions. Case management workflows must be designed so that alert investigation, escalation, and any subsequent account restriction or relationship review do not reveal to the customer that a report has been or may be filed. PNPC reviews the configured escalation workflow specifically for tipping-off risk — including how customer-facing staff are instructed to behave if a customer questions a delay or additional document request tied to an open investigation.

UAE AML/CFT regulation requires regulated entities to retain customer due diligence records, transaction records, and records relating to any suspicious transaction analysis and reporting for a minimum retention period set out in Federal Decree-Law No. 20 of 2018 and its implementing regulations, generally running for a period of years from the end of the business relationship or the date of the transaction, whichever is relevant — entities should confirm the current prescribed period with PNPC or the relevant supervisor rather than relying on a remembered figure, as retention requirements can be updated. PNPC configures the software's data retention and archival settings to meet this requirement, including ensuring records remain retrievable, not just stored, for the full retention window.

UAE AML/CFT regulation does not universally mandate that screening and monitoring data be hosted on servers physically located within the UAE, but data protection obligations under UAE federal personal data protection law, sector-specific rules (particularly for DIFC and ADGM entities under their own data protection regimes), and any group-level data governance policy can all bear on where customer and transaction data may be hosted and processed. PNPC reviews the proposed platform's hosting location and data protection terms as part of software shortlisting, flagging any residency or cross-border transfer consideration relevant to the client's specific regulatory position.

Software licensing costs vary substantially by platform tier, customer volume, and module selection (screening only versus screening plus full transaction monitoring and case management), and are set and quoted directly by the software vendor — PNPC does not mark up or take commission on licence fees. As a general orientation, a bare sanctions/PEP screening tool sized for a small DNFBP typically sits at the lower end of available platforms, while a full monitoring-and-case-management suite for a higher-volume entity commands a materially higher licence cost. PNPC presents the actual vendor quotes for shortlisted options in writing during the selection phase rather than estimating a figure in the abstract.

Both fall within DNFBP categories under UAE AML/CFT law, but their risk typologies and supervisory touchpoints differ. A DMCC-licensed precious metals and stones dealer typically faces higher cash-intensity risk, specific transaction-value reporting thresholds relevant to the sector, and DMCC's own compliance oversight alongside the federal framework. A mainland real estate broker under Ministry of Economy oversight typically faces lower transaction frequency but higher per-transaction value, with beneficial ownership and source-of-funds scrutiny on property purchases as the dominant risk theme. PNPC calibrates monitoring rules, screening cadence, and the case management workflow to the specific typology profile of the sector, not a generic DNFBP template.

Yes. Where a single licensed entity operates across multiple emirates, or a group has related entities licensed in different free zones (each potentially under a different immediate regulator), PNPC designs a coordinated AML/CFT technology and governance approach that respects each entity's specific supervisory requirements while avoiding duplicated, inconsistent, or contradictory screening and monitoring practices across the group. Centralising the underlying platform where feasible, with entity-specific configuration layers, is often more cost-effective and easier to govern than fully separate systems per licence.

Beyond licence pricing, PNPC reviews proposed vendor contracts for data ownership and portability on termination (can the entity export its full screening and case history if it switches platforms later), service-level commitments on list-update frequency and system uptime, liability and indemnity terms relevant to a compliance-critical system, and any auto-renewal or lock-in clauses that could leave the entity committed to an underperforming platform. These commercial terms sit alongside, not instead of, the configuration and effectiveness questions PNPC evaluates.

Yes, where relevant. AML/CFT software configuration sits within PNPC's broader IT Risk & Technology Assurance practice, and for clients also engaging PNPC for internal audit, IT general controls review, or specialised audit and certification work, the AML/CFT technology environment is assessed as part of that wider control landscape rather than in isolation — avoiding duplicated fieldwork and giving management a single, coherent view of technology-dependent controls across the business.