AML/CFT Compliance Programme Design

DNFBP stands for Designated Non-Financial Business or Profession — a category defined under UAE AML/CFT law that captures specific business activities considered higher-risk for money laundering even though they are not financial institutions. Under Cabinet Decision No. 10 of 2019 (as amended), the DNFBP categories broadly include: real estate agents and brokers when involved in transactions concerning the buying and selling of real estate; dealers in precious metals and stones when engaged in cash transactions above a prescribed threshold; independent legal professionals and accountants when preparing for or carrying out transactions involving buying/selling real estate, managing client money/securities/assets, managing bank/savings/securities accounts, organising contributions for company formation/operation/management, or forming/operating/managing legal persons or arrangements; and corporate and trust service providers offering company formation and management services (including registered agents and nominee arrangements). What matters is the activity actually performed, not the label on your trade licence.

The primary statute is Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations, as amended by Federal Decree-Law No. 26 of 2021. The executive regulations are set out in Cabinet Decision No. 10 of 2019, as subsequently amended, which details DNFBP categories, CDD requirements, and administrative penalties. Various Ministerial Decisions and supervisory-authority-specific guidance (from the Ministry of Economy, individual free zone authorities, and financial regulators such as the Central Bank, DFSA, and FSRA) provide operational detail applicable to specific sectors.

goAML is the electronic platform administered by the UAE's Financial Intelligence Unit (FIU) through which reporting entities register, submit Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other statutory reports. Registration on goAML is a standalone obligation for DNFBPs and other reporting entities — it is required regardless of whether the entity has ever identified a suspicious transaction. Supervisors treat an unregistered entity as non-compliant on its face, independent of its actual transaction history.

A BRA is a documented evaluation of the money laundering, terrorist financing, and proliferation financing risks the specific entity is exposed to, assessed across at least four dimensions: customer risk (types of customers, PEP exposure, beneficial ownership complexity), product/service risk (which of your services carry higher inherent ML/TF risk), delivery channel risk (face-to-face versus remote/digital onboarding), and geographic risk (jurisdictions your customers and counterparties are based in or transact with, including any exposure to higher-risk jurisdictions). The BRA should conclude with an overall risk rating and specific mitigating controls tied to each identified risk — not just a generic risk statement.

Customer Due Diligence (CDD) is the baseline identity verification and risk assessment performed on every customer or client before or during onboarding — verifying identity, understanding the nature of the business relationship, and identifying beneficial ownership for corporate customers. Enhanced Due Diligence (EDD) is a more intensive version applied to higher-risk relationships: Politically Exposed Persons (PEPs) and their close associates/family members, customers from higher-risk jurisdictions, complex or opaque ownership structures, unusually large or structured transactions, and any relationship the risk assessment otherwise flags as elevated risk. EDD typically requires additional identity verification, source-of-funds and source-of-wealth enquiry, senior management approval to onboard, and more frequent ongoing monitoring.

The Compliance Officer (often referred to functionally as the Money Laundering Reporting Officer or MLRO) should be a person with sufficient seniority, independence, and access to be able to receive internal reports, make STR filing decisions, and engage directly with senior management and, where necessary, the regulator. The role requires genuine time allocation — not a title added to an existing job description with no practical change in duties — and direct access to customer files and transaction data. For smaller entities, the role can be combined with another senior function, but the AML responsibilities and authority must be real and demonstrable.

A Suspicious Transaction Report (STR) — or Suspicious Activity Report (SAR) where no specific transaction has yet occurred — is a mandatory report filed via goAML when a reporting entity has reasonable grounds to suspect that funds or a transaction is connected to money laundering, terrorist financing, or proceeds of a predicate crime. Once filed, the FIU reviews and may request further information from the reporting entity. Crucially, the entity must not disclose to the customer, or to anyone outside the permitted internal escalation chain, that an STR has been or will be filed — a prohibition known as 'tipping off,' which is itself an offence under the Decree-Law.

At minimum, the Business Risk Assessment should be reviewed annually, or sooner if there is a material change in the business — new products/services, new customer segments, entry into new geographic markets, or a significant change in transaction volume or type. Policies and procedures should be reviewed against the current version of the law and any updated supervisory guidance at least annually. Staff training should include an annual refresher, in addition to onboarding training for new hires. Sanctions and PEP screening lists should be checked for updates on an ongoing basis, not merely at the annual review point.

Cabinet Decision No. 10 of 2019 (as amended) sets out a schedule of administrative penalties for specific violations — including failure to register, failure to appoint a Compliance Officer, failure to conduct or maintain CDD records, failure to file STRs, and tipping off — with penalties that can run into the hundreds of thousands of dirhams depending on the violation and its severity, and which can be levied per violation. Beyond administrative fines, the relevant licensing authority (DED, a free zone authority, or a financial regulator) can suspend or revoke the trade licence in serious or repeated non-compliance cases, and certain violations carry criminal exposure under the broader provisions of the Decree-Law.

The underlying federal AML/CFT law applies across the UAE regardless of mainland or free zone status — what differs is the day-to-day supervisory authority. A mainland DNFBP typically falls under Ministry of Economy supervision. A free-zone-licensed entity performing a DNFBP activity may fall under both the Ministry of Economy framework and, for some free zones with an active compliance function (DMCC being a prominent example for dealers in precious metals and stones), an additional free-zone-level compliance return and inspection regime. The substantive programme requirements are broadly consistent, but the registration, reporting, and inspection touchpoints can differ by free zone.

Yes, in substance, though the programme should be proportionate to your size and risk profile — proportionality is itself a recognised principle in a risk-based AML framework. A company service provider forming even a small number of entities is handling UBO identification, nominee arrangements, and company formation activity that sits squarely within the DNFBP definition regardless of client count. The core obligations — registration, a risk assessment, CDD on every client, a Compliance Officer, and the capacity to file an STR — apply irrespective of scale, though the sophistication of your monitoring systems and the depth of documentation can reasonably scale with your size.

The tipping-off prohibition, set out in the Decree-Law, prohibits a reporting entity or its staff from disclosing to the customer (or to any third party) that an STR has been filed, is being considered, or that an investigation is underway, where that disclosure could prejudice an investigation. In practice, this means frontline staff should not confront a customer about suspected activity, should not explain a delay or account restriction by referencing an AML concern, and should escalate internally through the defined pathway to the Compliance Officer rather than acting independently.

They are separate regulatory regimes administered by different authorities — the Federal Tax Authority for Corporate Tax and VAT, and the Ministry of Economy or sector regulators for AML/CFT — and compliance with one does not substitute for the other. However, in practice they intersect operationally: proper AML CDD and UBO identification records often support the ownership and beneficial-interest disclosures relevant to tax registration and Economic Substance Regulations assessments, and a business with disorganised AML files often also struggles with clean tax documentation, since both stem from the same underlying record-keeping discipline.

UAE reporting entities are required to screen customers and transactions against the UN Security Council Consolidated List (sanctions relating to terrorism, proliferation financing, and specific country regimes) and the UAE's Local Terrorist List maintained under domestic legislation. Screening should occur at the point of onboarding and on an ongoing basis thereafter, since sanctions lists are updated periodically and a previously clear customer can be added to a list after the relationship begins. Entities should also be alert to relevant international sanctions regimes (such as those administered by the UN, and applicable regional or bilateral sanctions frameworks) where their customer base or transaction flows have cross-border exposure.

PNPC's role is primarily to design, build, remediate, and periodically review your AML/CFT programme, train your team, and provide ongoing advisory support — including guidance to your appointed Compliance Officer on specific STR decisions and inspection responses. Depending on the engagement and your specific regulatory category, outsourced or fractional compliance officer arrangements may be structured, but the appropriateness of an outsourced MLRO arrangement depends on your specific regulator's expectations and entity type — this is assessed and agreed explicitly as part of scoping, not assumed by default.

Inspections can be routine (scheduled as part of a supervisor's ongoing oversight cycle across licensed DNFBPs), risk-triggered (following a sector-wide concern, a specific complaint, or an unusual pattern flagged through other regulatory touchpoints), or prompted by a renewal cycle where AML compliance documentation is requested as part of trade licence renewal. Free zones with active compliance functions, such as DMCC for precious metals and stones dealers, may run their own periodic compliance return process that itself can surface issues warranting a closer inspection.

Typically, the inspector requests the entity's AML/CFT policy and procedures manual, the Business Risk Assessment, evidence of goAML registration, a sample of customer/client files to test CDD and EDD application, records of any STRs filed (or a documented basis for none having been filed), staff training records, and confirmation of the Compliance Officer's appointment and role. The inspection tests whether the documented programme reflects actual practice — mismatches between policy and observed file evidence are the most common source of findings.

PNPC agrees a fixed, written scope and fee before any work begins, based on the applicability scoping outcome — the fee for a small CSP with a handful of clients differs meaningfully from a real estate brokerage with high transaction volume or a DPMS with significant cash handling. The fee covers the full programme build as scoped: BRA, policy manual, CDD/EDD framework, goAML registration, screening protocol, STR pathway, training delivery, and a pre-launch mock review. Ongoing annual review and advisory support is quoted separately as a retainer, agreed only once the client has seen the value of the initial build.

Yes — this is a common and often more cost-effective starting point. We run a gap analysis comparing the existing document against current regulatory requirements and, more importantly, against how the business actually operates. In many cases the core policy structure can be retained with targeted amendments, while the operational gaps — goAML registration, actual CDD file evidence, Compliance Officer resourcing, and training records — are what genuinely need building out, since a template document is rarely the whole problem.

Proliferation financing refers to the provision of funds or financial services used, in whole or in part, for the manufacture, acquisition, development, or use of weapons of mass destruction and their delivery systems, often in connection with international sanctions regimes targeting specific states or entities. The UAE's AML/CFT framework, aligned with FATF standards, requires reporting entities to consider proliferation financing risk alongside money laundering and terrorist financing risk within their Business Risk Assessment and screening procedures — particularly relevant for entities with cross-border trade, precious metals dealing, or exposure to sanctioned jurisdictions.

For a corporate customer, CDD requires identifying and verifying the Ultimate Beneficial Owner(s) — the natural person(s) who ultimately own or control the customer entity, typically through a specified ownership threshold (commonly 25% or more, though the applicable threshold and methodology should be confirmed against current regulatory guidance) or through other means of control such as voting rights or the ability to appoint senior management. Where a corporate customer has a layered ownership structure — one company owned by another, owned by another — CDD requires looking through the layers to the natural persons at the top, not stopping at the first corporate layer.

All staff who have customer-facing responsibilities or who could plausibly encounter a red flag in the course of their role — sales, operations, finance, and client-facing management — should receive AML/CFT awareness training, not only the appointed Compliance Officer. The training should be role-appropriate: frontline staff need to recognise red flags and know the internal escalation process, while the Compliance Officer needs deeper training on risk assessment methodology, EDD decision-making, and the STR filing process itself.

The Decree-Law and its executive regulations prescribe minimum retention periods for CDD documentation, transaction records, and records relating to any STR filed — generally requiring retention for a period of years following the end of the business relationship or the completion of the transaction, sufficient to allow reconstruction of individual transactions if required by a competent authority. The precise retention period should be confirmed against the current executive regulations and any sector-specific guidance, as retention requirements can be refined by subsequent Cabinet or Ministerial decisions.

Yes, these are distinct regimes with different purposes and different administering authorities. AML/CFT, under Federal Decree-Law No. 20 of 2018 (as amended), addresses money laundering and terrorist financing risk and is supervised by the Ministry of Economy, free zone authorities, or financial regulators depending on entity type. Economic Substance Regulations, administered by the Ministry of Finance, required certain UAE entities conducting defined 'Relevant Activities' to demonstrate adequate economic substance in the UAE and to file an annual ESR notification and, where applicable, an ESR report — however, the ESR notification and report filing obligation was discontinued for financial years commencing on or after 1 January 2023, under Cabinet Decision No. 98 of 2024, meaning ESR is now a historical-compliance and legacy-exposure matter (confirming past filings were made correctly) rather than a live ongoing filing obligation for current financial years. A business can still be subject to AML/CFT obligations independent of whatever its historical ESR position was.

It should be updated as soon as the material change occurs, not deferred to the next scheduled annual review. A significant shift in customer profile, geographic exposure, transaction volume, or the introduction of a new product/service line changes the underlying risk profile that the Business Risk Assessment is meant to reflect. Operating on a stale BRA that no longer matches the business, even for a few months, creates exactly the mismatch between documented risk assessment and actual operations that inspectors focus on.

These are related but distinct. Your bank conducts its own KYC and AML due diligence on you as its customer, under the Central Bank's regulatory framework applicable to the bank — this is separate from your own statutory AML/CFT obligations toward your customers if you are a DNFBP. However, having a robust, evidenced AML/CFT programme of your own materially strengthens your position during bank account opening and renewal KYC reviews, since banks increasingly ask corporate customers — particularly those in DNFBP sectors — to demonstrate their own compliance framework as part of the bank's enhanced due diligence on higher-risk customer categories.

A group-level policy framework can provide consistency, but each licensed entity that independently qualifies as a DNFBP or regulated entity typically needs its own entity-specific Business Risk Assessment, its own goAML registration, and evidence that CDD is being applied to that entity's actual customers — a shared policy document alone, without entity-specific risk assessment and operational evidence, does not satisfy each entity's individual obligations.

This situation should be addressed directly and promptly rather than left unaddressed — a documented internal review that identifies a historical gap, followed by appropriate escalation and, where warranted, a late filing with clear documentation of the discovery and remediation process, is viewed far more favourably by a supervisor than a gap that is only found during an external inspection. The specific handling depends heavily on the facts and should be discussed with your compliance advisor and, where appropriate, legal counsel before any filing decision is finalised.

PNPC supports clients at every stage — from ground-up programme design for a new DNFBP, through gap remediation for an existing but deficient programme, to active representation and remediation planning during or after a regulatory inspection. If you have received a notice from the Ministry of Economy, a free zone authority, or another supervisor, the priority is understanding the specific findings and timeline first, then building a remediation plan that addresses both the immediate finding and the underlying programme gap that caused it.

AML/CFT compliance programme design sits within PNPC's broader UAE Taxation & Regulatory Compliance practice, alongside legacy Economic Substance Regulations assessment (confirming historical filing positions for years before the regime was discontinued for financial years starting on or after 1 January 2023), AML/CFT risk assessment and customer risk profiling, goAML portal registration and reporting assistance, KYC and customer due diligence advisory, and AML/CFT regulatory remediation support. For clients also engaging PNPC for Corporate Tax or VAT compliance, we coordinate the entity, ownership, and record-keeping work across all regimes rather than treating each as a siloed engagement.

Engage PNPC for a standalone applicability scoping review — a focused assessment of your licensed activities, actual services performed, and customer/transaction profile against the DNFBP definitions and any sector-specific regulatory framework applicable to you. This produces a clear written determination of whether you are a DNFBP or otherwise AML-regulated entity, which supervisory authority applies, and — if applicable — a scoped recommendation for the programme design work that follows. This is a smaller, faster, and lower-cost engagement than committing directly to a full programme build.