AML and Compliance: 55 questions answered.

Three things a compliance consultant cannot. First, interpret the law: whether a customer, product, counterparty or jurisdiction is inside the obligations in Federal Decree-Law No. 10 of 2025 and its Executive Regulations, and put the firm's name to that position. Second, handle the regulator: inspection findings, information requests, enforcement letters and remediation plans. Third, build and test the programme to a legal standard, so the policies, risk assessment and MLRO reporting line survive an inspector reading them against the rulebook rather than against a template.

Federal Decree-Law No. 10 of 2025 on anti-money laundering, countering the financing of terrorism and the financing of illegal organisations, which repealed and replaced Federal Decree-Law No. 20 of 2018, together with its Executive Regulations in Cabinet Resolution No. 134 of 2025, which replaced Cabinet Decision No. 10 of 2019. Sector rulebooks sit on top: VARA's Compliance and Risk Management Rulebook for Dubai VASPs, the DFSA AML Module in the DIFC, the FSRA AML Rulebook in ADGM, and the Central Bank's standards for banks, exchange houses and payment firms. Targeted financial sanctions run under Cabinet Decision No. 74 of 2020.

Almost certainly. Any manual that cites Federal Decree-Law No. 20 of 2018 or Cabinet Decision No. 10 of 2019 as its legal basis is citing repealed law, and inspectors notice. Beyond the citations, the 2025 framework brings proliferation financing expressly into scope, reorganises national oversight and widens the penalty regime, so the risk assessment, the high-risk country procedure and the sanctions section usually need substantive changes rather than a find-and-replace.

Two groups. Financial institutions: banks, exchange houses, payment and stored value firms, insurers, securities firms, fund managers and virtual asset service providers licensed by VARA, the Capital Markets Authority, the DFSA or the FSRA. And designated non-financial businesses and professions: real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, lawyers and notaries. Both groups must register on goAML, appoint a compliance officer, run a documented risk-based programme and file suspicious transaction reports.

It depends on the regulator. VARA requires the MLRO to be a UAE-resident employee of the VASP, so for Dubai VASPs we support the MLRO rather than hold the role. DFSA and FSRA firms may use an outsourced MLRO provided the individual is approved by the regulator, and DNFBPs have more flexibility. In every case we provide the reporting-line design, the quarterly MLRO board report, the regulatory watch and the judgement calls that make the function work, whoever holds the title.

A periodic test of the whole programme by someone independent of the compliance function: does the risk assessment match the business, do the policies match the law, do the files match the policies, and does the MLRO actually report what the procedures say. The Executive Regulations require an independent audit function proportionate to the size and risk of the business, and the sector regulators ask for the output. A law firm review carries weight with an inspector that a review by the firm's own accountant does not.

A findings letter with a deadline, usually with a request for a remediation plan. Depending on the regulator and the breach, outcomes range from a supervisory letter to administrative fines on the firm and on individual executives, licence conditions, suspension or, under the Decree-Law, criminal referral. The response in the first two weeks sets the tone for everything that follows, which is why we treat an inspection letter as urgent legal work rather than a compliance task.

Fixed fees for defined projects such as a programme refresh for the 2025 law or an independent review, a fixed monthly fee for ongoing compliance support, and our standard hourly rates for inspection and enforcement work where the scope cannot be known in advance. We confirm the fee on the first call once we understand the licence, the business and the regulator involved.

Identify the legal basis, deadline and whether a penalty is proposed; acknowledge within the deadline; preserve all records for the period; assemble the facts before conceding any finding; and inform the board, whose members are personally exposed under the 2025 framework.

Yes. Federal Decree-Law No. 10 of 2025 and the Executive Regulations provide for administrative penalties on the firm and on its executives and senior management, and the Ministry of Economy and Tourism's circulars say so expressly for DNFBPs.

Usually yes, by written representations before the penalty is final, addressing the firm's size and history, absence of harm, self-identification, remediation and governance response. The specific appeal route depends on the regulator and the instrument imposing the penalty.

Root cause analysis rather than symptom fixes, named owners, dates, and a statement of the evidence that will prove closure for each item, followed by closure evidence actually delivered on those dates.

No. Preserve everything as it was. Correcting or deleting records after a findings letter turns a compliance deficiency into a conduct issue and can attract separate penalties.

Real estate brokers and agents, dealers in precious metals and stones, auditors and accountants and corporate service providers, supervised by the Ministry of Economy and Tourism, plus lawyers, notaries and independent legal professionals supervised by the Ministry of Justice.

Yes. Every DNFBP must register on the Financial Intelligence Unit's goAML portal, through the SACM pre-registration step, and register a named compliance officer. It is the first item the Ministry checks on inspection.

For jurisdictions on the FATF call-for-action list: enhanced due diligence on all relationships and transactions, internal monitoring and goAML reporting using the high-risk jurisdiction templates, no reliance on third parties located in those countries for customer due diligence, and targeted financial sanctions compliance. Penalties apply to the business and its executives. It was issued on 14 September 2026 under Article 14 of Federal Decree-Law No. 10 of 2025 and Article 23 of Cabinet Resolution No. 134 of 2025.

Yes. The framework requires a named compliance officer registered on goAML but does not require an employee. The business and its executives remain responsible for the programme and are personally exposed to penalties.

Yes, proportionate to their size and risk. The Executive Regulations require an independent audit function to test the programme, and Ministry inspectors ask for the most recent review and evidence that its findings were closed.

No. VARA requires the MLRO to be a UAE-resident employee of the VASP, independent of revenue functions and reporting to the board. External counsel can support the MLRO but cannot hold the role.

Yes, where the individual is approved by the DFSA as an Authorised Individual, is resident in the UAE, the outsourcing is documented and the firm's board retains oversight. The same approach applies in ADGM under the FSRA with Approved Person status.

The federal framework requires a named compliance officer registered on goAML but does not require an employee, so many smaller real estate, corporate services and precious metals businesses use an external compliance officer. The business and its executives remain responsible for the programme.

New customers by risk band, alerts raised and dispositioned, sanctions hits and their resolution, suspicious transaction reports filed, training delivered, open and closed findings, and regulatory changes with their impact and actions. It is the document inspectors ask for to prove the programme is running.

We provide it on a fixed monthly fee scaled to the licence and the volume of the business, confirmed on the first call. Projects such as a programme refresh or an independent review are quoted separately as fixed fees.

Cabinet Decision No. 74 of 2020 implements the UN Security Council sanctions resolutions and the UAE local terrorist list, alongside Federal Decree-Law No. 10 of 2025 and its Executive Regulations. The Executive Office for Control and Non-Proliferation administers the regime.

The UN Security Council consolidated list and the UAE local terrorist list, both published through the Executive Office for Control and Non-Proliferation. Other countries' programmes are not UAE law but are relevant to risk and to counterparty relationships, and many firms screen against them commercially.

Freeze the funds and assets without delay and without prior notice, report the freeze and any attempted transaction to the Executive Office for Control and Non-Proliferation through the prescribed channel, file with the Financial Intelligence Unit where there is also suspicion, and do not tip off. The freeze stays until the Executive Office directs otherwise.

At onboarding, on every list update against the whole customer base, periodically as a control, and on transactions for counterparties. Firms must subscribe to the Executive Office's list update notifications and be able to show screening ran on each update.

No. FATF listing triggers enhanced due diligence and countermeasures under Article 23 of the Executive Regulations; targeted financial sanctions apply to listed persons and entities under Cabinet Decision No. 74 of 2020. The two regimes overlap in practice but have different triggers and consequences.

Suspicion or reasonable grounds to suspect that a transaction, attempted transaction or funds relate to the proceeds of crime, terrorist financing or proliferation financing. Proof is not required and there is no minimum amount. The report must be filed without delay through goAML.

Pre-register on the Financial Intelligence Unit's SACM portal with the firm's trade licence and the MLRO's or compliance officer's identity documents, then complete the goAML registration. The MLRO is usually the registered user who files reports and receives Financial Intelligence Unit requests.

Yes. Tipping off is a criminal offence under Federal Decree-Law No. 10 of 2025. It covers direct disclosure and indirect disclosure, such as explaining a decline or an account closure by reference to a compliance report.

Yes, with the same care as a decision to file. The reasoned record of why an alert did not amount to suspicion is the MLRO's protection on inspection. An alert closed without reasoning reads as an unreported suspicion.

The Ministry of Economy and Tourism's Circular No. 2 of 2026 directs DNFBPs to use the goAML high-risk jurisdiction and high-risk jurisdiction activity report templates for activity linked to countries on the FATF call-for-action list.

Yes. Federal Decree-Law No. 10 of 2025 repealed and replaced Federal Decree-Law No. 20 of 2018 from 14 October 2025. Cabinet Resolution No. 134 of 2025 replaced Cabinet Decision No. 10 of 2019 as the Executive Regulations.

The obligations it describes largely continue, but the manual cites repealed law and will not reflect proliferation financing, the reorganised oversight structure or the current high-risk country rules. Inspectors treat an out-of-date legal basis as a finding in itself. It needs a documented refresh approved by the board.

The financing of proliferation of weapons of mass destruction is named expressly alongside money laundering and terrorist financing. Business risk assessments, customer risk models and training must address it, not just the sanctions screening section.

Article 23 of Cabinet Resolution No. 134 of 2025 requires enhanced due diligence proportionate to risk for relationships and transactions involving countries identified as high-risk, and countermeasures where a supervisor requires them. The Ministry of Economy and Tourism's Circular No. 2 of 2026 applies it to the FATF lists for DNFBPs.

For a single-licence firm with an existing manual, typically four to six weeks from documents to board approval, including the re-run risk assessment and a training module. Multi-licence groups and firms with open regulator findings take longer because the remediation plan and the refresh must be reconciled.

Yes for financial institutions and DNFBPs. The Executive Regulations in Cabinet Resolution No. 134 of 2025 require an independent audit function proportionate to the size and risk of the business to test the AML/CFT programme, and VARA, the DFSA, the FSRA, the Central Bank and the Ministry of Economy and Tourism each expect to see the results.

Only if the accountant did not design or operate the programme and has the regulatory competence to test it against the law rather than a checklist. The consultant who wrote the policies cannot review them. Regulators look at independence and competence together.

Proportionate to risk, which for most licensed firms means annually, and sooner after a material change in products, markets or ownership, after a regulator finding, or after a change in the law such as the 2025 framework.

A graded findings register with root causes, fixes, owners and dates, a board paper, and where needed a version for the regulator. The register is tracked to closure through the MLRO's board reports.

No. The AML independent audit function is a compliance testing requirement, not a statutory financial audit. It can be performed by any suitably independent and competent reviewer, including legal counsel, and a legal review carries weight on the judgement calls that drive most findings.

Yes. A VASP is a financial institution for the purposes of Federal Decree-Law No. 10 of 2025 and its Executive Regulations. VARA's Compliance and Risk Management Rulebook applies on top of the federal framework and adds virtual asset specific requirements such as the travel rule.

No. VARA requires the MLRO to be a UAE-resident employee of the VASP who is independent of revenue functions and reports to the board. The MLRO can be supported by external counsel and compliance specialists, but the role itself must sit inside the firm.

VARA requires originator and beneficiary information to accompany virtual asset transfers between VASPs, in line with the FATF standard, and a documented approach to transfers involving unhosted wallets. It requires both a technical solution and a policy for cases where the counterparty cannot comply.

With the Financial Intelligence Unit through the goAML portal. The VASP must be registered on goAML, usually with the MLRO as the registered user, and tipping off the customer is an offence under the Decree-Law.

The business risk assessment and policies first, then evidence: sampled onboarding files, transaction monitoring alert dispositions, sanctions hits and their resolution, travel rule records, training logs and board minutes showing the MLRO's reports. The most common finding is a gap between the written process and the evidence.

A VARA Business Risk Assessment (BRA) is the AML/CFT risk assessment that every Dubai-licensed Virtual Asset Service Provider (VASP) must conduct and maintain under Rule III.D of the VARA Compliance and Risk Management Rulebook. It identifies the money laundering, terrorism financing and proliferation financing risks inherent to the VASP's specific business model, assesses the effectiveness of its controls against those risks, and determines where compliance resources should be directed. It is the foundation of a VASP's financial crime compliance programme.

Under Rule III.D.3 of the VARA Rulebook, a VASP must review and update its BRA at intervals of no longer than three months, and must also update it whenever a significant change occurs in any of the areas listed in Rule III.D.2 — such as new products or virtual-asset listings, material changes to the customer base, regulatory or National Risk Assessment updates, adverse supervisory or audit findings, the sanctions designation of a counterparty VASP, or a change of MLRO.

VARA's good-practice guidance expects the BRA to be formally approved by the Board of Directors or an equivalent governing body, with the approval and its date documented. The MLRO typically owns the BRA and is responsible for its preparation, maintenance and accuracy, but MLRO or senior-management approval alone does not substitute for Board-level approval — the Board's role is to provide independent challenge of residual risk ratings, control-effectiveness assumptions and the risk-appetite framework.

Beyond the standard categories (customer types, products, delivery channels, geography and transaction volumes), VARA expects a strong BRA to formally score virtual-asset-specific risks: unhosted wallets (with Travel Rule and blockchain-analytics considerations); anonymity-enhanced VAs and transactions such as privacy coins and mixers; DeFi and complex VA structures; cross-border VA transfers and counterparty-VASP exposure; stablecoin-specific risks; and emerging fraud typologies including AI-enabled identity fraud, synthetic identity misuse and deepfake account takeover.

Yes. VARA's guidance treats proliferation financing (PF) as a distinct risk category with its own inherent risk score, control-effectiveness assessment and residual risk rating, separate from money laundering and terrorism financing. The BRA's PF conclusions should be demonstrably linked to the VASP's targeted financial sanctions framework — including EOCN registration for designation notifications, without-delay asset-freezing procedures consistent with Cabinet Decision No. 74 of 2020, screening against the UN Consolidated List and DPRK and Iran-specific lists, and reporting through goAML.

The BRA thematic review is a periodic, sector-wide supervisory review VARA conducts across all licensed VASPs using a dual methodology: a structured questionnaire covering eight thematic areas (governance, scope and methodology, data sources, inherent risk coverage, proliferation financing, control effectiveness, operationalisation, and review cycle), and a detailed analysis of the BRA documents VASPs submit. VARA's 2026 good-practice guidance is drawn from the supervisory observations of that review.

BRA quality is assessed as part of VARA's ongoing supervisory engagement. A weak BRA — for example one with ratings unsupported by narrative, self-assessed controls without independent validation, no separate proliferation-financing assessment, or no demonstrable link to operational decisions — is likely to attract supervisory findings and a remediation requirement. Because the BRA underpins the entire AML/CFT programme, deficiencies can cascade into wider compliance and enforcement risk for the VASP and personal exposure for the MLRO and Board.