The Executive Regulations to the UAE AML law require an independent audit function, proportionate to the size and risk of the business, to test the AML/CFT programme, and VARA, the DFSA, the FSRA and the Central Bank each expect to see the output. A useful review tests the risk assessment against the business, the policies against the law and the files against the policies, and ends in a findings register the board tracks to closure.
The requirement
Cabinet Resolution No. 134 of 2025, the Executive Regulations to Federal Decree-Law No. 10 of 2025, requires financial institutions and designated non-financial businesses and professions to maintain an independent audit function to test the effectiveness of their AML/CFT programme, proportionate to the size and nature of the business. The sector rulebooks repeat and sharpen it. VARA's Compliance and Risk Management Rulebook expects periodic independent review of the VASP's compliance framework. The DFSA AML Module and the FSRA AML Rulebook require the programme to be reviewed and the results reported to senior management. The Central Bank's standards for its licensees say the same. For DNFBPs supervised by the Ministry of Economy and Tourism, the independent audit is one of the items its inspectors ask for first.
"Independent" is the operative word. The review must be done by someone who did not design or run the programme. In a large firm that is internal audit. In a small firm it is an external reviewer, and the reviewer cannot be the consultant who wrote the policies.
What a useful review covers
- Risk assessment against the business. Does the enterprise-wide risk assessment describe the firm that actually exists today, with its current products, customers, geographies and channels? Is proliferation financing addressed? Is it dated and board-approved?
- Policies against the law. Do the policies cite and implement the current law, the Executive Regulations, the sector rulebook and Cabinet Decision No. 74 of 2020 on targeted financial sanctions? Our 2025 law refresh guide lists the usual gaps.
- Files against the policies. A sample of onboarding files across risk bands: identification, verification, beneficial ownership, source of funds where required, politically exposed person checks, risk rating and approval.
- Monitoring and alerts. Are alerts generated, reviewed and dispositioned within the time the procedure says, with reasons recorded? Were any escalated to the MLRO and what happened next?
- Sanctions screening. Lists used, frequency, treatment of hits, freeze and reporting steps, and evidence that screening actually ran on the dates claimed.
- Reporting. goAML registration current, suspicious transaction reports filed where the internal escalations justified them, MLRO board reports delivered on schedule.
- Governance and training. Board minutes showing oversight, training records with attendance and testing, and the status of findings from the last review.
The output
A findings register, graded by severity, each with a root cause, a recommended fix, an owner and a date. A short board paper summarising the state of the programme. And, where the regulator has asked for it, a version of the report suitable for submission. The register is then tracked at each MLRO board report until every item is closed. Inspectors ask for last year's review and this year's closure evidence together; a review with no closure trail is a finding of its own.
Why a law firm review is different
An accounting firm's review tends to test against a checklist derived from the rulebook. A law firm's review tests against the law itself and asks the questions the regulator will ask: is this customer actually a politically exposed person on the definition in the Executive Regulations, does this counterparty fall within the high-risk country countermeasures, was that alert a reportable suspicion or not. Those are legal judgements. A review that gets them wrong gives false comfort. One that gets them right and documents the reasoning is the firm's best evidence in an inspection. The full scope of our assurance work is on the AML compliance practice page.
Frequently asked questions
Is an independent AML audit mandatory in the UAE?
Yes for financial institutions and DNFBPs. The Executive Regulations in Cabinet Resolution No. 134 of 2025 require an independent audit function proportionate to the size and risk of the business to test the AML/CFT programme, and VARA, the DFSA, the FSRA, the Central Bank and the Ministry of Economy and Tourism each expect to see the results.
Can our external accountant do the independent AML review?
Only if the accountant did not design or operate the programme and has the regulatory competence to test it against the law rather than a checklist. The consultant who wrote the policies cannot review them. Regulators look at independence and competence together.
How often should the AML programme be reviewed?
Proportionate to risk, which for most licensed firms means annually, and sooner after a material change in products, markets or ownership, after a regulator finding, or after a change in the law such as the 2025 framework.
What does an independent AML review produce?
A graded findings register with root causes, fixes, owners and dates, a board paper, and where needed a version for the regulator. The register is tracked to closure through the MLRO's board reports.
Does a law firm need to be a registered auditor to do an AML review?
No. The AML independent audit function is a compliance testing requirement, not a statutory financial audit. It can be performed by any suitably independent and competent reviewer, including legal counsel, and a legal review carries weight on the judgement calls that drive most findings.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
