VARA requires a UAE-resident employee as MLRO and does not accept an outsourced appointment. The DFSA and the FSRA allow an outsourced MLRO or compliance officer where the individual is approved by the regulator and resident in the UAE. DNFBPs supervised by the Ministry of Economy and Tourism have more flexibility but must still register a named compliance officer on goAML. In every case the firm remains accountable, and external counsel's role is to support the function with reporting, regulatory watch and judgement on the hard cases.
Regulator by regulator
VARA
VARA's Compliance and Risk Management Rulebook requires a Money Laundering Reporting Officer who is a UAE-resident employee of the VASP, independent of revenue-generating functions and reporting directly to the board. An outsourced MLRO is not accepted. The Compliance Officer must also be resident and employed. What VARA does allow is external support for both roles: counsel and compliance specialists preparing board reports, monitoring rulebook changes, reviewing difficult files and running the independent review. Our guide to VARA key personnel covers the qualifications and salary benchmarks.
DFSA
In the DIFC, the MLRO is a mandatory Licensed Function and the individual must be approved by the DFSA as an Authorised Individual and be resident in the UAE. The DFSA permits the function to be outsourced to a suitably qualified external provider provided that the individual is approved, the arrangement is documented, and the firm's board retains oversight. The DFSA AML Module sets the MLRO's duties, including the annual AML return.
FSRA
In ADGM, the MLRO is a Controlled Function and the individual must be an Approved Person resident in the UAE. The FSRA takes a similar approach to the DFSA on outsourcing: possible, with approval and documented oversight. The FSRA AML Rulebook sets out the duties.
Central Bank
Banks, exchange houses, finance companies and payment firms must appoint a compliance officer and MLRO acceptable to the Central Bank, with fit-and-proper review and residency expectations. Outsourcing the role is generally not accepted for these licensees.
Ministry of Economy and Tourism DNFBPs
Real estate brokers and agents, dealers in precious metals and stones, auditors and accountants and corporate service providers must appoint a compliance officer and register that person on goAML. The federal framework does not require the compliance officer to be an employee, and many smaller DNFBPs use an external compliance officer. The business owner remains personally responsible for the programme, and the Ministry's circulars address penalties to the DNFBP and its executives directly. See our DNFBP guide.
What compliance support from counsel actually covers
- The quarterly MLRO board report. The document the board must receive and the inspector always asks for: new customers by risk band, alerts and dispositions, sanctions hits, STRs filed, training delivered, findings open and closed, and rulebook changes with their impact. We prepare it with the MLRO.
- Regulatory watch. New circulars, rulebook amendments, FATF list changes and national committee decisions, each translated into a one-page impact note with the actions required and a deadline.
- Judgement on hard cases. Whether a politically exposed person relationship can be onboarded, whether a counterparty falls within high-risk country countermeasures, whether an internal escalation is a reportable suspicion. These are legal calls and the MLRO should not have to make them alone.
- Policy maintenance. Keeping the manual current with the law, and keeping a change log so the inspector can see what changed when.
- Regulator correspondence. Drafting responses to information requests, inspection findings and enforcement letters. See inspections and enforcement.
- Annual independent review. Scheduled, scoped and delivered. See independent AML review.
Choosing the model
A VARA VASP needs a resident MLRO on payroll and benefits from external support that keeps that person out of trouble. A DIFC or ADGM boutique may run with an approved outsourced MLRO and counsel behind them. A DNFBP usually wants an external compliance officer and a once-a-year legal review. We set the model up to match the regulator, document it so the arrangement itself passes inspection, and provide the ongoing support on a fixed monthly basis. Details on the AML compliance practice page.
Frequently asked questions
Can a Dubai VASP use an outsourced MLRO?
No. VARA requires the MLRO to be a UAE-resident employee of the VASP, independent of revenue functions and reporting to the board. External counsel can support the MLRO but cannot hold the role.
Does the DFSA allow an outsourced MLRO?
Yes, where the individual is approved by the DFSA as an Authorised Individual, is resident in the UAE, the outsourcing is documented and the firm's board retains oversight. The same approach applies in ADGM under the FSRA with Approved Person status.
Must a DNFBP's compliance officer be an employee?
The federal framework requires a named compliance officer registered on goAML but does not require an employee, so many smaller real estate, corporate services and precious metals businesses use an external compliance officer. The business and its executives remain responsible for the programme.
What is in a quarterly MLRO board report?
New customers by risk band, alerts raised and dispositioned, sanctions hits and their resolution, suspicious transaction reports filed, training delivered, open and closed findings, and regulatory changes with their impact and actions. It is the document inspectors ask for to prove the programme is running.
What does ongoing AML compliance support from a law firm cost?
We provide it on a fixed monthly fee scaled to the licence and the volume of the business, confirmed on the first call. Projects such as a programme refresh or an independent review are quoted separately as fixed fees.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
