AML compliance in the UAE involves more than registering on goAML and preparing a written policy. Designated Non-Financial Businesses and Professions (DNFBPs) must implement controls appropriate to their money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks, and be able to demonstrate that those controls work in practice. Supervisory authorities may conduct risk-based inspections, while an independent audit function should assess the effectiveness of the AML programme. This guide explains what businesses should prepare, what an AML review may examine, and how to address gaps before they become more serious compliance issues.
Who conducts AML audits for UAE DNFBPs?
Designated Non-Financial Businesses and Professions (DNFBPs) — including qualifying real estate brokers and agents, dealers in precious metals and stones, trust and company service providers, and specified accounting or audit professionals — are subject to the applicable UAE AML/CFT/CPF framework and supervision by the competent authority for their sector and legal arrangements. Depending on the entity, the relevant supervisor may be the Ministry of Economy or another competent authority. Supervisory activity may include off-site reviews, on-site inspections, requests for records, and follow-up on identified deficiencies. The frequency and scope of supervision are risk-based.
Risk-based supervisory inspections or reviews by the competent authority
Off-site reviews or on-site inspections, including requests for documents, records, and explanations
Independent AML audit or effectiveness testing under the business's risk-based compliance framework
Follow-up reviews to verify that previously identified deficiencies have been addressed
DNFBPs are expected to establish an independent audit function as part of an effective AML/CFT/CPF framework. This function should assess the design and operational effectiveness of the business's policies, procedures, systems, and controls, and should operate independently of the Compliance Officer / MLRO function. The arrangements should be proportionate to the nature, size, complexity, and risk profile of the business. Depending on the circumstances, the independent audit work may be performed by a suitably qualified external provider rather than a dedicated in-house audit department.
What documents will the auditor ask for first?
Examiners typically start with a documentation review before moving to interviews and sample testing. Have the following ready:
The current AML/CFT/CPF policies, procedures, and controls, with evidence of senior-management approval
The business-wide ML/TF/PF risk assessment and records of periodic reviews or updates
goAML registration details and relevant reporting records, where applicableCustomer due diligence (CDD), beneficial-owner verification, and enhanced due diligence (EDD) files for selected customers
PEP and targeted financial sanctions screening records, including evidence of follow-up on relevant matches or alerts
Records of suspicious transaction or activity assessments, internal escalations, and reports submitted through goAML, where applicable
Staff AML training materials, attendance records, and evidence of understanding or assessment where used
The Compliance Officer / MLRO appointment details, role description, reporting line, and authority
Previous audit or inspection findings, remediation plans, and evidence that corrective actions were completed
Relevant transaction-monitoring records, case files, and documentation showing how unusual activity was investigated and resolved
Missing, inconsistent, or outdated records can make it difficult to demonstrate that the AML framework is being implemented effectively. Businesses should organise their documentation so that relevant records can be retrieved promptly and linked to the controls and risks they are intended to address.
What do auditors actually test during the review?
Policy versus practice
A written policy is only the starting point. Auditors compare what your documents say against what your transaction files and onboarding records show. If your policy requires EDD for high-risk customers but your files show none were escalated, that's a red flag.
Risk assessment quality
A generic, copy-pasted risk assessment rarely survives scrutiny. Auditors expect to see risk ratings tied to your actual customer base, products, delivery channels, and geographic exposure — updated periodically, not left untouched since registration.
Transaction monitoring and reporting
Reviewers may test whether the business identifies unusual or suspicious activity, documents its assessment, escalates concerns appropriately, and submits a report to the FIU when the applicable reporting obligation is triggered. They may also examine the quality of supporting records, the rationale for decisions not to report, and whether submitted reports contain clear, complete, and consistent information. Businesses should follow the applicable reporting requirements rather than rely on an informal interpretation of what constitutes a reasonable timeframe.
Governance and training
They'll also look for:
- Evidence that your Compliance Officer has real authority and reporting lines to senior management or ownership
- Annual (or more frequent) AML training completed by relevant staff
- Minutes or records showing management actually reviews AML performance, not just delegates it
What happens if the audit finds gaps?
The outcome depends on the nature of the deficiency, the level of risk, the applicable legal requirements, and the response taken by the business. Possible outcomes include:
Documentation or control gaps: The supervisor or independent reviewer may identify corrective actions and expect the business to address them within the applicable timeframe.
Material deficiencies: The competent authority may require formal remediation, request further evidence, or conduct a follow-up review.
Regulatory breaches: Where a breach of the applicable AML/CFT/CPF requirements is established, the competent authority may impose administrative measures or penalties in accordance with the relevant legal provisions.
Businesses should record each finding, assign responsibility for remediation, set target dates, and retain evidence that corrective actions have been completed. Do not assume that every finding results in a fine or that every deficiency will be treated as minor.
AML compliance and ultimate beneficial owner (UBO) requirements are related but distinct obligations. Businesses should check that ownership information recorded in their AML customer files is consistent with the relevant company records and UBO declarations, where applicable. Any discrepancies should be investigated and corrected through the appropriate process, with supporting documentation retained.
How to prepare before an audit is announced
Conduct periodic self-assessments against the applicable UAE AML/CFT/CPF requirements and document the findings and corrective actions.
Maintain organised CDD and EDD files, screening evidence, transaction reviews, and escalation records rather than reconstructing them when an inspection is announced.
Test the internal goAML reporting workflow through a documented simulation or tabletop exercise. Do not submit fictitious reports to the FIU as a test.
Keep records of staff training, including dates, topics, attendees, and any assessments or follow-up actions.
eview the business-wide risk assessment and controls whenever material changes occur in the business, customer base, services, transaction patterns, or geographic exposure.
Maintain an audit trail of previous findings, management decisions, remediation deadlines, and completed corrective actions.
Frequently Asked Questions
How often are DNFBPs audited for AML compliance in the UAE?
Supervisory inspection frequency is risk-based and depends on factors such as the entity's activities, size, risk profile, control environment, and previous inspection findings. Separately, the DNFBP's independent audit function should operate regularly, with the frequency and depth of testing determined using a risk-based methodology and the applicable supervisory guidance. Businesses should not assume that the absence of a previous inspection removes their obligation to maintain and test an effective AML programme.
Can a small business be exempt from AML audits?
If your business falls within a DNFBP category defined under UAE law, size alone doesn't exempt you. Even small firms must maintain a risk-based program and be ready for review.
Does having AML software guarantee a pass?
No. Software helps with screening and record-keeping, but auditors assess whether your people and processes actually use it correctly — a well-documented manual process can outperform a poorly implemented software setup.
How Elite Edge can help
Elite Edge Accounting & Bookkeeping, based in Business Bay, Dubai, supports DNFBPs through every stage of AML compliance UAE requirements — from goAML registration and policy drafting to pre-audit gap analysis and ongoing monitoring support. If an inspection notice has landed on your desk, or you simply want peace of mind before one does, contact our team for a confidential review.
This article is general information only and not professional, legal, or regulatory advice. AML rules and supervisory practices can change, so please confirm current requirements with a qualified advisor or the relevant UAE authority.