UAE businesses in designated non-financial businesses and professions (DNFBPs) — and all financial institutions — are required to implement AML/CFT (Anti-Money Laundering / Countering the Financing of Terrorism) compliance programmes under Federal Decree-Law No. 20 of 2018. Here is a practical compliance checklist.
Does Your Business Need AML/CFT Compliance?
Mandatory AML/CFT compliance applies to: banks and financial institutions (regulated by CBUAE), insurance companies, real estate agents and brokers (for transactions AED 55,000+), dealers in precious metals and stones (DPMSPs), auditors and accounting firms, lawyers and legal professionals providing certain services, trust and company service providers, and virtual asset service providers (VASPs under VARA). Most free zone trading and professional service companies: not currently classified as DNFBPs, but must still maintain basic KYC records for clients as good practice.
AML Compliance Programme Checklist
Policies and Procedures: Written AML/CFT policy approved by senior management, Customer Due Diligence (CDD) procedure, Enhanced Due Diligence (EDD) procedure for high-risk clients, transaction monitoring procedure, and Suspicious Transaction Reporting (STR) procedure. Customer Due Diligence (CDD): Collect and verify identity of all customers (passport/EID copy), identify and verify UBOs of corporate customers (25%+ beneficial ownership threshold), assess the purpose of the business relationship, and maintain records for 5 years after the end of the relationship. Transaction Monitoring: Monitor customer transactions for unusual patterns, investigate transactions inconsistent with stated business purpose, and document the results of all investigations. Reporting: File Suspicious Transaction Reports (STRs) with UAEFIU (Financial Intelligence Unit) at amlcft.gov.ae within 35 days of becoming suspicious. Training: Annual AML/CFT training for all employees who interact with customers.