AML Compliance Report UAE: 2026 MLRO Reporting Guide

Every compliance officer in the UAE owes senior management a written account of how the business is handling financial crime risk. Cabinet Resolution No. 134 of 2025 turns that into a legal duty. The compliance officer must prepare periodic reports, send them directly to senior management, and hand a copy to the supervisor on request, with management’s own observations and decisions included. This guide explains what an AML compliance report in the UAE has to cover in 2026, who signs it, how often to produce it, and what examiners look for when they ask to see one.

Last updated: 29 October 2026. Reviewed against Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.

Quick Answer

An AML compliance report in the UAE is the compliance officer’s periodic written assessment of the firm’s anti-money laundering, counter-terrorist financing and proliferation financing controls. Article 22(3) of Cabinet Resolution No. 134 of 2025 requires it to go directly to senior management, record their observations and decisions, and be sent to the supervisory authority on request.

Key Takeaways

It is a legal duty, not good practice. Article 22(3) of Cabinet Resolution No. 134 of 2025 makes periodic reporting to senior management one of only five listed duties of the compliance officer.
It applies across sectors. Licensed financial institutions, DNFBPs and virtual asset service providers all fall under the same article, whether supervised by the CBUAE, the Ministry of Economy, the DFSA, the FSRA or VARA.
Management’s response is part of the report. The text requires the report to include senior management’s observations and decisions, so a report nobody answered is an incomplete report.
The supervisor can ask for it at any time. A copy goes to the supervisory authority on request, which in practice means during an inspection, a thematic review or after a finding.
Exchange houses have an extra layer. CBUAE-licensed exchange houses also prepare a bi-annual compliance report under section 16.30 of the CBUAE exchange business standards.
The report is evidence of the MLRO’s own diligence. After the CBUAE fined a Head of Compliance AED 300,000 personally in June 2026, a dated paper trail of what was reported and when is the compliance officer’s best protection.

Definition: AML compliance report

A periodic written report prepared by the compliance officer (MLRO) that reviews the firm’s AML/CFT/CPF systems and procedures, measures how well they are being applied, proposes updates, and records senior management’s observations and decisions. Legal basis in the UAE: Article 22(3) of Cabinet Resolution No. 134 of 2025.

What Does UAE Law Require the Compliance Officer to Report?

The reporting duty sits in the Executive Regulations of the AML law. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its Executive Regulations, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025 and replaced Cabinet Decision No. 10 of 2019. For a full walk through the parent law, see our Federal Decree-Law No. 10 of 2025 guide.

The text of Article 22(3)

Article 22 requires every financial institution, DNFBP and VASP to appoint a compliance officer at management level, with independence in decision-making and the right competence and experience. It then lists five duties. The third duty is the one that creates the report. The compliance officer must:

review the firm’s AML, CFT and proliferation financing internal systems and procedures;
assess whether they are consistent with the Decree-Law and the Resolution;
evaluate the firm’s level of compliance with them in practice;
propose what is needed to update and develop them; and
prepare periodic reports on all of this, submitted directly to senior management, with a copy sent to the supervisory authority on request, including senior management’s observations and decisions.

Read closely, that sentence answers most of the questions compliance officers ask us. The report goes “directly” to senior management, so it cannot be filtered through a business line head first. It is “periodic,” so a one-off memo after an inspection does not satisfy it. And it must carry management’s response, which means the loop has to close before the report is complete.

Who counts as senior management?

Cabinet Resolution No. 134 of 2025 defines senior management as the persons with authority to take strategic and executive decisions that materially affect risk management, compliance policies and operational governance. The definition names chief executive officers, general managers and members of the board of directors, plus anyone who can directly influence how the business is run. For a company with a board, the board is in scope. For an owner-managed DNFBP, such as a two-partner real estate brokerage or a family-run gold trading business, the owners are the senior management.

How Article 22 links to Article 21

Article 21 requires internal policies, controls and procedures that are approved by senior management, proportionate to the firm’s risks, and reviewed on an ongoing basis. It also requires an independent audit function to test them. The compliance report is how senior management keeps that approval meaningful. Without a periodic report, the board approved a policy once and has no basis for saying it still works.

Who Has to Produce an AML Compliance Report in the UAE?

Article 22 does not distinguish between sectors. If your firm must appoint a compliance officer, it must also produce the periodic report. What changes from sector to sector is the supervisor who may ask for the copy and any extra format the supervisor layers on top.

Type of entity	Typical supervisor	Reporting obligation
Banks, finance companies, insurers (onshore)	Central Bank of the UAE (CBUAE)	Article 22(3) periodic report to senior management, copy on request
Exchange houses	CBUAE	Article 22(3) report plus the bi-annual compliance report under section 16.30 of the exchange business standards
Real estate brokers, DPMS, accountants, CSPs (mainland and most free zones)	Ministry of Economy	Article 22(3) periodic report to owners or senior management, copy on request
Lawyers and notaries	Ministry of Justice	Article 22(3) periodic report, copy on request
DIFC firms	DFSA	Article 22(3) report, plus any DFSA rulebook reporting that applies
ADGM firms	FSRA	Article 22(3) report, plus any FSRA rulebook reporting that applies
Virtual asset service providers (Dubai)	VARA	Article 22(3) report, plus any VARA rulebook reporting that applies

Exchange houses deserve a specific note. They already run a CBUAE-mandated bi-annual report under the exchange business standards, and the safest approach is to build one document that meets both the standard and Article 22(3). Our exchange house AML compliance guide covers the wider supervisory regime for that sector.

How Often Should the Report Be Produced?

The Resolution says “periodic” and does not set a fixed interval for every sector. That leaves the firm to set a frequency that matches its risk, and to defend that choice to its supervisor.

A risk-based reporting calendar

In our work with UAE firms, a risk-based approach to frequency usually lands in one of three places:

Quarterly: banks, exchange houses, payment service providers, VASPs and any firm with high transaction volumes or a large high-risk customer book.
Semi-annual: mid-sized DNFBPs, such as active real estate brokerages, gold and jewellery traders and corporate service providers.
Annual, with exception reports: small, low-volume DNFBPs, provided the policy requires an immediate ad hoc report whenever a material event occurs.

Whatever you choose, write it into the AML policy and get senior management to approve it. An examiner will accept a reasoned annual cycle for a three-person accounting practice. They will not accept a policy that says “periodic” and a file that holds one report from 2024.

When an ad hoc report is needed

Some events should go to senior management straight away rather than waiting for the next cycle:

a confirmed match against the UAE Local Terrorist List or the UN Consolidated List;
a supervisory inspection notice, information request or finding;
a significant system failure, such as a screening tool that stopped updating its lists;
a pattern of suspicious activity across several customers that changes the firm’s risk profile; and
a change to the law, such as a new Cabinet Resolution or supervisor circular, that requires a policy change.

Keep the content of any report that touches a filed STR inside the circle that needs to know. Article 19 of the Resolution prohibits disclosing that a report has been or will be filed, and our tipping off guide explains how to brief management without breaching it.

Need help building your reporting cycle? ADZ’s compliance advisory team drafts AML policies, sets reporting calendars and prepares compliance reports for UAE financial institutions and DNFBPs. Talk to our AML advisory team.

What Should an AML Compliance Report Contain?

The Resolution sets the purpose of the report rather than a template. A useful structure follows the order of Article 22(3) itself: what the systems are, whether they meet the law, how well they work, what should change, and what management decided. The table below is the section list we use as a starting point with clients, mapped to the legal requirement each section evidences.

Section	What it covers	Legal anchor
1. Executive summary	Overall compliance rating, top three risks, decisions requested	Art. 22(3), report to senior management
2. Risk assessment update	Changes to the business-wide risk assessment and the National Risk Assessment	Art. 5, identify and assess crime risks
3. CDD and EDD performance	Onboarding volumes, high-risk and PEP customers, overdue reviews	Arts. 6 to 8 and 16
4. Screening and TFS	Screening coverage, alert volumes, confirmed and partial matches, CNMR and PNMR filed	Cabinet Decision No. 74 of 2020
5. Monitoring and reporting	Alerts generated and closed, STRs and SARs filed on goAML, filing timeliness	Arts. 17 and 18
6. Training	Completion rates by role, new joiners, overdue staff	Art. 21(5) and Art. 22(4)
7. Audit and inspection findings	Open findings, owners, due dates, overdue items	Art. 21(6)
8. Regulatory change	New laws, circulars and guidance, and the policy changes they require	Art. 22(3), propose updates
9. Resourcing	Staffing, systems, budget gaps	Art. 22, competence and independence
10. Management response	Observations, decisions, owners and deadlines	Art. 22(3), observations and decisions

Risk assessment and customer risk

Start with what changed in the risk picture since the last report. Did the firm enter a new product line, a new geography or a new delivery channel?

Article 24 requires new products and technologies to be risk-assessed before launch, so any launch in the period should appear here with its assessment date. Add the shape of the customer book: how many customers sit in each risk rating, how many are PEPs, and how many have connections to countries the National Committee lists as high risk. Our business risk assessment guide explains how to build the underlying model.

Monitoring, screening and suspicious activity reporting

This is the section examiners read hardest. Give numbers, not adjectives: alerts generated, alerts closed, average days to close, and the backlog at period end.

For sanctions screening, show the number of potential matches, how many were false positives, and whether any confirmed or partial name match led to a freeze and a CNMR or PNMR on goAML. For suspicious activity, show how many internal referrals the compliance officer received, how many became STRs or SARs, and how many were closed with documented reasons.

Article 22(2) expressly allows the compliance officer to retain a matter “stating the reasons,” so a referral closed without a written rationale is a finding waiting to happen. For filing steps, see how to file an STR on goAML.

Training, audit findings and resourcing

List training completion by role, not just a firm-wide percentage. Senior management, front-line staff and the compliance team need different content, and a 95 percent overall figure can hide a sales team that never finished the course.

Then list every open audit or inspection finding with an owner, a due date and its status. Close with resourcing. If the compliance team is short of people or the screening system needs an upgrade, this is where the compliance officer puts the request in writing.

How Does the Report Protect the MLRO Personally?

The report is more than a governance document. It is the compliance officer’s record of what they told the people who run the business, and when.

The June 2026 CBUAE case

On 24 June 2026, the CBUAE imposed a financial penalty of AED 20,000,000 on a branch of a foreign bank for significant, repeated failures in its AML, CFT and sanctions framework. In the same action it imposed an individual penalty of AED 300,000 on the branch’s Head of Compliance and Money Laundering Reporting Officer for failing to fulfil the responsibilities of the role.

The word “repeated” matters. Repeated failures suggest problems that were known and not fixed. If a compliance officer reported a gap, proposed a fix and asked for resources, the report shows it. If they never put it in writing, nothing does.

The CBUAE enforcement policy explains how it applies administrative and financial sanctions under the Central Bank Law and the AML law, and our MLRO personal liability guide covers this case in depth.

Escalation that leaves a trail

Three habits make the report work as protection:

Date and version every report. Keep the final version and the evidence of when it went to senior management, such as the board pack or the email.
Record the decision, not just the discussion. Minutes that say “the board noted the report” are weak. Minutes that say “the board approved two additional analysts by 31 January” are strong.
Carry open items forward. Every unresolved item from the last report appears again until it is closed, with the number of periods it has been open.

Retain the reports and minutes for at least five years. Article 25 sets a five-year minimum for AML records, and our record-keeping guide explains how the retention clock runs.

What Do UAE Supervisors Check When They Ask for the Report?

Because a copy goes to the supervisor on request, the report usually surfaces during an inspection. Supervisors are reading for evidence that the AML programme is effective, not just documented. That focus matches the FATF mutual evaluation methodology, which weighs effectiveness heavily, and the FATF on-site visit for the UAE’s current mutual evaluation was scheduled for June 2026.

Common gaps we see in inspections

Reports with no management response. The single most common gap, and a direct breach of the “observations and decisions” wording.
Copy-and-paste reports. The same text period after period, with only the date changed.
Numbers that do not reconcile. STR counts in the report that differ from the goAML submission history.
Findings with no owner. Open audit points listed without a named person or a due date.
Reports routed through the business. A report that a commercial head edited before senior management saw it is not a report submitted “directly.”

If you have received an inspection notice, our AML inspection preparation guide and our guide on responding to an AML regulatory notice cover the steps around producing documents.

Penalties when the reporting framework fails

Weak reporting rarely gets fined on its own. It shows up as evidence in a wider finding about governance and oversight.

Under the 2025 regime, legal persons face fines from AED 5 million up to AED 100 million for the most serious breaches, alongside licence suspension and withdrawal powers. The June 2026 case shows supervisors will also add a personal penalty for the compliance officer. A weak AML compliance report will not cause that outcome by itself, but it removes the best evidence the firm has against it.

Test your reporting before an examiner does. ADZ conducts independent AML/CFT audits for CBUAE, DFSA and VARA-regulated entities, with four audit types: Federal, DFSA, VARA and Supply Chain. See our AML/CFT audit services.

How Do You Build the Report Step by Step?

A reliable AML compliance report comes from a process that runs all period, not a scramble in the last week. This is the sequence we recommend.

Fix the period and the deadline. Set the reporting cycle in the AML policy and put the senior management meeting date in the calendar a year ahead.
Collect data monthly. Pull screening, monitoring, CDD and training figures every month, so the report summarises numbers you already trust.
Reconcile against source systems. Check STR and SAR counts against goAML, screening counts against the screening tool, and training against the learning records.
Write the assessment, not just the data. For each section, say whether controls are effective, partly effective or ineffective, and why.
Propose specific changes. Each weakness needs a proposed fix, an owner, a cost where relevant and a date.
Submit directly. Send the report to senior management or the board without edits from the business lines.
Minute the response. Record observations and decisions in the meeting minutes and attach them to the final report.
Track and carry forward. Feed every decision into the remediation tracker and report on it next period.

Software helps with steps two and three. When screening results, CDD reviews and goAML reporting sit in one system, the compliance officer spends the reporting week on judgement rather than spreadsheets.

Pull your report data from one place. First Compliance automates CDD, sanctions screening across 1,800+ sanction lists and 5.5M+ PEP records, and goAML reporting. Explore First Compliance software.

How Is a Compliance Report Different From an Independent Audit?

Both appear in Article 21 and Article 22, and firms sometimes treat one as a substitute for the other. They are separate controls with separate authors.

Feature	AML compliance report	Independent AML audit
Legal basis	Art. 22(3), Cabinet Resolution No. 134 of 2025	Art. 21(6), Cabinet Resolution No. 134 of 2025
Author	The compliance officer (MLRO)	An independent function, internal audit or an external auditor
Frequency	Periodic, set by the firm on a risk basis	Set by the firm and its supervisor, often annual
Purpose	Report on compliance and request decisions	Test whether controls are adequate and effective
Audience	Senior management, copy to supervisor on request	Senior management or the audit committee

The two feed each other. Audit findings go into the compliance report’s findings section, and the audit tests whether the compliance officer’s reporting actually reached senior management. Our independent AML audit guide explains the audit side in detail.

Frequently Asked Questions

Is an AML compliance report mandatory in the UAE?

Yes. Article 22(3) of Cabinet Resolution No. 134 of 2025 requires the compliance officer of every financial institution, DNFBP and VASP to prepare periodic reports on the firm’s AML/CFT/CPF systems and compliance. Each AML compliance report goes directly to senior management, and a copy goes to the supervisory authority on request.

How often should a UAE compliance officer report to senior management?

The Resolution says “periodic” without fixing one interval for all sectors. Most banks, exchange houses and VASPs report quarterly, mid-sized DNFBPs semi-annually, and small DNFBPs annually with ad hoc reports for material events. The chosen frequency should be written into the AML policy and approved by senior management.

Do I have to send the compliance report to the Ministry of Economy?

Not automatically. Article 22(3) requires a copy to go to the supervisory authority upon its request, which for most DNFBPs is the Ministry of Economy. In practice the request usually comes during an inspection or information request, so the report must be ready to produce at short notice.

Who signs off the AML compliance report?

The compliance officer prepares and signs the report. Senior management receives it and records its observations and decisions, usually in board or management committee minutes attached to the final report. Cabinet Resolution No. 134 of 2025 defines senior management to include CEOs, general managers and board members.

What happens if senior management ignores the report?

The report must include senior management’s observations and decisions, so a report with no response is incomplete. The compliance officer should escalate in writing, carry the open items into the next report, and keep the evidence. Supervisors treat unanswered reports as a governance failure.

Is the exchange house bi-annual compliance report the same thing?

It overlaps but adds to it. CBUAE-licensed exchange houses prepare a bi-annual compliance report under section 16.30 of the exchange business standards, in addition to the Article 22(3) duty. Most exchange houses build one document that meets both.

How long must AML compliance reports be kept?

At least five years. Article 25 of Cabinet Resolution No. 134 of 2025 sets a five-year minimum retention period for AML records, and the reports, minutes and supporting data should be retrievable promptly when a supervisor asks.