Last updated: 5 November 2026. Reviewed against Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and Ministry of Economy and Tourism Circular No. 6 of 2025.

Quick Answer

Simplified due diligence in the UAE is allowed under Article 5(3) of Cabinet Resolution No. 134 of 2025 when a documented risk assessment shows low risk and there is no suspicion of a crime. Firms may verify identity later, refresh data less often and monitor less frequently. Sanctions screening and STR duties never relax.

Key Takeaways

• SDD is lawful and expected. Article 5(3) of Cabinet Resolution No. 134 of 2025 lets financial institutions, DNFBPs and VASPs apply simplified measures where low risk is identified.
• The regulator is asking for it. MoET Circular No. 6 of 2025, issued on 5 August 2025, tells DNFBPs to apply EDD to high-risk customers, standard CDD to medium risk and SDD to low risk.
• Low risk must be proven, not assumed. SDD is only available after you have assessed risk under Article 5(1) and set mitigation policies under Article 5(2).
• Suspicion ends SDD immediately. The article itself excludes any case where there is a suspicion that a crime has been committed.
• Sanctions screening never relaxes. SDD must keep Targeted Financial Sanctions instructions from the Executive Office fully applied.
• Four measures can be reduced. Timing of verification, frequency of data updates, frequency of monitoring, and how you establish the purpose of the relationship.
• The file note is the defence. Inspectors test the written reason a customer was rated low, not the label on the screen.

What Is Simplified Due Diligence in the UAE?

Simplified due diligence sits at the bottom of a three-tier, risk-based approach, and standard CDD applies to most customers. Enhanced due diligence applies to high-risk customers. SDD applies to the narrow group you can show is low risk. If you need a refresher on the middle tier, our guide to customer due diligence in the UAE covers the full set of standard measures.

What does Article 5(3) actually say?

Cabinet Resolution No. 134 of 2025, the executive regulations of Federal Decree-Law No. 10 of 2025, came into force on 14 December 2025 and replaced Cabinet Decision No. 10 of 2019. Article 5(3) says regulated entities may apply simplified measures where low risks are identified, unless there is a suspicion that a crime has been committed. They must first meet Clauses 1 and 2 of the same article and act in coordination with the Supervisory Authority.

The article then sets two conditions. The measures must be proportionate to the low-risk factors, and they must keep Targeted Financial Sanctions instructions fully applied. It lists four examples of what SDD may include:

1. Verifying the identity of the customer and the beneficial owner after the business relationship starts.
2. Updating customer data at longer intervals.
3. Reducing the frequency of ongoing monitoring and transaction scrutiny.
4. Inferring the purpose and nature of the relationship from the type of transaction or relationship, without collecting separate information.

Why is the UAE pushing firms to use SDD now?

Over-compliance has a cost the regulators now recognise. When every customer gets the same heavy file, compliance teams spend their hours on low-risk retail buyers and salaried residents instead of the complex structures that carry real exposure.

Ministry of Economy and Tourism Circular No. 6 of 2025 makes this point directly. It is addressed to real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, and corporate service providers. The circular says a tiered approach lets them focus resources on higher-risk customers and avoid excessive measures for lower-risk ones, in support of financial inclusion.

The international standard moved the same way. In February 2025 the FATF amended Recommendation 1 and its Interpretive Note, with related changes to the notes for Recommendations 10 and 15. The aim was to give firms more confidence to apply simplified measures where risk is lower. With the UAE’s 2026 FATF mutual evaluation under way and assessors focused on effectiveness, a firm that cannot show proportionate controls has a weaker story than one that can.

When Can You Apply Simplified Due Diligence?

You can apply simplified due diligence only when three things are true together. Your risk assessment supports a low rating, your policy approves SDD for that customer type, and nothing in the file suggests suspicion. Missing any one of the three takes the customer back to standard CDD.

What are the three preconditions in Article 5?

• A documented risk assessment (Article 5(1)). You must have considered customer, country and geographic, product, service, transaction and delivery channel risk before deciding the overall level. The method must be written down, kept up to date and available to the authorities on request. Your enterprise-wide business risk assessment is where low-risk segments first appear.
• Approved mitigation policies (Article 5(2)). Senior management must approve the policies and controls, and they must be proportionate to the size and nature of the business. Your SDD categories belong in that approved policy.
• Coordination with your supervisor. The article says SDD is applied in coordination with the Supervisory Authority. In practice, your SDD categories should match your supervisor’s guidance and the National Risk Assessment, and be visible in your policy so the supervisor can test them.

When is simplified due diligence never allowed?

SDD is off the table in the following situations, whatever the customer’s score says:

• Any suspicion of money laundering, terrorist financing or proliferation financing.
• Any link to a country identified by the National Committee as high-risk, or to a jurisdiction under FATF increased monitoring or a call for action.
• A customer or beneficial owner who is a politically exposed person. See our PEP screening guide for the EDD steps that apply instead.
• A potential or confirmed sanctions match that has not been cleared.
• Doubts about the accuracy of identification data you already hold, which under Article 7(1)(c) triggers fresh CDD.
• Complex ownership, nominee arrangements or structures with no clear commercial reason.

Which customers usually qualify as low risk?

The table below shows customer profiles that UAE firms commonly treat as low risk. None of them is low risk by law. Each still needs a scored assessment and a clean screening result.

What Changes Under SDD, and What Never Changes?

Simplified due diligence changes timing and frequency. It does not change the core identification duty, the sanctions duty or the reporting duty. The table sets out the difference element by element.

How does deferred verification work under Article 6(2)?

Article 6(2) lets you complete identity verification after the relationship starts in low-risk cases, but only on three conditions. Verification must be finished as soon as possible, the delay must be necessary so normal business is not disrupted, and you must apply effective measures to control the risk in the meantime. Article 6(3) adds that you must manage the risk where the customer can benefit from the relationship before verification is complete.

A practical control is a hard cap. A customer onboarded on SDD terms cannot exceed a set transaction value or withdraw funds until verification is closed. Any file still open after a fixed number of working days goes to the MLRO. Write the cap and the deadline into your procedure so the reviewer can test them.

Is the listed-company exemption the same as SDD?

No. Article 11 is a separate rule for companies listed on a securities market whose disclosure rules make beneficial ownership transparent, and for their controlled subsidiaries. For these customers you do not have to identify or verify each shareholder or beneficial owner, and you can take the information from public registers, the customer or other reliable sources.

You still identify the entity itself and the people acting for it, and you still screen. Our guide to beneficial ownership in the UAE explains the 25% ownership test that applies to everyone else.

Why does sanctions screening never relax?

Article 5(3) ties SDD to the full application of Targeted Financial Sanctions instructions issued by the Executive Office or other competent authorities. A low-risk customer still has to be screened against the UAE Local Terrorist List and the UN Consolidated List at onboarding and every time the lists change. If a match is confirmed, freezing and goAML reporting apply exactly as they would for any other customer. The TFS guide walks through those steps.

SDD vs CDD vs EDD: How Do the Three Tiers Compare?

MoET Circular No. 6 of 2025 maps each risk rating to one tier, subject to the absence of suspicion. In a typical UAE customer book, the middle tier is the largest.

SDD and EDD are mirror images in Cabinet Resolution No. 134 of 2025. Article 5(2)(c) tells you to update CDD data on high-risk customers more regularly. Article 5(3)(b) lets you update low-risk data at longer intervals. Both depend on the same risk score, so a weak scoring model undermines both tiers at once.

How Do You Build an SDD Test That Survives an Inspection?

A defensible SDD test has six parts: written categories, a scoring model, hard exclusions, a decision record, a review cycle and exit triggers. Build them in this order.

1. Define the eligible categories in policy. List the customer types that may be considered for SDD, such as government entities, listed companies and salaried residents below set transaction limits. Anything not on the list cannot be SDD.
2. Score every customer, including the obvious ones. Use the same model for all customers so the low rating comes from the score, not from a judgement made at the counter.
3. Apply hard exclusions before the score. PEP status, high-risk country links, unresolved screening hits and complex ownership should block SDD whatever the total.
4. Record the decision. Each SDD file needs a short note stating the category, the score, the exclusions checked and the measures relaxed.
5. Set the review cycle. Decide how often SDD customers are re-rated, and say so in the policy. A longer cycle is permitted. No cycle at all is not.
6. Define exit triggers. List the events that move a customer off SDD immediately, and make sure your monitoring can detect them.

What does a simple scoring model look like?

The model below is illustrative. Weightings must reflect your own business risk assessment and the National Risk Assessment, and your supervisor may expect different factors.

In this example, 5 or 6 points with no hard exclusion can qualify for simplified due diligence. A score of 7 to 11 points means standard CDD, and 12 points or more, or any hard exclusion, means EDD. If you onboard remotely, our eKYC guide covers the UAE PASS and digital ID checks that support a low channel score.

What should the SDD file note say?

Keep it short and specific, so a reviewer understands the decision in under a minute. A workable format reads:

“Customer rated LOW (score 5) under the Customer Risk Methodology v3.2. Category: UAE-listed company (Article 11 applied; ownership taken from exchange disclosures dated 2 November 2026). Exclusions checked: no PEP, no high-risk country link, sanctions screening clear on 3 November 2026. SDD measures applied: purpose inferred from service type; CDD refresh every 36 months; transaction review at reduced frequency; approved by the Compliance Officer on 3 November 2026.”

The 36-month cycle in this example is a policy choice, not a legal figure. Pick the interval your risk assessment supports and apply it consistently.

How Should DNFBPs and VASPs Apply SDD?

The four DNFBP sectors named in MoET Circular No. 6 of 2025 each have a small, identifiable low-risk segment. The examples below show where SDD tends to fit and where it does not.

Real estate brokers and agents

A UAE resident buying an off-plan unit through a bank mortgage, with the funds coming from a UAE bank account, often scores low on channel and source. Cash buyers, buyers paying through third parties, purchases in the name of a company with foreign owners, and rapid resales do not. Remember that some real estate transactions also trigger a separate goAML filing duty that SDD does not change. Our guide to money laundering through real estate in the UAE sets out the higher-risk patterns.

Dealers in precious metals and stones

Low-value retail sales paid by card to UAE residents are the clearest SDD candidates in the DPMS sector. Cash sales at or above reporting thresholds, bullion purchases and trade with counterparties in high-risk jurisdictions should never sit on SDD. The DPMS compliance guide covers the DPMSR reporting that runs alongside CDD.

Accountants, auditors and corporate service providers

Audit or bookkeeping work for UAE government entities and listed groups can justify SDD. Company formation for foreign owners, nominee arrangements, registered office services for entities with no UAE activity, and trust work almost never can. For CSPs, the risk sits in the structure being created, so the customer’s own profile is only half the score. See AML compliance for corporate service providers.

Virtual asset service providers

Cabinet Resolution No. 134 of 2025 includes VASPs in Article 5(3), so simplified due diligence is legally available to them, though the low-risk segment is small. Article 7(3) requires CDD on occasional transactions of AED 3,500 or more, single or linked, and transaction monitoring duties under the VARA rulebook still apply. Any reduced measures need clear support in your risk assessment. Our VASP compliance guide explains the VARA rulebook position.

What Triggers an Exit From SDD?

A customer leaves SDD the moment their risk changes, not at the next scheduled review. Build these triggers into your ongoing monitoring so they fire automatically:

• Any internal suspicion report or unusual activity alert.
• A sanctions or PEP screening hit, even if later cleared, until the review is complete.
• A change of beneficial owner, controller or country of residence.
• Transactions above the values or volumes the low rating assumed.
• A new link to a high-risk or monitored jurisdiction after a FATF plenary or a National Committee update.
• Doubts about the accuracy of data already on file.

If suspicion arises, you file an STR through goAML and take care not to tip off the customer. Article 14(2) allows you to stop CDD steps where they might alert the customer, as long as you report and record your reasons. The STR filing guide explains the process. Failing to report a suspicious transaction can lead to a fine of up to AED 5,000,000 under Federal Decree-Law No. 10 of 2025.

What records must you keep for SDD customers?

The same records you keep for everyone else.

Article 25 requires CDD records, monitoring results and analysis to be kept for at least five years. The period runs from the latest of these: the end of the relationship, account closure, completion of an occasional transaction, or the end of an inspection, investigation or court case. The SDD file note, the score and the screening results are part of that record. Our record-keeping guide covers how to organise files so individual transactions can be reconstructed.

What SDD Mistakes Do UAE Inspectors Pick Up?

In our work preparing UAE firms for inspections and independent audits, the same SDD weaknesses come up repeatedly:

• Silent SDD. Staff apply lighter checks to familiar customers without any SDD category in the policy. This is non-compliance with Article 5, not proportionality.
• Labels without scores. The system shows “Low” but nobody can show how the rating was calculated.
• No review date. Low-risk files are never refreshed because the policy sets no interval.
• Screening skipped on low-risk files. This breaches the TFS condition in Article 5(3) directly.
• Deferred verification with no deadline. Files opened under Article 6(2) stay incomplete for months.
• No exit triggers. A customer’s activity grows tenfold and the rating never moves.

Each of these weakens a firm’s defence when its simplified due diligence files are sampled. Fines on legal persons convicted of money laundering range from AED 5 million to AED 100 million under Federal Decree-Law No. 10 of 2025, and supervisors also impose administrative penalties for control failures. Our guide to preparing for a UAE AML inspection shows how reviewers sample files.

Frequently Asked Questions

When can simplified due diligence be applied in the UAE?

Only when your documented risk assessment rates the customer as low risk, your approved policy allows SDD for that customer type, and there is no suspicion of money laundering, terrorist financing or proliferation financing. Article 5(3) of Cabinet Resolution No. 134 of 2025 also requires coordination with your Supervisory Authority.

Is simplified due diligence mandatory for low-risk customers?

No. Article 5(3) says firms may apply SDD, so it is a permission, not an obligation. MoET Circular No. 6 of 2025 does encourage DNFBPs to apply SDD to low-risk customers so resources go to higher-risk relationships. Applying standard CDD to a low-risk customer is not a breach.

Can DNFBPs in the UAE use simplified due diligence?

Yes. Article 5(3) covers financial institutions, DNFBPs and virtual asset service providers. MoET Circular No. 6 of 2025 tells real estate brokers and agents, precious metals and stones dealers, auditors, accountants and corporate service providers to apply SDD to customers identified as low risk.

Do you still screen low-risk customers for sanctions?

Yes. Article 5(3) requires SDD to keep Targeted Financial Sanctions instructions fully applied. Every customer, whatever the rating, must be screened against the UAE Local Terrorist List and the UN Consolidated List at onboarding and whenever the lists are updated.

What is the difference between SDD and EDD?

SDD reduces the depth and frequency of checks for low-risk customers, for example verifying identity after onboarding or refreshing data less often. EDD increases them for high-risk customers, for example collecting source of wealth, monitoring more closely and obtaining senior management approval. Both depend on the same documented risk assessment.

Can you verify a customer’s identity after onboarding in the UAE?

Yes, in low-risk cases under Article 6(2) of Cabinet Resolution No. 134 of 2025. Verification must be completed as soon as possible and the delay must be necessary to avoid disrupting normal business. You must also control the risk in the meantime, for example by capping transactions until verification is done.

How often should low-risk customer data be updated?

The law does not set a fixed interval. Article 5(3)(b) allows updates at longer intervals for low-risk customers, so the cycle is a policy decision. Set it in your approved AML policy, base it on your risk assessment and apply it consistently, alongside event-driven reviews when risk changes.

Related Reading

• Customer Due Diligence (CDD) in the UAE: The Complete Compliance Guide
• Enhanced Due Diligence (EDD) in UAE: Complete 2026 Guide
• AML Business Risk Assessment in the UAE: 2026 Guide
• Ongoing Monitoring in UAE AML Compliance: 2026 Guide
• Third-Party Reliance and Outsourced CDD in the UAE
• PEP Screening in the UAE: A 2026 AML Compliance Guide
• Targeted Financial Sanctions (TFS) in the UAE
• AML Self-Assessment Guide for DNFBPs in UAE

Simplified due diligence is one of the few parts of UAE AML law that saves time when it is done properly. The work is in proving low risk on paper before you relax anything. ADZ helps UAE firms write the risk methodology, set SDD categories in policy, configure screening and train staff through Compliance 360, which offers 32 specialised AML/CFT training courses. Contact ADZ for a free consultation and gap analysis.

Disclaimer: This article is for general information only and does not constitute legal advice. Requirements vary by supervisor and sector. Confirm your obligations with your Supervisory Authority or a qualified adviser before changing your due diligence procedures.

The post Simplified Due Diligence (SDD) in the UAE: 2026 Guide appeared first on ADZ | Corporate Consulting Services | UAE.

Last updated: 1 November 2026. Reviewed against the FATF statements of 30 October 2026, Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.

Quick Answer

The FATF grey list October 2026 update removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco. No country was added, so 18 jurisdictions remain under increased monitoring. Iran, the DPRK and Myanmar stay on the black list. UAE firms must reflect these changes in country risk ratings under Cabinet Resolution No. 134 of 2025.

Key Takeaways

• Four countries left the grey list. Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco completed their FATF action plans and are no longer under increased monitoring.
• No country was added. The FATF grey list October 2026 edition holds 18 jurisdictions, down from 22, including Kuwait, Iraq, Lebanon, Kenya, Vietnam and the Virgin Islands (UK).
• The black list is unchanged. The FATF repeats its call for countermeasures against the DPRK and Iran, and Myanmar stays on the call-for-action list.
• Vietnam is on a final warning. The FATF voiced significant concern at its pace and expects tangible improvements by February 2027.
• Delisting does not mean low risk. A country leaving the list is one input to your rating, not an instruction to downgrade every linked customer.
• Article 23 is the legal hook. Cabinet Resolution No. 134 of 2025 requires proportionate enhanced due diligence for business with high-risk countries and countries with AML/CFT/CPF deficiencies.
• Inspectors look for the paper trail. A dated change record showing when you updated the country list, who approved it and which customers you re-rated is the evidence that counts.

What Changed on the FATF Grey List October 2026?

The FATF published its updated lists from Paris on 30 October 2026. The headline is a net reduction of four. The FATF found that each delisted country met the commitments in its action plan, and each is now expected to keep its improvements going with its FATF-style regional body.

Which countries were removed?

For UAE firms, Monaco and Bulgaria matter most in private wealth, real estate and corporate structuring files. Côte d’Ivoire and the DRC show up more often in trade finance, gold and commodity flows, so dealers in precious metals and stones (DPMS) and trading companies should check their books first.

Which countries remain under increased monitoring?

Eighteen jurisdictions remain on the FATF grey list October 2026 version:

Five of the 18 sit in the Middle East and North Africa, and several are close UAE trading partners. Kuwait made its political commitment in February 2026 and the FATF says it has moved ahead of schedule on outreach to real estate agents and DPMS. Iraq and Bosnia and Herzegovina joined in June 2026. Bosnia and Herzegovina, Haiti, Iraq and Yemen chose not to report this cycle, so their June 2026 statements still apply.

What did the FATF say about Vietnam, Cameroon and Haiti?

The FATF expressed “significant concern” at Vietnam’s pace. All of Vietnam’s action plan deadlines expired in May 2025, and the FATF expects tangible improvements by February 2027 or it will consider next steps. Cameroon and Haiti have also run past every deadline. Treat these three as the jurisdictions most likely to see tougher FATF language next year, and rate them accordingly now.

What happened to the black list?

The call-for-action list did not change. The FATF reiterated its call for countermeasures against the Democratic People’s Republic of Korea and Iran, citing heightened proliferation financing risk, and Myanmar remains listed. For the DPRK, the FATF repeats three specific countermeasures: terminate correspondent relationships with DPRK banks, close any DPRK bank subsidiaries or branches, and limit business relationships and financial transactions with DPRK persons. Iran reported to the FATF in September 2026, and the FATF found only limited progress.

You can read both statements on the FATF increased monitoring page and the FATF call for action page.

Why Does the FATF Grey List Matter Under UAE Law?

The FATF lists have no direct legal force in the UAE. They matter because UAE law tells you to take country risk into account, and the FATF lists are the main public evidence of that risk.

Four provisions of Cabinet Resolution No. 134 of 2025, the executive regulations to Federal Decree-Law No. 10 of 2025, do the work.

Article 5: geography is a required risk factor

Article 5(1)(a) requires financial institutions, DNFBPs and virtual asset service providers to consider all relevant risk factors before setting their overall risk level. Country and geographic risk is named alongside customer, product, service, transaction and delivery channel risk. Article 5(1)(b) requires you to document how you assess these risks, keep the assessment up to date and provide it to the authorities on request. The FATF grey list October 2026 outcome is exactly the kind of change that should prompt an update.

Article 23: enhanced due diligence for high-risk countries

Article 23 sits in its own division, titled High-Risk Countries. It has two parts:

1. Firms must apply enhanced customer due diligence, proportionate to the level of risk, to business relationships and transactions with natural or legal persons from countries the National Committee identifies as high-risk, or from countries with deficiencies in their AML, CFT and proliferation financing systems.
2. Firms must apply countermeasures and any other measures the supervisory authority requires, whether on its own initiative or as determined by the National Committee.

Note the word “proportionate”. The law does not demand identical EDD for every country on the grey list. It asks you to match the depth of EDD to the risk, and to be able to explain the match. Our enhanced due diligence guide sets out the full EDD toolkit.

Article 20: reliance on third parties

Article 20(1) lets you rely on a third party for customer due diligence, but only after taking into account the countries identified by the National Committee as high-risk and countries with AML/CFT/CPF deficiencies. If your introducer, group entity or outsourced KYC provider sits in a grey-listed country, your reliance assessment needs a fresh look. The third-party reliance guide covers the conditions in detail.

Article 49(16): your supervisor will pass on National Committee decisions

Article 49(16) makes supervisory authorities responsible for making sure firms are notified of, and comply with, National Committee decisions on EDD measures, countermeasures and concerns about other countries’ AML/CFT/CPF systems. In practice, the CBUAE, the Ministry of Economy and Tourism, the DFSA, the FSRA, VARA and the other supervisors circulate updated lists after FATF plenaries. Your own supervisor’s list is the one you will be tested against.

Does Removal From the Grey List Mean Lower Risk?

No. Delisting tells you the FATF is satisfied that a country has fixed the strategic deficiencies in its action plan. It does not tell you anything about a specific customer, transaction or counterparty from that country.

The FATF says Bulgaria, Côte d’Ivoire, the DRC and Monaco should continue to work with their regional bodies to sustain their improvements. A country can come off the list and still carry high exposure to corruption, organised crime or sanctions evasion in your sector. Monaco, for example, is a wealth centre, and private banking and high-value real estate files linked to it will often stay high risk on product and customer factors alone.

What changes is one input. If your country risk model gave a jurisdiction extra points for FATF increased monitoring, remove those points, re-run the score, and record the result. If the overall rating falls, you may be able to step down from EDD to standard CDD for some customers, but only after a documented review of each affected relationship.

What the FATF itself says about EDD and de-risking

The FATF statement makes three points UAE firms should keep in mind:

• The FATF does not call for enhanced due diligence on grey-listed jurisdictions. That call is reserved for the black list.
• The FATF Standards do not envisage de-risking, or cutting off entire classes of customers. They call for a risk-based approach.
• Flows for humanitarian assistance, legitimate NPO activity and remittances should be neither disrupted nor discouraged, with reference to UN Security Council Resolution 2761 (2024).

Read that alongside Article 23. UAE law still requires proportionate EDD for countries with AML/CFT/CPF deficiencies. A grey-listed country is strong evidence of deficiencies, so most UAE firms apply EDD triggers to it. The FATF’s point is that the EDD must be risk-based, not a blanket refusal.

How Should UAE Firms Rate Country Risk After the FATF Grey List October 2026 Update?

A defensible country risk rating combines several public sources and scores them the same way every time. The FATF lists are the anchor, not the whole model. The UAE National Risk Assessment adds the local view of which foreign threats matter most to the UAE.

A simple country risk scoring model

Set your bands in the methodology, for example 0 to 2 low, 3 to 5 medium, 6 and above high. The numbers matter less than consistency. An inspector will pick two countries and ask you to show how each reached its rating.

A worked example: Monaco before and after

Take a UAE real estate brokerage with a buyer resident in Monaco. Before 30 October 2026, Monaco carried 3 points for increased monitoring plus 2 points for secrecy indicators, a total of 5 and a medium-high band. After delisting, the FATF points fall away and the country score drops to 2.

The customer is not automatically low risk. A cash-rich buyer purchasing a high-value villa through a company still scores high on customer and product factors. The brokerage records the country change, re-runs the customer score, and keeps EDD if the combined score still demands it. It also notes in the file why the decision was taken.

Kuwait and Iraq: grey-listed neighbours

Kuwait and Iraq are both grey-listed and both have heavy trade, remittance and family links with the UAE. A blanket EDD rule for every Kuwaiti national would be disproportionate and would go against the FATF’s warning on de-risking. A better approach applies EDD triggers to higher-risk relationships, such as complex corporate structures, cash-intensive businesses, PEPs and cross-border transfers above your internal threshold, while standard CDD covers ordinary salaried residents.

What Should You Update This Month?

Work through these steps in order. Most firms can complete them within two to three weeks of a plenary, and inspectors increasingly ask how quickly the update happened.

1. Update the country list. Remove Bulgaria, Côte d’Ivoire, the DRC and Monaco from the grey list column. Keep the 18 remaining jurisdictions and the three call-for-action countries. Record the source and the date of change.
2. Check your supervisor’s list. Compare your list against the latest circular from the CBUAE, the Ministry of Economy and Tourism, the DFSA, the FSRA or VARA. Where the supervisor’s list is stricter, it wins.
3. Re-score affected countries. Run each changed jurisdiction through your scoring model and record the old and new ratings.
4. Pull the exposure report. List every customer, beneficial owner, counterparty and transaction route linked to a changed country. Include nationality, residence, place of incorporation and payment corridor.
5. Re-rate the affected customers. Review each one. Downgrade only where the combined score supports it, and keep EDD where customer or product risk still calls for it.
6. Recalibrate screening and monitoring. Update the jurisdiction tables in your screening and transaction monitoring rules so alerts follow the new list.
7. Review third-party reliance. Re-check any introducer, group entity or KYC provider in a listed country under Article 20.
8. Update the EWRA and policy. Note the change in the enterprise-wide risk assessment and, where needed, in the AML policy annex that lists high-risk countries.
9. Brief senior management. Record the update, the exposure numbers and any decisions in the compliance officer’s periodic report under Article 22(3).

Our AML business risk assessment guide shows how to fold country changes into the EWRA, and the AML compliance report guide covers the senior management record.

How Do the Grey List and Black List Affect goAML Reporting?

A country listing is not, by itself, a reason to file a suspicious transaction report. Suspicion must come from the facts of the case. Two reporting points still follow from the lists.

• High Risk Country reports. Where your supervisor directs it, transactions and activity linked to jurisdictions the UAE treats as high risk are reported through goAML as HRC (transaction) or HRCA (activity) reports. The FATF call-for-action list is the usual starting point. Our goAML report types guide explains when each applies.
• Suspicion still drives STRs. If a transaction linked to any country is suspicious, file an STR. Failing to report a suspicious transaction can lead to a fine of up to AED 5,000,000 under Federal Decree-Law No. 10 of 2025.

Proliferation financing deserves extra attention for DPRK and Iran exposure. Front companies, shell companies and complex ownership structures are the FATF’s named methods for DPRK sanctions evasion. Check these against your targeted financial sanctions controls as well as your country list.

What Do UAE Inspectors Expect to See?

Supervisors test country risk in three ways. They check that your list is current, that it matches the supervisor’s own list, and that the change actually reached the customer file.

In June 2026 the CBUAE fined a foreign bank branch AED 20 million for AML and sanctions failures, and fined its head of compliance AED 300,000 personally.

Fines on legal persons convicted of money laundering range from AED 5 million to AED 100 million under Federal Decree-Law No. 10 of 2025. An examiner who finds a country list two plenaries out of date will usually write it up as a finding.

The UAE’s own FATF mutual evaluation is under way in 2026 under the fifth-round methodology, which weighs effectiveness and real outcomes. Assessors look at whether the private sector applies country risk in practice, so a clean, dated country risk process helps the national result as well as your own file. The FATF mutual evaluation guide covers what assessors test.

Which UAE Sectors Feel the October 2026 Changes Most?

Every regulated firm needs to update its list, but exposure differs by sector.

• Exchange houses and payment service providers. Remittance corridors to Kenya, Nepal, Vietnam, Lebanon and Iraq remain grey-listed. Keep EDD triggers on high-value and unusual transfers, and avoid blanket corridor closures that cut off legitimate remittances.
• DPMS and gold traders. The removal of the DRC and Côte d’Ivoire touches gold and commodity supply chains, but responsible sourcing and supply chain due diligence obligations still apply in full.
• Real estate brokers and developers. Buyers from Monaco and Bulgaria may move to a lower country score, while buyers from Lebanon, Kuwait and Iraq stay under increased monitoring.
• Corporate service providers and family offices. Check structures that use Virgin Islands (UK) entities, which remain grey-listed. The FATF’s open action items there include supervision of trust and company service providers and sanctions for beneficial ownership breaches.
• VASPs. The FATF lists regulation of virtual assets and VASPs as an open item for Vietnam. Treat wallet and exchange flows linked to that jurisdiction with care.

Frequently Asked Questions

Which countries were removed in the FATF grey list October 2026 update?

Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco were removed on 30 October 2026 after completing their FATF action plans. No jurisdiction was added, so the grey list fell from 22 to 18 countries.

Is the UAE on the FATF grey list in 2026?

No. The UAE left the grey list in February 2024 and does not appear on the October 2026 list. Its fifth-round FATF mutual evaluation is under way in 2026, and the UAE holds the MENAFATF presidency this year.

Do UAE firms have to apply EDD to grey-listed countries?

Article 23 of Cabinet Resolution No. 134 of 2025 requires enhanced due diligence, proportionate to risk, for business with countries identified by the National Committee as high-risk or with AML/CFT/CPF deficiencies. Grey-listed countries usually meet that test, but EDD must be risk-based rather than blanket.

Can we downgrade customers from Monaco or Bulgaria now?

Only after a documented review. Delisting removes one country risk factor. Re-run the customer’s full risk score, including customer, product and channel factors, and record the reason for any change in the file before stepping down from EDD.

Which countries are on the FATF black list in October 2026?

The DPRK, Iran and Myanmar remain high-risk jurisdictions subject to a call for action. The FATF calls for countermeasures against the DPRK and Iran because of heightened proliferation financing risk.

How quickly should a UAE firm update its country list after a FATF plenary?

No fixed deadline appears in the regulations, but Article 5 requires risk assessments to be kept up to date. Most supervisors expect the change within weeks, documented with a date, an approver and a record of affected customers.

When is the next FATF plenary?

The next plenary is due in February 2027. The FATF has said it expects tangible improvements from Vietnam by then, so watch that statement and update your list again once it is published.

Related Reading

• Enhanced Due Diligence (EDD) in UAE: Complete 2026 Guide
• AML Business Risk Assessment in the UAE: 2026 Guide
• UAE National Risk Assessment: AML/CFT Guide
• FATF Mutual Evaluation 2026: UAE Guide
• Third-Party Reliance and Outsourced CDD in the UAE
• goAML Report Types in the UAE: STR, SAR and More (2026)
• Proliferation Financing UAE Compliance: 2026 Guide
• Ongoing Monitoring in UAE AML Compliance: 2026 Guide

The FATF grey list October 2026 update is small on paper, but it shows quickly whether a firm’s country risk process works in practice. The list should change, the scores should be re-run, affected customers should be reviewed and management should be told, with a date on each step. ADZ runs that cycle for financial institutions, DNFBPs and VASPs across the UAE. Contact ADZ for a free consultation and gap analysis of your country risk methodology.

This article is for general information and does not constitute legal advice. UAE AML/CFT laws, supervisory lists and enforcement practice change, and businesses should seek independent legal counsel for advice specific to their circumstances.

The post FATF Grey List October 2026: Country Risk Steps for UAE appeared first on ADZ | Corporate Consulting Services | UAE.

Last updated: 29 October 2026. Reviewed against Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.

Quick Answer

An AML compliance report in the UAE is the compliance officer’s periodic written assessment of the firm’s anti-money laundering, counter-terrorist financing and proliferation financing controls. Article 22(3) of Cabinet Resolution No. 134 of 2025 requires it to go directly to senior management, record their observations and decisions, and be sent to the supervisory authority on request.

Key Takeaways

• It is a legal duty, not good practice. Article 22(3) of Cabinet Resolution No. 134 of 2025 makes periodic reporting to senior management one of only five listed duties of the compliance officer.
• It applies across sectors. Licensed financial institutions, DNFBPs and virtual asset service providers all fall under the same article, whether supervised by the CBUAE, the Ministry of Economy, the DFSA, the FSRA or VARA.
• Management’s response is part of the report. The text requires the report to include senior management’s observations and decisions, so a report nobody answered is an incomplete report.
• The supervisor can ask for it at any time. A copy goes to the supervisory authority on request, which in practice means during an inspection, a thematic review or after a finding.
• Exchange houses have an extra layer. CBUAE-licensed exchange houses also prepare a bi-annual compliance report under section 16.30 of the CBUAE exchange business standards.
• The report is evidence of the MLRO’s own diligence. After the CBUAE fined a Head of Compliance AED 300,000 personally in June 2026, a dated paper trail of what was reported and when is the compliance officer’s best protection.

What Does UAE Law Require the Compliance Officer to Report?

The reporting duty sits in the Executive Regulations of the AML law. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its Executive Regulations, Cabinet Resolution No. 134 of 2025, took effect on 14 December 2025 and replaced Cabinet Decision No. 10 of 2019. For a full walk through the parent law, see our Federal Decree-Law No. 10 of 2025 guide.

The text of Article 22(3)

Article 22 requires every financial institution, DNFBP and VASP to appoint a compliance officer at management level, with independence in decision-making and the right competence and experience. It then lists five duties. The third duty is the one that creates the report. The compliance officer must:

• review the firm’s AML, CFT and proliferation financing internal systems and procedures;
• assess whether they are consistent with the Decree-Law and the Resolution;
• evaluate the firm’s level of compliance with them in practice;
• propose what is needed to update and develop them; and
• prepare periodic reports on all of this, submitted directly to senior management, with a copy sent to the supervisory authority on request, including senior management’s observations and decisions.

Read closely, that sentence answers most of the questions compliance officers ask us. The report goes “directly” to senior management, so it cannot be filtered through a business line head first. It is “periodic,” so a one-off memo after an inspection does not satisfy it. And it must carry management’s response, which means the loop has to close before the report is complete.

Who counts as senior management?

Cabinet Resolution No. 134 of 2025 defines senior management as the persons with authority to take strategic and executive decisions that materially affect risk management, compliance policies and operational governance. The definition names chief executive officers, general managers and members of the board of directors, plus anyone who can directly influence how the business is run. For a company with a board, the board is in scope. For an owner-managed DNFBP, such as a two-partner real estate brokerage or a family-run gold trading business, the owners are the senior management.

How Article 22 links to Article 21

Article 21 requires internal policies, controls and procedures that are approved by senior management, proportionate to the firm’s risks, and reviewed on an ongoing basis. It also requires an independent audit function to test them. The compliance report is how senior management keeps that approval meaningful. Without a periodic report, the board approved a policy once and has no basis for saying it still works.

Who Has to Produce an AML Compliance Report in the UAE?

Article 22 does not distinguish between sectors. If your firm must appoint a compliance officer, it must also produce the periodic report. What changes from sector to sector is the supervisor who may ask for the copy and any extra format the supervisor layers on top.

Exchange houses deserve a specific note. They already run a CBUAE-mandated bi-annual report under the exchange business standards, and the safest approach is to build one document that meets both the standard and Article 22(3). Our exchange house AML compliance guide covers the wider supervisory regime for that sector.

How Often Should the Report Be Produced?

The Resolution says “periodic” and does not set a fixed interval for every sector. That leaves the firm to set a frequency that matches its risk, and to defend that choice to its supervisor.

A risk-based reporting calendar

In our work with UAE firms, a risk-based approach to frequency usually lands in one of three places:

• Quarterly: banks, exchange houses, payment service providers, VASPs and any firm with high transaction volumes or a large high-risk customer book.
• Semi-annual: mid-sized DNFBPs, such as active real estate brokerages, gold and jewellery traders and corporate service providers.
• Annual, with exception reports: small, low-volume DNFBPs, provided the policy requires an immediate ad hoc report whenever a material event occurs.

Whatever you choose, write it into the AML policy and get senior management to approve it. An examiner will accept a reasoned annual cycle for a three-person accounting practice. They will not accept a policy that says “periodic” and a file that holds one report from 2024.

When an ad hoc report is needed

Some events should go to senior management straight away rather than waiting for the next cycle:

• a confirmed match against the UAE Local Terrorist List or the UN Consolidated List;
• a supervisory inspection notice, information request or finding;
• a significant system failure, such as a screening tool that stopped updating its lists;
• a pattern of suspicious activity across several customers that changes the firm’s risk profile; and
• a change to the law, such as a new Cabinet Resolution or supervisor circular, that requires a policy change.

Keep the content of any report that touches a filed STR inside the circle that needs to know. Article 19 of the Resolution prohibits disclosing that a report has been or will be filed, and our tipping off guide explains how to brief management without breaching it.

What Should an AML Compliance Report Contain?

The Resolution sets the purpose of the report rather than a template. A useful structure follows the order of Article 22(3) itself: what the systems are, whether they meet the law, how well they work, what should change, and what management decided. The table below is the section list we use as a starting point with clients, mapped to the legal requirement each section evidences.

Risk assessment and customer risk

Start with what changed in the risk picture since the last report. Did the firm enter a new product line, a new geography or a new delivery channel?

Article 24 requires new products and technologies to be risk-assessed before launch, so any launch in the period should appear here with its assessment date. Add the shape of the customer book: how many customers sit in each risk rating, how many are PEPs, and how many have connections to countries the National Committee lists as high risk. Our business risk assessment guide explains how to build the underlying model.

Monitoring, screening and suspicious activity reporting

This is the section examiners read hardest. Give numbers, not adjectives: alerts generated, alerts closed, average days to close, and the backlog at period end.

For sanctions screening, show the number of potential matches, how many were false positives, and whether any confirmed or partial name match led to a freeze and a CNMR or PNMR on goAML. For suspicious activity, show how many internal referrals the compliance officer received, how many became STRs or SARs, and how many were closed with documented reasons.

Article 22(2) expressly allows the compliance officer to retain a matter “stating the reasons,” so a referral closed without a written rationale is a finding waiting to happen. For filing steps, see how to file an STR on goAML.

Training, audit findings and resourcing

List training completion by role, not just a firm-wide percentage. Senior management, front-line staff and the compliance team need different content, and a 95 percent overall figure can hide a sales team that never finished the course.

Then list every open audit or inspection finding with an owner, a due date and its status. Close with resourcing. If the compliance team is short of people or the screening system needs an upgrade, this is where the compliance officer puts the request in writing.

How Does the Report Protect the MLRO Personally?

The report is more than a governance document. It is the compliance officer’s record of what they told the people who run the business, and when.

The June 2026 CBUAE case

On 24 June 2026, the CBUAE imposed a financial penalty of AED 20,000,000 on a branch of a foreign bank for significant, repeated failures in its AML, CFT and sanctions framework. In the same action it imposed an individual penalty of AED 300,000 on the branch’s Head of Compliance and Money Laundering Reporting Officer for failing to fulfil the responsibilities of the role.

The word “repeated” matters. Repeated failures suggest problems that were known and not fixed. If a compliance officer reported a gap, proposed a fix and asked for resources, the report shows it. If they never put it in writing, nothing does.

The CBUAE enforcement policy explains how it applies administrative and financial sanctions under the Central Bank Law and the AML law, and our MLRO personal liability guide covers this case in depth.

Escalation that leaves a trail

Three habits make the report work as protection:

1. Date and version every report. Keep the final version and the evidence of when it went to senior management, such as the board pack or the email.
2. Record the decision, not just the discussion. Minutes that say “the board noted the report” are weak. Minutes that say “the board approved two additional analysts by 31 January” are strong.
3. Carry open items forward. Every unresolved item from the last report appears again until it is closed, with the number of periods it has been open.

Retain the reports and minutes for at least five years. Article 25 sets a five-year minimum for AML records, and our record-keeping guide explains how the retention clock runs.

What Do UAE Supervisors Check When They Ask for the Report?

Because a copy goes to the supervisor on request, the report usually surfaces during an inspection. Supervisors are reading for evidence that the AML programme is effective, not just documented. That focus matches the FATF mutual evaluation methodology, which weighs effectiveness heavily, and the FATF on-site visit for the UAE’s current mutual evaluation was scheduled for June 2026.

Common gaps we see in inspections

• Reports with no management response. The single most common gap, and a direct breach of the “observations and decisions” wording.
• Copy-and-paste reports. The same text period after period, with only the date changed.
• Numbers that do not reconcile. STR counts in the report that differ from the goAML submission history.
• Findings with no owner. Open audit points listed without a named person or a due date.
• Reports routed through the business. A report that a commercial head edited before senior management saw it is not a report submitted “directly.”

If you have received an inspection notice, our AML inspection preparation guide and our guide on responding to an AML regulatory notice cover the steps around producing documents.

Penalties when the reporting framework fails

Weak reporting rarely gets fined on its own. It shows up as evidence in a wider finding about governance and oversight.

Under the 2025 regime, legal persons face fines from AED 5 million up to AED 100 million for the most serious breaches, alongside licence suspension and withdrawal powers. The June 2026 case shows supervisors will also add a personal penalty for the compliance officer. A weak AML compliance report will not cause that outcome by itself, but it removes the best evidence the firm has against it.

How Do You Build the Report Step by Step?

A reliable AML compliance report comes from a process that runs all period, not a scramble in the last week. This is the sequence we recommend.

1. Fix the period and the deadline. Set the reporting cycle in the AML policy and put the senior management meeting date in the calendar a year ahead.
2. Collect data monthly. Pull screening, monitoring, CDD and training figures every month, so the report summarises numbers you already trust.
3. Reconcile against source systems. Check STR and SAR counts against goAML, screening counts against the screening tool, and training against the learning records.
4. Write the assessment, not just the data. For each section, say whether controls are effective, partly effective or ineffective, and why.
5. Propose specific changes. Each weakness needs a proposed fix, an owner, a cost where relevant and a date.
6. Submit directly. Send the report to senior management or the board without edits from the business lines.
7. Minute the response. Record observations and decisions in the meeting minutes and attach them to the final report.
8. Track and carry forward. Feed every decision into the remediation tracker and report on it next period.

Software helps with steps two and three. When screening results, CDD reviews and goAML reporting sit in one system, the compliance officer spends the reporting week on judgement rather than spreadsheets.

How Is a Compliance Report Different From an Independent Audit?

Both appear in Article 21 and Article 22, and firms sometimes treat one as a substitute for the other. They are separate controls with separate authors.

The two feed each other. Audit findings go into the compliance report’s findings section, and the audit tests whether the compliance officer’s reporting actually reached senior management. Our independent AML audit guide explains the audit side in detail.

Frequently Asked Questions

Is an AML compliance report mandatory in the UAE?

Yes. Article 22(3) of Cabinet Resolution No. 134 of 2025 requires the compliance officer of every financial institution, DNFBP and VASP to prepare periodic reports on the firm’s AML/CFT/CPF systems and compliance. Each AML compliance report goes directly to senior management, and a copy goes to the supervisory authority on request.

How often should a UAE compliance officer report to senior management?

The Resolution says “periodic” without fixing one interval for all sectors. Most banks, exchange houses and VASPs report quarterly, mid-sized DNFBPs semi-annually, and small DNFBPs annually with ad hoc reports for material events. The chosen frequency should be written into the AML policy and approved by senior management.

Do I have to send the compliance report to the Ministry of Economy?

Not automatically. Article 22(3) requires a copy to go to the supervisory authority upon its request, which for most DNFBPs is the Ministry of Economy. In practice the request usually comes during an inspection or information request, so the report must be ready to produce at short notice.

Who signs off the AML compliance report?

The compliance officer prepares and signs the report. Senior management receives it and records its observations and decisions, usually in board or management committee minutes attached to the final report. Cabinet Resolution No. 134 of 2025 defines senior management to include CEOs, general managers and board members.

What happens if senior management ignores the report?

The report must include senior management’s observations and decisions, so a report with no response is incomplete. The compliance officer should escalate in writing, carry the open items into the next report, and keep the evidence. Supervisors treat unanswered reports as a governance failure.

Is the exchange house bi-annual compliance report the same thing?

It overlaps but adds to it. CBUAE-licensed exchange houses prepare a bi-annual compliance report under section 16.30 of the exchange business standards, in addition to the Article 22(3) duty. Most exchange houses build one document that meets both.

How long must AML compliance reports be kept?

At least five years. Article 25 of Cabinet Resolution No. 134 of 2025 sets a five-year minimum retention period for AML records, and the reports, minutes and supporting data should be retrievable promptly when a supervisor asks.

Related Reading

• MLRO Responsibilities in the UAE: 2026 Guide
• MLRO Personal Liability in the UAE: 2026 CBUAE Fines
• Independent AML Audit in the UAE: The 2026 Guide
• AML Business Risk Assessment in the UAE: 2026 Guide
• AML Inspection Preparation in the UAE
• AML Record-Keeping Requirements in the UAE
• AML Training Requirements in the UAE

A good AML compliance report tells senior management the truth about the firm’s controls and asks them for decisions. Months later, it is the proof that the compliance officer did both. For the compliance officer, that record is both a legal duty under Article 22(3) and the best evidence of their own diligence when an examiner arrives. Contact ADZ for a free consultation and gap analysis of your current reporting cycle, or ask about Compliance 360’s 32 KHDA-approved AML/CFT courses for your board and compliance team.

This article is for general information and does not constitute legal advice. UAE AML/CFT laws, Central Bank regulations and enforcement practice change, and businesses should seek independent legal counsel for advice specific to their circumstances.

The post AML Compliance Report UAE: 2026 MLRO Reporting Guide appeared first on ADZ | Corporate Consulting Services | UAE.

Last updated: 25 October 2026. Written by the ADZ compliance advisory team for MLROs, compliance officers and product owners at UAE financial institutions, DNFBPs and VASPs.

Quick Answer

eKYC in the UAE is legal and supervised. CBUAE guidance lets licensed financial institutions verify customers remotely through UAE PASS, the ICP validation gateway for Emirates ID, or Emirates Facial Recognition. Before relying on a digital ID system, the institution must document an assurance level assessment and an appropriateness assessment, keep the verification record, and keep monitoring the customer.

Key Takeaways

• Remote onboarding is permitted. UAE identification rules are technology neutral, so digital evidence can meet the same “reliable and independent source” test as a paper document.
• Three national routes are named. The CBUAE points institutions to UAE PASS, the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) online validation gateway, and Emirates Facial Recognition.
• Two assessments come first. An assurance level assessment, then an appropriateness assessment, both documented and refreshed on a periodic and event-driven basis.
• Keep the digital proof. When you verify an Emirates ID, you keep a copy of the card and its digital verification record, for at least five years after the relationship ends.
• Reliance does not move liability. If you rely on another regulated entity’s identification, ultimate responsibility for CDD stays with you.
• The legal basis has moved. The guidance was written under Federal Decree-Law No. 20 of 2018, which Federal Decree-Law No. 10 of 2025 has replaced, so read its article references against the new law.
• Weak eKYC is expensive. Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 set administrative fines of AED 5 million to AED 100 million for legal entities in breach.

What Is eKYC in the UAE?

eKYC is not a separate legal regime. It is a way of meeting the identification and verification step of customer due diligence in the UAE, which also covers beneficial ownership, the purpose of the relationship and ongoing monitoring. A clean selfie match does not finish your CDD. It finishes one part of it.

Identity proofing vs authentication: what is the difference?

The CBUAE guidance splits any digital ID system into two working parts, plus one optional part:

• Identity proofing and enrolment answers “Who are you?” It covers collecting identity evidence, validating that the evidence is genuine, and verifying that it belongs to the person in front of the camera.
• Authentication and identity lifecycle management answers “Are you the same person we identified?” It covers logins, step-up checks and what happens when a device or credential is lost.
• Portability and interoperability lets a verified identity be reused at another institution. It is optional, and the guidance does not focus on it.

For onboarding, proofing is the step your inspector tests first. Authentication matters later, because it links the person who opened the account to the person now moving money through it.

Which customer details must eKYC capture?

For a natural person, the CBUAE lists the same attributes whether you collect them on paper or on a phone:

• Full name as shown on the passport or identity card
• ID number, country of issue, issue date and expiry date
• Nationality
• Permanent residential address
• Date and place of birth
• Employer name and address, where applicable

A digital journey that skips any of these fields has a CDD gap, however good its biometric engine is.

Which Rules Govern eKYC in the UAE?

The CBUAE Digital Identification guidance

The core document is the CBUAE’s Guidance for Licensed Financial Institutions on Digital Identification for Customer Due Diligence. It took effect on 31 October 2022, and institutions were expected to show compliance within one month. The CBUAE Rulebook still lists it as in force.

The guidance draws on the FATF Guidance on Digital Identity (March 2020), the Wolfsberg Group and the US NIST digital identity standards. It sits alongside the CBUAE’s Guidelines for Financial Institutions adopting Enabling Technologies, which set expectations on biometrics and multifactor authentication.

What changed with Federal Decree-Law No. 10 of 2025?

The guidance cites Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. Both have been replaced. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, and its implementing regulation, Cabinet Decision No. 134 of 2025, took effect on 14 December 2025.

In practice, the duties behind the guidance carry forward: identify and verify each customer from a reliable and independent source, monitor the relationship, and keep the records. What changes is the citation.

Your eKYC policy should quote the 2025 law and Cabinet Decision No. 134 of 2025, not the repealed articles the 2022 guidance mentions. Inspectors notice a policy that still cites a law that no longer exists.

Who does the guidance apply to?

It applies to every person licensed or supervised by the CBUAE, including:

• National banks and branches of foreign banks
• Exchange houses and finance companies
• Stored value facility issuers, retail payment service providers and card schemes
• Registered hawala providers
• Insurance companies, agencies and brokers

DNFBPs supervised by the Ministry of Economy and Tourism, and firms in the DIFC, ADGM or under VARA, answer to their own supervisors. The CBUAE document does not bind them directly. It is still the most detailed written statement of what a UAE regulator expects from a digital ID system. We see DNFBP compliance teams use it as their eKYC benchmark when a supervisor asks how a remote check was validated.

Which Digital ID Routes Does the CBUAE Recognise?

The guidance asks institutions to understand and use the national identification systems already running in the UAE. It names three, and it sets a separate rule for passports.

Is UAE PASS enough on its own for KYC?

UAE PASS gives you a strong identity proofing result for a UAE resident. It does not give you the customer’s source of funds, the purpose of the relationship, PEP status or beneficial owners. Treat it as the identity layer of your CDD, then run screening and risk scoring on top. For higher-risk customers, the enhanced due diligence steps still apply in full.

What about customers who are not UAE residents?

Non-residents have no Emirates ID and usually no UAE PASS, which removes the government validation route. The guidance sets a physical certification rule for passports used in place of an Emirates ID. If your model onboards non-residents fully remotely through a private identity vendor, document why that vendor meets the reliability and independence test, and expect the inspector to read that assessment closely.

How Do You Run the eKYC Assurance and Appropriateness Assessments?

This is where most eKYC files fail. The CBUAE expects two documented assessments, run in sequence, before a digital ID system is used for CDD.

Step 1: the assurance level assessment

This assessment asks how much confidence the system’s technology, architecture and governance give you that it produces accurate results and resists manipulation. You can run it yourself, with due diligence on the provider and its governance, or rely on audit or certification evidence from an expert body. You may use an expert body’s work only if you have good reason to believe it applies a recognised, publicly disclosed assurance framework.

The guidance encourages you to assess each component separately. Proofing, authentication and any federation layer may need different levels of reliability. If you cannot establish the assurance level, or the system is not reliable enough, you stop. You do not move on to step 2 until the gap is closed.

Step 2: the appropriateness assessment

With the assurance level known, you decide, on a risk-based approach, whether that level is appropriate for your customers, products and channels given money laundering, terrorist financing and fraud risk. A system that suits a low-limit prepaid wallet may not suit a private banking relationship or a high-value remittance corridor.

How should the assessments be documented?

Both assessments must be written down, either inside your enterprise-wide risk assessment or as a separate document, and updated periodically and whenever something changes. Any team can own them; the guidance does not require internal audit to do the work. A short evidence pack usually holds:

Is Non-Face-to-Face Onboarding Higher Risk in the UAE?

Not automatically. Under the FATF Interpretive Note to Recommendation 10, non-face-to-face relationships are an example of potentially higher risk.

The CBUAE guidance qualifies this. A remote check through a reliable, independent digital ID system with proper controls may present a standard level of risk, or even a lower one where higher assurance levels apply. Your eKYC risk rating should reflect the strength of the route used, not just the fact that the customer was remote.

What are the main eKYC fraud risks?

The guidance separates risks at enrolment from risks at login. Both feed your transaction monitoring and suspicious activity reporting.

How do deepfakes change eKYC controls?

The 2022 guidance predates the current wave of AI-generated faces and injected video streams, but its logic covers them. An eKYC system that cannot detect a fake is not reliable, so it fails the assurance test.

In our audit work, we now put three questions to every eKYC vendor:

• Does the liveness check catch a replayed or injected video feed, as well as a printed photo held up to the camera?
• Is the face matched against a government source, or only against the uploaded ID image?
• How often is the detection model retested against new attack types?

Record the answers in your assurance assessment. For a wider view of AI in controls, see our AI in AML compliance guide.

Why are money mules an eKYC problem?

The FATF has observed that the overwhelming majority of digital IDs misused by criminal groups were issued on the basis of legitimate identity evidence. In the straw-man pattern the CBUAE guidance describes, real people open accounts, then sell their credentials to a criminal group that runs many accounts from one phone or tablet.

A perfect eKYC proofing result does not stop this. Authentication data does. The CBUAE expects institutions to use geolocation, IP and device data from logins in their ongoing monitoring, including to spot activity from sanctioned or high-risk jurisdictions.

Can You Rely on a Third Party or Vendor for eKYC?

Yes, in two different ways, and confusing them is a common inspection finding.

Our guide to third-party reliance and outsourced CDD sets out the contract clauses and testing that make either model defensible.

What Records Must an eKYC File Hold?

UAE record-keeping rules are technology neutral. A digital record is as acceptable as a paper one, provided it is complete and can be produced quickly. Retain CDD records for at least five years after the business relationship ends, in line with our AML record-keeping guide. For each eKYC onboarding, the file should hold:

• The identity attributes captured, mapped to the CBUAE field list
• A copy of the Emirates ID and its digital verification record from the ICP gateway or UAE PASS
• The biometric match and liveness result, with timestamp and system version
• Device, IP and geolocation data captured at onboarding
• Screening results for sanctions, PEPs and adverse media, including clean results
• The customer risk rating and the reason for it
• Any manual review notes and the name of the reviewer

eKYC Implementation Checklist for UAE Compliance Teams

Use this sequence when you launch or review a digital onboarding journey:

1. Map the journey. List every channel, customer type and identity route, including the fallback when a digital check fails.
2. Update the legal references. Cite Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 in your eKYC policy.
3. Run and file the assurance level assessment. Rate each component and keep the vendor evidence.
4. Run and file the appropriateness assessment. Decide which segments may onboard remotely and which need a branch or video check.
5. Set the controls. Government-source validation, liveness detection, biometric step-up for high-risk actions, device monitoring.
6. Connect eKYC to screening and risk scoring. Identity proof alone is not CDD.
7. Feed login data into monitoring. Device sharing, impossible travel and high-risk locations become alerts.
8. Train the people who review exceptions. Manual overrides are where fake identities slip through.
9. Test it independently. Include eKYC in your next independent AML/CFT audit and record the findings.

Frequently Asked Questions

Is eKYC legal in the UAE?

Yes. UAE customer identification rules are technology neutral. The CBUAE’s Digital Identification guidance, in force since 31 October 2022, expressly permits licensed financial institutions to verify customers through reliable and independent digital ID systems such as UAE PASS and the ICP validation gateway.

Can I use UAE PASS for customer due diligence?

Yes, for identification and verification of UAE residents. The CBUAE names UAE PASS as a national digital identity system institutions should understand and use. It does not replace the rest of CDD, so you still need beneficial ownership, purpose of the relationship, screening and a risk rating.

Do I need to keep a copy of the Emirates ID if I verify it digitally?

Yes. When an institution verifies an Emirates ID, physically or through eKYC, the CBUAE expects it to use the ICP online validation gateway, UAE PASS or another government-supported solution. It must then keep a copy of the Emirates ID and its digital verification record.

Is non-face-to-face onboarding automatically high risk in the UAE?

No. FATF treats non-face-to-face relationships as potentially higher risk. The CBUAE guidance adds that eKYC through a reliable, independent digital ID system with proper controls may be standard risk, or even lower risk where higher assurance levels apply.

What is an assurance level assessment for eKYC?

It is a documented review of how reliable and independent a digital ID system is, based on its technology, architecture and governance. It comes before the appropriateness assessment, and if the system’s assurance cannot be established, the institution should not use it for CDD until the gap is fixed.

Does the CBUAE digital ID guidance apply to DNFBPs?

Not directly. It applies to CBUAE-licensed institutions such as banks, exchange houses, finance companies, payment providers and insurers. DNFBPs answer to the Ministry of Economy and Tourism or their own supervisor, though many use the CBUAE guidance as a practical benchmark for remote identity checks.

Related Reading

• Customer Due Diligence (CDD) in the UAE: The Complete Compliance Guide
• Enhanced Due Diligence (EDD) in UAE: Complete 2026 Guide
• Third-Party Reliance and Outsourced CDD in the UAE
• Ongoing Monitoring in UAE AML Compliance: 2026 Guide
• AML Record-Keeping Requirements in the UAE
• PEP Screening in the UAE: A 2026 AML Compliance Guide
• Payment Service Provider AML Compliance UAE: 2026 Guide

eKYC in the UAE works when the paperwork behind it is as strong as the app in front of it. That means a documented assurance assessment, a clear appropriateness decision, and a verification record you can produce on request. With the UAE’s next FATF mutual evaluation work in view, supervisors are testing exactly that.

Current CBUAE requirements sit on the CBUAE Rulebook, and DNFBP guidance sits with the Ministry of Economy and Tourism. ADZ is ISO 27001 and ISO 9001:2015 certified and runs four types of independent AML audit: Federal, DFSA, VARA and Supply Chain. If you want your digital onboarding tested before an inspector tests it, ask about our independent AML/CFT audits or contact ADZ for a free consultation and gap analysis.

Disclaimer: This article is general guidance on UAE AML/CFT and digital identification requirements as of October 2026 and is not legal advice. Supervisory guidance, approved identity systems and legal references change. Confirm your specific obligations with ADZ, your supervisor or legal counsel before relying on any point in this article.

The post eKYC in the UAE: 2026 Digital ID Rules for AML Compliance appeared first on ADZ | Corporate Consulting Services | UAE.

Last updated: 21 October 2026. Written by the ADZ compliance advisory team for MLROs and compliance officers at UAE financial institutions, DNFBPs and VASPs.

Quick Answer

goAML report types fall into three groups. Suspicion reports (STR and SAR) are filed without delay when you suspect money laundering or terrorist financing. Threshold reports (DPMSR and REAR) are filed when a defined payment occurs, suspicion or not. Sanctions reports (CNMR and PNMR) follow a name match, and AIF, AIFT, HRC and HRCA cover follow-ups and high-risk countries.

Key Takeaways

• Each report has its own trigger. goAML treats an STR, a SAR, a DPMSR and a CNMR as separate report types, and inspectors test whether you chose the right one.
• Transaction or no transaction decides STR vs SAR. An STR records a suspicious transaction, including an attempted one. A SAR records suspicious activity where no transaction took place.
• Threshold reports ignore suspicion. Dealers in precious metals and stones file a DPMSR, and real estate brokers file a REAR, when a cash payment reaches AED 55,000.
• The FFR is now the CNMR. The Executive Office for Control and Non-Proliferation renamed the Funds Freeze Report as the Confirmed Name Match Report in its March 2026 guidance update.
• One event can need two reports. A suspicious AED 55,000 cash purchase of gold needs a DPMSR for the threshold and an STR for the suspicion.
• Sanctions clocks are short. A confirmed match is frozen within 24 hours and reported within five business days.
• The penalty exposure is real. Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 set administrative fines of AED 5 million to AED 100 million for legal entities in breach.

What Are goAML Report Types?

The legal duty to report comes from Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025 and replaced Federal Decree-Law No. 20 of 2018. Its implementing regulation, Cabinet Decision No. 134 of 2025, came into force on 14 December 2025 and repealed Cabinet Decision No. 10 of 2019.

Together they require financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers to report to the FIU through goAML. Our Federal Decree-Law No. 10 of 2025 guide covers the wider changes.

Your supervisor depends on your licence. Banks, exchange houses and finance companies answer to the Central Bank of the UAE (CBUAE). Mainland DNFBPs answer to the Ministry of Economy and Tourism (MOET) or the Ministry of Justice.

Firms in the DIFC answer to the DFSA, firms in ADGM to the FSRA, and Dubai virtual asset firms to VARA. All of them file through the same goAML report types, so the selection rules below apply across the country.

Why do the three report groups matter?

Each group answers a different question. A suspicion report tells the FIU that something looks wrong. A threshold report records that a defined payment happened, and a sanctions report records that a listed name matched a customer.

A file that mixes these up, such as an STR filed where a REAR was required, tells an inspector the reporting procedure was never mapped to the real obligations. With the UAE’s FATF mutual evaluation running in 2026, supervisors check whether entities pick the correct goAML report types, and they look at quality as closely as volume.

Which goAML Report Types Does the UAE FIU Accept?

The table below maps each report type to its trigger, the businesses that file it, and the timing standard. Use it as the first page of your reporting procedure.

The portal also handles the FIU’s own requests to you. A Request for Information (RFI) arrives in your goAML message board and is answered through an AIF or AIFT. Registration comes first: you cannot file any of these until your entity and its users are approved on the portal, which our goAML registration guide walks through step by step.

STR vs SAR: How Do You Choose the Right Suspicion Report?

The STR and the SAR are the two report types most often confused, because many global firms use the terms as synonyms. goAML does not. The deciding question is simple: did a transaction happen, or was one attempted?

When is an STR the correct report?

File an STR when your suspicion attaches to a transaction. That includes a payment received, a transfer sent, a purchase completed, or a transaction the customer attempted and you refused. The STR carries the transaction details, the parties, and your reasoning.

• A customer deposits cash in amounts just under internal review limits on consecutive days.
• A client pays for a property from a third-party account with no clear link to the buyer.
• A customer tries to buy gold bars with cash, then walks away when asked for source of funds documents.

When is a SAR the correct report?

File a SAR when the suspicion comes from behaviour and no transaction exists. A prospective client who abandons onboarding after an identity check fails is a typical case. So is a customer who asks how to stay under reporting limits, or adverse news about an existing client with no new transactions on file.

What does “without delay” mean in practice?

The law sets no fixed number of days. Supervisors read “without delay” as soon as the suspicion is formed and documented. An internal escalation that sits in an MLRO’s inbox for three weeks is the kind of gap inspectors flag. Our guide on how to file an STR in the UAE sets out a workable escalation timeline.

Two rules apply to both report types. You must not tip off the customer that a report has been made or is being considered, which our tipping off guide covers in detail. And failing to report a suspicious transaction can draw a fine of up to AED 5,000,000 under the 2025 framework, on top of supervisory action against the entity.

What Are AIF and AIFT Reports Used For?

Additional information files keep the FIU’s picture of a case current. They are not a fresh report. They attach to a report you have already filed, or answer a request the FIU has sent.

• AIF is used when the new information has no transaction data, such as an updated address, a new beneficial owner, or adverse media found after the original STR.
• AIFT is used when the new information includes transactions, such as further payments on an account already reported.

Here is the working rule. If a customer you already reported keeps behaving the same way, file an AIF or AIFT linked to the original report. A new STR is only right when the new activity is a different suspicion.

Keep the original report reference on the customer file so any analyst can link the two. When the FIU sends an RFI, reply through the same route and within the deadline stated in the request.

When Do HRC and HRCA Reports Apply?

HRC and HRCA reports cover transactions and activity linked to jurisdictions the UAE treats as high risk. The starting point is the FATF list of high-risk jurisdictions subject to a call for action. In its 19 June 2026 statement, FATF kept the Democratic People’s Republic of Korea, Iran and Myanmar on that list. You can check the current position on the FATF website.

Supervisors can add to that list. For mainland DNFBPs, the Ministry’s circular MOET/AML/001/2026, dated 11 March 2026, updated the high-risk and increased-monitoring country lists used for CDD and EDD. Reporting entities should take their list from their own supervisor, not from a vendor feed alone.

• HRC: a transaction where a party, an account, an intermediary bank or the goods route touches a listed jurisdiction.
• HRCA: activity with no transaction, such as an onboarding request from a person resident in a listed jurisdiction.

An HRC records a jurisdiction link and says nothing about suspicion. If the transaction is also suspicious, file an STR as well. Apply enhanced due diligence to every relationship that touches these jurisdictions, as the EDD guide explains.

Which Threshold Reports Apply to DPMS and Real Estate?

Two sectors carry mandatory threshold reports, and both use the same AED 55,000 figure. That shared number is a common source of confusion, so map each one separately.

DPMSR for dealers in precious metals and stones

A dealer files a DPMSR when a single cash transaction, or a series of linked cash transactions, reaches AED 55,000 or more. Suspicion plays no part in the trigger. The opening example in this guide, AED 160,000 in cash across three visits, crosses the threshold through linked transactions, so a DPMSR is due regardless of how the dealer views the customer. Our DPMS compliance guide covers the wider obligations, including CDD and record-keeping.

REAR for real estate brokers, agents, lawyers and notaries

A REAR is filed when a freehold property purchase or sale includes a cash payment of AED 55,000 or more, single or linked, or any payment in virtual assets, however small. Rentals and off-plan deposits that never reach a title transfer do not trigger a REAR on their own. The full trigger detail and filing steps are in our Real Estate Activity Report guide.

Keep the AED 55,000 reporting figure apart from the AED 60,000 cross-border declaration limit, which is a customs obligation on travellers. Supervisors test for this exact mix-up during inspections. The cash transaction reporting guide sets the three figures side by side.

How Do CNMR and PNMR Differ From Suspicion Reports?

CNMR and PNMR are sanctions reports. They record what you did after screening matched a customer or counterparty to the UAE Local Terrorist List or the United Nations Consolidated List. They do not express suspicion of money laundering, and they run on fixed clocks.

• CNMR: the identifiers confirm the match. Freeze all funds and assets without delay and within 24 hours, without notifying the customer, then file the CNMR within five business days of the freeze.
• PNMR: the match is possible but cannot be confirmed or discounted on the information you hold. Suspend the transaction and file the PNMR within five business days.

What happened to the Funds Freeze Report (FFR)?

Older policies, training decks and vendor manuals still refer to the Funds Freeze Report, or FFR. The Executive Office for Control and Non-Proliferation renamed it the Confirmed Name Match Report when it amended its targeted financial sanctions guidance in March 2026. The obligation did not change, but a policy that still says FFR tells an inspector the framework has not been refreshed. Update the term across your manual, your screening workflow and your training material.

For the full decision path on matches, read our guides on CNMR and PNMR filing and sanctions screening alert management.

Can One Event Need Two goAML Reports?

Yes, and this is where many filing errors start. The goAML report types answer different questions, so one event can trigger more than one. The table shows common combinations.

Record the reasoning for every combination. When an inspector asks why a DPMSR had no matching STR, the answer should be a dated note on file, not a recollection.

What Are the Most Common goAML Filing Errors?

In ADZ’s audit and advisory work across UAE DNFBPs and financial institutions, the same reporting faults come up again and again. Most of them sit in procedure, and very few are portal problems. Mixing up goAML report types tops the list.

1. Wrong report type. A SAR filed where a transaction was involved, or an STR filed where only a REAR was required.
2. Threshold missed on linked payments. Instalments or split cash payments are not added together, so the AED 55,000 trigger is never caught.
3. Thin narrative. The reason for suspicion is a single line. The FIU needs the who, what, when and why, plus what the customer said when asked.
4. Retired terminology. Policies still name the FFR, cite Federal Decree-Law No. 20 of 2018 as current, or refer to Cabinet Decision No. 10 of 2019.
5. No link between follow-ups. Repeat activity is filed as new STRs instead of AIF or AIFT entries tied to the first report.
6. Slow escalation. Staff raise an internal alert, but the MLRO decision is not dated, so “without delay” cannot be shown.
7. Single-user access. Only one person holds goAML credentials, so reporting stops when that person is on leave.
8. Missing records. Copies of reports and the analysis behind them are not kept for the full five years required under the UAE record-keeping rules.

How Do You Build a goAML Report Selection Procedure?

A written procedure turns the table above into a repeatable decision. Build it in seven steps.

1. Map your sector obligations. List which goAML report types apply to your licence. A bank will not file DPMSRs, while a brokerage will file REARs.
2. Write a decision tree. Start with “is there a sanctions match?”, then “did a threshold payment occur?”, then “is there suspicion, and was there a transaction?” Each answer points to a report type.
3. Set internal clocks. Define how many hours staff have to escalate, and how quickly the MLRO decides. Write the 24-hour freeze and five-business-day sanctions deadlines in full.
4. Configure your systems. Set transaction monitoring to aggregate linked cash payments against the AED 55,000 trigger, and set screening to route confirmed and partial matches to separate queues.
5. Assign goAML users. Register at least two authorised users, with the MLRO and a deputy, so filings continue during absence.
6. Train by scenario. Run staff through the combination scenarios above. Front-line staff do not file reports, but they must know what to escalate.
7. Test it annually. Sample filed and unfiled cases each year, check report-type choice and timing, and record the results. An independent AML audit is the cleanest way to evidence this.

Tie the procedure to your enterprise-wide risk assessment. A business that rates cash-heavy customers as high risk should expect more DPMSR or REAR filings and staff the function to match.

Frequently Asked Questions

What is the difference between an STR and a SAR on goAML?

An STR is filed when suspicion is linked to a completed or attempted transaction. A SAR is filed when the suspicion comes from behaviour or information and no transaction took place. Both are filed with the UAE FIU without delay, and tipping off the customer is prohibited for both.

Is the Funds Freeze Report (FFR) still a goAML report type?

No. The Executive Office for Control and Non-Proliferation renamed the Funds Freeze Report as the Confirmed Name Match Report (CNMR) in March 2026. The obligation is the same: freeze within 24 hours of confirming a sanctions match, then report within five business days.

Do I need to file an STR as well as a DPMSR?

Only if the transaction is also suspicious. A DPMSR is a threshold report triggered by cash of AED 55,000 or more. It does not replace an STR. If the payment looks suspicious, file both, and record why on the customer file.

What is the AED 55,000 threshold in goAML reporting?

It is the cash trigger for two threshold reports. Dealers in precious metals and stones file a DPMSR, and real estate brokers, agents, lawyers and notaries file a REAR, when a single or linked cash payment reaches AED 55,000. A REAR is also required for any virtual asset payment in a freehold deal.

When should I use an AIF instead of a new STR?

Use an AIF or AIFT when you are adding information to a report already filed, or answering an FIU Request for Information. Use AIFT when the new information includes transactions. File a new STR only if the new activity represents a different suspicion.

Who must file HRC and HRCA reports in the UAE?

Reporting entities directed by their supervisor file an HRC for transactions, and an HRCA for activity, linked to jurisdictions the UAE treats as high risk. The FATF call-for-action list is the starting point, and supervisors such as the Ministry of Economy and Tourism publish their own updated lists.

What is the penalty for not filing a required goAML report?

Failing to report a suspicious transaction can draw a fine of up to AED 5,000,000. Under Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, administrative fines for legal entities in breach reach AED 5 million to AED 100 million, with licence action possible for repeated failures.

Related Reading

• How to File an STR in the UAE: 2026 goAML Reporting Guide
• goAML Portal Registration Guide 2026
• CNMR and PNMR Filing on goAML: UAE Sanctions Guide
• Real Estate Activity Report UAE: 2026 goAML Filing Guide
• AML Compliance for DPMS in UAE: The 2026 Guide
• Tipping Off in the UAE: The 2026 AML Compliance Guide
• Federal Decree-Law No. 10 of 2025: UAE AML Compliance Guide
• Independent AML Audit in the UAE: The 2026 Guide

Choosing the right goAML report type is a daily decision for any UAE compliance team, and inspectors now test it file by file. The official reporting channel and current guidance sit with the UAE Financial Intelligence Unit, and DNFBP supervision guidance sits with the Ministry of Economy and Tourism. ADZ is ISO 27001 and ISO 9001:2015 certified and handles goAML registration and DPMSR reporting end to end. If you want your reporting procedure reviewed before your next inspection, contact ADZ for a free consultation and gap analysis, or ask about our independent AML/CFT audits.

Disclaimer: This article is general guidance on UAE AML/CFT reporting as of October 2026 and is not legal advice. Report triggers, deadlines and supervisor lists change. Confirm your specific obligations with ADZ, your supervisor or legal counsel before relying on any point in this article.

The post goAML Report Types in the UAE: STR, SAR and More (2026) appeared first on ADZ | Corporate Consulting Services | UAE.

Quick Answer

Yes, an MLRO can be fined personally in the UAE. The Central Bank fined a bank’s Head of Compliance and MLRO AED 300,000 in June 2026, separate from the AED 20 million penalty on the bank itself, for failing to fulfil his duties during a period of repeated AML and sanctions control failures. A May 2025 case went further: a branch manager was fined AED 500,000 and barred from holding any position at a licensed UAE financial institution. Personal MLRO liability is now a documented enforcement pattern, not a theoretical risk, and it applies under laws that sit outside the AML statute itself.

Key Takeaways

• Personal fines are confirmed, not hypothetical. The CBUAE fined an MLRO AED 300,000 in June 2026, on top of a AED 20 million penalty against the institution he worked for.
• Repeated findings are the trigger. Both the 2026 and 2025 enforcement releases describe “significant, repeated failures,” language that points at remediation that was promised but never closed out.
• A professional ban is on the table. The May 2025 case barred a branch manager from holding any post at a licensed UAE financial institution, not just from his existing job.
• The legal basis sits outside the AML law too. The CBUAE fined both institutions under the Central Bank Law (Federal Decree-Law No. 14 of 2018), which runs alongside, not instead of, the AML-specific Federal Decree-Law No. 10 of 2025.
• Documentation is the main defense. Examiners test whether the MLRO escalated, recorded and closed findings, not only whether a policy document existed on paper.
• DNFBPs carry comparable exposure. The compliance officer at a real estate brokerage, a DPMS dealer or a corporate service provider answers to the Ministry of Economy or a free zone regulator under the same administrative sanction logic, even though the examples in this guide come from banking.

The Fine That Changed How UAE MLROs Read Their Own Job Description

On 24 June 2026, the Central Bank of the UAE announced a financial penalty of AED 20,000,000 on a branch of a foreign bank. The examinations behind the fine found significant, repeated failures in the branch’s anti-money laundering, counter-terrorist financing and sanctions framework. In the same release, the CBUAE confirmed a separate, individual penalty of AED 300,000 on the branch’s Head of Compliance and Money Laundering Reporting Officer, citing his failure to fulfil the responsibilities of his position.

This was not an isolated approach. On 20 May 2025, the CBUAE fined an exchange house AED 200,000,000 under Article 137 of the Central Bank Law, after examinations revealed significant failures in its AML/CFT framework. A branch manager at that exchange house was fined AED 500,000 personally and prohibited from holding any position at any licensed financial institution in the UAE. Read together, the two releases establish a pattern: when the CBUAE finds repeated, unremediated gaps, it does not confine the consequence to the institution’s balance sheet. It names an individual and attaches a personal number to the finding.

The pattern lines up with where the UAE sits in the wider FATF framework. The country is not on the FATF’s list of jurisdictions under increased monitoring, and its next mutual evaluation is positioned for 2026, which gives domestic regulators a direct incentive to show enforcement teeth on exactly the kind of repeated, unremediated finding both cases describe.

Neither release names the institution or the individual publicly. That restraint does not reduce the exposure for the person who was fined. A barred professional cannot work at a licensed UAE financial institution again, named publicly or not, and the fine itself is a matter of personal record with the regulator.

Where MLRO Personal Liability Actually Comes From in UAE Law

Compliance teams often assume personal liability sits entirely inside Federal Decree-Law No. 10 of 2025, the UAE’s core AML/CFT statute. In practice, an MLRO’s exposure comes from at least two separate legal tracks, and understanding both changes how a defense file should be built.

The Central Bank’s Own Licensing Powers

Both 2025 and 2026 cases above were fined under the Central Bank Law, Federal Decree-Law No. 14 of 2018 Regarding the Central Bank and Organization of Financial Institutions and Activities, and its amendments. This law gives the CBUAE direct supervisory authority over licensed banks and exchange houses, independent of the AML statute’s own administrative fine schedule. For banking-sector MLROs, this is often the first track a personal fine travels down, because it lets the regulator act on examination findings without waiting for a separate AML prosecution.

The AML Law’s Administrative Fine Schedule

Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, and its executive regulation, Cabinet Decision No. 134 of 2025, carry their own administrative fine schedule, with penalties reaching AED 5 million to AED 100 million for legal entities found in breach. The MLRO is the named accountable officer for AML/CFT compliance under this law, which is the same reason a DNFBP’s compliance officer, not only a bank’s, can be examined and sanctioned individually by the Ministry of Economy or the relevant free zone regulator.

Criminal Exposure for Specific AML Offences

Beyond administrative fines, Federal Decree-Law No. 10 of 2025 carries criminal provisions for specific conduct, including tipping off a customer about a pending suspicious transaction report. ADZ’s guide to tipping off in the UAE covers those criminal thresholds in detail. The lesson for an MLRO is that personal exposure is not one fine amount to memorize. It is a set of separate legal tracks, administrative and criminal, banking-specific and AML-specific, that can each be triggered by the same underlying failure.

DNFBP Compliance Officers Face the Same Logic, Different Regulator

A compliance officer at a real estate brokerage, a DPMS dealer or a corporate service provider does not answer to the CBUAE, so the two cases above will not appear in that officer’s own regulatory history. The accountability structure is still the same. The Ministry of Economy and the relevant free zone authority supervise DNFBPs under Federal Decree-Law No. 10 of 2025 directly, and the law names the compliance officer as the accountable individual for the AML/CFT programme regardless of sector. A DNFBP compliance officer who treats the CBUAE’s enforcement language as a banking-only story is reading the signal too narrowly. The pattern it describes, repeated findings becoming a personal one, applies wherever a named individual carries the compliance mandate.

Why “Repeated Failures” Is the Phrase Every MLRO Should Worry About

Both enforcement releases use near-identical language: “significant, repeated failures.” That wording is doing real work. A first-cycle finding, where an examiner identifies a gap and the institution commits to a remediation date, is a normal part of supervision. A repeated finding means the same weakness was identified before, a commitment was made to fix it, and the fix did not hold.

From the regulator’s perspective, a repeated finding converts a systems problem into an accountability problem. The question stops being “does this bank have a sanctions screening tool” and becomes “did the person responsible for sanctions screening know about the gap, and what did they do about it.” That is precisely the question a personal fine answers. An MLRO who can show a dated escalation memo, a resourcing request that was ignored, or a remediation tracker with closed items has a materially different position than one who cannot produce anything beyond the original policy document.

Five Failure Points That Attach to the MLRO Personally

Reading across the CBUAE’s public enforcement language and ADZ’s own audit findings for UAE clients, five recurring gaps are the ones most likely to turn an institutional finding into a personal one.

Late or Missing STR Filing

A suspicious transaction report filed weeks after the trigger event, or not filed at all, is the clearest evidence an examiner can point to. ADZ’s goAML STR filing guide sets out the filing timelines and the evidence an MLRO should retain for every decision not to file.

Gaps in Ongoing Monitoring

A risk-based monitoring schedule that exists on paper but was not actually run on the stated cadence is a repeat-finding risk by design. The gap between the policy and the practice is exactly what a second examination cycle tests.

Unescalated Known Risk

An MLRO who identifies a control weakness and raises it informally, in a conversation that leaves no written trail, has no defense when the same weakness resurfaces in the next examination. Verbal escalation does not exist for liability purposes.

Sanctions Screening Left to Run Itself

Both 2025 and 2026 cases cite sanctions framework failures alongside AML/CFT ones. A screening tool with outdated list feeds, uncleared alert backlogs, or no documented tiering of match review is the kind of gap that survives quietly until an examiner tests it. ADZ’s guide to sanctions screening alert management sets out the SLA and re-screening cadence examiners expect to see.

Repeat Findings Left Open Past Their Deadline

A remediation plan with no closed date, or a closed date that was quietly extended without documented justification, is the single strongest pattern behind both 2025 and 2026 fines. An open finding is a risk. An open finding with a missed, undocumented deadline is a personal liability event waiting to happen.

A Practitioner Action Plan for Reducing Personal Exposure

None of the steps below require new technology or a bigger budget. They require discipline, and they are the difference between an MLRO who can defend a decision and one who cannot.

Keep a Decision Log, Not Just a Policy

Every material AML decision, a close call on a customer risk rating, a decision not to file an STR, a judgment call on a sanctions screening match, should be dated, reasoned in writing, and filed. A policy document describes what should happen in general. A decision log proves what actually happened in a specific case, and it is what an examiner reads first.

Put an Escalation and Sign-Off Matrix in Writing

Define, in a single document, exactly which findings go to the MLRO, which go to the board or senior management, and within what timeframe. When a finding is escalated according to that matrix, the escalation itself becomes evidence that the MLRO acted on his duties, even if the institution’s broader response was slow.

Track Every Remediation Item to a Closed Date

A simple tracker, open date, owner, target close date, actual close date, evidence of closure, turns “we are working on it” into a defensible record. If a closure date slips, record why and get sign-off on the new date in writing. This single habit is the most direct countermeasure against the “repeated failures” language both enforcement cases used.

Request Resourcing in Writing, Not in a Meeting

If the MLRO function is under-resourced, a verbal request raised in a management meeting leaves no trail. A written resourcing request, even a short email, creates a record that the MLRO flagged the constraint and the decision to proceed without additional resourcing sat with senior management, not with the compliance function alone.

Ask About MLRO and Director’s Liability Cover

Professional indemnity and directors’ and officers’ liability policies vary in whether they extend to a named individual’s regulatory fine, as opposed to legal defense costs in a related claim. An MLRO should confirm, in writing with the institution’s insurer or broker, exactly what a personal AML fine would and would not trigger under the existing policy, well before an examination begins.

What an Examiner Expects to See on Day One

An MLRO who treats an examination as a document-production exercise is already behind. Examiners increasingly test whether the evidence pack reflects ongoing practice or was assembled the week before the visit. The table below sets out what a defensible pack looks like.

None of these items are exotic. What separates an institution that survives a repeated examination from one that attracts a personal fine is whether the evidence was built continuously, or reconstructed under deadline pressure.

Independent Audit as the Clearest Protection an MLRO Can Build

An internal compliance function, by definition, struggles to mark its own homework. An independent AML/CFT audit, run by a party with no stake in the outcome, is the single clearest way for an MLRO to demonstrate that findings were tested honestly and closed properly, rather than simply declared closed. ADZ’s independent AML audit guide sets out the four audit types (Federal, DFSA, VARA and Supply Chain) and what each one tests.

For institutions regulated directly by the CBUAE, this matters even more given the two enforcement cases above both cite the Central Bank Law rather than the AML statute alone. A compliance officer who can point to a recent, independent audit report, with findings closed and documented, is in a fundamentally different position than one relying solely on the institution’s own internal sign-off.

Frequently Asked Questions

Can an MLRO be personally fined in the UAE?

Yes. The CBUAE fined a bank’s Head of Compliance and MLRO AED 300,000 personally in June 2026, separate from the AED 20 million fine on the bank, for failing to fulfil the duties of his role. A separate May 2025 case fined a branch manager AED 500,000 and barred him from holding any post at a licensed UAE financial institution.

What law gives the CBUAE the power to fine an MLRO individually?

In both public 2025 and 2026 cases, the CBUAE cited the Central Bank Law, Federal Decree-Law No. 14 of 2018 Regarding the Central Bank and Organization of Financial Institutions and Activities, and its amendments. This power operates alongside, not instead of, the administrative fine schedule under the AML-specific Federal Decree-Law No. 10 of 2025.

Does Federal Decree-Law No. 10 of 2025 also create personal liability for compliance officers?

Yes, for DNFBPs and licensed financial institutions supervised under the AML law directly. The MLRO is the named accountable officer for AML/CFT compliance, and the Ministry of Economy and free zone regulators can examine and sanction a compliance officer individually under this law’s own administrative fine schedule, which reaches AED 5 million to AED 100 million for legal entities.

Can an MLRO be banned from working in UAE financial services?

Yes. The May 2025 CBUAE case barred a branch manager from holding any position at any licensed financial institution in the UAE, in addition to the AED 500,000 personal fine. This is a professional prohibition, not only a financial penalty.

What is the real difference between the institutional fine and the personal fine?

The institutional fine sanctions the company for the control failure itself. The personal fine sanctions a named individual for failing to carry out the duties of a specific regulated role, typically the MLRO or a senior manager with direct responsibility. The two fines are assessed and announced separately, and only one of them follows the person to their next job.

How can an MLRO reduce personal liability risk in practice?

Keep a dated decision log for every material AML judgment call, put the escalation and sign-off matrix in writing, track every remediation item to a documented closed date, request resourcing in writing rather than verbally, and commission an independent AML/CFT audit on a regular cycle rather than relying only on internal sign-off.

Does professional indemnity or liability insurance cover an MLRO’s personal AML fine?

It depends on the specific policy, and coverage for a named individual’s regulatory fine is not automatic under every professional indemnity or directors’ and officers’ policy. An MLRO should confirm in writing with the institution’s insurer or broker exactly what a personal AML fine would trigger, before an examination begins rather than after a finding.

Related Reading

• MLRO Responsibilities in the UAE: 2026 Guide
• MLRO Appointment in the UAE: 2026 Fit and Proper Guide
• Independent AML Audit in the UAE: The 2026 Guide
• Tipping Off in the UAE: The 2026 AML Compliance Guide
• Sanctions Screening Alert Management in the UAE: 2026 Guide
• UAE Central Bank Law AML Compliance: 2026 Deadline Guide
• How to File an STR in the UAE: 2026 goAML Reporting Guide

Personal MLRO liability in the UAE is now a matter of public enforcement record, not a theoretical reading of the law. The compliance officers who come through an examination cycle well are the ones who can produce a continuous, dated record of what they knew, what they escalated and what they closed, not just a policy binder. Contact ADZ for a consultation on mapping your MLRO’s personal exposure against current practice.

This article is for general information and does not constitute legal advice. UAE AML/CFT laws, Central Bank regulations and enforcement practice change, and businesses should seek independent legal counsel for advice specific to their circumstances.

The post MLRO Personal Liability in the UAE: 2026 CBUAE Fines appeared first on ADZ | Corporate Consulting Services | UAE.

Quick Answer

A UAE business covered by Federal Decree-Law No. 10 of 2025 must appoint an MLRO who is UAE-resident, AML-experienced, and cleared through the regulator’s fit and proper test before taking up the role. CBUAE, DFSA, VARA, SCA/CMA and the Ministry of Economy each run their own approval step, and the MLRO function can sit in-house or be outsourced.

Key Takeaways

• MLRO appointment is mandatory: any entity covered by Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 must name an MLRO, whether in-house or outsourced.
• Fit and proper is regulator-specific: CBUAE, DFSA, FSRA (ADGM), VARA, SCA/CMA and the Ministry of Economy each assess MLRO candidates under their own rulebook, not one shared UAE-wide test.
• UAE residency is the common thread: almost every regulator expects the MLRO to be UAE-resident and reachable for inspections and periodic reporting.
• No valid MLRO means no valid AML programme: an unapproved or vacant MLRO seat is treated the same way as having no AML controls at all.
• Outsourcing is explicitly allowed: the role can be filled by a qualified third-party provider instead of an internal hire, as long as the regulator’s fit and proper bar is still met.
• Approval attaches to the person, not the title: several regulators (VARA included) treat MLRO approval as personal to the named individual, so it does not transfer automatically when someone new takes the seat.
• Documentation outlives the hire: the fit and proper assessment file needs to survive staff turnover and stand up to regulator review long after onboarding.

Who Must Appoint an MLRO Under the 2025 Law

Federal Decree-Law No. 10 of 2025 and its implementing regulation, Cabinet Resolution No. 134 of 2025, require every Financial Institution (FI) and every Designated Non-Financial Business or Profession (DNFBP) to name a Money Laundering Reporting Officer at management level. Article 22 of the Cabinet Resolution frames this as a requirement for a competent compliance officer, not a part-time add-on to someone else’s job description.

In practice, the obligation reaches:

• Banks, exchange houses and insurance providers supervised by the Central Bank of the UAE (CBUAE)
• Real estate brokers and agents
• Dealers in precious metals and stones (DPMS)
• Lawyers, notaries and independent legal professionals
• Accountants and auditors
• Corporate service providers
• Virtual asset service providers (VASPs) licensed under VARA

Free zone entities in the DIFC and ADGM fall under the DFSA and FSRA rulebooks respectively, which mirror the federal MLRO requirement inside their own frameworks.

Does Company Size Change the Obligation?

No. The law ties the MLRO requirement to the regulated activity a business carries out, not to its headcount or annual revenue. A two-person real estate brokerage and a 200-person exchange house sit under the same baseline obligation to appoint and maintain an MLRO. What differs is the resourcing model they use to meet it, covered later in this guide. A newly licensed business sometimes assumes it has a grace period before the MLRO appointment becomes mandatory. It does not: the obligation to name a compliance officer attaches from the point the licence covers a regulated activity, not from a date the business chooses once it feels ready.

What “Fit and Proper” Actually Means for an MLRO

“Fit and proper” is shorthand for two separate tests a regulator runs on any proposed MLRO. Fitness looks at competence: does the candidate understand money laundering typologies, the UAE legal framework, and the day-to-day mechanics of CDD, screening and reporting. Propriety looks at integrity: does the candidate have a disciplinary, criminal or regulatory record that should disqualify them, and can the business show the appointment was made in good faith rather than as a box-ticking exercise.

Core Fit and Proper Criteria Regulators Look For

• Relevant AML knowledge: a working understanding of UAE money laundering typologies, sanctions regimes, and the business’s own risk exposure.
• Seniority and independence: the authority to escalate a suspicious transaction report without needing sign-off from the person whose activity is in question.
• No disqualifying history: no unresolved regulatory sanctions, criminal convictions for financial crime, or prior removal from an approved role.
• Capacity to do the job: enough time, UAE presence and resources, not an MLRO title bolted onto an unrelated full-time role with no bandwidth left over.
• Transparent disclosure: full disclosure of outside directorships, family ties to senior management, or other conflicts the business must show it can manage.

Conflicts of Interest the Regulator Will Ask About

A common failure point is naming an MLRO who also owns, directs or is closely related to the business’s senior management. Regulators do not automatically block this, but they expect the business to demonstrate how the conflict is managed: an escalation path that bypasses the conflicted individual, a deputy MLRO who can act independently, or board-level oversight that does not run through the same person being reported on.

How MLRO Approval Differs by Regulator

There is no single UAE-wide MLRO licence. Each regulator runs its own notification or approval process, and the depth of scrutiny varies by sector risk.

The pattern across every row is the same even though the paperwork differs: the regulator wants a named, UAE-based individual with real AML competence, not a title on an organisation chart. VARA publishes its approved-persons regime directly, treating MLRO sign-off as a named, personal licence condition rather than a back-office formality, and DFSA requires Authorised Individual status before anyone can act as Compliance Officer and MLRO for a DIFC-registered firm.

Common MLRO Appointment Mistakes UAE Businesses Make

Most MLRO appointment problems are not dramatic. They are small gaps that compound until an inspection or a licence renewal exposes them.

• Naming the role before naming the regulator: a business decides internally who the MLRO will be, then discovers only during a licence renewal that the relevant regulator never actually approved the appointment.
• Treating the MLRO appointment as a one-line job description change: updating an employment contract to add “MLRO” without building the fit and proper file, the conflict-of-interest declaration, or the regulator notification that should sit behind it.
• No deputy MLRO: the function goes effectively vacant the moment the named individual is on leave, ill, or serving a resignation notice, with no one else authorised to receive or escalate a report.
• Letting the file go stale: the original appointment was approved years ago, but nothing documents whether the person still meets the fit and proper standard today, including any change in their residency status or disciplinary record.
• Assuming group structure covers every entity: one MLRO appointment approved for a parent company is treated as automatically covering a related UAE entity, without checking whether that specific regulator actually allows the arrangement.
• Outsourcing without checking the provider’s own standing: handing the MLRO function to a third party without confirming that the provider itself carries UAE residency, current certifications and a clean regulator track record.

UAE Residency and Experience Expectations

None of the UAE’s AML regulators publishes a single, universal minimum years-of-experience figure inside their rulebook. What shows up consistently, in guidance, in regulator expectations during approval interviews, and in how businesses actually staff the role, is a narrower practical standard.

• UAE residency: the MLRO should be based in the UAE and reachable during a live inspection or investigation, not operating the function remotely from another jurisdiction.
• Three to five years of AML experience in a regulated UAE business is the experience band most regulators and employers treat as credible for a standalone MLRO appointment.
• A recognised AML certification, such as ICA, ACAMS or CFCS, strengthens a fit and proper submission even where it is not a strict legal prerequisite.
• Demonstrated regulator-facing experience, having handled an inspection, a goAML filing cycle, or a prior approval process, carries real weight in how a regulator assesses the “proper” half of the test.

A business that cannot meet this bar internally is not stuck. Outsourcing or co-sourcing the MLRO function to a provider that already carries the right UAE residency, certifications and regulator track record is a legitimate, commonly used route, covered further below.

What Happens Without an Approved MLRO

An MLRO seat that is vacant, filled by someone who never cleared the regulator’s fit and proper process, or filled only on paper, is treated the same way as having no AML programme at all. Federal Decree-Law No. 10 of 2025 carries administrative fines of AED 5,000,000 to AED 100,000,000 for legal entities found non-compliant with their AML obligations, and a missing or invalid MLRO is one of the clearest, most easily evidenced gaps an examiner can point to.

Regulators have also shown they will look past the institution to the individual. The Central Bank of the UAE fined a foreign bank branch AED 20,000,000 in June 2026 for repeated AML, counter-terrorist financing and sanctions-control failures, and separately fined the branch’s Head of Compliance and MLRO AED 300,000 for failing to perform the duties of the role. The institutional and personal penalties sat side by side, which is the clearest signal yet that CBUAE treats a properly appointed, properly functioning MLRO as a distinct line of accountability, not a footnote to the entity’s own fine.

An examiner reviewing an AML programme rarely starts with the most complex control. A missing, lapsed or never-approved MLRO appointment is one of the first things a file review surfaces, because it is binary and easy to evidence: either the regulator’s acknowledgement or approval letter exists, dated and matched to the person currently in the role, or it does not. Businesses that treat the appointment as settled once and never revisit it are the ones most likely to find the gap during, rather than before, an inspection.

In-House, Co-Sourced or Fully Outsourced MLRO

UAE regulators do not require the MLRO to be a full-time employee of the regulated business. Three staffing models are commonly accepted, and the right choice depends on transaction volume, sector risk and how fast the business is growing, the same factors that shape a wider third-party reliance and outsourced CDD arrangement.

ADZ runs a Compliance Team Workforce Supply service built for exactly this decision: a UAE-resident, regulator-experienced compliance function that a business can plug in instead of carrying the hiring risk of a standalone internal MLRO. For businesses that want to build internal capability instead, ADZ’s Compliance 360 training programme, KHDA-approved, offers 32 specialised AML/CFT courses that can bring an internal candidate up to the experience and certification standard regulators expect.

How to Build an MLRO Appointment File That Survives Inspection

A fit and proper approval is not a one-time form. Regulators expect a file that documents the decision and stays current for as long as the person holds the role, the same file an independent AML audit will ask to see.

1. Senior management approval minutes recording the decision to appoint, dated and signed by the board or equivalent.
2. Full CV and qualification evidence, including any AML certification (ICA, ACAMS, CFCS or equivalent).
3. Conflict-of-interest declaration, with the management plan for any conflict that cannot be fully removed.
4. UAE residency and Emirates ID evidence, kept current as visas renew.
5. The regulator notification or approval application itself, filed through CBUAE, DFSA, FSRA, VARA, SCA/CMA or the Ministry of Economy as applicable, with the acknowledgement or approval letter retained.
6. A named deputy or alternate MLRO, so the function does not go vacant during leave, illness or a resignation notice period.
7. An ongoing fit and proper review, repeated periodically rather than filed once and forgotten, so the record reflects the person currently in the seat.

Frequently Asked Questions

Can an MLRO be outsourced in the UAE?

Yes. UAE regulators accept an outsourced or co-sourced MLRO as long as the individual still meets the applicable fit and proper standard, carries UAE residency, and has the authority to act independently within the business. The regulated entity remains responsible for the outcome even when the function is outsourced.

What qualifications does an MLRO need in the UAE?

There is no single legally fixed qualification list across every regulator. In practice, regulators and employers look for three to five years of AML experience in a regulated UAE business, a recognised certification such as ICA, ACAMS or CFCS, and a working understanding of UAE money laundering typologies and reporting obligations.

Does CBUAE approve every MLRO appointment?

CBUAE runs a fit and proper assessment for MLROs at the banks, exchange houses and other financial institutions it supervises, tied into its broader senior-management approval regime. Businesses supervised by other regulators, such as DFSA, FSRA, VARA, SCA/CMA or the Ministry of Economy, go through that regulator’s own process instead.

Can one person be the MLRO for more than one UAE entity?

Some regulators allow this for related or group entities, provided the individual genuinely has the capacity and independence to perform the role for each entity and the regulator approves the arrangement. It is not a default right, and it should be confirmed with the specific regulator before relying on it.

Does the MLRO have to be UAE-resident?

UAE residency is expected across every regulator covered in this guide. An MLRO operating the function remotely from outside the UAE, without UAE residency, is unlikely to satisfy a fit and proper review.

What happens if a business operates without an approved MLRO?

A business with no MLRO, or one filled by someone who was never approved, is treated as having no functioning AML programme. Under Federal Decree-Law No. 10 of 2025, that exposes the entity to administrative fines ranging from AED 5,000,000 to AED 100,000,000, separate from any personal penalty a regulator may also impose on an individual found responsible.

Who approves an MLRO for a VARA-licensed company?

VARA runs a positive, personal approval process for each named MLRO at a virtual asset service provider it licenses. The approval does not transfer to another individual or another entity if the person changes roles.

Is the MLRO personally liable for compliance failures?

Regulators have shown they can and do penalise individuals separately from the institution. The June 2026 CBUAE case fined a bank branch’s Head of Compliance and MLRO AED 300,000 alongside the branch’s own AED 20,000,000 fine. The exact legal basis and scope of personal liability depend on the specific regulator and the facts of each case, so this is a question worth raising directly with an advisory team rather than assuming either way.

Related Reading

• MLRO Responsibilities in the UAE: 2026 Guide
• Independent AML Audit in the UAE: The 2026 Guide
• Third-Party Reliance and Outsourced CDD in the UAE
• UAE Central Bank Law AML Compliance: 2026 Deadline Guide
• AML Compliance for VASPs in the UAE: 2026 VARA Guide
• CMA AML Compliance UAE: The 2026 Broker Guide
• DIFC AML Compliance 2026: The DFSA Rulebook Guide

Getting an MLRO appointment wrong is rarely a dramatic failure. It is usually a quiet gap: a title on an org chart that was never actually approved, a candidate who never had the UAE residency or experience the regulator expected, or a deputy who was never formally named. None of those gaps show up until an inspection or a licence renewal forces the question. Contact ADZ for a consultation on whether your current MLRO appointment would hold up to regulator scrutiny.

This article is for general information and does not constitute legal advice. Confirm current requirements with the relevant UAE regulator (CBUAE, DFSA, FSRA, VARA, SCA/CMA or the Ministry of Economy) before acting on any specific MLRO appointment.

The post MLRO Appointment in the UAE: 2026 Fit and Proper Guide appeared first on ADZ | Corporate Consulting Services | UAE.

Sanctions screening alert management is the part of a UAE AML programme that quietly consumes the most analyst hours and produces the least defensible paper trail. Every onboarding, every periodic review, and every list update throws off alerts against the UAE’s targeted sanctions lists and the wider watchlists a screening tool checks. Most UAE compliance teams can describe their screening obligation. Far fewer can show a supervisor exactly how an alert moved from “hit” to “cleared” and why the threshold that generated it was set where it was.

This guide covers the operational layer that sits underneath the legal framework. It shows how to set matching thresholds that catch real risk without flooding the queue, and how to build an alert triage workflow with service levels a supervisor can inspect. It also covers how to re-screen the existing customer book, not just new business, as lists change.

Quick Answer: What is sanctions screening alert management?

Sanctions screening alert management is the operational process of tuning match thresholds, triaging and clearing alerts within set timeframes, and documenting every decision generated when a customer or counterparty is checked against sanctions and watchlists. In the UAE it sits alongside the legal obligation to screen under Federal Decree-Law No. 10 of 2025, and a weak alert process is one of the most common findings in a CBUAE or Ministry of Economy inspection.

Key Takeaways

• Screening and alert management are not the same thing. Running a screen is a legal obligation. Deciding what the alert it produces actually means is an operational skill most UAE firms have not built.
• Thresholds that are too loose bury the real match. A programme that generates hundreds of low-value alerts a week trains analysts to clear fast, which is how a genuine hit gets waved through.
• Service levels belong in writing. “We review alerts promptly” is not a control. A supervisor wants a stated turnaround time per alert tier and evidence you met it.
• Re-screening the existing book matters as much as screening new customers. A list update that adds a name means every existing customer needs checking again, not only the next onboarding.
• Every discounted alert needs a reason on file. “Not a match” without a documented basis reads, in an inspection, exactly like a decision nobody actually made.
• Whitelisting is a control point, not a shortcut. Suppressing a recurring false positive without governance is one of the fastest ways to miss a true positive later.

What sanctions screening alert management actually covers

UAE AML rules already require that businesses screen customers and beneficial owners against sanctions lists at onboarding, before transactions, and on an ongoing basis. Our guide to targeted financial sanctions in the UAE covers that legal obligation: who must screen, which lists apply, and what happens once a true match is confirmed. This guide picks up where that one stops, at the point a screening tool returns a possible match and somebody has to decide what it means.

That decision point is where most UAE compliance functions are weakest. A list of obligations tells a supervisor what you are required to do. An alert log tells a supervisor whether you actually did it, consistently, on time, with a reason recorded. The second document is the one an inspector reads line by line.

The Financial Action Task Force’s guidance on the risk-based approach is explicit that controls, including screening, should be calibrated to risk rather than applied uniformly. The Central Bank of the UAE applies that same principle when it examines licensed institutions. Its enforcement record shows screening and monitoring failures are a recurring finding, as in its 24 June 2026 action against a foreign bank branch for repeated AML/CFT and sanctions-control weaknesses. A programme that cannot explain why its thresholds are set where they are has not met the risk-based standard on paper, whatever the tool itself is capable of.

A worked scale helps make the volume problem concrete. A mid-sized UAE exchange house or DNFBP screening a few thousand customer records a month against 1,800-plus sanction and watchlist entries, with an untuned fuzzy-match setting, can easily generate several hundred alerts in that period. Tightened to a risk-based setting with documented whitelisting for recurring, cleared common names, the same book can run at a fraction of that volume without dropping coverage on the names that actually matter.

Screening versus alert management, defined

Why UAE sanctions screening generates so many false positives

A false positive is an alert that turns out, on review, not to be the sanctioned or watchlisted party at all. A healthy UAE screening programme still produces plenty of them. The problem is not that false positives exist. The problem is a volume so high that reviewers stop reviewing and start rubber-stamping.

Common name and transliteration noise

Arabic names transliterated into Latin script produce multiple accepted spellings for the same name. The reverse problem is just as common: a name shared by thousands of residents in the UAE’s South Asian or Southeast Asian population will match a sanctioned party’s name on partial string similarity alone. Fuzzy matching, which exists to catch deliberate misspelling, is also what generates most of this noise.

Untuned matching algorithms

Most screening tools ship with a default match sensitivity. Left untouched, that default is usually calibrated for a global customer base, not the UAE’s specific name patterns. A setting that is too loose returns alerts on almost every name with three or more shared letters. A setting that is too tight risks missing a genuine match written with a transliteration variant.

Screening too broad a net at the wrong points

Some firms screen full customer records, including free-text address and notes fields, against name lists built for personal names. Others screen at every minor record update rather than at meaningful trigger points. Both inflate the alert count without adding risk coverage.

Setting matching thresholds that work

A threshold is the similarity score at which a screening tool decides a name is close enough to a watchlist entry to raise an alert. Getting it right is a risk-based judgement, not a technical default, and it has to be documented as one.

Exact, fuzzy, and phonetic matching

• Exact matching flags only an identical string. It misses transliteration variants and deliberate misspelling, so it is rarely used alone for sanctions screening.
• Fuzzy matching scores similarity between strings, catching near-misses and typos. This is the main driver of alert volume and the main lever for tuning it.
• Phonetic matching flags names that sound alike even when spelled differently, which matters for Arabic transliteration but adds further volume if applied without limits.

Calibrating by risk tier

A single threshold across an entire customer base is a blunt instrument. A risk-based approach, the same principle UAE regulators expect in a business risk assessment, applies tighter thresholds, meaning more alerts, to higher-risk relationships and counterparties, and more permissive thresholds to lower-risk, well-understood domestic business. Our AML business risk assessment guide sets out the risk-rating methodology this calibration should sit on top of.

Whatever setting is chosen, write down why. “Set at vendor default” is not a defensible answer in an inspection. “Set at this level because our risk assessment rates this segment as X” is.

Building an alert triage workflow with real SLAs

An alert that sits unreviewed is a control that exists on paper only. Supervisors test this directly, by asking to see the current alert queue and how old the oldest open item is.

Tier the alerts

Not every alert carries the same urgency. A practical structure:

Set service levels for each tier, and measure them

A target review window only works as a control if someone tracks whether it was met. A monthly metric, alerts cleared within SLA versus total alerts, belongs in the MLRO’s reporting to senior management. Our MLRO responsibilities guide sets out what that upward report should contain more broadly.

Escalation when a match looks real

A Tier 1 alert that survives initial review as a plausible true match escalates immediately to the MLRO, not at the next team meeting. From there, the freeze-then-report sequence for a confirmed or partial sanctions match is a separate, time-critical process. Our CNMR and PNMR filing guide walks through the 24-hour freeze and five-business-day filing clock that starts the moment a match is confirmed.

Reducing false positives without missing a true match

The goal is not zero alerts. A programme that generates no alerts at all is usually screening too narrowly, not performing well. The goal is a false positive rate low enough that each alert gets the attention it deserves.

Whitelisting and suppression, governed carefully

Where the same low-risk individual triggers the same alert repeatedly, for example a common name that has been investigated and cleared multiple times, a documented whitelist entry can suppress the repeat alert. This is a legitimate control, not a workaround, provided it is approved by someone other than the analyst who wants the alert to stop appearing, reviewed periodically, and reversible the moment a list changes.

Periodic threshold review

A threshold set once and never revisited drifts out of step with the business as the customer base, product mix, and the sanctions lists themselves change. Review the match sensitivity on a set schedule, at least annually and after any material change in customer base or risk profile, and record what changed and why.

Quality-check sampling

Pull a sample of cleared alerts, not just open ones, on a regular basis and have a second reviewer check the original decision. This surfaces a reviewer who clears too fast, or a pattern the threshold is missing, long before a supervisor finds it first.

Re-screening cadence: onboarding is not enough

A customer screened clean on day one is not permanently clean. Sanctions lists change, and a customer’s own risk profile changes with them.

Trigger-based re-screening

Every update to a relevant sanctions list should trigger a re-screen of the existing customer book against that update, not just new applicants. This is the single most commonly missed control in UAE sanctions screening: firms screen well at onboarding and stop there.

Batch re-screening the existing book

Beyond list-triggered checks, run a full batch re-screen of the existing customer and counterparty base on a defined schedule, commonly aligned with the periodic KYC review cycle for each risk tier. Document the date, the scope, and the outcome of each batch run so a supervisor can see the control operated, not just that it exists in policy.

Documenting alert decisions so they survive an inspection

Every alert, cleared or escalated, needs a record that stands on its own without someone having to explain it from memory. At minimum, log:

• The alert date and the list or watchlist that generated it
• The identifiers compared, name, date of birth, nationality, and any others available
• The match score or basis for the alert
• The decision reached, confirmed match, partial match, or discounted as a false positive
• The name of the person who made the decision and the date
• The reasoning, in enough detail that a different reviewer could follow it

UAE record-keeping rules require this kind of evidence to be retained for a minimum of five years, including for alerts later discounted as false positives. Our AML record-keeping requirements guide covers the retention rules in full. The same documentation discipline applies to adverse media and PEP alerts, which run through a similar review-and-decide process. See our guides to adverse media screening and PEP screening in the UAE for how those alert types differ in practice.

What UAE supervisors expect to see in an inspection

When a CBUAE, Ministry of Economy, or free-zone supervisor reviews a sanctions screening programme, the technology is almost never the first question. The first question is whether the firm can produce evidence that the process around the technology actually runs. Registration itself starts on the UAE FIU’s goAML portal, which also carries the notification channel most supervisors expect firms to be enrolled in for sanctions-related alerts.

A practical self-check before an inspection:

• Current match thresholds, with a dated rationale for why each one is set where it is, not just the vendor default.
• An alert log covering a representative period, showing tier, decision, decision-maker, and date for every alert, cleared and escalated alike.
• Evidence of SLA performance, not just an SLA policy: a report showing what share of alerts in each tier were actually cleared within the target window.
• A whitelist register, if one exists, showing who approved each suppression and when it was last reviewed.
• Proof of re-screening against at least the most recent list update, covering the existing customer book, not only new onboarding.
• A sample of discounted false positives with reasoning attached, ready to walk a reviewer through without needing to reconstruct the thinking from memory.

A firm that can produce all six on request has an alert management programme a supervisor can test. A firm that can only describe its screening tool has a gap, no matter how sophisticated that tool is.

Frequently Asked Questions

What is sanctions screening alert management?

It is the process of reviewing, deciding, and documenting what a sanctions or watchlist screening tool returns. Screening itself is the technical check against the lists; alert management is the human and governance layer that decides whether each result is a real match and records why.

Why do UAE sanctions screening programmes generate so many false positives?

Mainly transliteration variance between Arabic and Latin script, common names shared across a large resident population, and fuzzy-matching settings left at a vendor default rather than tuned to the UAE context.

What is a good match threshold for sanctions screening?

There is no single correct number. A defensible threshold is risk-based, tighter for higher-risk relationships and looser for lower-risk ones, documented with the reasoning behind each setting, and reviewed at least annually.

How often should existing customers be re-screened against sanctions lists?

Immediately after any relevant update to a sanctions list, and again on a batch cycle aligned with periodic KYC review for each risk tier. Screening only at onboarding leaves the existing customer book unchecked against new designations.

What should a sanctions alert SLA look like?

A tiered structure works well in practice. Same business day for a high-confidence alert against a UN or local designated-party list. Two to three business days for a standard alert. Up to five business days for a low-confidence, previously-seen pattern. Each tier should have a measured, reported turnaround.

Can whitelisting a false positive create compliance risk?

Yes, if it is done informally. An ungoverned whitelist can suppress a real alert the next time the underlying list changes. Treat whitelisting as a controlled exception: approved by someone other than the requesting analyst, reviewed periodically, and automatically re-tested against list updates.

What records must be kept for a discounted sanctions alert?

The alert date, the list that triggered it, the identifiers compared, the match score or basis, the decision and who made it, and the reasoning behind discounting it as a false positive. UAE rules require this evidence for a minimum of five years, the same as for a confirmed match.

Who is responsible for sanctions screening alerts, the analyst or the MLRO?

The analyst or screening team performs the first-line review, but the MLRO owns the overall programme, sets the escalation path, and answers to senior management and the supervisor for how alerts are handled. A Tier 1 alert that looks like a genuine match should reach the MLRO without delay.

Related Reading

• Targeted Financial Sanctions in the UAE
• CNMR and PNMR Filing on goAML: UAE Sanctions Guide
• PEP Screening in the UAE: A 2026 AML Compliance Guide
• Adverse Media Screening in the UAE: 2026 AML Guide
• MLRO Responsibilities in the UAE: 2026 Guide
• AML Business Risk Assessment in the UAE: 2026 Guide
• AML Record-Keeping Requirements in the UAE

A sanctions screening tool is only as good as the process built around its alerts. Getting the thresholds, the triage workflow, and the documentation right is what turns a screening subscription into an actual control. It is also what gives a UAE compliance team something defensible to show when a supervisor asks how an alert was handled.

First Compliance builds this alert management layer on top of its 1,800-plus sanction lists and 5.5 million-plus PEP records, and ADZ’s advisory team can review an existing screening setup against current UAE requirements. This article is general compliance guidance, not legal advice, and does not replace a review of your specific obligations by a qualified advisor.

The post Sanctions Screening Alert Management in the UAE: 2026 Guide appeared first on ADZ | Corporate Consulting Services | UAE.

Quick Answer: What Is a Real Estate Activity Report in the UAE?

A Real Estate Activity Report (REAR) is a goAML filing that UAE real estate brokers, agents, lawyers and notaries must submit to the Financial Intelligence Unit when a freehold property deal involves a cash payment of AED 55,000 or more, or any virtual asset payment, however small.

The requirement runs under Ministry of Economy and Tourism Circular No. 5 of 2022 and now sits inside the wider Federal Decree-Law No. 10 of 2025 AML framework. Filing happens on the same goAML portal used for suspicious transaction reports, but a REAR is not a substitute for an STR. If the transaction itself looks suspicious, that is a separate filing, on top of the REAR, not instead of it.

Key Takeaways

• REAR is a threshold report, not a suspicion report. You file one because a payment crossed a number, not because you suspect wrongdoing.
• AED 55,000 is the cash trigger. One payment or a linked series of instalments that reaches this figure in cash requires a filing.
• Virtual asset payments have no minimum. Any part of a property price settled in crypto or funds converted from crypto triggers a REAR, however small.
• The duty sits with the professional, not just the developer. Brokers, agents, lawyers and notaries who prepare, conduct or execute the transaction are the filers, not the buyer or seller.
• REAR and STR are not interchangeable. A transaction can require both: a REAR for the threshold and a separate STR if something about the deal looks wrong.
• Records survive the filing by five years. ID documents, contracts, source of funds evidence and the REAR itself all have to be retained.
• Non-filing is a federal breach with real teeth. Administrative penalties under Federal Decree-Law No. 10 of 2025 reach well beyond a formal warning, and licence suspension is on the table.

What Is a Real Estate Activity Report (REAR)?

Where the obligation comes from

The REAR was introduced by Ministry of Economy and Tourism Circular No. 5 of 2022, which came into force on 1 July 2022 to close a gap regulators had flagged for years: freehold real estate deals settled partly or wholly in cash, with no systematic record reaching the Financial Intelligence Unit. That circular is still the operative instrument for REAR mechanics in 2026. What has changed is the law sitting above it. Federal Decree-Law No. 10 of 2025, in force since 14 October 2025 and replacing the earlier Federal Decree-Law No. 20 of 2018, together with Cabinet Decision No. 134 of 2025, now sets the penalty structure, the beneficial ownership expectations, and the supervisory powers that apply when a REAR obligation is missed. A REAR filed in 2026 sits inside this federal framework even though the report itself still runs on the 2022 circular’s terms.

REAR vs other goAML report types

goAML hosts several distinct report types, and using the wrong one is treated as a filing deficiency during inspection. A REAR is triggered by a payment threshold on a specific real estate transaction. An STR is triggered by suspicion, regardless of value, and applies across every sector, not just real estate. A Dealers in Precious Metals and Stones Report (DPMSR) uses the same AED 55,000 figure but applies to a different sector entirely. The three reports are not substitutes for one another. A real estate deal can require a REAR, an STR, or both, depending on the facts.

Who Must File a REAR in the UAE

Real estate brokers and agents

Any licensed real estate broker or agent who prepares, conducts or executes a freehold property purchase or sale on behalf of a client is a Reporting Entity for REAR purposes. This applies on the mainland and inside commercial free zones alike. The Ministry of Economy and Tourism is the designated AML supervisor for this group, and it treats REAR registration and filing history as a first-line inspection item, ahead of deeper policy or training questions.

Lawyers, notaries and independent legal professionals

A lawyer, notary or other independent legal professional who prepares or executes a real estate transaction for a client carries the same REAR duty as a broker when they are the one handling the payment and transfer mechanics. A law firm that only drafts a sale and purchase agreement without touching the transaction’s execution is in a different position from one that also manages the funds and registration, and that distinction is worth documenting in your own file, not assuming.

When the obligation does not apply

REAR is a freehold transaction report. A rental agreement, a leasehold assignment, or an off-plan reservation deposit that never reaches a title transfer does not, on its own, trigger a REAR. The obligation attaches at the point a freehold sale or purchase is being prepared, conducted or executed with a qualifying payment, not at every stage of a broader real estate relationship. Reviewing the sector’s broader red flags alongside the REAR trigger helps a brokerage avoid the opposite mistake: treating every file as reportable and burying genuinely suspicious transactions in noise.

The AED 55,000 Filing Trigger, in Detail

REAR has two distinct triggers, and treating them as one is a common source of missed filings.

Cash payments

A single cash payment of AED 55,000 or more toward a freehold property purchase or sale triggers the report. Part payment counts just as much as full settlement: a buyer who pays AED 1,200,000 by bank transfer and AED 60,000 in cash has still crossed the line on the cash element alone, and the report is due regardless of how small that element is relative to the total deal. The AED 55,000 figure also governs the DPMSR threshold and sits below the AED 60,000 border declaration limit, and keeping those three numbers straight matters because supervisors test for exactly this kind of confusion during inspection.

Virtual asset payments

Any portion of a property price paid in virtual assets, or in funds that were converted from virtual assets at some point in the chain, triggers a REAR with no minimum value. This is the broadest trigger in the whole framework and reflects a specific regulatory concern: that crypto settlement is being used to obscure the origin of real estate purchase funds. A broker handling a deal with any crypto component should treat the REAR duty as automatic, not threshold-dependent.

Cumulative and instalment payments

Payments connected by buyer, timing or purpose are aggregated, not assessed in isolation. A buyer who pays AED 20,000 in cash on three separate visits toward the same unit has made a linked series worth AED 60,000, and the broker aggregates and reports on that basis. Brokerages that assess each instalment against the threshold on its own, without looking at the pattern across the file, are the ones that end up under-reporting, and that is the specific control weakness Ministry of Economy and Tourism inspectors are trained to probe.

Documents and CDD You Need Before Filing

A REAR filing is only as good as the customer due diligence behind it. Before you submit, you should hold:

• Buyer and seller identification. Emirates ID or passport copies for individuals, trade licence and incorporation documents for corporate parties.
• Beneficial ownership information. For a corporate buyer or seller, the register identifying the natural persons who ultimately own or control the entity, including through layered structures.
• Source of funds and source of wealth evidence. Bank statements, loan approvals, sale proceeds from a prior asset, or other documented origin for the payment, scaled to the size and risk profile of the transaction.
• Sanctions and PEP screening results. A documented check of both parties against UN, OFAC and UAE local sanctions lists, and against politically exposed persons databases, run at the time of the transaction, not months later.
• Transaction documentation. The sale and purchase agreement, payment schedule, and any instalment or escrow arrangement that explains how and when funds moved.

A practical example makes the gap visible. A brokerage closes a villa sale where the buyer pays AED 2,100,000 by bank transfer and a further AED 55,000 in cash to cover a furniture handover agreed outside the main contract. The transfer alone would never trigger a REAR. The AED 55,000 cash element does, on its own, regardless of how small it looks next to the transfer. A broker who only screens the headline sale price and never looks at the side payment misses the filing entirely, and that is the exact pattern Ministry of Economy and Tourism inspectors look for when they request a sample of closed files.

Step-by-Step: Filing a REAR on goAML

A brokerage that has never filed before needs to treat registration as its own project, not a step inside the first transaction that happens to need one.

1. Register as a Reporting Entity on goAML. This is a one-time registration with the UAE Financial Intelligence Unit, separate from any Ministry of Economy and Tourism licence renewal, and it must happen before the brokerage’s first REAR obligation arises, not after. Registration needs the trade licence, the compliance officer’s details, and confirmation of the designated activity, and it is worth starting weeks ahead of an anticipated large transaction rather than during one.
2. Confirm the transaction meets a REAR trigger. Check the payment pattern on the specific deal against the AED 55,000 cash threshold and the virtual asset trigger before you start the form, so you are not filing a report the transaction does not actually require.
3. Assemble the CDD package. Pull buyer and seller identification, beneficial ownership information, source of funds evidence and screening results together before opening the goAML form, because the form will not let you submit with gaps in the mandatory fields.
4. Complete the REAR form in goAML. Enter subject details for both parties, the property reference, the payment amount and method, and the transaction date, following the UAE Financial Intelligence Unit’s current REAR template fields.
5. Submit and retain the acknowledgement. goAML issues a submission reference on successful filing. Keep that reference with the transaction file, not only in the portal.
6. Retain all supporting records for five years. The REAR itself, the CDD documents behind it, and any internal notes on how the threshold was assessed all need to survive a Ministry of Economy and Tourism inspection that can happen well after the deal closed.

Common Reasons REAR Filings Get Rejected or Flagged

• Threshold miscalculated on instalment deals. Each payment assessed alone instead of aggregated across the linked series.
• Missing beneficial ownership detail for corporate buyers. A trade licence alone does not satisfy the UBO requirement when the buying entity has layered ownership.
• Source of funds left generic. A field marked “savings” or “business income” without supporting documentation reads as unresolved, not resolved, during inspection.
• Wrong report type filed. Filing an STR where a REAR was the correct report, or the reverse, because the two obligations were not assessed separately.
• Filing delayed past the transaction close. A REAR submitted weeks after the deal, assembled retroactively from memory rather than from a file built as the transaction progressed.

Penalties for Not Filing a REAR

A missed REAR is not a paperwork lapse that gets a warning letter. It is a breach of the AML framework the same as any other unfiled report, and it carries the same administrative exposure.

Enforcement against individuals, not just entities, is a live pattern in 2026. The Central Bank of the UAE has fined entities across the financial sector repeatedly through the year for AML control failures, with personal penalties against named compliance officers alongside institutional fines in more than one case. Real estate supervisors are following the same enforcement logic: a broker’s personal filing discipline is now a named line item in an inspection, not a background assumption.

How REAR Fits Into Your Wider AML Programme

REAR filing cannot sit on its own as an isolated form-filling task. It only works reliably when it is built on the same risk assessment, CDD standard and recordkeeping discipline that the rest of your AML programme runs on. A brokerage that treats real estate’s broader money laundering exposure as a live risk, not a compliance afterthought, catches REAR triggers earlier in the transaction and builds a cleaner file by the time it reaches goAML. That same discipline is what an independent auditor will test first.

The link back to your Enterprise-Wide Risk Assessment matters here too. A brokerage that rates cash-heavy, high-value freehold deals as higher risk in its EWRA should already expect those files to carry REAR exposure, and should staff, train and document accordingly rather than treating each filing as a surprise. Compliance officers who sit across both documents, the risk assessment and the transaction file, are the ones who catch a missed threshold before an inspector does.

Frequently Asked Questions

Who must file a Real Estate Activity Report in the UAE?

Real estate brokers, agents, lawyers and notaries who prepare, conduct or execute a freehold property purchase or sale on a client’s behalf must file. The buyer and seller themselves are not the filers; the professional handling the transaction is.

What is the AED 55,000 threshold for REAR?

It is the cash payment trigger. A single cash payment, or a linked series of instalments that together reach AED 55,000, toward a freehold property purchase or sale requires a REAR filing on goAML.

Does REAR apply to payments made in cryptocurrency?

Yes, and with no minimum value. Any part of a property price settled in virtual assets, or in funds converted from virtual assets, triggers a REAR regardless of how small the amount is.

Is REAR the same as filing an STR?

No. A REAR is a threshold report filed because a payment crossed a defined figure. An STR is filed because something about the transaction raises a reasonable ground for suspicion, independent of value. The same deal can require both.

Does REAR apply to off-plan property purchases?

REAR attaches to freehold sale and purchase transactions. A reservation deposit on an off-plan unit that has not reached a title transfer does not, by itself, trigger the report, but once the transaction proceeds to a qualifying freehold purchase with a cash or virtual asset payment at or above the trigger, the obligation applies.

What happens if a broker does not file a required REAR?

The brokerage faces administrative penalties under Federal Decree-Law No. 10 of 2025 that can reach up to AED 100,000,000 for serious violations, alongside possible licence restriction or suspension by the Ministry of Economy and Tourism and, in deliberate or repeated cases, criminal liability for the individuals responsible.

Do rental transactions require a REAR filing?

No. REAR applies to freehold purchase and sale transactions. A lease or rental agreement does not trigger the report on its own.

How long must REAR records be retained?

Five years from the transaction, in line with the general UAE AML recordkeeping standard. This covers the REAR filing itself, the customer due diligence file, and any internal notes on how the threshold was assessed.

Related Reading

• Money Laundering Through Real Estate in UAE
• AML Red Flags for Real Estate in the UAE
• Tokenised Real Estate AML Compliance in the UAE 2026
• Cash Transaction Reporting UAE: The 2026 AML Guide
• How to File an STR in the UAE: 2026 goAML Reporting Guide
• CNMR and PNMR Filing on goAML: UAE Sanctions Guide
• Independent AML Audit in the UAE: The 2026 Guide

Filing a Real Estate Activity Report correctly comes down to the same discipline every UAE AML obligation rewards: know the trigger, build the file as the transaction happens, and keep the record. The UAE Financial Intelligence Unit and the Ministry of Economy and Tourism both treat REAR compliance as a live inspection item for UAE real estate professionals in 2026. ADZ helps real estate brokerages, agents and law firms map their REAR obligations, build the CDD package behind each filing, and run the goAML submission correctly the first time. This article is general compliance information, not legal advice. Confirm your specific REAR obligations with ADZ or your legal counsel before relying on any point in this article.

The post Real Estate Activity Report UAE: 2026 goAML Filing Guide appeared first on ADZ | Corporate Consulting Services | UAE.

Quick Answer: Do JAFZA and RAKEZ Companies Need AML Compliance?

Yes. Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 apply to every UAE legal person carrying out a designated activity, free zone or mainland. A JAFZA or RAKEZ company that falls into a DNFBP category, such as real estate brokerage, company formation services, or dealing in precious metals and stones, must register on goAML, run customer due diligence, keep a beneficial ownership register, and file suspicious transaction reports through the same federal channel as every other regulated entity. JAFZA and RAKEZ add their own licence-renewal document checks, not a separate compliance regime.

Key Takeaways

• Free zone status is not an exemption. The AML obligation attaches to the activity a company carries out, not to where it is licensed.
• JAFZA and RAKEZ are commercial free zones, not financial free zones. Neither sits under the DFSA or the FSRA, so a company registered there answers to the Ministry of Economy and Tourism or the Central Bank of the UAE depending on its activity, the same as a mainland company.
• goAML registration is the first test a supervisor checks. A JAFZA or RAKEZ DNFBP that has not registered is already in breach, regardless of whether it has ever filed a report.
• Document requests at renewal are a compliance checkpoint, not paperwork. Shareholder registers, UBO registers and financial statements that free zone authorities request map directly to federal recordkeeping duties.
• The beneficial ownership register has to be current, not filed once. A change in ownership or control has to be reflected without the delay that free zone companies commonly treat as acceptable.
• Independent audit applies to free zone companies too. Cabinet Decision No. 134 of 2025 does not carve out an exception for JAFZA or RAKEZ licensees.

Free Zone Status Does Not Exempt You from UAE AML Law

What federal law actually says

Federal Decree-Law No. 10 of 2025, which replaced the earlier Federal Decree-Law No. 20 of 2018, defines its scope by activity rather than by jurisdiction inside the UAE. A real estate brokerage, a corporate service provider, an accounting firm, or a dealer in precious metals and stones is a designated non-financial business or profession wherever it is licensed. The law does not list JAFZA or RAKEZ as carve-outs, because there is no carve-out to list.

This is the single most common misunderstanding ADZ sees among free zone clients. A trading company set up in RAKEZ assumes the free zone authority’s own compliance letter at renewal is the extent of its AML duty. It is not. The letter confirms the company has supplied documents the authority wants on file. It does not substitute for goAML registration, a risk assessment, or a working customer due diligence process.

Where free zones add their own layer

JAFZA and RAKEZ sit outside the DIFC and ADGM financial free zone model. Neither has its own AML rulebook or supervisor. What each does have is a set of corporate documents it asks a company to maintain and, in some cases, submit at licence renewal: a shareholder register, a UBO register, and recent financial statements. These exist primarily for corporate governance and economic substance purposes, but they overlap heavily with the records a federal AML programme already requires a DNFBP to keep. A company that treats the free zone’s request as a one-off renewal task, rather than as evidence its ongoing AML recordkeeping is current, is building the gap a supervisor will eventually find.

The supervisory split matters here. A JAFZA or RAKEZ company that is a DNFBP answers to the Ministry of Economy and Tourism for AML supervision in most cases, while one carrying out a financial activity such as payment services or lending answers to the Central Bank of the UAE. The free zone authority itself never acts as the AML supervisor. This is a different structure from the DIFC model, where the DFSA both licenses and supervises AML compliance for firms inside its own financial free zone. JAFZA and RAKEZ companies should expect two separate relationships: one with the free zone authority for the trade licence, and an entirely distinct one with the federal supervisor for AML.

JAFZA AML Compliance Requirements

Who at JAFZA needs to register

JAFZA hosts a wide mix of trading, logistics, manufacturing and services companies. Among these, the activities that trigger a federal AML obligation are the same as anywhere else in the UAE: real estate brokerage and development, corporate service provision, dealing in precious metals and stones above the cash threshold, accounting and audit services, and legal consultancy. A JAFZA-licensed general trading company that also brokers warehouse or industrial property, for example, has stepped into DNFBP territory the moment that activity starts, whether or not the trade licence description flags it clearly.

The document set JAFZA expects

At incorporation and renewal, JAFZA typically requests a shareholder register, a UBO register consistent with the company’s declared structure, and either audited financial statements or management accounts covering a recent period. None of this is JAFZA inventing an AML process. It is JAFZA checking that the corporate records a federally regulated DNFBP should already hold are in fact in order. A company that cannot produce a current UBO register at JAFZA renewal almost certainly cannot produce one for a goAML inspection either.

goAML registration for JAFZA companies

Registration happens directly with the UAE Financial Intelligence Unit through the goAML portal, not through JAFZA. A JAFZA company’s reporting officer, who does not need to carry a specific professional title but does need to be formally designated, completes the registration, and the company is then responsible for filing suspicious transaction reports, cash transaction reports where thresholds apply, and periodic declarations through that same portal. A missed registration is itself a supervisory violation and falls within the administrative fine bracket of AED 10,000 to AED 5 million per violation under the current law.

RAKEZ AML Compliance Requirements

Who at RAKEZ needs to register

RAKEZ licenses a large volume of small and medium trading, e-commerce, consultancy and industrial businesses, many run by a single owner-operator. The AML trigger is identical in principle to JAFZA: it depends on activity, not on company size. A RAKEZ-licensed consultancy that offers company formation or nominee director services to third parties is providing a corporate service, and corporate service provision is a designated activity. The owner-operator structure common at RAKEZ does not reduce the obligation, and in practice it often means there is no separate compliance function at all, which raises risk rather than lowering it.

The document set RAKEZ expects

RAKEZ’s renewal and compliance documentation generally mirrors JAFZA’s: shareholder and UBO registers current to the company’s actual ownership, and financial records appropriate to the company’s size and activity. Because RAKEZ hosts a high volume of smaller entities, a common failure point ADZ sees is a UBO register that was accurate at formation but was never updated after a shareholder changed, a share transfer completed, or a new director was appointed.

goAML and DNFBP self-assessment for RAKEZ companies

A RAKEZ company that falls into a DNFBP category carries the same goAML registration duty as a JAFZA company. Before registering, it is worth running a short internal check against the designated-activity list to confirm the obligation applies and to identify which specific duties, screening, reporting, record retention, follow from it. ADZ’s AML self-assessment guide for DNFBPs works through that check step by step.

JAFZA vs RAKEZ: Where the Requirements Actually Differ

The table makes the real point: the differences between JAFZA and RAKEZ are about the kind of company each tends to host, not about two different AML rulebooks. A JAFZA logistics group with a property arm and a RAKEZ one-person trading company answer to the identical federal law. What changes is which gap they are most likely to have missed.

Building the Compliance Programme Both Free Zones Expect

Enterprise-wide risk assessment

Every DNFBP, free zone or mainland, has to run an enterprise-wide risk assessment that looks at its customers, the products and services it offers, the geographies it deals with, and its delivery channels. For a JAFZA trading company this usually means weighing exposure to higher-risk trade corridors and counterparties; for a RAKEZ consultancy it more often means weighing the risk profile of the clients it forms companies for. The FATF Recommendations set the risk-based approach that Federal Decree-Law No. 10 of 2025 carries into UAE law, and ADZ’s AML business risk assessment guide sets out the methodology a UAE firm is expected to follow.

A risk assessment written once at formation and never revisited is one of the most common findings in a free zone compliance review. A JAFZA logistics company that starts shipping to a new corridor, or a RAKEZ consultancy that picks up its first client from a higher-risk jurisdiction, has changed its own risk profile the moment that relationship begins. The assessment has to be reviewed at least annually and whenever the business changes in a way that could raise or lower its exposure.

Customer due diligence and sanctions screening

Once the risk assessment is in place, customer due diligence has to be applied on a risk-based scale, standard checks for lower-risk relationships, enhanced checks for higher-risk ones such as politically exposed persons or customers from higher-risk jurisdictions. Screening against UAE and United Nations sanctions lists is not optional at any risk tier. First Compliance, ADZ’s proprietary software, automates this screening against more than 1,800 sanction lists and over 5.5 million PEP records, which matters most for exactly the kind of lean, owner-operator structure common at RAKEZ that has no dedicated compliance headcount to run checks manually.

UBO register and keeping it current

Both JAFZA and RAKEZ ask for a UBO register at renewal, and both expect it to reflect the company’s actual ownership at the time of the request, not its ownership at formation. Under the UAE’s beneficial ownership framework, any individual holding 25 percent or more of shares or voting rights, or who otherwise exercises control over the company, has to be identified and recorded, and the register has to be updated when that ownership changes. ADZ’s beneficial ownership guide for UAE companies covers the identification criteria and the update obligation in full.

Record retention and STR filing

Customer due diligence records, transaction records and the documents behind any report filed on goAML have to be retained for a minimum of five years from the relevant trigger point, typically the end of the business relationship or the date a transaction was completed. A suspicious transaction report has to be filed regardless of the value involved whenever grounds for suspicion exist, including where a company declines to proceed with a client relationship on AML grounds. ADZ’s goAML registration guide walks through registration and the reporting workflow that follows it.

When a Free Zone Company Needs an Independent Audit

Cabinet Decision No. 134 of 2025 requires an independent audit function that tests whether a company’s AML/CFT controls are adequate and actually working, and this requirement applies to JAFZA and RAKEZ DNFBPs on the same basis as any federally supervised firm. For a smaller RAKEZ company this is often the first moment an owner realises the compliance programme exists mostly on paper rather than in practice, since an audit tests live customer files and closed alerts rather than reading a policy document. ADZ’s independent AML audit guide sets out what an auditor actually tests and how findings get closed before a supervisor asks about them.

What a Ready JAFZA or RAKEZ Compliance File Looks Like

A file that would survive both a free zone renewal check and a federal AML inspection has a consistent shape, whichever free zone issued the licence:

• A written AML/CFT policy that names the designated activity, the risk assessment methodology, and the reporting officer by name and contact detail.
• A current enterprise-wide risk assessment, reviewed in the last twelve months or since the last material change to the business.
• A goAML registration confirmation, with the reporting officer’s login active and not left under a former employee’s credentials.
• Customer due diligence files for every active client relationship, showing the risk rating applied and the checks that matched it.
• Sanctions and PEP screening records, including evidence that screening is repeated periodically, not only at onboarding.
• A UBO register that matches the company’s actual shareholding as of today, with a dated log of when it was last reviewed.
• A training record showing staff who handle customer onboarding have received AML awareness training appropriate to their role.

None of this is exotic. It is the same file a DIFC or ADGM firm maintains, built for a company that happens to be licensed through a commercial free zone rather than a financial one. The gap ADZ sees most often at JAFZA and RAKEZ companies is not that the file is wrong. It is that most of these items do not exist yet, because nobody treated the free zone renewal pack as a signal that the rest of the file was due as well.

Common Mistakes Free Zone Companies Make

• Treating the free zone renewal pack as the compliance programme. Shareholder and UBO registers satisfy the authority. They do not satisfy goAML registration, screening, or reporting duties.
• Missing a DNFBP activity that grew informally. A trading licence that quietly expanded into brokering commercial property, or into offering nominee services to other companies, has crossed into designated-activity territory without anyone updating the compliance assessment.
• Letting the UBO register go stale. A share transfer or a new director appointed mid-year has to be reflected in the register promptly, not caught up at the next renewal cycle.
• Assuming a single owner-operator does not need a formal MLRO designation. The reporting officer requirement does not scale down with company size; it scales down with risk, which is a different test.
• Screening only at onboarding. Sanctions lists and PEP status change continuously, and a one-time check at account opening misses changes that happen afterward.

Frequently Asked Questions

Do JAFZA companies need to register on goAML?

Yes, if the company’s licensed activity falls into a designated non-financial business or profession category, such as real estate brokerage, corporate services, or dealing in precious metals and stones. Registration happens directly with the UAE Financial Intelligence Unit through the goAML portal, not through JAFZA.

Is AML compliance mandatory for RAKEZ free zone companies?

Yes. Federal Decree-Law No. 10 of 2025 applies by activity, not by free zone. A RAKEZ company offering company formation, nominee director or similar corporate services is a designated non-financial business or profession and carries the full set of federal AML obligations.

What AML documents does JAFZA ask for?

JAFZA typically requests a current shareholder register, a UBO register, and either audited financial statements or management accounts at incorporation and renewal. These support the free zone’s own governance checks and overlap with the records a federally regulated DNFBP already has to maintain.

Which RAKEZ business activities most commonly need AML registration?

Company formation and corporate services, real estate-related activity, and dealing in precious metals or stones are the most common triggers among RAKEZ-licensed businesses. General trading alone does not trigger DNFBP status unless the specific trade involves one of the designated categories.

Does being in a free zone reduce AML penalties?

No. Free zone registration has no bearing on the penalty structure under Federal Decree-Law No. 10 of 2025. Administrative fines of AED 10,000 to AED 5 million per violation, and criminal fines for legal persons of AED 5 million to AED 100 million, apply regardless of whether the company is licensed onshore or in a free zone.

Can one compliance programme cover a group with both JAFZA and RAKEZ entities?

Yes, provided the programme is built at the level of each licensed entity’s actual activity and risk profile rather than applied as a single generic policy. A group-wide risk assessment can sit at the parent level, but goAML registration, reporting officer designation and UBO registers apply entity by entity.

Related Reading

• AML Compliance for Free Zone Companies in the UAE
• AML Compliance for DMCC Companies in the UAE
• goAML Registration Guide 2026
• Beneficial Ownership in UAE AML Compliance
• AML Self-Assessment Guide for DNFBPs in UAE
• Independent AML Audit in the UAE: The 2026 Guide
• Federal Decree-Law No. 10 of 2025: UAE AML Compliance Guide
• UAE AML Compliance Checklist

A JAFZA or RAKEZ trade licence is proof you can operate in the UAE. It is not proof you are AML compliant, and the two get confused most often at exactly the point a bank, a supervisor, or a due diligence request from a counterparty asks for evidence of the second one.

This article is general guidance on UAE AML/CFT compliance for free zone companies and is not legal advice. Confirm your specific obligations with ADZ or your legal counsel before relying on any point in this article.

The post JAFZA and RAKEZ AML Compliance: UAE 2026 Free Zone Guide appeared first on ADZ | Corporate Consulting Services | UAE.