ADGM AML Compliance Consultant: FSRA Rulebook Support

Who this is for

This page is for owners, senior executive officers, compliance officers and MLROs of firms established in Abu Dhabi Global Market who need an ADGM AML compliance consultant with a working knowledge of the FSRA. That includes Authorised Persons holding a Financial Services Permission, and DNFBPs that are registered with the ADGM Registration Authority and supervised for AML purposes by the FSRA. Typical situations we are brought into:

• A newly authorised asset manager, adviser or fund platform that needs its first AML framework built to the FSRA's standard before onboarding clients.
• A single family office or multi-family office that has grown past the point where a part-time arrangement for the MLRO role is defensible.
• A corporate service provider, law firm or accounting practice registered as a DNFBP in ADGM that has been asked to complete its annual AML return and is unsure what good looks like.
• A firm whose MLRO has resigned and needs interim cover while a permanent appointment is sought and approved.
• A business centre or co-working operator in ADGM that has been told it carries DNFBP obligations and does not yet have policies, a risk assessment or a trained team.

What FSRA AML compliance requires of an ADGM firm

ADGM firms sit under two layers of AML obligation. The first is federal: Federal Decree-Law No. 10 of 2025 applies across the UAE, including the financial free zones, and it is the source of the administrative penalties (AED 10,000 to AED 5,000,000 per violation, plus warnings, sector bans and licence restriction, suspension or revocation) and the criminal offences. The second layer is the FSRA's own AML and Sanctions Rules and Guidance, which translates the federal requirements into detailed expectations for firms inside ADGM. We have summarised that rulebook in our guide to the FSRA AML and Sanctions Rulebook.

In plain terms, the FSRA expects an ADGM firm to have the following in place and to be able to evidence each of them on request:

• An appointed MLRO of appropriate seniority, independence and residency, with access to the board or governing body and the resources to do the job.
• A documented business risk assessment that identifies the money laundering, terrorist financing, proliferation financing and sanctions risks the firm faces, and shows how controls respond to them.
• Customer due diligence proportionate to risk, including beneficial ownership identification, PEP checks and enhanced measures for higher-risk relationships.
• Ongoing monitoring of customer activity and periodic review of customer files.
• Suspicious transaction and activity reporting through the UAE FIU's goAML platform, with goAML registration in place for the firm.
• Sanctions screening against UN and UAE lists, with the ability to freeze and report without delay.
• AML training for staff, with records, and an annual AML return submitted to the FSRA covering the firm's framework and activity for the period.

Where the rulebook sets precise time limits, thresholds or formats, we work from the current published text rather than from memory, and we recommend you do the same. The FSRA revises its rules and guidance, and an obligation that was described one way two years ago may now be framed differently.

What Adventant does

Every engagement starts with a gap assessment and ends with a framework your MLRO can run without us if you choose. The steps below are the standard shape; the scope is fixed in a written proposal before any work begins.

1. Scoping call and document request. We confirm your regulatory category (Authorised Person, Registration Authority DNFBP, or both), the activities you carry on and the client base. You receive a document request list the same week.
2. Gap assessment against the FSRA AML and Sanctions Rulebook. We review your policies, business risk assessment, customer files, screening records, training records, STR history and governance against each rulebook area. Typically two to three weeks from receipt of documents. Deliverable: a findings report rated by severity with a prioritised remediation plan.
3. Policy and risk assessment build or rewrite. Where gaps exist, we draft or redraft the AML and sanctions policy, the business risk assessment and the customer risk methodology, written for your activities rather than lifted from a template. Typically two to four weeks, including one round of review with your MLRO and board.
4. MLRO support or outsourced MLRO. For firms whose category permits it, we can take the MLRO appointment, subject to FSRA approval. For firms that must appoint in-house, we provide ongoing support: case reviews, STR drafting, periodic reporting to the board and a sounding board for difficult onboarding decisions.
5. Annual AML return preparation. We assemble the data, test it against your records so the return reconciles with what an inspector would find, and sit with your MLRO while the submission is completed in the FSRA's system.
6. Inspection readiness. Before an FSRA visit or thematic review, we run a mock inspection: a document walkthrough, interviews with the SEO and MLRO, and sample testing of customer files. You receive a short list of items to fix before the regulator arrives. See our inspection readiness checklist for the areas we cover.
7. Handover and training. We train the team on the final framework and hand over an operating calendar listing every recurring AML task for the year.

What you receive

Why businesses choose us for this

• Our consultants are former senior compliance leaders from UAE banks, including Standard Chartered, RAKBANK and FAB, who have run AML functions supervised by the Central Bank and worked with free zone regulators.
• We have direct experience of regulatory inspections and the remediation that follows, so our advice is shaped by what inspectors actually test, not by what a template says.
• Our documents are written for your firm. A family office, a fund adviser and a corporate service provider in ADGM face different risks and should not share a policy.
• Scope, deliverables and fees are agreed in writing before we start, so there is no drift and no surprise invoices.
• We are based in Dubai and work across the UAE, with regular presence in Abu Dhabi for ADGM clients who prefer meetings in person.

Common mistakes we see

• Treating the federal law as the whole obligation and never reading the FSRA AML and Sanctions Rulebook, which is where the detailed expectations sit.
• A business risk assessment that lists risks but never links them to controls or to the customer risk methodology, so the risk-based approach exists only on paper. Our guide to writing a business risk assessment explains the fix.
• An MLRO who is also the SEO, the finance head and the only person who reviews their own decisions, with no record of board reporting.
• Beneficial ownership established at onboarding and never refreshed, despite changes in the structure chart that the firm itself helped to implement.
• Sanctions screening run against one commercial list without checking the UAE's own designations, or without a documented process for what happens when there is a match.
• An annual AML return completed from memory, with figures that do not match the firm's own STR log or training records.
• Zero suspicious transaction reports over several years treated as proof of a clean book rather than a point the inspector will probe. See zero STRs does not mean zero risk.

Related reading

• Guide: the FSRA AML and Sanctions Rulebook explained
• Working with the ADGM FSRA as your AML supervisor
• How to write an AML business risk assessment in the UAE
• goAML reporting guide for UAE firms
• How to choose an outsourced MLRO in the UAE

Next step

If you are unsure whether your ADGM firm's framework would stand up to an FSRA review, start with a conversation. We will ask about your category, your client base and when you last tested your controls, and tell you honestly whether a gap assessment is warranted or whether a narrower piece of work would serve you better.

General information, not legal advice. Check current requirements with your supervisory authority.