DIFC AML Compliance Consultant: DFSA AML Module Support

Who this is for

This page is for firms that need a DIFC AML compliance consultant because the Dubai Financial Services Authority, not the Ministry of Economy and Tourism, is their AML supervisor. If your entity holds a DFSA licence or is registered as a DNFBP in the Dubai International Financial Centre, the rules on this page apply to you, and the mainland guidance you may have read elsewhere does not. We work with firms in the following situations:

• An Authorised Firm (asset manager, advisory firm, fund manager, broker, insurer or intermediary) that has received a DFSA information request or has a thematic or risk assessment visit coming up.
• A law firm, accounting practice or corporate service provider registered as a DNFBP in DIFC that has never had its AML framework reviewed independently.
• A single family office or holding structure in DIFC that is unsure how far the module applies to its activities and wants a clear answer.
• A newly licensed firm whose AML policies were drafted during the application process and have not been tested against how the business actually operates.
• A firm whose MLRO has resigned, is on extended leave or holds the role alongside several other functions and needs structured support.

What the DFSA AML Module requires of DIFC firms

The DFSA's AML, CTF and Sanctions Module is the rulebook that translates UAE federal AML law into obligations for firms in the Centre. It sits beneath Federal Decree-Law No. 10 of 2025, the current UAE AML law, which gives every Supervisory Authority, including the DFSA, the power to impose administrative fines of AED 10,000 to AED 5,000,000 per violation alongside written warnings, sector bans and licence restriction, suspension or revocation. Our guide to the DFSA AML, CTF and Sanctions Module walks through the structure in detail; this page summarises what matters commercially.

In plain terms, the module expects a DIFC firm to do the following, and to be able to prove it did so:

• Appoint a Money Laundering Reporting Officer with sufficient seniority, independence and time to do the job, and keep the DFSA informed of who holds the role.
• Prepare and maintain a business risk assessment covering customers, products, delivery channels, jurisdictions and transactions, and use it to shape the rest of the programme.
• Apply risk-based customer due diligence, including identification of beneficial owners, enhanced measures for higher-risk relationships and politically exposed persons, and ongoing monitoring throughout the relationship.
• Screen customers and transactions against UN and UAE sanctions lists and act on matches without delay.
• Report suspicious activity to the UAE Financial Intelligence Unit through goAML, and keep internal records of what was considered and why.
• Train staff on AML risks relevant to their roles, and keep evidence that the training took place.
• Submit an annual AML return to the DFSA and respond to the DFSA's supervisory requests.

Each of these is a documented expectation, not a suggestion. The DFSA has published enforcement outcomes against DIFC firms for AML failings, and the pattern in those cases is consistent: policies that existed on paper but were not applied, risk assessments that were never refreshed, MLROs without the resources to do the role properly. The exact wording of each requirement changes from time to time, so for specific rule references check the current published text of the module on the DFSA website rather than relying on a summary. Our DFSA industry page explains how the regulator's approach differs from the mainland supervisors.

What Adventant does

The engagement follows a fixed sequence. Scope, deliverables and fees are agreed in writing before the first workshop, and nothing is added without your sign-off.

1. Scoping call and document request (week 1). We confirm your DFSA category, your DNFBP registration status if relevant, your business model and the review history. We send a document list covering your AML policy, business risk assessment, customer files, screening records, training logs, STR register and most recent annual AML return.
2. Gap assessment against the module (typically weeks 2 to 3). We test each area of the module against what your firm actually does, not what the policy says. This includes sample testing of customer files, a walk-through of your onboarding and monitoring process with the people who run it, and a review of how the MLRO's role operates in practice.
3. Findings report and prioritised remediation plan (week 3 or 4). You receive a written report that grades each finding, explains the regulatory basis and sets out what good looks like. The remediation plan is sequenced by risk and effort so you can see what must be fixed first.
4. Policy and procedure build or rewrite (typically weeks 4 to 7). Where documents are missing or generic, we rewrite them to fit your business. This covers the AML policy, the business risk assessment, customer risk rating methodology, CDD and EDD procedures, sanctions screening procedures, STR escalation procedures and the training plan.
5. MLRO support or outsourced MLRO. Where the DFSA's rules permit for the firm's category, we can act as or alongside your MLRO under a defined mandate. Where they do not, we provide structured support to the appointed individual: periodic reviews, escalation advice, STR drafting support and preparation of MLRO reporting to the board. See our compliance officer and MLRO support service.
6. Annual AML return preparation. We help compile the data, review the responses for consistency with your risk assessment and policies, and flag anything that could invite follow-up questions before it is submitted.
7. Inspection readiness. Ahead of a DFSA visit or thematic review, we run a mock review: document pack preparation, interview preparation for the MLRO and senior management, and a final check that remediation items have been closed with evidence.

What you receive

Why businesses choose us for this

• Our consultants are former senior compliance leaders from UAE banks, including Standard Chartered, RAKBANK and FAB, who have run AML programmes under regulatory scrutiny rather than written about them.
• We have direct experience of regulatory inspections and remediation, including preparing document packs, briefing management for interviews and closing findings to a regulator's satisfaction.
• Our work is practical and firm-specific. We do not sell a policy template with your name inserted; we build procedures around how your DIFC firm actually onboards and serves clients.
• Fixed scope agreed up front. You know the deliverables, the timeline and the fee before work begins, and changes are agreed in writing.
• Dubai-based with UAE-wide coverage. We can be in the Centre for workshops and interviews, and we also support groups with entities in ADGM and on the mainland so that one framework works across supervisors.

Common mistakes we see

• Treating the mainland MoET guidance as if it applied in DIFC, so the firm follows the wrong rulebook and misses DFSA-specific expectations such as the annual AML return.
• A business risk assessment written once at licensing and never updated, even after the firm added new products, jurisdictions or client types.
• An MLRO who holds the role alongside finance, operations or the CEO position, with no documented time allocation and no independent reporting line to the board.
• Customer risk ratings assigned by default to 'medium' with no methodology behind them, which makes enhanced due diligence impossible to justify or evidence.
• Sanctions screening performed only at onboarding, with no rescreening when lists change and no record of how alerts were cleared.
• No internal STR consideration log, so the firm cannot show that unusual activity was looked at even when a report was not ultimately filed. Our note on why zero STRs does not mean zero risk explains why this matters.
• Training recorded as a single annual slide deck sent by email, with no attendance record, no testing and no tailoring to the roles that actually face customers.

Related reading

• Guide: the DFSA AML, CTF and Sanctions Module
• DFSA-regulated firms: how we work with the regulator's approach
• How to write an AML business risk assessment in the UAE
• AML inspection readiness checklist for UAE firms
• Preparing for an independent AML review

Next step

If you are not certain how your DIFC firm would fare under a DFSA review, the quickest way to find out is a scoped gap assessment. Send us your DFSA category, your most recent AML policy and business risk assessment and we will reply with a fixed-scope proposal..

General information, not legal advice. Check current requirements with your supervisory authority.