AML Software for DNFBPs in the UAE: Selection and Implementation

Who this is for

This page is for owners, compliance officers and MLROs of designated non-financial businesses and professions who need to choose, replace or properly implement AML software for DNFBPs in the UAE. It is written for people who have to make a decision and defend it to a regulator, not for software buyers at a bank. Typical situations include:

• A real estate brokerage or precious metals dealer screening customers manually against a free online search, with no record of what was checked or when.
• An accounting, audit or corporate services firm that has outgrown spreadsheets across several hundred clients.
• A law firm or company service provider with an inspection finding on screening or ongoing monitoring that must show a remediated process.
• A DNFBP that pays for a screening tool but has never tuned it and has thousands of unresolved alerts.
• A group with several licensed entities that wants one system, one set of procedures and one audit trail.

What the law requires, and where software fits

Federal Decree-Law No. 10 of 2025 requires every regulated entity to identify and verify its customers and beneficial owners, assess customer risk, apply targeted financial sanctions without delay, monitor business relationships on an ongoing basis, and report suspicious transactions to the Financial Intelligence Unit through goAML. The law does not say you must buy software. It says you must achieve these outcomes reliably, and demonstrate that you have.

For a firm with a handful of customers, a documented manual process can be defensible. For most DNFBPs it is not: manual screening is not repeated when lists change, leaves no timestamped evidence, and depends on whoever did the check. Administrative fines range from AED 10,000 to AED 5,000,000 per violation, and weak screening and monitoring are common findings in MoET inspections. Software is the practical way to make the obligation repeatable.

The three things AML software actually does

Strip away the marketing language and every AML platform offers some combination of three functions:

1. Sanctions and PEP screening. Checking customers, beneficial owners, directors and counterparties against the UN Consolidated List, the UAE Local Terrorist List, other relevant sanctions programmes, PEP databases and adverse media, at onboarding and continuously as lists update.
2. Customer or transaction monitoring. Watching for changes in customer risk, unusual patterns, cash thresholds, structuring, or activity inconsistent with the profile. For most DNFBPs this is periodic customer review with a small number of transaction rules.
3. Case management and reporting. Recording each alert, who reviewed it, what they found, why it was closed or escalated, and assembling what is needed to file a suspicious transaction report on goAML. This is where inspectors spend the most time.

What a small DNFBP needs versus what a bank needs

A bank processes millions of payments and needs real-time interdiction, scenario engines and a tuning team. A real estate broker with two hundred active clients needs none of that. Over-buying creates its own problem: a platform nobody understands produces alerts nobody clears, and an unresolved alert queue is a worse inspection outcome than a simple system used properly. Your business risk assessment should tell you how much monitoring you need, and your documented screening process should drive the configuration.

What Adventant does

We run selection and implementation as a fixed-scope engagement. Where you already have a tool, we start at configuration or validation. Timings are typical for a single-entity DNFBP and depend on vendor responsiveness and the state of your customer data.

1. Requirements from the risk assessment (typically week 1). We read your business risk assessment, customer base and current procedures and translate them into requirements: which lists, how often to rescreen, which monitoring rules, who needs access, what the audit trail must show. If the risk assessment is out of date, we say so first.
2. Shortlist (typically weeks 1 to 2). We identify options at the right scale and price point, issue a written vendor questionnaire covering coverage, matching, residency, integration and exit, attend demonstrations with you and score responses against your requirements, not the vendor's script.
3. Selection and contracting (typically week 3). We compare cost models, review the data processing and service terms, and confirm how you get your data out if you leave.
4. Configuration (typically weeks 3 to 5). We set matching sensitivity, list selection, risk-rating parameters, rescreening frequency and monitoring rules in line with your risk assessment, and document every setting with a reason.
5. Testing and validation (typically weeks 5 to 6). We run known test names, including transliteration variants, to confirm the system catches what it should, measure the false positive rate on your real customer file, adjust and record the results as evidence.
6. Procedures and training (typically week 6). We update your AML policies and procedures, write the alert-handling workflow, and train the people who will clear alerts and escalate to the MLRO.
7. Go-live and tuning (typically weeks 7 to 10). We review the first weeks of live alerts, retune where the configuration produces noise or misses matches, and hand over a tuning log the regulator can read.

Adventant also offers its own screening and monitoring platform, TruDiligent. We mention it because it should be disclosed, not because this page is a sales route for it. When advising on selection we assess our platform against the same questionnaire as every other option, and we will tell you if another tool or a manual process is the better fit for your firm.

What you receive

Why businesses choose us for this

• Former senior compliance leaders from UAE banks who have run screening and monitoring systems at scale and know what breaks in practice.
• Direct experience of regulatory inspections and remediation, so we configure and document with the inspector's questions in mind.
• Vendor-neutral advice, with our own platform disclosed so you can judge the advice accordingly.
• Practical, not template-driven: thresholds are tested on your customer file, not copied from a default profile.
• Fixed scope agreed up front, with the stages above as the contract.
• Dubai-based with coverage across the UAE, including mainland DNFBPs under MoET and entities in DIFC and ADGM.

How to evaluate AML screening software for a UAE DNFBP

If you run the evaluation yourself, these questions separate suitable tools from unsuitable ones. Ask each vendor to answer in writing.

• List coverage and update frequency. Are the UN Consolidated List and the UAE Local Terrorist List included as standard, how quickly does a new designation appear in the product, and are existing customers rescreened automatically when lists change?
• Fuzzy matching and false positives. How does it handle Arabic transliteration, name order and common names? Can sensitivity be adjusted per list or risk band?
• Audit trail. Does every alert record who reviewed it, when, what they looked at and why it was closed, exportable unchanged for an inspector?
• Data residency. Where is customer data stored and processed, confirmed in writing?
• Cost model. Per user, per screening, per record or flat fee? Model your real volumes over three years before comparing.
• Integration. Bulk customer upload today, connection to your CRM or practice system later, without a bespoke project?
• Exit. Can you export all records, alert histories and decisions in a readable format if you leave? Retention obligations outlive the contract.

Common mistakes we see

• Buying a platform designed for banks, then switching off most of it because nobody can manage the alert volume.
• Accepting the vendor's default matching threshold without testing it against the firm's own customer names.
• Screening at onboarding only, with no automatic rescreening when sanctions lists change.
• Closing alerts with a one-word note, leaving no explanation an inspector could follow.
• Treating the software purchase as the compliance programme, with procedures and training never updated to match.
• Signing a multi-year contract without confirming data export rights or where the data is hosted.
• Leaving a backlog of unresolved alerts for months, which is read as a monitoring failure rather than a resourcing issue.

Related reading

• Sanctions and PEP screening process in the UAE
• How to write an AML business risk assessment
• goAML reporting guide
• AML inspection readiness checklist
• Zero STRs does not mean zero risk

Next step

If you are choosing a system, replacing one, or making an existing one defensible before an inspection, a short conversation about your customer base and current process is enough for us to say what scale of tool you need and what the engagement involves. If you would rather not run a system in-house, we also provide outsourced screening and customer monitoring.

General information, not legal advice. Check current requirements with your supervisory authority.