FATF 2026 Readiness for UAE DNFBPs: Inspection-Proof Your AML Programme

Who this is for

This page explains FATF 2026 readiness for DNFBPs in the UAE: what the mutual evaluation means for a mainland business supervised by the Ministry of Economy and Tourism (MoET), what an inspector will ask you to produce, and how Adventant's readiness engagement works. It is written for owners and compliance leads who want to know where they stand before the supervisor asks. If you want the background first, read our explainer on the UAE FATF mutual evaluation in 2026 and our AML inspection readiness checklist.

The engagement suits businesses in situations such as these:

• A real estate brokerage or company service provider that has never been inspected and has an AML manual that was written at licensing and not revisited since.
• A dealer in precious metals and stones, accountancy practice or law firm that has received a questionnaire or data request from MoET and is unsure how to answer it well.
• A DNFBP that passed a previous inspection on paperwork but knows its screening, monitoring or STR decisions would not stand up to a file-by-file review.
• A group with several licensed entities that wants a consistent, defensible evidence pack across all of them before the 2026 cycle.
• A board or owner who has been told the programme is fine and wants an independent view from people who have sat on the other side of an inspection.

What the FATF 2026 mutual evaluation means for your business

The Financial Action Task Force assesses countries, not companies. The UAE's 5th-round mutual evaluation is scheduled for 2026, although on-site dates had not been officially confirmed at the time of writing, so check the current published text. Assessors will look at whether the UAE's AML and CFT framework is effective in practice, and one of the things they examine closely is whether supervisors of DNFBPs are identifying and correcting weaknesses in the firms they oversee.

That is why a country-level evaluation lands on your desk. The UAE was removed from the FATF grey list in February 2024 after a sustained enforcement effort, and supervisory authorities have every reason to demonstrate that effectiveness is being maintained. For a DNFBP, the practical consequence is a higher chance of an inspection, a questionnaire or a data request, and a greater focus on whether controls work rather than whether documents exist.

The legal basis has not changed in your favour. Federal Decree-Law No. 10 of 2025, which replaced the 2018 law, allows the Supervisory Authority to impose administrative fines of AED 10,000 to AED 5,000,000 per violation, issue written warnings, ban individuals from the sector and restrict, suspend or revoke a licence. See our guide to AML fines and penalties in the UAE and our overview of the MoET AML regime under the 2025 law.

In our experience, an effectiveness-focused inspection of a DNFBP concentrates on four things:

• Evidence requests: the business risk assessment, a sample of CDD files, screening logs with match dispositions, the record of STR decisions including decisions not to report, training records and board or management minutes showing AML was discussed.
• Beneficial ownership accuracy: whether the ultimate beneficial owners recorded on file match the corporate documents, whether changes have been picked up, and whether the information agrees with what has been registered elsewhere.
• STR quality: whether suspicious activity was recognised, escalated and reported on goAML with a clear narrative, and whether the compliance officer can explain why cases were closed without reporting.
• Consistency: whether what the policy says, what the risk assessment says and what the files show are the same thing.

What Adventant does

Our FATF 2026 readiness engagement for DNFBPs is a fixed-scope project. The steps below describe the standard shape; the scope is agreed in writing before work begins.

1. Scoping call and document request. We confirm your licence category, supervisor, customer base, products and delivery channels, and issue a document request list. Typically completed in the first week.
2. Readiness assessment scored against inspector expectations. We review the risk assessment, policies, CDD files, screening and monitoring records, STR decisions, training and governance, and score each area against what inspectors ask for rather than against a generic template. Typically two weeks, depending on the number of files and entities.
3. Findings and prioritised remediation plan. You receive a written report ranking gaps by regulatory exposure, with a clear owner, action and target date for each. Nothing is marked as a finding without a stated reason and a stated fix.
4. Evidence pack build. We assemble the pack an inspector will expect to see: an index of policies and their approval dates, the current risk assessment, sampled CDD files with explanations, screening and monitoring logs, the STR decision register, training records and governance minutes. Where records are missing, we help you reconstruct what can honestly be reconstructed and document what cannot.
5. Remediation sprint. Working with your compliance officer, we close the gaps that can be closed within the engagement window: updating the risk assessment, correcting beneficial ownership records, tightening screening dispositions, documenting STR decisions and refreshing training. Typically two to four weeks.
6. Mock inspection with question and answer. We conduct a rehearsal in the format a supervisor uses: an opening meeting, a file walkthrough, questions to the compliance officer and senior management, and a request for records at short notice. You see where answers are weak before it matters.
7. Management briefing. A short session for owners, partners or the board setting out what was found, what has been fixed, what remains open and how to answer the questions senior management is most likely to be asked.

What you receive

Why businesses choose us for this

• Our team is made up of former senior compliance leaders from banks in the UAE, including Standard Chartered, RAKBANK and FAB, who have run AML programmes under direct regulatory scrutiny.
• We have first-hand experience of regulatory inspections and of remediating findings afterwards, so we know what the questions are and what a convincing answer looks like.
• The work is practical rather than template-driven: we review your actual files, your actual screening dispositions and your actual STR decisions.
• The scope, deliverables and fee are agreed in writing before we start, and we do not expand them without your agreement.
• We are based in Dubai and work with businesses across all seven emirates, on the mainland and in the financial free zones.

Common mistakes we see

• Treating a signed and dated AML manual as proof of compliance when the files show the procedures are not followed, a point we expand on in an up-to-date manual is not the same as a compliant one.
• A business risk assessment that lists generic risks and does not change the customer risk ratings, the CDD depth or the monitoring applied.
• Beneficial ownership records that were accurate at onboarding and have never been refreshed, so they no longer match the corporate documents.
• Screening logs with matches marked as false positives and no recorded reason for the decision.
• Zero STRs filed over a long period with no record that anyone considered whether reporting was warranted, which we discuss in zero STRs does not mean zero risk.
• Training recorded as an annual attendance list with no content, no test and no evidence that front-line staff know how to escalate.
• No management or board minutes showing that AML risk, inspection findings or STR volumes were ever discussed.

Related reading

• The UAE FATF mutual evaluation in 2026: what it means for regulated businesses
• AML inspection readiness checklist for the UAE
• KYC and beneficial ownership checklist
• How to write an AML business risk assessment
• MoET supervision of DNFBPs

Next step

If you are a DNFBP supervised by MoET and want to know how your programme would hold up under an effectiveness-focused inspection, start with a scoping call. We will tell you honestly whether a full readiness engagement is warranted or whether a narrower independent AML compliance review would serve you better.

General information, not legal advice. Check current requirements with your supervisory authority.