Compliance advisers working through documents at a meeting table

AML advisory, UAE · 11 min read

Outsourced MLRO and Compliance Officer for DNFBPs in the UAE

Mainland DNFBPs must appoint a competent compliance officer but many are too small for a full-time hire. Here is what an outsourced MLRO does, what stays with you, and how the engagement works.

Talk to us

In short

An outsourced MLRO for DNFBPs in the UAE is a named, experienced individual appointed by your business to carry out the compliance officer function required under Federal Decree-Law No. 10 of 2025 and MoET's supervisory rules. Adventant provides that person, documents the appointment properly, runs your risk assessment, customer due diligence oversight, goAML reporting, training and management reporting, and works to a fixed monthly scope. Senior management accountability stays with the business; the day-to-day expertise comes from us.

Every mainland DNFBP supervised by MoET must appoint a compliance officer with adequate seniority, competence and access to information.
Outsourcing the role is a legitimate way to meet the requirement when a full-time hire is not proportionate, provided the appointment is documented and the person actually performs the function.
The compliance officer owns the business risk assessment, CDD oversight, STR decisions and goAML filing, record keeping, training and reporting to management.
Senior management accountability for AML compliance does not transfer to the outsourced provider.
Whether the person must be UAE-based and whether the regulator must be notified depends on the supervisory authority and sector rules, which must be checked against current published guidance.
Adventant works to a fixed scope: appointment, onboarding, a monthly operating rhythm, quarterly management reporting and an annual review.

Who this is for

This page explains what an outsourced MLRO for DNFBPs in the UAE actually involves, for owners and general managers of mainland businesses that are regulated for anti-money laundering purposes but do not have a compliance function in-house. If one of the following describes you, read on.

A real estate brokerage in Dubai, Abu Dhabi or Sharjah that has registered on goAML, named a director as compliance officer on the form, and has done little since.
A dealer in precious metals and stones that handles cash or high-value transactions and has been told by MoET or its bank that it needs a qualified compliance officer.
An accounting, audit or bookkeeping practice with a handful of partners, none of whom has time to run AML compliance alongside client work.
A company service provider or law firm forming companies and acting for clients, where the owner has been the compliance officer by default and wants to hand the role to a professional.
A small financial business in DIFC, ADGM or under CBUAE or SCA that is between MLROs and needs cover while it recruits.

The obligation: why a DNFBP needs a compliance officer

Under Federal Decree-Law No. 10 of 2025, the current UAE AML law, designated non-financial businesses and professions are subject to the same core obligations as financial institutions: identify and assess money laundering and terrorist financing risk, apply customer due diligence, keep records, report suspicious transactions to the Financial Intelligence Unit through goAML, and put in place internal controls. Those controls must include a compliance officer. For mainland DNFBPs the supervisory authority is the Ministry of Economy and Tourism.

The compliance officer, often called the MLRO in the financial sector, is the person the regulator holds to account for the day-to-day operation of the AML programme. The law and MoET guidance expect that person to have adequate seniority, relevant competence, independence from the front line where possible, and access to all customer and transaction information. Naming a junior employee on the goAML registration form does not meet the standard.

In practice the compliance officer is responsible for the following:

Preparing and maintaining the business risk assessment and keeping it aligned with the AML policy.
Overseeing customer due diligence: onboarding checks, beneficial ownership, sanctions and PEP screening, enhanced due diligence and periodic review.
Receiving internal reports of suspicious activity, deciding whether to file, and submitting STRs, SARs and other reports on goAML within the required time.
Keeping records of customers, transactions, screening results and reporting decisions for the retention period.
Delivering and recording AML training for staff and owners.
Reporting to senior management on compliance status, gaps and incidents.
Acting as the point of contact for MoET, the FIU and law enforcement requests.

Failure to appoint a competent compliance officer is itself a breach. The administrative penalties available to the supervisory authority range from a written warning to fines of AED 10,000 to AED 5,000,000 per violation, licence restriction, suspension or revocation. See our page on AML fines and penalties in the UAE for the full framework.

What outsourcing the role means in practice

An outsourced compliance officer is not a hotline or a software subscription. It is a named individual, appointed in writing by your business, who performs the function on an agreed schedule. The arrangement should include a documented appointment, a service agreement with responsibilities and service levels, access to your customer files, records and screening tools, a named deputy, and an escalation channel for staff. The person is recorded on goAML and in your AML manual.

What stays with the business

Senior management accountability does not transfer. The owners and managers of the business remain responsible for approving the risk assessment and policies, resourcing the compliance function, acting on the compliance officer's recommendations, and ensuring staff actually follow the procedures. The outsourced officer advises, oversees and reports; the business decides and is answerable to the regulator for the outcome. A good provider will put this in writing rather than imply otherwise.

Two questions every buyer asks

Does the compliance officer have to be based in the UAE? Supervisory authorities generally expect the compliance officer to be reachable, able to attend inspections and meetings, and in a position to access records promptly, and some sector rules are explicit on residency or location. The precise requirement depends on which authority supervises you and should be checked against current published guidance. Adventant's compliance officers are based in Dubai and cover the whole UAE, so this question does not arise for our clients.

Does the regulator need to be told, or approve the appointment? Notification and approval requirements differ between MoET, DFSA, FSRA, CBUAE and SCA. Some require formal notification or fit-and-proper approval of the MLRO; MoET-supervised DNFBPs record the compliance officer through goAML and their registration details. Rather than assert a single answer, we check the requirement for your sector at the time of appointment and complete whatever notification or update is needed. See our goAML registration guide for how the registration record works.

What Adventant does

The engagement follows a fixed sequence so that both sides know what is being delivered and when.

Scoping call. A conversation with the owner or managing partner about your licence, activities, customer base, volumes and current AML arrangements. We confirm which supervisory authority applies, whether an outsourced appointment is suitable, and agree the monthly scope and fee. Typically one week from first contact to a signed proposal.
Appointment and documentation. We prepare the appointment letter or board resolution naming the individual compliance officer and deputy, the service agreement with service levels and escalation routes, and the responsibility matrix that records what sits with us and what remains with management. The AML manual is updated to reflect the appointment.
Onboarding of systems and goAML. We obtain access to your customer files, screening tool and transaction records, update the goAML registration to reflect the new compliance officer, complete any notification the supervisory authority requires, and review existing files and policies for immediate gaps. Typically two to three weeks.
Monthly operating rhythm. Agreed hours each month for reviewing new customer onboarding, high-risk approvals, screening alerts, internal suspicion reports and STR decisions, goAML filings, record checks and staff queries. A nominated contact at Adventant is reachable during business hours for urgent matters.
Reporting to management. A written compliance report each quarter covering onboarding volumes, high-risk customers, alerts and reports filed, training delivered, open gaps and regulatory developments. Presented to owners or the board, with minutes kept.
Annual review. Once a year we refresh the business risk assessment, review and update the policies, deliver annual training, and test a sample of files. The output is a report that doubles as your evidence pack if MoET inspects.

Two advisers and a client in a scoping meeting with documents on the table — The engagement begins with a scoping call to confirm the supervisory authority, the risk profile and the right level of monthly support.

What you receive

Deliverable	What it contains	Why it matters
Appointment pack	Appointment letter or board resolution, service agreement, responsibility matrix, deputy arrangements	Shows the regulator that a competent person was formally appointed and what they are accountable for
Updated goAML registration	Compliance officer details updated, any required regulator notification completed, confirmation retained	Registration is mandatory and the compliance officer on record must be the person doing the job
Monthly compliance log	Record of files reviewed, alerts cleared, approvals given, internal reports received and STR decisions with reasons	Evidence that the function operates continuously, not just on paper
goAML filings	STRs, SARs and other required reports drafted, filed and acknowledged, with supporting records	Reporting decisions are the compliance officer's core duty and the area of highest personal exposure
Quarterly management report	Compliance status, key risk indicators, incidents, training, open actions and regulatory changes	Demonstrates senior management oversight, which the law requires and inspectors test
Annual review report	Refreshed risk assessment, policy updates, training records, sample file testing results	Your evidence pack for MoET, your auditors and your bank

Why businesses choose us for this

Our compliance officers are former senior bank compliance leaders in the UAE who have run AML functions at Standard Chartered, RAKBANK and FAB, and who understand how a regulator reads a file.
We have direct experience of regulatory inspections and remediation, so the monthly work is shaped around what inspectors actually ask for.
The work is practical rather than template-driven: the risk assessment and procedures are written for your business, your customers and your volumes.
Scope and fee are fixed and agreed up front, with hours, deliverables and response times set out in the service agreement.
We are Dubai-based with UAE-wide coverage, so the compliance officer can attend your office, your regulator and your bank in person when needed.

Common mistakes we see

Naming a director or the office manager as compliance officer on goAML with no training, no time allocated and no record of any work done.
Treating an outsourced provider as a substitute for management oversight, with no minutes or evidence that owners ever saw a compliance report.
Giving the outsourced officer no access to systems, so reviews happen on screenshots sent by WhatsApp weeks after onboarding.
Filing zero STRs for years and assuming that is a clean record rather than a question the inspector will ask.
An AML manual that is up to date but describes procedures the business does not actually follow.
No deputy, so the function stops whenever one person is on leave.

A fingerprint graphic over a laptop keyboard representing secure goAML reporting — STR decisions and goAML filings are the compliance officer's core duty and must be recorded with reasons.

Next step

If you are a mainland real estate broker, dealer in precious metals and stones, accountant, auditor, company service provider or law firm and you need a compliance officer who will actually do the work, book a scoping call. We will tell you honestly whether an outsourced appointment suits your size and risk profile.

A 30-minute scoping call with a senior compliance officer, with a fixed-scope proposal to follow.

Talk to us about an outsourced MLRO

General information, not legal advice. Check current requirements with your supervisory authority.

Frequently asked questions

Can a DNFBP in the UAE outsource its compliance officer or MLRO?

Yes, in most cases. UAE AML rules require every regulated business to appoint a compliance officer with adequate seniority and competence, but they do not require that person to be an employee. Outsourcing is widely used by smaller DNFBPs. The appointment must be documented, the person must genuinely perform the function and have access to records, and senior management remains accountable. Check your supervisory authority's current guidance for any sector-specific conditions.

Does an outsourced MLRO have to be based in the UAE?

Requirements differ by supervisory authority. Regulators generally expect the compliance officer to be reachable, able to attend inspections and able to access records promptly, and some sector rules state a residency or location requirement explicitly. Check the current published guidance for your authority. Adventant's compliance officers are based in Dubai and cover the whole UAE, so location is not an issue for our clients.

Does MoET need to approve or be notified of an outsourced compliance officer?

Notification and approval requirements vary between MoET, DFSA, FSRA, CBUAE and SCA. For mainland DNFBPs, the compliance officer's details are recorded through the goAML registration and must be kept current. Some financial regulators require formal notification or fit-and-proper approval of the MLRO. We check the requirement for your sector at the time of appointment and complete whatever update or notification is needed.

What is the difference between a compliance officer and an MLRO?

In the UAE the terms describe the same core role. Financial institutions supervised by CBUAE, DFSA, FSRA and SCA usually use MLRO, meaning Money Laundering Reporting Officer. MoET guidance for DNFBPs uses compliance officer. Both refer to the individual responsible for the AML programme, suspicious transaction reporting and liaison with the regulator and the FIU. The obligations are substantially the same whichever title is used.

If I outsource the MLRO role, am I still liable for AML breaches?

Yes. Senior management accountability for AML compliance stays with the business and its owners. The outsourced compliance officer performs the function, advises and reports, but management must approve the risk assessment and policies, resource the programme and act on recommendations. Administrative penalties under Federal Decree-Law No. 10 of 2025 are imposed on the regulated entity. A properly documented appointment and evidence of oversight are your best protection.