# Adventant: full site content > Adventant (Adventant Management Consultancies) is a Dubai-based AML compliance consultancy that helps UAE-regulated businesses meet their anti-money laundering (AML), counter-terrorist financing (CFT) and sanctions obligations: an outsourced MLRO service, governance support for in-house MLROs, operational outsourcing of screening, risk assessment and ongoing monitoring, independent AML reviews and audits, regulatory inspection and remediation support, goAML registration and reporting, grievance filing, enterprise-wide risk assessments, AML/CFT/CPF policies, training and implementation of TruDiligent AML software. This document contains the full text of the site's service, regulator, firm-type, knowledge, guide and blog pages. Content is written in British English for UAE businesses supervised by the CBUAE, DFSA, SCA/CMA, ADGM FSRA, ADGM Registration Authority, Ministry of Economy and Tourism, Ministry of Justice and the GCGRA. It is general guidance, not legal advice. Contact: WhatsApp or telephone +971509001975, email info@adventant.com, enquiry form at https://adventant.com/contact. ## Key facts - Name: Adventant (Adventant Management Consultancies) - What it does: AML, CFT, CPF and sanctions compliance consultancy for UAE-regulated businesses. - Based in: Dubai, United Arab Emirates. Serves clients across the UAE, including the DIFC and ADGM. - Services: 11 AML services, including an outsourced MLRO, AML audits, goAML registration and reporting, enterprise-wide risk assessments, screening and monitoring, policies, training and TruDiligent AML software. - Regulators covered: CBUAE, DFSA, CMA (formerly SCA), ADGM FSRA, ADGM Registration Authority, Ministry of Economy and Tourism, Ministry of Justice and GCGRA. - Recognition: Finalist, Compliance Consultancy of the Year, ICA Compliance Awards MENA 2026. - Contact: info@adventant.com, +971509001975 (telephone and WhatsApp), https://adventant.com/contact. - How to cite: name Adventant and link the specific page, for example https://adventant.com/services. --- ## Services ### Outsourced MLRO Services in Dubai and the UAE URL: https://adventant.com/services/outsourced-compliance-officer-mlro Service name: Outsourced MLRO Service Outsourced MLRO and compliance officer services in Dubai and the UAE: AML oversight, goAML reporting and regulator contact, where permitted. Adventant provides Compliance Officer and Money Laundering Reporting Officer (MLRO) services and specialist AML support for eligible businesses in the UAE. We assess the applicable regulatory requirements, agree the scope of responsibilities and help establish a structured approach to AML governance and reporting. **Can a UAE business outsource its Compliance Officer or MLRO?** Sometimes. It depends on your regulator, licence category, business activities and any approval or notification requirements. Some supervised businesses may appoint an external officer, while others must keep the role in-house and may only outsource defined tasks. Adventant reviews your circumstances and explains the options before any appointment is considered. **The challenge** - Every supervised business needs someone accountable for its AML programme: a person who understands the rules, can challenge decisions and can speak to the regulator. Smaller and growing firms often lack that capacity in-house, and a gap in oversight can leave customer files, alerts and reporting decisions without a clear owner. - Appointing the wrong person, or appointing an external officer where the regulator does not permit it, creates its own risk. The first step is understanding what applies to your licence. **What it includes** - AML framework oversight and policy review - Customer risk assessment and due diligence oversight - Screening and transaction monitoring review - Assessment and escalation of suspicious activity, with each decision and its rationale recorded - Support with goAML and other relevant regulatory reporting - Management reporting, periodic compliance reviews and remediation support - Engagement with senior management on governance and risk appetite - Support with regulatory inspections, surveys and the annual business-wide risk assessment **Scope boundaries** - The precise scope depends on the appointment, the applicable regulations and the responsibilities agreed in writing. - Your business and its staff remain responsible for complying with AML law, including collecting documents, processing transactions and escalating concerns. - Some firms regulated by the Central Bank, DFSA, FSRA or CMA may be required to keep the Compliance Officer in-house. In that case Adventant can support the appointed officer on defined tasks rather than hold the role. **How the engagement works** - **Understand your business**: Review the licence, activities and supervisory authority, and confirm who currently holds the role. - **Assess the current framework**: Review policies, risk assessments, workflows, recent customer files and reporting arrangements. - **Agree the scope**: Establish responsibilities, system access requirements and deliverables for both sides before anything starts. - **Implement the engagement**: Complete the appropriate handover, including regulator portal access, policies, registers and open submissions, then begin the agreed compliance activities. - **Maintain oversight**: Conduct agreed reviews, escalate issues, report to senior management and support continuous improvement. **Who needs it** - Businesses without a full-time compliance officer - Growing firms that need experienced AML oversight - Teams needing temporary or ongoing cover for the role - Firms seeking advisory and operational AML support **Regulatory context** - UAE anti-money-laundering and counter-terrorist-financing requirements apply to supervised financial institutions, virtual asset businesses and Designated Non-Financial Businesses and Professions (DNFBPs). Each supervisor issues rules and guidance for its sector, including expectations about the Compliance Officer and MLRO role. - Whether the role can be held externally, and whether approval or notification is needed, is set by the rules that apply to your licence. Confirm the position with your supervisor, or with us, before any appointment. **FAQs** - **Can every UAE business outsource its MLRO?** No. Appointment requirements vary according to the regulator, licence category and applicable rules. Eligibility must be confirmed before proceeding. - **Can Adventant support an in-house MLRO?** Yes. The service includes specialist support options for businesses that need help with defined AML tasks. The permissible scope must be checked against the applicable requirements. - **What information is needed for an initial assessment?** Start with your trade licence or relevant authorisation, the name of your supervisory authority, a description of your activities and your current compliance arrangements. - **Who decides whether a suspicious activity report is filed?** The appointed MLRO decides, in consultation with senior management, and records the rationale for the decision. - **What happens if our current officer resigns?** Appoint a new officer who meets your regulator's requirements as soon as possible and obtain a detailed handover. Adventant can help plan the handover and identify any notification your regulator requires. - **Will Adventant deal with the regulator directly?** Where Adventant holds the appointed role and the rules allow it, yes. Otherwise your business remains the regulator's point of contact and we support you behind the scenes. --- ### Governance Support for Your MLRO in the UAE URL: https://adventant.com/services/compliance-officer-mlro-support Service name: Governance Support for Your MLRO Governance support for your in-house MLRO or compliance officer in the UAE: file reviews, policy updates and reporting preparation. Adventant helps your Compliance Officer or MLRO with day-to-day work and with cases that need a closer look. Responsibilities are agreed at the start, covering the tasks we handle and the decisions that stay with your appointed officer and management. **What is governance support for an in-house MLRO?** It is practical help for an officer who holds the role in-house: reviewing files and alerts, updating procedures, preparing reports and giving a second opinion on complex cases. The officer remains in the role and keeps the decisions. Adventant provides capacity and specialist input. **The challenge** - An in-house officer often carries the whole AML programme alone: customer file reviews, alert handling, reporting, training, policy updates and regulatory requests, on top of other duties. Workload peaks, absences and unfamiliar cases can leave important work late or thinly documented. - Support works best when it is scoped to the officer's real pressure points rather than a generic package. **What it includes** - Reviewing customer files against your AML policy, including ownership and risk ratings - Reviewing how alerts and concerns were handled and documented - Updating policies, procedures and registers - Preparing and quality-checking periodic and regulatory reports - Supporting regulatory surveys, inspections and information requests - Assisting with employee training and management reporting - Providing a second opinion on complex or borderline cases - Governance support: board and senior management reporting, committee papers and clear oversight arrangements **Scope boundaries** - Your appointed officer keeps the role and the decisions that belong to it. - We agree the tasks, access requirements and turnaround times before starting. - Support can be one-off, for a defined period or ongoing, depending on what you need. **How the engagement works** - **Agree scope and decision rights**: Set out the tasks we will handle and the decisions that stay with your officer. - **Review current files and documents**: Look at a sample of customer files, the alert log, policies and the latest risk assessment. - **Support the agreed work**: Take on the agreed tasks through your reporting cycles and busy periods. - **Report and improve**: Flag gaps, recommend corrective actions and keep your officer informed. **Who needs it** - Officers who need specialist backup or extra capacity - Businesses keeping the role in-house but wanting assurance - Teams preparing for a regulatory survey or inspection - Firms covering a period of leave or a vacancy in the team **Regulatory context** - Regulators expect the appointed officer to have the authority, independence and resources to do the job. External support can help meet that expectation but does not replace the appointed role. - Where the role itself must be held in-house, defined-task support is typically the appropriate model. Confirm the position for your licence. **FAQs** - **Does this replace our compliance officer?** No. Your appointed officer keeps the role and the decisions. We provide support and specialist input. - **Can you cover a busy period or a period of leave?** Yes, we can provide temporary capacity. We agree what we can handle and who holds the role in the meantime, and check any notification your regulator requires. - **What would you review first?** Usually a sample of customer files, the alert log and the current policy and risk assessment, so we can see where support will help most. - **Can this lead to an outsourced appointment?** Possibly, where your regulator permits an external appointment. That is a separate decision with its own eligibility checks. --- ### Outsourced AML Screening and Monitoring in the UAE URL: https://adventant.com/services/outsourced-screening-customer-monitoring Service name: Operational Outsourcing Outsourced AML compliance in the UAE: sanctions and PEP screening, KYC onboarding checks and transaction monitoring, every decision recorded. Adventant can take on the day-to-day customer AML lifecycle for your business: onboarding and KYC, screening, customer risk assessment and ongoing monitoring. Checks follow a risk-based approach agreed with you, and potential concerns are escalated promptly to your appointed officer. **What does operational AML outsourcing cover?** It covers the routine AML work on each customer: collecting and checking onboarding information, screening against sanctions and PEP lists, assigning a risk rating and reviewing the relationship over time. Adventant performs the agreed tasks and escalates concerns, while decisions that belong to your appointed officer and management stay with them. **The challenge** - Customer checks are repetitive, time-sensitive and easy to do inconsistently when volumes grow or the team is stretched. Gaps typically show up later as incomplete files, undocumented decisions and alerts that were not reviewed in time. - Outsourcing the routine work can free your team, but only if responsibilities, standards and escalation routes are clear from the start. **What it includes** - Collecting and checking onboarding information and supporting documents - Identifying beneficial owners and understanding ownership and control - Sanctions and PEP screening at onboarding and at agreed intervals - Reviewing potential sanctions and PEP matches and recording how each was resolved - Assigning and documenting a customer risk rating - Ongoing monitoring and periodic reviews on a risk-based schedule - Reviewing transaction monitoring alerts and escalating unusual activity - Escalating potential concerns to your Compliance Officer or MLRO - Keeping onboarding decisions and supporting records organised and retrievable **Scope boundaries** - Your appointed officer and management keep responsibility for risk decisions, onboarding approvals and reporting decisions unless agreed otherwise in writing and permitted by your regulator. - Your business remains responsible for meeting its AML obligations when tasks are outsourced. - Where your regulator restricts outsourcing, we confirm what can be delegated before work starts. **How the engagement works** - **Agree the standards**: Set onboarding requirements, the risk model, review frequencies and escalation rules with your team. - **Set up access and workflow**: Agree how documents, systems and queries will be shared securely. - **Perform the checks**: Onboard, screen and rate customers, recording each decision and its supporting evidence. - **Monitor and review**: Refresh reviews and monitor activity according to each customer's risk rating. - **Escalate and report**: Raise concerns promptly and give you regular reporting on volumes, outcomes and open items. **Who needs it** - Firms with limited in-house compliance capacity - Businesses onboarding customers at volume - Teams that want a consistent, documented approach to customer checks - Firms clearing a backlog of customer reviews **Regulatory context** - Supervised businesses are expected to apply customer due diligence, screening and ongoing monitoring that reflect the risk of each customer. Rules on what may be outsourced, and on who remains accountable, depend on your supervisor. - Outsourcing does not transfer your responsibility for AML compliance. Agree the arrangement in writing and check it against your regulator's expectations. **FAQs** - **Can you work in our existing systems?** Often, yes. We can work within your existing onboarding and screening tools or recommend how to organise the process. The aim is consistent, documented checks rather than any particular product. - **Who approves a customer?** Approval decisions follow the responsibilities agreed with your management and appointed officer. We prepare the file and recommendation, and sign-off stays with you unless the arrangement and your regulator allow otherwise. - **How do you handle higher-risk customers?** Higher-risk customers receive enhanced due diligence and are escalated to your appointed officer for a decision, with the reasoning recorded. - **Is outsourcing allowed for my business?** It depends on your regulator and licence category. We confirm what can be delegated before any work begins. --- ### Independent AML Audits and Reviews in the UAE URL: https://adventant.com/services/independent-aml-compliance-review Service name: Independent AML Audits / Reviews Independent AML audits and reviews in Dubai and the UAE: we test files, alerts, escalation and reporting, and give clear, rated findings. An independent review and audit tests whether your AML procedures are suitable for your business and whether they are actually being followed. Adventant samples customer files, tests how alerts and reports are handled and sets out findings and recommended corrective actions. **What is an independent AML compliance review?** It is an objective assessment, carried out by someone not involved in running your AML programme, of whether your policies and controls are suitable for your risks and are followed in practice. It typically involves testing customer files, alerts, escalations, reporting and training records, and ends with findings and a remediation plan. **The challenge** - Teams that run the AML programme every day are poorly placed to judge it objectively. Gaps stay hidden until a regulator or an incident finds them. - A review is most useful when it tests what happens in practice, not only what the policy says. **What it includes** - Assessing whether your AML framework suits your activities and risks - Sampling customer files and testing due diligence and risk ratings - Testing how screening and monitoring alerts are reviewed, escalated and closed - Reviewing reporting decisions and records - Reviewing training, governance and management reporting - Reporting findings ranked by severity - Recommending corrective actions and following up on remediation **Scope boundaries** - A review reflects the sample and period examined and is not a guarantee that no issues exist. - Independence matters. Where Adventant also supports your AML programme, we agree how to keep the review objective. - The scope and standard of review follow the requirements for your sector. **How the engagement works** - **Agree scope and sample**: Set the areas, period and sample, weighted towards higher-risk activity. - **Review documents and controls**: Assess policies, risk assessments, governance and reporting arrangements. - **Test files and alerts**: Sample customer files and trace alerts from detection to decision. - **Report findings**: Set out findings by severity with clear recommended actions. - **Support remediation**: Help you plan and track corrective actions, and agree any follow-up review. **Who needs it** - Businesses due a periodic independent review - Firms preparing for a regulatory inspection or survey - Businesses that have changed owners, systems or officers - Teams wanting assurance that controls work in practice **Regulatory context** - Many supervisors expect an independent assessment of the effectiveness of AML controls, often through an independent audit or review function. How often, and whether it can be carried out externally, depends on your sector and supervisor. - Check what your regulator expects for the scope and frequency of independent testing. **FAQs** - **Is an independent review required?** Many supervised businesses are expected to test their AML controls independently. The frequency and format depend on your regulator, so we confirm what applies. - **What do we receive at the end?** A written report with findings by severity and recommended corrective actions, which you can use to plan remediation. - **How is the sample chosen?** We agree the scope and sample with you, usually weighted towards higher-risk customers and recent activity, so the review tests what matters. - **Can you help fix the findings?** Yes, we can support remediation. Where we do, we agree how to keep any later review independent. --- ### AML Regulatory Inspection Support in the UAE URL: https://adventant.com/services/regulatory-inspections-remediation Service name: Regulatory Inspection Support AML inspection support in the UAE: gap assessments, MoET and regulator inspection preparation, survey responses and remediation of findings. Adventant helps supervised businesses prepare for and respond to regulatory scrutiny. We assess your AML framework against the requirements that apply to you, support you through inspections and regulatory surveys, and help you fix findings with a documented remediation plan. **What is a regulatory gap assessment?** A gap assessment compares your AML policies, procedures and day-to-day practice with the requirements that apply to your licence and sector, and lists what is missing or weak. It gives you a prioritised set of actions before an inspection, a survey or a change in the rules. **What this service covers** - **Regulatory gap assessments**: We compare your framework and day-to-day practice with the rules and guidance that apply to you, and rank the gaps by risk. - **Regulatory inspection support**: We help you prepare documents and staff before an onsite or offsite inspection, organise information requests and support you while the inspection runs. - **Responding to regulatory surveys**: We help you gather accurate data and prepare consistent answers to the questionnaires and surveys your supervisor issues. - **Remediation following regulatory findings**: We turn findings into an action plan with owners and dates, help put the fixes in place and keep evidence that each item is closed. **The challenge** - Inspections, surveys and findings tend to arrive with tight timeframes. Without preparation, teams spend that time searching for records instead of explaining how their controls work. - Findings that are closed on paper but not in practice tend to reappear at the next review, so remediation needs evidence, not only updated documents. **What it includes** - Mapping your AML framework against the requirements that apply to your licence - Ranking gaps by risk and agreeing a realistic action plan - Preparing document packs, registers and staff for inspections - Coordinating responses to information requests during an inspection - Preparing accurate and consistent responses to regulatory surveys and questionnaires - Building a remediation plan for regulatory findings, with owners and target dates - Tracking remediation and keeping evidence that each finding is closed **Scope boundaries** - Your business remains the regulator's point of contact unless agreed otherwise and permitted. Responses are submitted by you or with your authority. - We cannot influence the outcome of an inspection or the regulator's view of its findings. Our role is to help you prepare, respond accurately and fix what needs fixing. - Submissions must reflect your actual practice. We will not help present controls that are not in place. **How the engagement works** - **Understand the trigger**: Review the inspection notice, survey or findings, and note any deadline the regulator has set. - **Assess the gaps**: Compare your framework and practice with the requirements, and rank what needs attention. - **Prepare and respond**: Organise documents, brief staff and prepare accurate responses for the regulator. - **Remediate**: Put the agreed fixes in place, with owners, target dates and evidence. - **Confirm closure**: Check that each item is closed in practice and keep the record for the next review. **Who needs it** - Businesses notified of an upcoming inspection - Firms that have received regulatory findings or a remediation request - Businesses asked to complete a regulatory survey or questionnaire - Firms that want an objective view of where they stand before the regulator asks **Regulatory context** - UAE supervisors carry out onsite and offsite inspections, issue surveys and questionnaires, and may require businesses to remediate the weaknesses they identify. The form and timing depend on the supervisor and your licence. - Deadlines for responses and remediation are set by the supervisor in each case. Follow the instructions you receive and keep a record of what was submitted. **FAQs** - **How is a gap assessment different from an independent AML review?** A gap assessment compares your framework with the rules that apply to you. An independent review also tests whether controls work in practice by sampling files and alerts. Many businesses start with a gap assessment and follow it with a review. - **Can you support us during the inspection itself?** Where your supervisor permits it and you agree, yes. In every case we help you prepare documents, staff and answers beforehand. - **We have received findings. Where do we start?** Note any deadline the regulator has set and share the findings with us. We help you build a remediation plan, deal with the highest-risk items first and keep evidence of each fix. - **Who submits a regulatory survey response?** Your business does, through the channel your supervisor specifies. We help gather the data and check that the answers are accurate and consistent with your records. --- ### goAML Registration and Reporting in the UAE URL: https://adventant.com/services/goaml-registration-regulatory-reporting Service name: goAML Registration and Reporting goAML registration and reporting in the UAE: FIU registration, EOCN subscription, STR and SAR filing, and preparing regular reports. Adventant supports UAE businesses with goAML registration, subscription to the EOCN notification service and regulatory reporting. We help authorised compliance officers prepare, assess and file reports to the UAE Financial Intelligence Unit, and prepare semi-annual reports, so that each submission is accurate, timely and supported by a clear record. **What is goAML?** goAML is the online platform used to register with, and file reports to, the UAE Financial Intelligence Unit. Registration gives your business access to the platform. It does not by itself make your business compliant: customer checks, monitoring, training and record-keeping still have to be in place. **What this service covers** - **goAML registration**: Registering your business on goAML with the UAE Financial Intelligence Unit, including authorised users and roles. - **EOCN subscription**: Subscribing to the Executive Office for Control and Non-Proliferation notification service, so you are told when sanctions lists change. - **Filing reports through goAML**: Preparing, checking and filing the reports that apply to your business, with the rationale for each decision recorded. - **Semi-annual reports**: Preparing semi-annual compliance reports where your supervisor requires them, using figures that match your records. **Report types we help with** - **STR (Suspicious Transaction Report)**: Filed when there are reasonable grounds to suspect that a transaction is linked to money laundering, terrorist financing or another crime. - **SAR (Suspicious Activity Report)**: Filed for suspicious activity or behaviour that is not tied to a specific transaction, such as an attempted or declined relationship. - **REAR (Real Estate Activity Report)**: Filed by real estate agents and brokers for property transactions that meet the conditions set by their supervisor, such as certain payments in cash or virtual assets. - **DPMSR (Dealers in Precious Metals and Stones Report)**: Filed by dealers in precious metals and stones for cash transactions at or above the threshold set by their supervisor. - **CNMR (Confirmed Name Match Report)**: Filed when screening confirms a match against the UAE Local Terrorist List or the UN Consolidated List, after the required freezing measures have been applied. - **PNMR (Partial Name Match Report)**: Filed when screening finds a potential match that cannot be confirmed or ruled out, with the relationship or transaction suspended while it is reviewed. - **Other report types**: Some sectors and situations call for other reports. We confirm which apply to your business before anything is filed. **The challenge** - Registration is straightforward once the right information and authorised users are in place, but errors in setup can delay access. Reporting is harder: a report has to be complete, consistent with your records and filed on time, and the decision to file needs a documented rationale. - Different businesses file different report types, so it matters to know which apply to your activities. **What it includes** - Preparing for and supporting goAML registration, including user and role set-up - Confirming the report types that apply to your activities - Helping prepare suspicious transaction and suspicious activity reports (STRs and SARs) - Supporting other report types that apply to your sector, such as sanctions name match reports and reports for real estate agents and precious metals and stones dealers - Subscribing to the EOCN notification service for sanctions list updates - Preparing semi-annual reports where your supervisor requires them - Checking reports for completeness and consistency with your records before submission - Recording the rationale for each reporting decision - Tracking open regulator requests and submissions **Scope boundaries** - Authorised compliance officers decide whether and when to file. We prepare and assess, and the decision stays with the officer. - Registration and reporting requirements differ by sector and supervisor, so we confirm yours first. - We file only with your authorisation and agreed access. **How the engagement works** - **Confirm requirements**: Establish whether you must register and which reports apply to your activities. - **Prepare to register**: Gather the documents and identify the authorised users. - **Register and set up**: Complete registration and set up user access and roles. - **Prepare reports**: Draft, assess and check each report against your records. - **Submit and record**: File, keep confirmations and retain the rationale for the decision. **Who needs it** - Businesses that need to register on goAML - Compliance Officers and MLROs preparing STRs, SARs and other reports - DNFBPs with sector-specific report types - Firms that want reports quality-checked before submission **Regulatory context** - The UAE Financial Intelligence Unit receives reports of suspicious activity and other prescribed reports through goAML. Which businesses must register, and which reports they must file, depends on the sector and supervisor. - Report types, thresholds, forms and procedures can change, so check current requirements on the UAE FIU and EOCN websites. **FAQs** - **Does goAML registration make us compliant?** No. Registration gives access to the platform. You still need customer due diligence, monitoring, training, record-keeping and a documented reporting process. - **Which reports do we need to file?** It depends on your activities and supervisor. Most supervised businesses may need to file suspicious transaction or activity reports, and some sectors have additional report types. We help you confirm which apply. - **Who decides whether to file a report?** Your appointed Compliance Officer or MLRO, in consultation with senior management where appropriate. We help prepare and assess the report. - **What do you need to start registration?** Typically your trade licence or authorisation, ownership details and the details of the officer and any other users who will access the platform. We confirm the exact list for your business. --- ### AML Fine Grievance and Waiver Requests in the UAE URL: https://adventant.com/services/grievance-filing-fine-waiver Service name: Grievance Filing (Fine Waiver) Help with an AML fine in the UAE: a clear, evidenced grievance or waiver request against an administrative penalty from your supervisor. Where an administrative penalty has been imposed for an AML matter, the business concerned may be able to file a grievance and ask for the penalty to be reviewed, reduced or waived. Adventant helps you understand the decision, gather evidence of the corrective steps taken and prepare a clear, well-supported submission. **Can an AML fine be waived in the UAE?** In some cases a business can file a grievance against an administrative penalty and ask for it to be reviewed, reduced or waived. Whether that route is available, the time allowed and the outcome are decided by the relevant authority. A strong grievance explains the facts, shows the corrective action taken and is filed within the time allowed. **The challenge** - A penalty decision usually comes with a limited window to object. Businesses often spend that time unsure of the process, then submit a grievance that argues with the finding instead of explaining the facts and the corrective steps taken. - A grievance is stronger when the underlying issue has already been fixed and the evidence is organised. **What it includes** - Reviewing the penalty decision and the findings behind it - Confirming the grievance route and the time allowed, as stated in the decision or by the authority - Establishing the facts and gathering supporting evidence - Documenting corrective actions already taken, and any still in progress - Drafting a clear, factual grievance submission for your review - Supporting the filing through the channel the authority specifies - Tracking the response and any follow-up requests **Scope boundaries** - The decision to accept a grievance, and to reduce or waive a penalty, rests entirely with the relevant authority. We cannot guarantee any outcome. - The grievance is filed by your business or with your authority, and must be accurate and complete. - Deadlines are set by the authority. Contact us as soon as you receive a penalty decision. **How the engagement works** - **Review the decision**: Read the penalty decision and any findings or inspection report behind it. - **Confirm the route and timing**: Identify where the grievance is filed and the time allowed to file it. - **Gather the evidence**: Collect the records that explain the facts and show the corrective steps taken. - **Prepare the submission**: Draft a clear, factual grievance for your review and approval. - **File and follow up**: Support the filing, track the response and help with any follow-up requests. **Who needs it** - Businesses that have received an AML-related administrative penalty - Firms that have fixed the underlying issue and want this taken into account - Businesses unsure whether a grievance route is available to them **Regulatory context** - UAE supervisors can impose administrative penalties for breaches of AML and CFT obligations. The process for objecting to a penalty, including who decides and the time allowed, depends on the supervisor and is normally set out in the decision or the supervisor's guidance. - Check the instructions in your decision for how and when to file, and whether any obligations continue while the grievance is considered. **FAQs** - **How long do we have to file a grievance?** The time allowed is set by the relevant authority and is usually stated in the penalty decision or its guidance. Act quickly and share the decision with us so the deadline is not missed. - **Will the fine definitely be waived?** No. The authority decides. A clear, evidenced grievance that shows the issue has been corrected gives your case the best footing, but no adviser can guarantee the result. - **What do you need from us?** The penalty decision, any inspection report or findings, and records of the steps you have taken since. We tell you what else would strengthen the submission. - **Should we fix the issue before filing?** Where possible, yes. Showing that the underlying weakness has been corrected, with evidence, usually makes a grievance more persuasive. --- ### Enterprise-Wide AML Risk Assessment in the UAE URL: https://adventant.com/services/business-customer-risk-assessments Service name: Enterprise-Wide Risk Assessment AML risk assessment services in the UAE: enterprise-wide (EWRA) and customer risk assessments across customers, countries, products and channels. Adventant reviews your business activities, customer base and countries of operation to identify potential money laundering and terrorist financing risks. We also help assess individual customers, document their risk ratings and decide which relationships need closer attention or additional checks. **What is an enterprise-wide risk assessment (EWRA)?** An enterprise-wide risk assessment, also called a business-wide risk assessment, identifies how your business could be used for money laundering or terrorist financing, based on your customers, geographies, products and delivery channels, and judges whether your controls respond to those risks. A customer risk assessment applies the same thinking to each customer to set the level of due diligence and monitoring. **The challenge** - A risk assessment that sits in a drawer adds little. The value comes from using it to decide onboarding rules, monitoring and review frequency, and from being able to show the reasoning. - Many businesses rate customers by habit rather than by a clear method, so similar customers end up treated differently. **What it includes** - Assessing business-wide risk across customers, geographies, products, services and delivery channels - Reviewing the controls that respond to each risk and the residual risk that remains - Designing a customer risk rating method that staff can apply consistently - Assessing and documenting individual customer risk ratings - Identifying relationships that need enhanced due diligence - Recording your risk appetite and the reasoning behind it - Producing a clear, defensible written assessment **Scope boundaries** - Risk ratings and risk appetite are decisions for your management and appointed officer. We provide structure and challenge. - An assessment reflects your business at a point in time and needs updating when it changes. - We use the requirements and guidance that apply to your licence category as the starting point. **How the engagement works** - **Map your business**: Document your customers, geographies, products and delivery channels. - **Identify and rate inherent risk**: Assess where the business is most exposed before controls are considered. - **Review the controls**: Test whether existing controls respond to each identified risk. - **Document residual risk and appetite**: Record what remains, what you accept and what needs action. - **Apply and update**: Feed the results into onboarding, monitoring and review, and refresh them as things change. **Who needs it** - Businesses preparing their periodic business-wide risk assessment - Firms entering new markets, products or customer types - Teams that need a consistent customer risk rating method - Businesses preparing for a regulatory review **Regulatory context** - A risk-based approach sits at the centre of UAE AML requirements: supervised businesses are expected to identify, assess and understand their money laundering and terrorist financing risks and to apply controls in proportion. Supervisors may set expectations for how often the assessment is reviewed and what it should cover. - National and sector risk assessments published by UAE authorities can inform your own. Check the material relevant to your sector. **FAQs** - **How often should the assessment be updated?** Regularly, and whenever your business changes materially, for example through new products, markets or customer types. Your regulator may set a minimum frequency. - **How do customer risk ratings work?** You rate each customer using factors such as who they are, where they operate, what they use and how they were onboarded. The rating then drives the level of due diligence, monitoring and review frequency. - **Does the assessment replace our policies?** No. It informs them. Policies and controls should respond to the risks the assessment identifies. - **Who signs off the assessment?** Senior management, on the recommendation of your appointed officer. --- ### AML/CFT/CPF Policies and Procedures for UAE Businesses URL: https://adventant.com/services/aml-policies-procedures Service name: AML / CFT / CPF Framework AML/CFT/CPF policies and procedures manuals for UAE businesses, written around how you work, with clear roles, escalation and record-keeping. Your AML policy should reflect how your business operates. Adventant prepares and updates AML, counter-terrorist financing (CFT), counter-proliferation financing (CPF) and sanctions policies and procedures that set out the checks employees must complete, who handles concerns and how decisions are recorded, so your team has clear instructions for daily work. **What should an AML policy cover?** A policy sets out your approach to AML and counter-terrorist financing: roles and responsibilities, customer due diligence, screening, monitoring, reporting, training and record-keeping. Procedures turn that into step-by-step instructions for staff. Both should match your activities, customers and regulator rather than a generic template. **The challenge** - A template policy rarely matches how a business actually works. Staff either ignore it or follow it inconsistently, and the gaps appear in a review. - Policies also go stale when the business, its customers or the rules change. A policy that does not match practice is a weakness, not a safeguard. **What it includes** - Drafting or refreshing AML, CFT, CPF and sanctions policies - Writing procedures that match your activities, systems and regulator - Defining roles, approval levels, escalation routes and reporting lines - Setting out customer due diligence, screening and monitoring steps - Aligning documents with your business-wide risk assessment - Preparing templates, checklists and registers that staff will actually use - Reviewing and updating documents as your business or the rules change **Scope boundaries** - Policies are drafted for your business and approved by your management and appointed officer. - Written procedures only help if staff apply them, so training and compliance monitoring are separate steps. - We reflect the requirements that apply to your licence but do not provide legal advice. **How the engagement works** - **Understand your business**: Learn how you onboard, serve and monitor customers day to day. - **Review existing documents**: Identify what works, what is missing and what no longer matches practice. - **Draft policies and procedures**: Write documents tailored to your activities, systems and regulator. - **Embed and approve**: Agree roles and escalation routes, obtain approval and brief the team. - **Maintain and update**: Review on a schedule and whenever the business or the rules change. **Who needs it** - New businesses building an AML framework - Firms with generic or outdated policies - Businesses changing products, customers or markets - Teams preparing for a review or inspection **Regulatory context** - Supervised businesses are expected to maintain documented AML and counter-terrorist-financing policies, controls and procedures that are proportionate to their risks, approved by senior management and kept up to date. - Supervisors may publish sector-specific guidance on what policies should contain. Check the guidance issued for your licence category. **FAQs** - **Can we just use a template?** A template is a starting point at best. Procedures work when they reflect your activities, systems and customers, so we tailor them to how you operate. - **How often should policies be reviewed?** Regularly, and whenever your services, customers or the applicable rules change. Follow any specific review period set by your regulator. - **Who approves the policy?** Senior management, on the recommendation of your Compliance Officer or MLRO, in line with your governance. - **Do policies need to match the risk assessment?** Yes. Controls should respond to the risks you identify, so we align the two. --- ### AML Training for UAE Businesses URL: https://adventant.com/services/aml-training Service name: AML Training Role-based AML and CFT training for UAE staff, managers and boards: red flags, obligations and internal reporting, with attendance records. Adventant trains employees to recognise concerns in the work they handle. Training covers customer checks, warning signs and the steps for reporting concerns internally, using case studies and examples relevant to your business so people see how procedures apply to their roles. **Who needs AML training?** Anyone whose work touches customers, transactions or records can notice a red flag, so training is usually expected for all relevant staff, with more depth for those in compliance, onboarding and senior roles. Training should be repeated regularly and recorded. **The challenge** - Generic, once-a-year slide decks rarely change behaviour. Staff need to recognise what a warning sign looks like in their own work and know exactly who to tell. - Regulators also look for evidence: who was trained, on what and when. **What it includes** - Role-relevant AML and CFT training for different staff groups - Red flags and warning signs relevant to your sector and customers - Internal reporting routes and individual responsibilities - Case studies and examples drawn from your business - Customer due diligence, screening and escalation steps in practice - Refresher sessions and onboarding training for new joiners - Awareness updates for staff and senior management when rules or risks change - Attendance and completion records kept for your file **Scope boundaries** - Training supports, but does not replace, procedures, supervision and monitoring. - Content is tailored to your activities and the requirements that apply to you. - Where your regulator sets minimum training content or frequency, we align to it. **How the engagement works** - **Tailor the content**: Shape the material around your activities, roles and customers. - **Deliver the sessions**: Run sessions using case studies and examples drawn from your business. - **Check understanding**: Test comprehension and answer questions on how procedures apply. - **Record completion**: Keep attendance and completion records for your compliance file. - **Refresh regularly**: Repeat and update training as staff, risks and requirements change. **Who needs it** - Front-line and onboarding staff - Compliance, finance and senior management - New joiners and teams needing refreshers - Businesses meeting training expectations set by their supervisor **Regulatory context** - Supervised businesses are generally expected to train relevant employees on AML and counter-terrorist-financing requirements, their internal procedures and how to report suspicion, and to keep records of that training. - Content and frequency expectations differ by supervisor, so we align training to the guidance for your licence category. **FAQs** - **Is training a one-off?** No. Awareness obligations usually call for regular, role-relevant training with records kept, plus onboarding training for new joiners. - **Can sessions be tailored to our business?** Yes. We use case studies and examples relevant to your activities so staff see how procedures apply to their roles. - **How do you show that training was completed?** We keep attendance and completion records and can provide them for your compliance file or a regulatory review. - **Do senior managers need training?** Yes. Senior management is responsible for oversight and benefits from training pitched at governance and accountability. --- ### AML Software Implementation in the UAE (TruDiligent) URL: https://adventant.com/services/aml-software-implementation Service name: AML Software (TruDiligent) AML software implementation in the UAE: TruDiligent set up for your screening, risk scoring and alerts, with data migration and user training. Adventant implements TruDiligent, an AML compliance platform for customer due diligence, screening and alert handling. We configure it around your policies and risk model, bring your existing customer records across, train your users and support you through go-live. **What does implementing AML software involve?** Implementation means configuring the software to follow your AML policies: your onboarding steps, risk rating method, screening rules and alert workflow. It also covers moving existing customer records across, setting user roles and training staff. The software supports your controls; it does not replace your policies or the judgement of your appointed officer. **The challenge** - Software that is bought but poorly configured can create more work: alerts nobody reviews, risk scores that do not match your policy and records spread across systems. - Implementation works best when the configuration starts from your documented procedures and risk assessment, not from the default settings. **What it includes** - Reviewing your AML procedures and risk model before configuration - Configuring onboarding, KYC and KYB workflows in TruDiligent - Setting up screening, alert review and closure workflows - Setting user roles, approvals and access rights - Migrating existing customer records where needed - Training users and administrators - Go-live support and a post-launch review of how the platform is used **Scope boundaries** - The software supports your AML controls. Your business, its appointed officer and management remain responsible for decisions and for meeting your obligations. - Configuration reflects the policies and risk model you approve. Changes to either should be agreed and documented. - The scope of the implementation, including data migration and any integrations, is agreed in writing before work starts. **How the engagement works** - **Understand your process**: Review how you onboard, screen and monitor customers today. - **Design the configuration**: Map your policies, risk model and approvals onto the platform. - **Configure and migrate**: Set up workflows and user roles, and bring existing records across. - **Train and test**: Train users and administrators, and test the workflows with real scenarios. - **Go live and review**: Support the launch and review how the platform is being used after go-live. **Who needs it** - Businesses moving from spreadsheets or manual checks - Gold, diamond and precious metals dealers - Firms that need a clear record of screening and alert decisions - Teams that want customer due diligence records in one place **Regulatory context** - UAE supervisors expect businesses to carry out customer due diligence, screening and ongoing monitoring, and to keep records that show what was done. Software can help apply these steps consistently, but it does not by itself make a business compliant. - Make sure the configuration reflects your current risk assessment and policies, and review it whenever either changes. **FAQs** - **Does using AML software make us compliant?** No. Software helps apply your controls consistently and keeps a record, but compliance still depends on suitable policies, a sound risk assessment, trained staff and decisions by your appointed officer. - **Can you move our existing customer records?** Usually, yes. We review the format and quality of your current records and agree how they will be migrated as part of the scope. - **Do you train our team?** Yes. Training for users and administrators is part of the implementation, so your team can run the platform day to day. - **Where can we see TruDiligent?** The AML Software page gives an overview of the platform, and we can arrange a demo on request. --- ## Regulators and supervisory authorities ### CBUAE: Central Bank of the UAE URL: https://adventant.com/industries/cbuae Jurisdiction: Federal Mainland The Central Bank of the UAE supervises a broad range of institutions, from banks and finance companies to exchange houses, payment and stored value providers, insurers and Central Bank-regulated virtual asset providers. Each type of institution has its own business model and risk profile, so AML controls need to reflect what the firm actually does. Adventant supports CBUAE-supervised businesses with AML governance, customer due diligence, screening, monitoring and reporting. We start by confirming which rules and guidance apply to your licence category rather than assuming one set of requirements fits every institution. **Who it covers** - Banking and finance: Banks, Foreign bank branches, Finance companies, Investment companies - Payments and money services: Exchange houses, Payment Service Providers, Payment Token Service Providers, Stored Value Facilities, Retail Payment Service providers, Card scheme operators, Registered Hawala Providers - Virtual assets: CBUAE-regulated VASPs - Insurance: Insurance companies, Reinsurance companies, Insurance agents and agencies, Insurance brokers **Common control areas** - Governance, including a Compliance Officer and MLRO with appropriate authority and clear reporting lines - A business-wide and customer risk assessment that reflects your products, customers and channels - Customer due diligence, including beneficial ownership and enhanced due diligence for higher-risk customers - Sanctions and PEP screening with a documented process for reviewing potential matches - Transaction monitoring suited to your payment flows and customer base - Suspicious activity reporting and regulatory reporting through goAML - Staff training, record-keeping and independent testing of controls **FAQs** - **Can a CBUAE-supervised institution outsource its Compliance Officer?** Some CBUAE-supervised institutions may be expected to keep the Compliance Officer role in-house, although specific AML tasks can sometimes be outsourced under conditions. The position depends on the institution type and the current rules, so confirm it before any arrangement. Adventant can support an in-house officer on defined tasks. - **Do the same AML rules apply to every CBUAE-supervised firm?** No. Banks, exchange houses, payment providers and insurers have different requirements and guidance. We confirm which apply to your licence category. - **Does Adventant support virtual asset businesses supervised by the Central Bank?** Yes, subject to confirming which supervisor and rules apply to your activities, since some virtual asset firms are supervised by other authorities. **Official resources** - [Central Bank of the UAE](https://www.centralbank.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### DFSA: Dubai Financial Services Authority (DIFC) URL: https://adventant.com/industries/dfsa Jurisdiction: DIFC The Dubai Financial Services Authority regulates financial services in the Dubai International Financial Centre. Authorised firms range from investment firms, asset managers and fund managers to brokers, custodians, trust service providers and crypto token firms. Designated Non-Financial Businesses and Professions operating in the DIFC, such as auditors, law firms and company service providers, are also part of the picture. Adventant helps DIFC firms strengthen AML governance and controls. The DIFC has its own regulatory framework, so we start with the rules and guidance that apply to your authorisation or registration instead of reusing a generic approach. **Who it covers** - Authorised firms: Investment firms, Asset managers, Fund managers, Investment advisers, Brokers and dealers, Custodians, Trust service providers, Insurance-related firms, Money service businesses, Crypto and token firms regulated by the DFSA, Crowdfunding firms, Capital market firms, Market institutions and exchanges - DNFBP firms: Registered auditors, Real estate developers and brokers, Precious metals and stone dealers, Law firms and notary firms, Independent legal businesses, Accounting firms, Insolvency firms, Single family offices, Company service providers **Common control areas** - A Money Laundering Reporting Officer and senior management oversight, as required for your category of firm - A documented business risk assessment and a risk-based approach to customers - Customer due diligence including beneficial ownership, with enhanced measures for higher-risk relationships - Sanctions screening, PEP identification and escalation of matches - Ongoing monitoring and suspicious activity reporting - Staff training and record-keeping - Independent testing of AML systems and controls **FAQs** - **Can a DFSA-authorised firm appoint an external MLRO?** Many DFSA-authorised firms may be expected to keep key compliance roles within the firm, although specific AML tasks can sometimes be supported externally. Requirements depend on your authorisation, so confirm before any arrangement. Adventant can support your appointed MLRO on defined tasks. - **Are DIFC DNFBPs covered by the same requirements as authorised firms?** Not necessarily. Authorised firms and DNFBPs are subject to different parts of the regime. We confirm which apply to you. - **Is the DIFC regime the same as the onshore UAE rules?** No. The DIFC has its own regulatory framework, so we work from the rules that apply in the DIFC for your category of firm. **Official resources** - [Dubai Financial Services Authority](https://www.dfsa.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### CMA: Capital Markets Authority (formerly SCA) URL: https://adventant.com/industries/cma Jurisdiction: Federal Mainland (formerly SCA) The Capital Markets Authority, formerly the Securities and Commodities Authority (SCA), supervises securities and commodities markets and the firms that operate in them. That includes broker-dealers, investment advisers, portfolio and fund managers, custodians, market infrastructure, virtual-asset businesses and commodity businesses. Adventant supports CMA-regulated firms with AML governance, customer due diligence, screening, monitoring and reporting, working from the requirements and guidance that apply to your licence rather than a generic template. **Who it covers** - Investment and securities firms: Broker-dealers, Investment advisers, Portfolio managers, Fund managers, Custodians - Capital-market infrastructure: Exchanges, Central counterparties, Clearing houses, Central depositories - Virtual-asset businesses: VA brokers, VA custodians, VA platform operators - Commodity businesses: Commodity brokers, Commodity exchanges, Clearing institutions - Other regulated firms: Credit rating agencies, Crowdfunding operators, Fund administrators, Registrars, Listing and financial advisers, Relevant audit firms **Common control areas** - Governance, including a Compliance Officer and MLRO with appropriate authority - A risk assessment reflecting your clients, markets, products and channels - Customer due diligence for investors and counterparties, including beneficial ownership - Sanctions and PEP screening with documented review of matches - Monitoring of trading, settlement and payment activity for unusual patterns - Suspicious activity reporting and regulatory reporting through goAML - Staff training, record-keeping and independent testing **FAQs** - **Which businesses does the CMA supervise for AML?** The CMA supervises firms in the securities and commodities sectors, including brokers, advisers, fund and portfolio managers, custodians, market infrastructure and certain virtual asset and commodity businesses. Confirm the position for your licence. - **Can a CMA-licensed firm outsource its Compliance Officer?** Some CMA-regulated firms may be required to keep the Compliance Officer in-house, while particular AML tasks can sometimes be supported externally under conditions. Confirm your position first. Adventant can support an in-house officer. - **Is the CMA the same body as the SCA?** The CMA was formerly known as the SCA. We use the current name and confirm the status of specific rules and guidance with you. **Official resources** - [Capital Markets Authority](https://www.uaecma.gov.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### ADGM (FSRA): ADGM Financial Services Regulatory Authority URL: https://adventant.com/industries/adgm-fsra Jurisdiction: ADGM Abu Dhabi Global Market is a financial free zone with its own regulatory framework. The Financial Services Regulatory Authority (FSRA) supervises financial services firms in ADGM, including banks, investment firms, asset managers, fund-related businesses, custodians and virtual asset firms. Adventant supports ADGM firms with AML governance, due diligence, screening, monitoring and reporting, working from the FSRA's requirements for your category of authorisation. Non-financial businesses in ADGM follow a separate supervisory route, covered on our ADGM Registration Authority page. **Who it covers** - Financial services (FSRA): Banks, Investment firms, Asset managers, Funds and brokers, Custodians, Virtual asset firms **Common control areas** - A Money Laundering Reporting Officer and senior management oversight suited to your authorisation - A business risk assessment reflecting your clients, products and jurisdictions - Customer due diligence including beneficial ownership and enhanced measures for higher risk - Sanctions screening and PEP identification with documented review of alerts - Ongoing monitoring and suspicious activity reporting - Staff training and record-keeping - Independent testing of AML systems and controls **FAQs** - **Is the ADGM regime the same as the DIFC or onshore UAE?** No. ADGM has its own regulatory framework, separate from the DIFC and from the onshore rules. We work from the requirements that apply to your authorisation. - **Can an FSRA-authorised firm outsource its MLRO?** Some FSRA-authorised firms may be expected to hold key compliance roles in-house while outsourcing specific AML tasks under conditions. Confirm your position before any arrangement. Adventant can support an in-house MLRO on defined tasks. - **Which ADGM authority supervises my business for AML?** Financial services firms are supervised by the FSRA, and certain non-financial businesses are supervised by the ADGM Registration Authority. We help you confirm which applies. **Official resources** - [Abu Dhabi Global Market](https://www.adgm.com/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### ADGM (DNFBP): ADGM Registration Authority URL: https://adventant.com/industries/adgm-registration-authority Jurisdiction: ADGM Designated Non-Financial Businesses and Professions in ADGM, such as real estate businesses, dealers in gold and high-value goods, lawyers, accountants and company service providers, are subject to AML requirements, with the ADGM Registration Authority involved in their supervision where applicable. Auditors, insolvency practitioners and similar regulated professions may also fall within the framework. Adventant helps these businesses build practical AML controls: understanding who their customers are, recording decisions, recognising unusual activity and reporting concerns. We start by confirming whether and how the requirements apply to your activities. **Who it covers** - DNFBPs (Registration Authority): Real estate, Gold and jewellery, High-value goods, Lawyers, Accountants, Company service providers - Professional and specialist firms: Auditors, Insolvency practitioners, Similar regulated professions **Common control areas** - A designated compliance officer with appropriate seniority - A business risk assessment covering your clients, services and geographies - Customer due diligence, including identifying beneficial owners of corporate clients - Sanctions and PEP screening with a record of how matches were reviewed - Recognising and reporting suspicious activity through goAML, including any sector-specific reports - Staff training and record-keeping **FAQs** - **Which ADGM businesses count as DNFBPs?** Typically real estate businesses, dealers in precious metals and stones or other high-value goods, lawyers, accountants and company service providers, depending on their activities. We help confirm whether you fall within scope. - **Can an ADGM DNFBP appoint an external compliance officer?** It depends on the applicable rules and any approval or notification requirements. Confirm before any appointment. Adventant can review your position and explain the options. - **Do DNFBPs file goAML reports?** DNFBPs generally need to register on goAML and report suspicion, and some sectors have additional report types. We help you confirm which apply. **Official resources** - [Abu Dhabi Global Market](https://www.adgm.com/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### MoET: Ministry of Economy and Tourism URL: https://adventant.com/industries/moet Jurisdiction: Mainland & Commercial Free Zones The Ministry of Economy and Tourism supervises a range of Designated Non-Financial Businesses and Professions for AML purposes across mainland UAE and commercial free zones. These include real estate agents, auditors, accountants, corporate service providers and dealers in precious metals and precious stones. Adventant supports these businesses with practical AML controls that suit their size and sector: knowing their customers, recording decisions, recognising unusual activity and reporting concerns. We begin by confirming which requirements apply to your licensed activities. **Who it covers** - Supervised DNFBPs: Real estate agents, Auditors, Accountants, Corporate service providers, Dealers in precious metals and precious stones **Common control areas** - A designated compliance officer with appropriate seniority - A business risk assessment covering your customers, services and geographies - Customer due diligence, including identifying beneficial owners of corporate customers - Sanctions and PEP screening with a record of how matches were reviewed - Awareness of the cash-intensive and high-value transactions typical of your sector - Suspicious activity reporting and sector-specific reports through goAML - Staff training and record-keeping **FAQs** - **Which businesses does MoET supervise for AML?** MoET supervises DNFBPs including real estate agents, auditors, accountants, corporate service providers and dealers in precious metals and precious stones across mainland UAE and commercial free zones. Your licence and activities determine whether it applies to you. - **Do MoET-supervised businesses need a compliance officer?** Supervised businesses are generally expected to appoint a suitably qualified compliance officer. Whether an external appointment is permitted depends on the current rules and any notification needed, and we confirm the position for your business. - **Which goAML reports apply to real estate agents and precious metals dealers?** These sectors have report types specific to their activities in addition to suspicious activity reporting. We help you confirm which apply to your business. **Official resources** - [Ministry of Economy and Tourism](https://www.moet.gov.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### MoJ: Ministry of Justice URL: https://adventant.com/industries/moj Jurisdiction: Legal Profession The Ministry of Justice is responsible for AML supervision of legal professionals who carry out certain activities, including lawyers, legal consultancy firms and notaries. Not every legal activity falls within the AML regime. Whether it applies generally depends on the work carried out for clients. Adventant helps legal practices work out where the requirements apply and build proportionate controls: client due diligence, risk assessment, recording decisions and reporting concerns. We start with your activities rather than assuming the whole practice is in scope. **Who it covers** - Legal professions: Lawyers, Legal consultancy firms, Notaries carrying out activities within the AML remit **Common control areas** - Identifying which of your activities fall within the AML regime - A practice-level risk assessment covering clients, matters and geographies - Client due diligence, including beneficial ownership of corporate clients - Understanding the source of funds where a matter involves handling or moving money - Sanctions and PEP screening with a record of review - Reporting suspicion in line with the applicable rules - Staff training and record-keeping **FAQs** - **Are all law firms subject to AML supervision?** AML requirements generally apply to legal professionals when they carry out specified activities for clients, such as certain transactions or company-related services. Whether your practice is in scope depends on what you do. We help you assess this. - **Can a law firm appoint an external compliance officer?** That depends on the applicable rules and any notification requirements. We review your position before any appointment is considered. - **Do notaries have separate requirements?** Notaries within the Ministry of Justice's AML remit carry out activities that can fall within the regime. We confirm which requirements apply to your role. **Official resources** - [Ministry of Justice](https://www.moj.gov.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ### GCGRA: General Commercial Gaming Regulatory Authority URL: https://adventant.com/industries/gcgra Jurisdiction: Commercial Gaming The General Commercial Gaming Regulatory Authority licenses and regulates commercial gaming in the UAE. Licensed operators handle player funds and fast-moving transactions, which creates money laundering risks specific to the sector. Adventant helps licensed operators build AML controls that match how they actually take bets and pay out: player due diligence, risk assessment, monitoring, screening and reporting. We start from your licence conditions and regulator guidance. **Who it covers** - Gaming: Licensed commercial gaming operators **Common control areas** - Governance, including a Compliance Officer with appropriate authority - A business risk assessment covering players, products, channels and payment methods - Player due diligence at the points your licence conditions require - Source of funds checks for higher-risk players - Sanctions and PEP screening with documented review of matches - Monitoring of deposits, play and withdrawals for unusual patterns - Suspicious activity reporting, staff training and record-keeping **FAQs** - **What AML obligations do licensed gaming operators have?** Licensed operators are generally expected to understand their risks, identify and verify players where required, monitor activity, report suspicion and train staff. The detail is set by the licence conditions and regulator guidance, which we confirm with you. - **Can a gaming operator outsource compliance activities?** Some tasks, such as customer checks or alert review, may be supported externally. Whether the compliance officer role can be held externally depends on the rules and licence conditions, so we confirm first. - **Does monitoring differ for online and land-based operators?** Yes. Data, channels and risks differ, so monitoring and customer checks are designed around how each operator actually takes bets and pays out. **Official resources** - [General Commercial Gaming Regulatory Authority](https://www.gcgra.gov.ae/) - [UAE Financial Intelligence Unit (goAML)](https://www.uaefiu.gov.ae/) - [Executive Office for Control and Non-Proliferation](https://www.uaeiec.gov.ae/) --- ## Firm types ### AML compliance for banks in the UAE URL: https://adventant.com/sectors/banks Published: 2026-10-19 Banks sit at the centre of the UAE financial system, so they carry the heaviest expectations. This page explains where the money laundering risk concentrates, who supervises you and what a credible programme looks like. **Main risk:** Cross-border flows through layered corporate customers **Key control:** Risk-based due diligence, including beneficial owners **Typical report:** Suspicious transaction and activity reports through goAML Most money in the economy passes through a bank at some point. That position makes banks the first line of defence against money laundering and terrorist financing, and the first place a supervisor looks. A bank is expected to know who its customers are, to understand why they use the account and to notice when the activity stops making sense. This page covers licensed banks and the UAE branches of foreign banks. A branch is not a separate company, but it is still expected to run a credible local programme: its own risk assessment, a Compliance Officer or MLRO who can act on UAE obligations, and reporting to the UAE Financial Intelligence Unit through goAML. Group policy can set the framework, but it cannot replace local responsibility. Scale makes the job harder. A retail bank may handle millions of transactions a month for people it will never meet. A private or correspondent bank may handle a small number of very large and complicated relationships. The controls that suit one do not suit the other, which is why supervisors ask for a programme built on the bank's own risk assessment and not a copy of a template. **Money laundering and terrorist financing risks** - **Correspondent and cross-border payments**: A bank that clears payments for other banks often cannot see the end customer. The danger is moving funds for a respondent whose own controls are weak, or whose customers sit in higher-risk jurisdictions. - **Trade finance**: Letters of credit, invoices and shipping documents can be over-valued, under-valued, duplicated or invented to justify moving money across borders. The UAE's role as a trading hub makes trade-based laundering a particular concern. - **Politically exposed persons and private wealth**: Wealth arrives from many countries, and some of it belongs to or is controlled by public officials and their families. Establishing source of wealth, and not only source of funds, is the difficult part. - **Layered corporate customers**: Chains of holding companies, nominee arrangements and shell companies can hide who really owns and controls an account. A bank that stops at the first layer of ownership has not finished its due diligence. - **Cash and structuring**: Cash deposits split into smaller amounts to avoid attention, or large cash movements that do not fit the customer's business, remain a classic warning sign. - **Sanctions and proliferation financing**: Banks must screen customers and payments against the UAE local terrorist list and the United Nations lists, and act without delay when a true match is confirmed. A slow or inconsistent response is a serious failing. **What supervisors expect** - A Compliance Officer or MLRO with real authority, direct access to senior management and the board, and enough resource to do the job properly. - A written business-wide risk assessment that covers customers, products, countries and delivery channels, refreshed on a regular cycle and whenever something material changes. - Customer due diligence scaled to risk: simplified where the risk is demonstrably low, standard for most customers and enhanced for higher-risk ones, including politically exposed persons. - Identification of beneficial owners, and reasonable steps to verify them, rather than relying on a declaration alone. - Screening of customers, owners and payments against sanctions lists, with a documented process for reviewing potential matches and freezing without delay when a match is confirmed. - Transaction monitoring tuned to the bank's own products and customers, with alerts investigated, closed with a recorded reason and escalated when suspicion remains. - Suspicious transaction and activity reporting through goAML, and strict care never to tip off the customer. - Regular training, records kept for the period the rules require (commonly at least five years, so check your supervisor's guidance) and independent testing of the whole programme. **Red flags** - Account activity that does not match what the customer said about their business when the account was opened. - Large or frequent cash deposits followed quickly by transfers abroad. - Funds that enter and leave an account within days, leaving little behind. - Customers who are reluctant to explain ownership, or whose ownership keeps changing. - Trade documents with values, quantities or counterparties that do not add up. - Payments to or from countries that have no obvious link to the customer's business. **Scenario (illustration, not a real case): A new trading company and an unexplained pattern.** A newly incorporated trading company opens an account and says it will import electronics. Three months later the account receives transfers from several unrelated companies in different countries, each just below the level at which the bank triggers an enhanced review. Within a day the money is forwarded to a company abroad that the customer cannot explain. No single transfer looks alarming, but together they do not fit an electronics importer. A good monitoring programme alerts on the pattern, the analyst asks the relationship manager for invoices and contracts, and if the explanation does not hold up the Compliance Officer decides whether to file a report. The bank acts on the pattern and the missing explanation, not on proof of a crime. **Which supervisor applies:** Your supervisor depends on where the bank is licensed. A bank licensed by the Central Bank of the UAE is supervised by the CBUAE, and a bank authorised in Abu Dhabi Global Market is supervised by the FSRA. A foreign bank branch is supervised by the authority that licensed the branch, not by the home regulator of the parent. Banks in other financial free zones answer to their own free-zone regulator. If you are unsure, your licence names the authority. **FAQs** - **Does a foreign bank branch need its own MLRO?** Supervisors expect a branch to have a local Compliance Officer or MLRO who can act on UAE obligations, including filing reports through goAML. Group functions can support the branch, but responsibility for local compliance should not sit only at head office. Check your supervisor's guidance for the exact requirement. - **How often should a bank refresh its risk assessment?** No single date suits every bank. Most review at least once a year and again when something material changes, such as a new product or a new market. Your supervisor's guidance and your own board-approved policy set the frequency. - **Is simplified due diligence allowed?** Yes, where the risk is demonstrably low and the rules permit it. It is not the same as doing nothing: you still identify the customer, monitor the relationship and document why the lower level was appropriate. - **What happens after a bank files a suspicious report?** The report goes to the UAE Financial Intelligence Unit through goAML. The bank must not tell the customer, and it keeps managing the relationship carefully while it waits for any direction. Filing is a legal obligation once the threshold of suspicion is met, not an accusation. - **Can a bank outsource parts of its AML work?** Parts of the work, such as screening support or file reviews, can be supported by an outside firm. Accountability stays with the bank and its senior management, and supervisors expect the bank to oversee the provider and show how it checks the quality of the work. --- ### AML compliance for finance companies in the UAE URL: https://adventant.com/sectors/finance-companies Published: 2026-10-19 Finance companies lend and lease without taking deposits, which makes them look lower risk than banks. Supervisors do not see it that way. This page explains what to watch and what to put in place. **Main risk:** Loans repaid early or by someone other than the borrower **Key control:** Checking who really borrows, who repays and why **Typical report:** Suspicious transaction and activity reports through goAML A finance company lends money, leases equipment or vehicles, or finances purchases, without taking deposits from the public. Because the money flows out first and comes back in instalments, it is tempting to think the laundering risk is small. The risk is simply in a different place: in who is allowed to borrow, in who repays and in how quickly. Lending is a very convenient way to turn dirty cash into a clean-looking asset. If a customer repays a large loan in cash, or settles it early from an unexplained source, the lender has helped the money appear legitimate. Finance companies licensed by the Central Bank of the UAE are expected to understand this and to design their controls around it. The sector is also exposed to fraud. Fake identities, inflated invoices and borrowers who never intended to repay all produce proceeds of crime, and they often reach a finance company through brokers, dealers or other intermediaries that it does not fully control. **Money laundering and terrorist financing risks** - **Early or unexpected repayment**: A borrower who clears a long-term loan within weeks, or pays down a large balance from an unclear source, may be using the loan to launder funds. The question is always where the repayment came from. - **Third-party repayments**: Instalments paid by someone other than the borrower, or from accounts in other names and countries, break the link between the customer and the money. - **Cash repayments**: Where cash is accepted, repeated payments just below an internal limit, or large cash settlements, are a classic sign of structuring. - **Asset finance and resale**: Financed vehicles, machinery or equipment can be sold quickly, sometimes abroad, so that value is moved out of the country while the finance is still running. - **Intermediaries and introducers**: Many customers arrive through dealers, brokers or agents. If the lender relies on them to collect documents, it still has to be satisfied that the checks were done properly. - **Business borrowers with thin substance**: A newly formed company with little trading history, borrowing against future contracts, may be a vehicle for moving money rather than running a real business. **What supervisors expect** - A Compliance Officer or MLRO with authority and access to senior management, and a clear written programme approved at board level. - A business risk assessment that covers products such as personal loans, leasing and trade or invoice finance, as well as the channels and countries involved. - Customer due diligence before funds are advanced, including beneficial owners of business borrowers, with enhanced steps for higher-risk customers. - Understanding the purpose of the loan and how it will be repaid, and checking that the answer is credible for the customer. - Sanctions and politically exposed person screening at onboarding and on an ongoing basis, with documented review of matches. - Monitoring of repayments for early settlements, third-party payments, cash and changes in pattern, with alerts investigated and recorded. - Reports through goAML when there is suspicion, and care not to tip the customer off. - Training, record keeping for the required period, oversight of any introducers you rely on and independent testing of the programme. **Red flags** - A customer who repays a large loan early and cannot explain where the money came from. - Instalments paid by people or companies that have no clear connection to the borrower. - A borrower who seems more interested in how quickly the loan can be cleared than in the cost of it. - Documents from the same introducer that look similar, inconsistent or altered. - Financed assets that are resold or moved abroad shortly after purchase. - A new company borrowing a large amount against contracts that cannot be verified. **Scenario (illustration, not a real case): A car loan settled in cash in the second month.** A customer takes out a large vehicle loan through a dealer and, two months later, comes to settle the whole balance, mostly in cash. He explains that a relative sent him money. The finance company could treat this as a happy outcome, since the loan is repaid. A careful one asks who the relative is, why the money came in cash, why the loan was needed at all, and whether the pattern fits the customer's income. It records the answers, checks whether the dealer has seen similar cases and, if the explanation is weak, passes the file to the Compliance Officer to consider a report. Getting repaid is not the same as being comfortable with the money. **Which supervisor applies:** Finance companies licensed by the Central Bank of the UAE are supervised by the CBUAE for AML purposes. If you are a lender in a financial free zone, your free-zone regulator is your supervisor. If you are not sure which licence your lending activity falls under, check the licence and ask the authority that issued it. **FAQs** - **Are finance companies treated differently from banks?** The principles are the same: know the customer, understand the risk, monitor and report. The detail differs because a finance company does not take deposits, so its controls focus more on borrower checks, repayment behaviour and the intermediaries that bring in customers. - **Do I have to check customers brought to me by dealers or brokers?** You can rely on an introducer for some steps if the rules allow it, but responsibility for the checks stays with you. Supervisors expect you to test that the introducer's work is reliable and to be able to show how you did so. - **Should I accept cash repayments?** The rules do not forbid it, but cash is higher risk. Many lenders set a low limit or refuse cash altogether. If you accept it, you need to be able to explain why, record who paid and watch for patterns. - **What counts as an unusual repayment?** Anything that does not fit what you know about the customer: an early settlement, a payment from an unrelated third party, a sudden large lump sum or a change in the way payments are made. The point is to investigate and record the answer, not to assume the worst. - **How often should customer files be reviewed?** More often for higher-risk customers and when something changes. Most firms set a review cycle by risk rating and add event-driven reviews, for example after an alert or a change in ownership. Your policy should state the cycle. --- ### AML compliance for investment companies in the UAE URL: https://adventant.com/sectors/investment-companies Published: 2026-10-19 Investment companies often deal with a small number of large, wealthy and sometimes complicated clients. This page explains what that means for money laundering risk and for the programme a supervisor expects. **Main risk:** Large investments from wealth that is hard to trace **Key control:** Source of wealth and ownership checks before money is accepted **Typical report:** Suspicious transaction and activity reports through goAML Investment companies licensed by the Central Bank of the UAE invest capital for themselves, their shareholders or a defined group of clients. The exact scope of what a firm may do depends on its licence, so the first step for any firm is to read its licence and be clear about the activities it covers. The AML picture is shaped by who the investors are and how the money arrives. Relationships tend to be few, large and long-lasting, and the investors may be individuals, families, trusts or holding companies from many countries. A single failure of due diligence can therefore involve a very large sum. Supervisors will not expect the same transaction monitoring as a retail bank. They will expect a firm to know who is behind each investor, to understand where the wealth came from and to notice when a structure is more complicated than the investment needs. **Money laundering and terrorist financing risks** - **Source of wealth and source of funds**: Large investments need an explanation of how the investor came to have the money and where the specific funds were held. A story that cannot be supported with documents deserves caution. - **Complex ownership structures**: Investments may come through trusts, foundations, holding companies and nominees in several jurisdictions. The more layers there are without a clear commercial reason, the harder it is to see the real owner. - **Politically exposed persons**: Wealthy investors include public officials and their families. They are not barred, but they need enhanced checks and senior approval. - **Third-party funding**: Money that comes from someone other than the named investor, or is returned to a different account at the end, can disguise the true beneficiary. - **Rapid in-and-out movements**: An investor who places a large sum and asks for it back soon afterwards, without a market reason, may be using the investment only to pass money through a respectable name. **What supervisors expect** - A Compliance Officer or MLRO with enough standing to challenge business decisions, and board-level ownership of the programme. - A business risk assessment that reflects your investors, the countries they come from, your products and how funds arrive and leave. - Due diligence on every investor, including identifying and verifying beneficial owners, and enhanced due diligence for higher-risk ones. - Evidence of source of wealth and source of funds in proportion to the size of the investment. - Sanctions and politically exposed person screening at onboarding and while the relationship lasts. - Ongoing monitoring of contributions, redemptions and changes in ownership, with unusual activity escalated. - Suspicious activity reporting through goAML, training, record keeping and independent testing. **Red flags** - An investor who is vague about the origin of the funds, or whose explanation changes. - Ownership that is passed through several companies in different countries with no clear reason. - Funds arriving from, or redeemed to, an account that does not belong to the investor. - A request to redeem soon after investing, especially at a loss and without explanation. - Pressure to accept the investor quickly, or to skip checks because of a connection. - Adverse media about the investor or the people behind it that has not been addressed. **Scenario (illustration, not a real case): A large placement through a holding structure.** A firm is offered a substantial investment from a holding company registered abroad, owned by a trust whose beneficiaries are not named in the papers supplied. The introducer says the family is well known and the matter should be treated discreetly. The firm's response should be the opposite of discreet: ask for the trust documents, identify the settlor and beneficiaries, understand how the family's wealth arose and where the money is held. If the information is not provided, the firm should be willing to decline the business, and to consider whether the refusal itself raises concern that warrants a report. **Which supervisor applies:** Investment companies licensed by the Central Bank of the UAE are supervised by the CBUAE for AML purposes. Firms licensed in a financial free zone, such as the DIFC or ADGM, are supervised by the regulator of that zone, and may be better described on the pages for investment firms or asset managers. Check the activities listed on your licence. **FAQs** - **How much source of wealth evidence is enough?** Enough to make the origin of the wealth credible and to be supported by documents, in proportion to the amount and risk. For a high-risk investor that may mean accounts, sale agreements, tax records or an independent report. The test is whether an examiner reading the file would be satisfied. - **Can we rely on an introducer who says the investor is reputable?** A recommendation is a starting point, not due diligence. You can use an introducer to collect documents where permitted, but you remain responsible for the result and should verify the important facts yourself. - **Do we need transaction monitoring?** Yes, in a form that suits the business. A firm with few large relationships may rely on manual review of contributions, redemptions and ownership changes rather than automated systems, provided the review is regular, documented and effective. - **What if an investor is a politically exposed person?** You can accept the business if the risk is understood and managed. That normally means senior management approval, a clear source of wealth and funds, and closer ongoing monitoring. - **Which regulator applies to a firm in a free zone?** The regulator of the free zone where the firm is licensed. A firm in the DIFC answers to the DFSA and one in ADGM to the FSRA. The CBUAE supervises firms it has licensed. --- ### AML compliance for exchange houses and money service businesses in the UAE URL: https://adventant.com/sectors/exchange-houses Published: 2026-10-19 Exchange houses move money for people who often have no other way to do it, at high volume and in small amounts. That mix is why supervisors look closely. This page explains the risks and the controls that matter. **Main risk:** Cash remittances split across many senders and receivers **Key control:** Identify the sender and the receiver, and watch for linked payments **Typical report:** Suspicious transaction reports through goAML Exchange houses buy and sell foreign currency and send money across borders. In a country where a large share of the workforce supports families abroad, they provide an essential service. They also handle cash, deal with walk-in customers they may see only once and send money to countries with very different risk profiles. Money service businesses is the wider term used by some regulators, and covers firms whose business is moving or exchanging money for others. The AML expectations are broadly the same: know who is sending and receiving, understand why, and notice patterns that do not fit. The sector has a long record of regulatory attention. Supervisors expect strong controls over cash, over remittance data and over the use of agents and sub-agents, because a weak link anywhere in the chain can be used to move illicit money. **Money laundering and terrorist financing risks** - **Structuring and smurfing**: Splitting a large sum into many small transfers, often using different senders or branches, keeps each payment below attention thresholds. Only a view across customers and branches reveals it. - **Cash intensity**: Large cash handling carries risks of forged notes, unexplained cash and cash that is not what the customer says it is. Cash controls need to be as tight as customer controls. - **Beneficiaries in higher-risk countries**: Payments to places with weak controls, conflict or sanctions exposure need extra attention, particularly when the link between sender and receiver is unclear. - **Missing or poor payment information**: A transfer that does not carry accurate details of who is sending and who is receiving is hard to screen and hard to investigate. Complete information should travel with every payment. - **Agents and partner networks**: Payments often pass through agents, correspondents and partners. The firm is responsible for choosing them carefully and for noticing if their behaviour changes. - **Informal value transfer around the edges**: Customers may use a licensed firm as the front end of an informal arrangement, with settlement happening elsewhere. Unusual patterns of two-way flows between the same people are worth a closer look. **What supervisors expect** - A Compliance Officer or MLRO who knows the business in detail, with direct access to senior management and enough resource across all branches. - A business risk assessment covering customers, countries, products, branches and agents, kept up to date. - Customer identification for every relevant transaction, with higher-risk customers, large amounts and linked transactions subject to extra checks. - Complete originator and beneficiary information on every transfer, and screening of both against sanctions lists before the payment is released. - Monitoring across branches and channels for linked transactions, structuring and unusual corridors. - Strong cash controls, including counting, reconciliation and reporting of unusual cash. - Reporting of suspicion through goAML, training of counter staff who are the first line of defence, and independent testing, including branch visits. **Red flags** - Several customers sending small amounts on the same day to the same beneficiary. - A customer who changes the amount or splits the transfer when asked for identification. - Senders who appear to have no connection to the beneficiary or to the reason given. - Large amounts relative to the customer's apparent job or income. - Customers using several branches in one day, or several names for the same payment. - Reluctance to give the purpose of the payment or details of the beneficiary. **Scenario (illustration, not a real case): Ten small transfers, one beneficiary.** On a Friday, ten different customers visit three branches and each sends an amount just under the level that triggers enhanced checks, all to the same account in another country. Each counter clerk sees an ordinary remittance. Only the central monitoring team sees the pattern. A well-run firm would have rules that look for many senders to one beneficiary across branches, an analyst who reviews the alert the same day, and a Compliance Officer who decides whether to hold further payments and file a report. It would also use the case to retrain counter staff on how to spot a split payment in front of them. **Which supervisor applies:** Exchange houses are licensed and supervised by the Central Bank of the UAE. Money service businesses authorised in the Dubai International Financial Centre are supervised by the DFSA. If you operate in another free zone, your licensing authority will tell you which supervisor applies, and some activities need a licence of their own, so check your authorisation carefully. **FAQs** - **Why are exchange houses treated as higher risk?** Because of the combination of cash, speed, cross-border movement and customers who may be walk-ins. This does not mean every exchange house is a problem. It means supervisors expect strong controls in proportion to the exposure. - **Do I need to identify every customer?** Customer identification rules depend on the type and size of transaction and on your supervisor's guidance. As a rule you should be ready to identify customers well before the level at which a report becomes mandatory, and you must always identify when you suspect wrongdoing. - **What information must travel with a payment?** Supervisors expect accurate information on the sender and the receiver to accompany transfers, so that the payment can be screened and traced. The detail required is set in your supervisor's rules, so check it for your type of payment. - **Who is responsible when an agent makes a mistake?** The firm. If you appoint agents or rely on partners, you remain responsible for the result. You need to select them carefully, train them, monitor them and be able to show that you do. - **How should counter staff be trained?** With real examples of split payments, mismatched explanations and pressure from customers, and with a simple route to escalate without alerting the customer. Short refreshers during the year work better than one annual session. --- ### AML compliance for payment service providers in the UAE URL: https://adventant.com/sectors/payment-service-providers Published: 2026-10-19 Payment providers sit between merchants, banks and customers, and they move money quickly. This page covers where the AML risk sits for them and what supervisors expect of a modern payments firm. **Main risk:** Fast, high-volume payments for merchants and users at a distance **Key control:** Merchant onboarding and real-time monitoring **Typical report:** Suspicious transaction reports through goAML Payment service providers cover a wide group: firms that process card and online payments for merchants, issue accounts or wallets, initiate payments on behalf of customers or support retail payments of other kinds. In the UAE they are licensed by the Central Bank, and the retail payment services regime applies to many of them. Their customers are often merchants and users they never meet. Onboarding is digital, volumes are high and money can move in seconds. That speed is the product, and it is also the risk, because there is less time between a payment being made and the funds being out of reach. A supervisor will expect the firm's controls to be as modern as its product. That means automated checks at onboarding, monitoring that works in real time or close to it, and clear ownership of the AML programme inside what is often a fast-growing technology business. **Money laundering and terrorist financing risks** - **Merchant risk**: Merchants that are not what they claim, such as shell businesses used to pass illicit funds through the payment system, or businesses in higher-risk sectors, can put the whole provider at risk. - **Remote onboarding and identity fraud**: When no one meets the customer, false or stolen identities are a constant risk. Verification tools need to be tested and not simply trusted. - **Mule accounts**: Accounts opened by real people who are then used to receive and forward criminal proceeds are common in digital payments. Behavioural monitoring is needed to spot them. - **Speed and cross-border reach**: Funds can arrive and leave within minutes, across borders and between partners, so that detection after the fact is often too late. - **Reliance on partners**: Banks, card networks, agents and technology vendors are woven into the payment chain. The provider must understand where its own responsibility starts and ends. - **Fraud overlapping with laundering**: Scams, account takeovers and chargeback abuse produce criminal proceeds that then need to be moved. Fraud and AML teams that do not share information leave gaps. **What supervisors expect** - A named Compliance Officer or MLRO with real authority, plus board and senior management who understand the AML risks of the product. - A risk assessment that covers each product, merchant type, customer type, country and delivery channel, refreshed when new products launch. - Merchant and customer due diligence that fits the risk, with beneficial owner checks and ongoing review. - Sanctions and politically exposed person screening at onboarding and during the relationship. - Monitoring tuned to the firm's real flows, with fast alert handling and clear thresholds for escalation. - Reports through goAML, training that reflects how staff really work, and records kept for the required period. - Independent testing of systems as well as policies, including how the firm's models and rules were designed and tuned. **Red flags** - A merchant whose trading profile changes sharply, or whose volumes do not match its stated business. - Accounts that receive many small payments and quickly forward them to another account. - Repeated use of the same device or address across several unrelated accounts. - Refund or chargeback patterns that suggest a merchant is cycling money. - Customers who give inconsistent details during onboarding. - Payments to or from sectors or countries that the provider has not assessed. **Scenario (illustration, not a real case): A new online merchant whose volume jumps.** A new merchant says it sells accessories online. In its first week it processes a handful of sales. In the fourth week volume rises tenfold, most payments come from cards issued in several different countries and many are refunded to different cards. The provider's rules should flag the sudden change. An analyst would look at the merchant's website, deliveries, refund pattern and device data, speak to the merchant and, if needed, hold settlement while the explanation is sought. If the story does not hold, the Compliance Officer decides on a report and on whether to end the relationship. **Which supervisor applies:** Payment service providers and retail payment service providers licensed by the Central Bank of the UAE are supervised by the CBUAE. Providers in a financial free zone answer to that zone's regulator. Your licence and the category of payment service you are authorised to provide determine the specific rules that apply. **FAQs** - **Is a payment service provider the same as a bank for AML purposes?** Not the same, but the core duties are alike: know your customer, monitor, screen and report. What differs is the product risk, which is why the programme should be built from your own risk assessment rather than a bank template. - **Can we rely on the bank or card scheme's checks?** Their checks do not replace yours. You are responsible for your own customers and merchants, and supervisors expect your own programme to function even if a partner has strong controls. - **How strict does remote identity verification need to be?** It needs to be reliable for the risk. Many firms combine document checks, liveness tests and data checks, and add extra steps for higher-risk cases. Whatever you use, test how well it catches false identities and keep records of the results. - **How should fraud and AML teams work together?** By sharing alerts and findings. Fraud cases often reveal laundering and the other way round. A single case management process, or at least a regular exchange, closes the gap. - **What happens when volumes grow quickly?** Controls must grow too. Supervisors expect resourcing, systems and alert backlogs to be monitored by management. A growing alert queue that is never cleared is a finding waiting to happen. --- ### AML compliance for payment token service providers in the UAE URL: https://adventant.com/sectors/payment-token-service-providers Published: 2026-10-19 Payment tokens, such as dirham-linked stablecoins, move like cash but on a ledger anyone can see. This page explains what that means for money laundering risk and for the controls a supervisor expects. **Main risk:** Value that moves quickly and across borders on open networks **Key control:** Know the holder, screen wallets and monitor on-chain activity **Typical report:** Suspicious transaction reports through goAML A payment token is a digital token designed to hold a stable value and to be used to pay for things, rather than to be held as an investment. Businesses that issue, convert, hold or transfer these tokens for customers in the UAE need to be authorised by the Central Bank, and they have AML duties like other regulated financial firms. Tokens combine features of cash and of electronic money. They can move between people in seconds and across borders, and the ledger is often public. That makes some investigation easier, because transactions can be traced, but it also means that value can be moved before anyone at the issuer has had a chance to react. Supervisors expect a firm that handles payment tokens to bring the discipline of a bank to a new technology: proper customer checks, sanctions screening that covers wallet addresses, and monitoring that uses both the firm's own records and what the blockchain shows. **Money laundering and terrorist financing risks** - **Anonymity and wallet ownership**: A wallet address does not by itself say who owns it. The firm has to link addresses to verified customers and treat unhosted or unknown wallets with care. - **Speed and cross-border movement**: Tokens can pass through many wallets and across borders very quickly, which makes it harder to stop funds once a problem is spotted. - **Mixing and obfuscation**: Tools designed to hide the trail of funds, and chains of transfers between many wallets, can be used to layer criminal proceeds. - **Sanctions exposure**: Wallets linked to sanctioned people or places can interact with the network. Screening must cover addresses as well as names. - **Redemption and conversion points**: Where tokens are turned back into money, the firm is at a gateway. This is where checks on the source of the tokens and the identity of the customer matter most. **What supervisors expect** - A named Compliance Officer or MLRO with understanding of the technology, and board oversight of the AML programme. - A risk assessment that considers the token, the networks used, the customers, the countries and the way tokens are issued and redeemed. - Customer due diligence before onboarding, with beneficial owner checks for business customers, and enhanced checks for higher-risk customers. - Screening of customers and wallet addresses against sanctions lists, and a process to act without delay on a confirmed match. - Monitoring that combines internal records with blockchain analytics, and investigation of alerts with recorded outcomes. - Information on the parties to a transfer collected and passed on, in line with the rules that apply to your activity. - Reporting through goAML, training, record keeping and independent testing of both technology and process. **Red flags** - Tokens received from addresses linked to mixers, darknet markets or sanctioned parties. - A customer who wants to move tokens through several wallets before redeeming. - Many small transfers that add up to a large amount, or the reverse. - Customers who refuse to confirm ownership of a wallet they want to use. - Redemptions to bank accounts in the name of other people. - Sudden activity on a long-dormant account. **Scenario (illustration, not a real case): A fast redemption after a chain of transfers.** A customer receives a large amount of tokens from an address the firm's analytics tool flags as having received funds from a high-risk service. Within an hour the customer asks to redeem the whole balance to a bank account in someone else's name. A strong programme stops the redemption, asks the customer to explain the origin of the tokens and the ownership of the receiving account, and records the response. If the explanation is not persuasive, the Compliance Officer considers a report and whether to freeze or return the funds in line with the rules. **Which supervisor applies:** Payment token services licensed in the UAE under the Central Bank's regime are supervised by the CBUAE. Other token and crypto activity may fall under a different regulator depending on the product and where the business is based, so read the virtual asset service provider page if your activity goes beyond payment tokens. **FAQs** - **Is a payment token the same as a cryptocurrency?** Not necessarily. A payment token is intended to maintain a stable value and to be used for payments, while many cryptocurrencies are held or traded as investments. The regulatory treatment can differ, so check how your activity is classified. - **Does the public ledger make AML easier?** In some ways, because transactions can be traced. But a wallet address is not an identity, and criminals can move tokens through many addresses. You still need customer due diligence and monitoring. - **Do we need to screen wallet addresses?** Supervisors expect screening to cover the risks that the technology brings, which in practice includes addresses linked to sanctioned or high-risk parties. Many firms use blockchain analytics tools to support this. - **What about transfers to private wallets?** They are higher risk because ownership is harder to confirm. Firms usually require proof of control of the wallet and apply extra checks. Your supervisor's rules set the minimum. - **Who supervises other crypto businesses?** It depends on the activity and where the firm is licensed. See the page on virtual asset service providers for how this is divided between the regulators on this site. --- ### AML compliance for stored value facilities in the UAE URL: https://adventant.com/sectors/stored-value-facilities Published: 2026-10-19 Prepaid cards and digital wallets are convenient and easy to share, which is exactly why they attract misuse. This page explains the AML risks of stored value and what supervisors expect. **Main risk:** Anonymous or lightly checked cards and wallets passed between people **Key control:** Limits that match the level of customer checks **Typical report:** Suspicious transaction reports through goAML A stored value facility lets people load money onto a card, wallet or similar account and spend it later. Examples include prepaid cards, digital wallets and gift or travel cards. They are licensed by the Central Bank of the UAE and are designed to be easy to open and easy to use. Convenience is the point, and also the risk. A card bought with cash and handed to another person, a wallet opened with minimal checks, or many wallets opened by the same group can all be used to move or hide money. The lighter the customer checks, the tighter the limits need to be. Supervisors generally accept that different products carry different levels of risk. A closed-loop card that can only be used in one shop is not the same as an open-loop card that can withdraw cash anywhere. What they expect is that the firm has thought about this and set limits and controls to match. **Money laundering and terrorist financing risks** - **Lightly verified accounts**: Accounts opened with little or no identification are easier to misuse. Where a lighter process is allowed, it must come with low limits and close monitoring. - **Cash loading**: Loading cards with cash, repeatedly and in small amounts, can place illicit cash into the system without drawing attention. - **Cards shared or sold**: Cards passed from person to person, or bought in bulk by one buyer, defeat the link between the account and the user. - **Cash withdrawal abroad**: Open-loop cards used to withdraw cash in other countries move value across borders with little trace. - **Mule use**: Individuals recruited to open accounts and pass money through them are a common use of wallets and prepaid cards. **What supervisors expect** - A Compliance Officer or MLRO with authority and a clear programme approved by management. - A product-by-product risk assessment, covering load methods, withdrawal options, limits and the markets served. - Customer due diligence matched to the account's limits, with full checks where limits are higher or functions broader. - Controls on how many cards one person can hold and on bulk or corporate purchases. - Sanctions and politically exposed person screening, with documented review of matches. - Monitoring for patterns such as repeated loads and withdrawals, quick in-and-out movement and use in several countries. - Reports through goAML, training for staff and agents, record keeping and independent testing. **Red flags** - Multiple cards or wallets opened with the same address, phone number or device. - Frequent cash loads just below a threshold. - Cards used for cash withdrawals in countries unrelated to the holder. - Bulk corporate orders with no clear business purpose. - Accounts that are loaded and emptied almost immediately. - A customer who asks about limits and how to avoid checks. **Scenario (illustration, not a real case): A bulk order for gift cards.** A newly registered company places a large order for open-loop prepaid cards to be distributed as staff gifts. It has no staff list to share, asks for the cards to be delivered to a private address and wants them loaded immediately with cash. The firm should treat the order as higher risk: confirm who owns and controls the company, understand why so many cards are needed, ask how the cards will be distributed and decline or reduce the order if answers are poor. The order, the questions asked and the answers should all be recorded for the Compliance Officer. **Which supervisor applies:** Stored value facilities licensed in the UAE under the Central Bank's regime are supervised by the CBUAE. Providers operating in a financial free zone are supervised by that zone's regulator. Your licence defines what products you can issue, and the rules attached to it may set limits and customer requirements. **FAQs** - **Can a stored value product be issued without full customer checks?** Where the rules allow lighter checks, they usually come with lower limits and more monitoring. The detail depends on your licence and your supervisor's rules, so confirm what applies to each product. - **Are gift cards treated differently from wallets?** The risk differs. A card that can only be used in one shop is generally lower risk than one that can withdraw cash anywhere. You should assess each product separately and set limits accordingly. - **How should we deal with bulk purchases?** Treat them as a higher-risk case. Check who the buyer is, why the quantity is needed and how the cards will be used, and keep a record of your decision. - **Do agents and distributors need training?** Yes, if they sell or load your products. They are often the first to meet the customer, so they need to know what to look for and how to report concerns. - **When should we close an account?** When you cannot complete due diligence, when activity cannot be explained and you remain concerned, or when you have reported suspicion and the relationship is no longer acceptable. Take care not to tip the customer off. --- ### AML compliance for card scheme operators in the UAE URL: https://adventant.com/sectors/card-scheme-operators Published: 2026-10-19 A card scheme does not usually deal with cardholders directly. It runs the network that banks and payment firms use. This page explains how AML duties apply at that level and what supervisors expect. **Main risk:** Members and merchants with weak controls using the network **Key control:** Membership standards and monitoring of participants **Typical report:** Suspicious transaction reports through goAML A card scheme operator runs the rules, technology and settlement arrangements that allow card payments to work between banks, merchants and cardholders. In the UAE, operators of such schemes fall within the Central Bank's supervision. Most of the customer relationships sit with the members, such as issuing and acquiring banks and payment firms. The scheme therefore does not see every cardholder. Its AML role is different: it decides who may join, sets and enforces standards, and monitors activity across the network for patterns that individual members may miss. This is a role with influence. A scheme that admits a weak member, or does not act on warning signs, lets illicit funds flow through a trusted brand. Supervisors expect scheme operators to take that responsibility seriously even though they are not on the front line. **Money laundering and terrorist financing risks** - **Admitting weak members**: A bank or payment firm with poor controls can introduce high-risk merchants or issue cards that are easily abused. Membership checks are the first line of defence. - **High-risk merchants and merchant laundering**: Fake merchants, or real merchants used to process transactions that are not genuine, can run illicit funds through the network as sales. - **Cross-border cash-out**: Cards used to withdraw cash abroad, or to buy goods that are easily resold, can move value across borders with little trace. - **Gaps between members**: Each member sees only its own part. Patterns that only appear across several members, such as one card used with many acquirers, may be visible only to the scheme. - **Sanctions and restricted activity**: The scheme must ensure that sanctioned parties and prohibited activities are kept out of the network and that members apply the right controls. **What supervisors expect** - A Compliance Officer or MLRO who understands both the scheme's rules and the supervisor's expectations, and who can escalate to the board. - A risk assessment that looks at members, geographies, products and the types of merchants the network serves. - Due diligence on prospective and existing members, including their ownership, licences, AML programmes and track record. - Standards, audits and sanctions for members that do not meet the scheme's AML requirements. - Network-level monitoring for unusual patterns across members, with a route to share concerns with members and authorities where appropriate. - Screening of the scheme's own counterparties and a process to act on sanctions matches without delay. - Reporting through goAML where suspicion arises, training, record keeping and independent testing. **Red flags** - A prospective member that has been criticised by regulators or has weak AML governance. - A sudden growth in volumes at one acquirer that does not match its merchant base. - Clusters of transactions at merchants that appear to sell nothing real. - Cards from one issuer used heavily for cash withdrawals in unrelated countries. - A member that is slow or unwilling to answer the scheme's AML questions. - Repeated rule breaches that are not corrected. **Scenario (illustration, not a real case): One acquirer, an unusual merchant cluster.** Scheme monitoring shows that an acquiring member has signed up dozens of small online merchants in a short period. Most have almost identical websites and receive payments from cards issued in many countries, with a high refund rate. No single transaction stands out. The scheme's AML team contacts the member, asks for the merchants' due diligence files, reviews them and, finding weak checks, requires remediation and enhanced monitoring. If the member does not cooperate, the scheme considers suspending processing and whether a report should be filed. **Which supervisor applies:** Card scheme operators in the UAE are supervised by the Central Bank. If your operations also involve a financial free zone, check with the free-zone regulator whether any part of your activity is supervised there as well. **FAQs** - **Does a card scheme have to identify cardholders?** Usually not directly, because cardholder relationships sit with issuing members. The scheme's duty is to make sure members meet proper standards and to monitor the network. The detail depends on how the scheme operates and on the Central Bank's rules. - **What should membership due diligence cover?** Ownership and control, licences, financial strength, AML policies and track record, and the types of business the member will bring to the network. It should be repeated when something material changes. - **How can a scheme enforce AML standards?** Through its rules and contracts, which can include audits, remediation plans, fines and, in serious cases, suspension. Enforcement is only credible if it is used consistently. - **Can a scheme report suspicious activity itself?** Where the scheme itself forms a suspicion in the course of its activity, it has the same duty to report through goAML as other regulated firms. It should also have a route to alert members and authorities. - **How does a scheme monitor activity it cannot fully see?** By using the data it has: patterns across members, merchants, countries and refund rates. The aim is not to see every payment in detail but to spot what no single member could see. --- ### AML compliance for registered hawala providers in the UAE URL: https://adventant.com/sectors/hawala-providers Published: 2026-10-19 Hawala is an informal way of moving value that runs on trust between brokers. In the UAE it is allowed only through registered providers with real AML duties. This page explains the risks and what is expected. **Main risk:** Value moved by settlement between brokers, with little formal trace **Key control:** Complete records of every transfer and settlement **Typical report:** Suspicious transaction reports through goAML Hawala is a long-established system in which one broker takes money from a customer in one place and another broker pays out the equivalent in another, with the two brokers settling between themselves later. It is cheap and fast and widely used by migrant workers, but because the money does not travel with the instruction, there can be little formal trace. The UAE does not ban hawala but requires providers to register with the Central Bank and to follow AML rules. In practice, that means keeping detailed records of who sends and who receives, reporting suspicious activity and accounting for the settlements between brokers. The register matters. A provider that is not registered is operating illegally, and a registered one that keeps poor records is the kind of firm that supervisors expect to find weaknesses in. Good record keeping is the difference between a legitimate service and an opaque one. **Money laundering and terrorist financing risks** - **Weak audit trail**: Where records are paper-based or inconsistent, it is hard to show who sent what, to whom, and how the settlement was made. This is the main concern of supervisors. - **Settlement between brokers**: Settlement may happen through goods, cash, trade invoices or other transfers, not always through banks. Understanding how and when it takes place is essential. - **Use by criminals**: A method that is quick, informal and cross-border can be attractive for moving proceeds of crime and for funding terrorism, which is why the registration regime exists. - **Cash and structuring**: As in other money transfer businesses, splitting large sums into smaller transfers is a way of staying beneath attention. - **Links to trade-based value transfer**: Settlement through goods and invoices can be used to disguise the movement of value if documents do not reflect real trade. **What supervisors expect** - Registration with the Central Bank and compliance with the conditions of registration, including any reporting it requires. - A named person responsible for compliance, with a clear programme that fits the size and nature of the business. - Identification of customers and recording of the details of senders and receivers for every transfer. - Complete, accurate and retrievable records of transfers and of the settlements between brokers. - Screening of customers, beneficiaries and countries against sanctions lists, and action on matches. - Reporting of suspicious activity through goAML and care not to alert the customer. - Training for everyone who deals with customers and regular checks that the procedures are followed. **Red flags** - A customer who wants to send a large sum with no reason or paperwork. - Repeated payments of similar amounts to the same receiver by different senders. - Reluctance to provide identification or to explain the purpose of the transfer. - Settlement arrangements that cannot be explained or do not match real trade. - Requests to avoid keeping a record. - Customers using the service to move sums that do not fit their income. **Scenario (illustration, not a real case): A broker who settles in invoices.** A registered hawala broker settles its balance with a counterpart abroad through the purchase of goods that the counterpart ships later. Nothing is recorded beyond a handwritten note. A supervisor asking how a specific transfer was settled cannot be given a document that shows it. The broker should instead record each transfer, link it to the settlement and keep invoices and shipping documents that show real trade. If the broker cannot do this, the provider's risk is that the arrangement may be treated as a means of moving value without a proper audit trail. **Which supervisor applies:** Hawala providers in the UAE register with and are supervised by the Central Bank. If you offer money transfer services in a financial free zone, check with that zone's regulator, because the rules may be different. Operating without registration is a serious breach, so confirm your status before you accept any customer money. **FAQs** - **Is hawala legal in the UAE?** Providers can operate if they are registered with the Central Bank and follow the rules attached to that registration. Operating without registration is not allowed. You should confirm your own status with the Central Bank. - **What records do I need to keep?** Records of each customer, each transfer and each settlement, in a form that can be produced when asked. The Central Bank's conditions set the minimum, and good practice is to keep more rather than less. - **Can a small hawala broker run a simple AML programme?** Yes. The programme can be proportionate to the size and risk of the business, but it must exist, be written down, be followed and be tested. Simple does not mean absent. - **What if a customer refuses identification?** You should not complete the transfer. If the refusal looks suspicious, consider a report. Do not explain to the customer that you are considering one. - **Do I have to report through goAML?** Registered providers are expected to report suspicion through goAML. Register early, because you need access to the system at the moment you want to file. --- ### AML compliance for virtual asset service providers in the UAE URL: https://adventant.com/sectors/virtual-asset-service-providers Published: 2026-10-19 Virtual asset businesses move value across borders in minutes, using technology that was designed to avoid middlemen. This page explains how the UAE expects them to manage money laundering risk, and which regulator may apply. **Main risk:** Fast cross-border transfers to wallets whose owners are unknown **Key control:** Identify customers, screen wallets and monitor on-chain activity **Typical report:** Suspicious transaction reports through goAML A virtual asset service provider, or VASP, is a business that exchanges, transfers, holds, brokers or operates a platform for virtual assets on behalf of customers. That covers exchanges, brokers, custodians and other platforms. The UAE treats these businesses as part of its financial AML framework, and they are expected to meet standards close to those of other financial firms. Several authorities are involved, because the UAE has more than one regulatory system. On this site, virtual asset businesses appear under the Central Bank, the DFSA in the Dubai International Financial Centre, the FSRA in Abu Dhabi Global Market and the Capital Markets Authority. Which one applies depends on where the firm is licensed and on what it does. There is also a separate Dubai authority for virtual assets outside the DIFC, which is not covered on this site, so check your own licence. The technology brings real strengths for investigators, because many blockchains are public. It also brings real weaknesses: value can move across the world in minutes, wallets do not reveal their owners and a number of tools exist to obscure the trail. The best firms combine the discipline of a bank with a deep understanding of the technology. **Money laundering and terrorist financing risks** - **Wallets and unknown owners**: An address does not say who controls it. Transfers to and from unhosted wallets, where the user holds the keys, need extra care because the firm cannot see the person behind them. - **Speed and borders**: Assets can leave a platform and cross several jurisdictions in minutes. Controls that act only after the fact will miss the moment of risk. - **Mixers, privacy tools and chain-hopping**: Services that blend funds from many sources, and moving value between different assets and networks, are used to break the link between the origin and the destination. - **Fraud, scams and ransomware proceeds**: Proceeds of crimes such as investment scams and ransomware are commonly turned into virtual assets and cashed out through exchanges. - **Sanctions evasion**: Sanctioned parties may use virtual assets to move value. Firms must screen customers and addresses and act without delay on a confirmed match. - **Customer onboarding at a distance**: Customers join online, often from many countries. Identity fraud and the use of accounts by people other than the verified holder are constant concerns. **What supervisors expect** - A Compliance Officer or MLRO who understands both the technology and the regulations, with direct access to the board. - A business risk assessment covering the assets handled, the networks used, the customers served, the countries involved and the type of service offered. - Customer due diligence at onboarding, including beneficial owners of business customers and enhanced checks for higher-risk customers. - Screening of customers and of wallet addresses against sanctions lists, using blockchain analytics where appropriate. - Collection and transmission of originator and beneficiary information for transfers, in line with the rules that apply to your licence (often called the travel rule). - Monitoring that combines the firm's own records with on-chain data, and investigation of alerts with a recorded outcome. - Reporting through goAML, staff training that covers new typologies, record keeping and independent testing of systems and processes. **Red flags** - Funds arriving from addresses linked to mixers, darknet markets or sanctioned parties. - A customer who deposits, trades briefly and withdraws to a new wallet with no apparent purpose. - Use of privacy-enhanced assets or tools without a reasonable explanation. - Transfers split into many small amounts or moved through many wallets. - A customer who will not confirm control of the wallet they want to withdraw to. - Several accounts that share devices, addresses or bank accounts but present as unrelated. **Scenario (illustration, not a real case): A deposit from a flagged address, then a fast exit.** A new customer funds an account with a large amount of tokens from an address that the firm's analytics tool marks as having received funds linked to a scam. Within an hour the customer swaps into a different asset and tries to withdraw to a new wallet. The firm's controls should pause the withdrawal, ask the customer how the assets were obtained and who controls the destination wallet, and record the answers. If the explanation is weak or the customer disappears, the Compliance Officer considers a report to the Financial Intelligence Unit and whether to freeze the funds, always in line with the rules that apply to the licence. **Which supervisor applies:** It depends on where you are licensed and what you do. Virtual asset businesses licensed by the Central Bank are supervised by the CBUAE. Crypto and token firms in the DIFC are supervised by the DFSA, and virtual asset firms in Abu Dhabi Global Market by the FSRA. Virtual asset brokers, custodians and platform operators overseen by the Capital Markets Authority are supervised by the CMA. A separate Dubai authority covers virtual assets outside the DIFC and is not described on this site. Your licence names your regulator. **FAQs** - **Which regulator supervises my virtual asset business?** It depends on where you are licensed and on the activity. The Central Bank, the DFSA, the FSRA and the Capital Markets Authority each supervise different groups on this site, and a separate Dubai authority exists for activity outside the DIFC. Check your licence, and if in doubt ask the issuing authority. - **Does the travel rule apply to us?** Supervisors expect virtual asset businesses to collect and pass on information about the parties to transfers, in line with international standards. The exact requirement depends on your licence and the rules your regulator has issued, so check the current guidance. - **Can we accept transfers from private wallets?** Many firms do, but with extra checks such as proof that the customer controls the wallet and a look at the address's history. Some choose not to accept them at all. The decision should follow from your risk assessment. - **Do we need blockchain analytics?** The rules do not name a tool. But supervisors expect monitoring that is capable of dealing with the risks of the technology, and in practice most firms use blockchain analytics to do so. - **What if a customer is in a country we do not serve?** Your onboarding should detect it, using location checks as well as documents. If you find that a customer in a restricted country has been onboarded, you should deal with the matter according to your policy and consider whether a report is needed. --- ### AML compliance for insurance and reinsurance companies in the UAE URL: https://adventant.com/sectors/insurers Published: 2026-10-19 Most insurance carries low laundering risk, but life and investment-linked products do not. This page explains where the risk concentrates for insurers and reinsurers and what supervisors expect. **Main risk:** Life and investment-linked policies bought, surrendered or cancelled early **Key control:** Understand the policyholder, the beneficiary and where premiums come from **Typical report:** Suspicious transaction reports through goAML An insurance company takes premiums and promises to pay if something happens. For motor, health or property cover, there is little to launder: the premiums are modest and payouts are tied to real losses. Life insurance with a savings or investment element is different, because money paid in can be accessed again by surrendering the policy, and that looks like a legitimate source of funds. Reinsurers sit behind insurers. They deal with other firms, not individuals, but they can still be used to move funds between countries, particularly if reinsurance contracts are not at arm's length or are used to cover claims that are not real. Because the risks vary across the product range, supervisors do not expect identical controls for every policy. They expect the firm to understand which products carry real risk and to put its effort there. **Money laundering and terrorist financing risks** - **Large single premiums**: Paying a large sum in one go into a savings or investment-linked policy is a quick way to place funds, particularly if the source is unclear. - **Early surrender and cancellation**: A policyholder who cancels soon after buying, accepting a penalty, may be using the policy as a way to convert money into a refund from a respected insurer. - **Third-party payers and beneficiaries**: Premiums paid by someone other than the policyholder, or benefits directed to people with no obvious connection, break the link between the money and its owner. - **Fraudulent or inflated claims**: Claims that are staged or exaggerated may be a way to turn illicit funds into insurer payouts, sometimes with help from the intermediary. - **Reinsurance and intermediary chains**: Money can move through several firms and countries before it reaches the final party. Each step needs to be understood. - **Politically exposed persons**: High-value life and wealth products can attract wealthy customers, including public officials and their families. **What supervisors expect** - A named Compliance Officer or MLRO, with board-level ownership of the AML programme. - A business risk assessment that distinguishes products, distribution channels, customers and countries, so that effort goes where the risk is. - Due diligence on policyholders, and where relevant beneficiaries and payers, at a depth that matches the product and the customer's risk. - Understanding of the source of funds for larger premiums and of the reason for a payment from or to a third party. - Screening of customers, beneficiaries and payers against sanctions lists, with a record of match review. - Monitoring of surrenders, cancellations, claims and unusual premiums, with alerts handled and recorded. - Oversight of agents and brokers who sell on the insurer's behalf, reporting through goAML, training, record keeping and independent testing. **Red flags** - A customer who pays a large single premium and asks early about surrender terms. - Premiums paid from accounts that do not belong to the policyholder. - A policy that is cancelled shortly after it starts, with the refund sent to a third party. - A change of beneficiary to someone with no clear relationship to the policyholder. - Claims that appear inflated or inconsistent with the policy. - A customer who is more interested in how to access the money than in the cover itself. **Scenario (illustration, not a real case): A single premium policy surrendered in the first year.** A customer pays a large single premium into a savings policy by transfer from a company account, and nine months later asks to surrender it, asking for the proceeds to be paid to a different company. The insurer can see the transaction as a perfectly legitimate use of a contract right. An alert insurer sees an unusual combination: a large premium from one company, a quick surrender and a refund to another. It asks for an explanation, reviews the file, speaks to the intermediary and, if the answers are poor, escalates to the Compliance Officer, who decides on a report. **Which supervisor applies:** Insurance and reinsurance companies licensed in the UAE are supervised by the Central Bank. Firms in a financial free zone answer to that zone's regulator. A group may include both, in which case you should work out which entity falls under which regime. **FAQs** - **Do all insurance products carry the same AML risk?** No. General insurance such as motor or health generally carries lower risk than life policies with a savings or investment element. Supervisors expect you to assess risk by product and to put more controls where the risk is greater. - **Do we have to do due diligence on beneficiaries?** Often yes, at the latest when a payout is made, and sooner for higher-risk products. The depth depends on the risk, but paying a benefit to a person you know nothing about is a gap that supervisors look for. - **How should we deal with brokers and agents?** Choose them carefully, train them and monitor their business. The insurer remains responsible for customer checks even when intermediaries collect the documents. - **Do reinsurers need to do customer due diligence?** Reinsurers deal with other firms, so the checks are focused on the counterparty, its owners, its regulatory status and the reason for the contract. The principle is the same: know who you deal with and why. - **When should an insurer report an early surrender?** When you suspect that the surrender is linked to wrongdoing. An early surrender on its own does not require a report, but one that is unexplained, unusual for the customer or combined with other warning signs deserves escalation. --- ### AML compliance for insurance agents, brokers and related firms in the UAE URL: https://adventant.com/sectors/insurance-intermediaries Published: 2026-10-19 Agents and brokers meet the customer first, collect the documents and often handle the premium. That makes them an important part of the AML chain. This page explains what is expected of them. **Main risk:** Premiums and refunds passing through third parties **Key control:** Verify the customer and the payer before placing the cover **Typical report:** Suspicious transaction reports through goAML Insurance agents and agencies work for one or more insurers, while brokers act for the customer and place cover with the market. Insurance-related firms include other businesses that support the sector. All of them sit between the customer and the insurer, and they are often the only party who ever meets the customer. That position carries responsibility. An insurer relying on a broker's customer checks is trusting that the work was done properly. A broker who treats the checks as paperwork leaves a gap that neither the broker nor the insurer can see. The risk mainly concerns life and investment-linked products, but intermediaries also see fraud, inflated claims and premium payments from third parties. Supervisors expect intermediaries to be honest about which of these apply to them and to build controls around them. **Money laundering and terrorist financing risks** - **Premium financing and third-party payers**: Premiums paid by someone other than the policyholder need an explanation and may need checks on the payer. - **Refunds and cancellations**: Policies cancelled early, with the refund routed to a different person or account, can be a way to clean funds. - **Handling client money**: Brokers that hold premiums or claims money in an account for a time are exposed to the risk that the account is used to pass funds through. - **Fake or inflated claims**: An intermediary can be pulled into claims that are staged or exaggerated, sometimes by a customer, sometimes by someone inside. - **Relying on others' documents**: Documents collected from sub-agents or customers may be incomplete or false if not checked carefully. **What supervisors expect** - A named person responsible for AML compliance, with the authority to refuse business, and a programme proportionate to the size of the firm. - A business risk assessment that considers which products you sell, who buys them and how premiums are paid. - Customer identification and verification before cover is placed, including beneficial owners of corporate customers where relevant. - Understanding of who pays premiums and who receives refunds and claims, and a reason when they are not the policyholder. - Sanctions and politically exposed person screening, with a record of how matches were dealt with. - Reports through goAML when there is suspicion, and a clear process to escalate to the compliance officer. - Training for everyone who deals with customers, record keeping and independent testing of how the controls operate. **Red flags** - A customer who pays cash or through an unexplained third party. - A request to place cover quickly with limited paperwork. - Cancellation soon after purchase with a request to pay the refund elsewhere. - A customer who is uninterested in price or terms but wants to know how to access the funds. - Documents that look altered or are inconsistent with other information. - Claims that follow shortly after cover begins and do not fit the facts. **Scenario (illustration, not a real case): Refund requested to a different account.** A customer buys a life policy through a broker, paying the first premium from a company account that has no link to him. Six weeks later he cancels and asks for the refund to be paid to a personal account abroad. A broker that processes the instruction without a question has done what it was told. A broker that has thought about its risks sees a payer, a cancellation and a payee who are all different people. It asks for an explanation, informs the compliance officer and, if the explanation is weak, considers a report. **Which supervisor applies:** Insurance agents, agencies and brokers licensed in the UAE are supervised by the Central Bank. Insurance-related firms in the Dubai International Financial Centre are supervised by the DFSA. Free-zone firms outside those regimes answer to their own authority. If you sell for more than one insurer, your supervisor is determined by your own licence, not by the insurers you work with. **FAQs** - **If the insurer does customer checks, do I still have to?** In most cases yes. Each regulated firm has its own duties, and you cannot assume the insurer has done what you should have. You can share information, but you should be able to show what you did. - **Can a small agency have a simple AML programme?** Yes. It can be proportionate to the size and risk, but it must be written down, followed, and tested. A one-person agency still needs a named responsible person and records. - **How do we handle client money?** Keep it separate and record every movement. Know whose money it is, why it is there and where it goes next. Unexplained balances are a sign that something is wrong. - **What should we do if a customer asks us not to record something?** Do not agree. Record the request and tell the compliance officer, who should consider whether the request is a warning sign that warrants a report. - **Does this apply to general insurance such as motor?** The rules apply to the business, but the risk is usually lower for general insurance. You should still know your customers and report suspicion, with controls that match the risk. --- ### AML compliance for investment firms, brokers and dealers in the UAE URL: https://adventant.com/sectors/investment-firms Published: 2026-10-19 Brokers and dealers help clients buy and sell securities and other instruments, often across borders and at speed. This page explains how the market can be used to launder money and what supervisors expect of the firms in between. **Main risk:** Trading and transfers used to layer funds and disguise ownership **Key control:** Know the client, the account holder and where the funds come from **Typical report:** Suspicious transaction reports through goAML Investment firms, brokers and dealers execute trades, hold client assets and arrange investments. In the UAE they are supervised by different authorities according to where they are licensed. The Capital Markets Authority supervises securities and commodities firms onshore, the DFSA supervises authorised firms in the DIFC and the FSRA those in Abu Dhabi Global Market. Markets offer a respectable-looking route for money. Funds paid into an account and traded may be returned as proceeds of an investment, with a clean explanation. A firm that does not understand where the money came from, or who is really behind an account, can provide the cover without knowing it. The sector is also exposed to market abuse, which overlaps with AML. Insider dealing, manipulation and pump-and-dump schemes produce criminal proceeds that need to be moved, and the firms that see the orders are often the first to see the pattern. **Money laundering and terrorist financing risks** - **Cash in, trade, cash out**: Funds are deposited, traded in ways that look like normal activity, and withdrawn as investment proceeds. Without a view of the source, the trade hides the origin. - **Nominee and omnibus accounts**: Accounts that hold assets for many beneficial owners, or for someone acting on behalf of an unnamed person, make it harder to see who is behind the trades. - **Third-party funding and transfers**: Money coming from or going to accounts that do not belong to the client is a standard warning sign. - **Trades with no economic purpose**: Buying and selling the same asset between connected accounts, or at prices that make no commercial sense, can move value from one party to another. - **Cross-border clients and complex structures**: International clients, offshore holding companies and trusts make it harder to establish ownership and source of wealth. - **Market abuse proceeds**: Manipulation and insider dealing generate profits that must be laundered. Trade surveillance and AML should connect. **What supervisors expect** - A Compliance Officer and MLRO with experience of markets, enough authority to stop a trade or an onboarding, and access to the board. - A business risk assessment that covers clients, products, markets, channels and countries. - Client due diligence before trading begins, including the identification of beneficial owners and, for higher-risk clients, source of wealth and funds. - Understanding of nominee and omnibus arrangements, and measures to look through them where the rules require. - Screening of clients, owners and counterparties against sanctions lists with a record of how matches were handled. - Monitoring of deposits, withdrawals and trading for patterns that make no sense, and coordination between trade surveillance and AML teams. - Reporting through goAML, training, record keeping and independent testing. **Red flags** - A client who deposits funds, trades very little and asks to withdraw them elsewhere. - Payments from or to third parties with no clear connection to the client. - Trades between accounts that appear to be controlled by the same person. - A client who is indifferent to losses or to the costs of trading. - Ownership that is layered through several jurisdictions without a clear reason. - Pressure to open an account urgently or to skip documentation. **Scenario (illustration, not a real case): Deposits from several people, one beneficial owner.** A new client opens a trading account with a modest deposit, and over several weeks the account receives transfers from four different people, each described as a family member. The client trades lightly and then asks for the balance to be paid to an account abroad. The firm should treat the pattern as unexplained: find out who the family members are, why they are funding the account, whether any of them is the real owner and why the destination account is in another country. If the answers are not satisfactory, the Compliance Officer decides on a report and whether to restrict the account. **Which supervisor applies:** It depends on where you are licensed. The Capital Markets Authority supervises securities and commodities firms onshore, including broker-dealers. The DFSA supervises authorised firms in the DIFC, and the FSRA supervises investment firms, funds and brokers in Abu Dhabi Global Market. Your licence names the regulator and the activities you are allowed to carry out. **FAQs** - **Are brokers and dealers responsible for checking where client money comes from?** Yes, in proportion to the risk. A firm that accepts a large deposit without understanding its origin, or lets a client trade through someone else's money, has a gap that supervisors will notice. - **How should we handle omnibus accounts?** By understanding who sits behind them. Depending on the rules, you may need to look through the account to the underlying owners or satisfy yourself that the firm holding it has proper controls. The risk assessment should say which applies. - **How are AML and trade surveillance connected?** They look at the same activity from different angles. Surveillance looks for market abuse and AML looks for laundering and suspicious funds. Sharing alerts and cases helps both. - **When can we start trading for a new client?** Once due diligence is complete. If your rules allow limited activity while checks finish, the allowance is narrow and should be recorded. Starting first and checking later is a common supervisory finding. - **Who decides whether to file a report?** The MLRO or Compliance Officer, after review. Front-office staff should escalate without delay and without telling the client. --- ### AML compliance for asset managers, fund managers and portfolio managers in the UAE URL: https://adventant.com/sectors/asset-managers Published: 2026-10-19 Managers invest other people's money, so the first question is always whose money it is. This page explains the AML risks in managing funds and portfolios and what supervisors expect of a manager. **Main risk:** Investors whose identity or funds are hidden behind structures **Key control:** Investor due diligence, including through distributors and administrators **Typical report:** Suspicious transaction reports through goAML Asset managers, fund managers and portfolio managers invest on behalf of clients, either through separate mandates or through pooled funds. They are supervised by the Capital Markets Authority onshore, by the DFSA in the DIFC and by the FSRA in ADGM, depending on where they are licensed. The AML duty starts with the investor. In a segregated mandate, the manager has a direct relationship with the client. In a pooled fund, investors may come through distributors, platforms, nominee companies or fund administrators, so the manager may never meet them. The rules expect the manager to be sure that someone has done the checks, and to be able to show who and how. Fund structures can also be complicated. Master-feeder arrangements, side pockets and offshore vehicles all add layers. A manager that understands the structure, and can explain why it exists, is in a stronger position than one that simply accepts it. **Money laundering and terrorist financing risks** - **Investors behind intermediaries**: Where investors reach the fund through nominees or distributors, the manager may not see the real owners. The checks done by others need to be understood and tested. - **Subscriptions and redemptions**: Large subscriptions from unclear sources, and redemptions paid to third parties or other countries, are the main entry and exit points for illicit money. - **Complex or offshore structures**: Funds and investor vehicles in several jurisdictions can make ownership and control hard to establish. - **Source of wealth of large investors**: Institutional and high-net-worth investors may bring significant sums that need an explanation beyond the bank statement. - **Politically exposed persons and sovereign links**: Investors connected to public officials need enhanced attention, including senior approval. **What supervisors expect** - A Compliance Officer or MLRO with enough influence to challenge investment and commercial decisions. - A risk assessment that covers each fund and mandate, the investor base, distribution channels and countries. - Investor due diligence, including beneficial owners, at the level that suits the risk, and clear allocation of responsibility where distributors or administrators carry out checks. - Source of funds and source of wealth enquiries for larger or higher-risk investors. - Sanctions and politically exposed person screening of investors and, where relevant, underlying owners. - Monitoring of subscriptions, redemptions and transfers, with particular attention to third-party payments and early redemptions. - Reporting through goAML, training, record keeping and independent testing, including testing of delegated work. **Red flags** - A subscription from an account in a name other than the investor's. - A request to redeem shortly after investing, with proceeds to be paid elsewhere. - An investor who is evasive about ownership or source of wealth. - A structure that has more layers than the investment needs. - Pressure to accept an investor ahead of the usual checks. - Adverse media about an investor or the people who control it. **Scenario (illustration, not a real case): A nominee investor in a pooled fund.** A distributor brings a substantial subscription into a private fund on behalf of a nominee company, saying that the underlying investors have been checked. The manager asks to see the distributor's due diligence procedures and a sample of files, and finds that source of funds has not been recorded for several investors. The manager pauses the subscription, asks the distributor to supply the missing information and records the outcome. If the distributor cannot or will not, the manager declines the money and considers whether a report is appropriate. **Which supervisor applies:** It depends on where the manager is licensed. The Capital Markets Authority supervises onshore asset and fund managers, the DFSA supervises authorised asset and fund managers in the DIFC, and the FSRA supervises those in Abu Dhabi Global Market. Funds and managers are often in different places, so look at the licence of each entity you are responsible for. **FAQs** - **If the administrator does investor checks, are we still responsible?** Yes. You can delegate tasks, but not responsibility. You need to be satisfied that the administrator is doing the work properly and be able to show how you checked. - **What about investors who come through a platform?** Platforms and nominees can carry out checks on their clients, but you need to understand what they do and test it. The risk assessment should say when you rely on others and when you look through to the investor. - **How much source of wealth work is enough?** Enough to make the origin of the wealth credible and documented, in proportion to the amount and the risk. For large or higher-risk investors, that is likely to mean evidence beyond a signed statement. - **Should we monitor redemptions?** Yes. Redemptions, especially early ones or those paid to third parties or other countries, are a key exit point. Your controls should cover them. - **Does a small manager need a full programme?** The programme can be proportionate, but it must cover the same areas: risk assessment, due diligence, screening, monitoring, reporting, training and testing. --- ### AML compliance for investment advisers in the UAE URL: https://adventant.com/sectors/investment-advisers Published: 2026-10-19 Advisers do not usually hold client money, which makes some assume that AML rules matter less. Supervisors take the opposite view: advisers see the client closely. This page sets out the risks and expectations. **Main risk:** Clients seeking advice to place funds whose origin is unclear **Key control:** Know the client, their wealth and their purpose **Typical report:** Suspicious transaction reports through goAML Investment advisers give advice on investments, and in some cases arrange transactions on behalf of clients. They may not hold client assets, but they learn a great deal about a client's wealth, objectives and plans. That puts them in a good position to notice when something does not fit. Supervisors expect advisers to use that position. If a client wants to invest a large sum but cannot explain where it came from, or asks for a structure that appears designed to hide ownership, the adviser is often the first person to see the issue. The Capital Markets Authority, the DFSA and the FSRA all supervise investment advisers in their own areas. Advisers in each system have the same basic duties and the details differ with the licence. **Money laundering and terrorist financing risks** - **Clients with unexplained wealth**: A client who wants advice on a large sum, but is unable to say how it was earned, creates a risk that the adviser's work helps place illicit money. - **Advice that helps build opaque structures**: Suggesting trusts, companies and cross-border vehicles without a clear commercial reason can end up hiding ownership. - **Politically exposed clients**: Wealthy clients can include public officials and their families. They need senior approval and more attention. - **Introducers and referral networks**: Advisers often receive clients from introducers who may not carry out checks to the same standard. - **Dealing through others**: Instructions given by someone other than the client, or on behalf of an unnamed principal, make it hard to know who benefits. **What supervisors expect** - A named compliance officer or MLRO, with the authority to refuse a client. - A business risk assessment that reflects the type of clients, the services provided and the countries involved. - Client due diligence before advice is given, including beneficial owners and a record of the client's source of wealth for higher-risk clients. - Screening of clients and owners against sanctions lists, with documented review. - Ongoing review of the client relationship, and attention to changes in the client's circumstances or instructions. - Reporting of suspicion through goAML, with care not to alert the client. - Training, record keeping and independent testing proportionate to the firm. **Red flags** - A client who wants advice on investing a large sum quickly and cannot explain its origin. - Requests for structures with no clear commercial purpose. - Instructions that come from someone other than the client. - A client who is reluctant to provide documents or discuss ownership. - A client from a high-risk country with no clear reason for choosing the adviser. - Interest in how to avoid reporting or disclosure. **Scenario (illustration, not a real case): A request for an unusual structure.** A client asks an adviser to help set up an arrangement under which several companies in different countries would hold a portfolio, and says he does not want his name to appear. When asked why, he says he values privacy. The adviser should not dismiss the request, but should explain that the firm must know the real owner, ask for a commercial reason for the structure and record the answers. If the client is unwilling to cooperate, the adviser should decline and speak to the compliance officer about a report. **Which supervisor applies:** Investment advisers are supervised according to where they are licensed: by the Capital Markets Authority onshore, by the DFSA in the DIFC and by the FSRA in ADGM. If your firm gives advice but also does other regulated activities, the regulator will usually be the one that issued your licence. **FAQs** - **We do not hold client money. Do the AML rules still apply?** Yes. They apply to the regulated activity, not to whether you hold the cash. Advisers must identify clients, understand their purpose and report suspicion. - **How do we deal with referrals from introducers?** Treat the introducer's work as a starting point. Check the client yourself, or satisfy yourself that the introducer's checks meet your standards and keep a record. - **What should we do if a client refuses to explain their wealth?** Do not proceed as normal. Record the refusal, tell the compliance officer and consider whether to decline the client and whether to report. - **Can we advise on structures designed to protect privacy?** Privacy is legitimate, but secrecy from the firm is not. You must know the real owner and understand why the structure is needed. - **How often should we review client files?** At a frequency set by risk and whenever something changes. Higher-risk clients should be reviewed more often. Your policy should state the cycle. --- ### AML compliance for custodians in the UAE URL: https://adventant.com/sectors/custodians Published: 2026-10-19 Custodians hold assets for others and settle trades on their behalf. They see what moves but not always why. This page explains where the AML risk lies and how supervisors expect custodians to respond. **Main risk:** Assets and settlements for clients whose ultimate owners are not visible **Key control:** Know the client and the account holder behind the instruction **Typical report:** Suspicious transaction reports through goAML A custodian safeguards financial assets, such as securities and cash, for its clients and handles settlement and administration. The clients are often institutions such as funds, managers and other financial firms, but may also be wealthy individuals. A custodian generally acts on instructions from the client or its manager, and often has less direct contact with the underlying owner than a broker or a bank. That distance is the main AML issue: assets can be held and moved at the direction of someone other than the person whose name is on the account. Supervisors expect custodians to know who their clients are, to understand who may instruct them and to watch the movement of assets and cash for patterns that are out of line. **Money laundering and terrorist financing risks** - **Distance from the beneficial owner**: Accounts held for funds, nominees and other intermediaries may hide the real owner. The custodian needs to understand how far it can see and what it relies on. - **Instructions from third parties**: Managers, advisers and attorneys may instruct on the client's behalf. Authority, and the relationship between them, needs to be verified. - **Free-of-payment transfers**: Moving assets without payment, or between connected accounts, can shift value without showing a price. - **Cross-border transfers of assets**: Assets leaving the custodian to accounts in other countries need attention, particularly if the destination is high risk or the reason is unclear. - **Sanctions**: Assets held for sanctioned parties must be identified and frozen without delay. Screening needs to cover owners, controllers and authorised signatories. **What supervisors expect** - A Compliance Officer or MLRO with an understanding of custody operations and authority to stop a transfer. - A business risk assessment covering clients, assets, markets and the way instructions are given. - Client due diligence, including beneficial owners, authorised signatories and anyone with the power to instruct. - Understanding of intermediary structures and a risk-based approach to what the custodian does and does not look through. - Sanctions screening of clients, owners, signatories and counterparties, with an immediate response to a confirmed match. - Monitoring of transfers, free-of-payment movements and changes in pattern. - Reporting through goAML, training, record keeping and independent testing. **Red flags** - A request to move assets to an account with no stated connection to the client. - Instructions from someone whose authority is not documented. - Free-of-payment movements between accounts with the same controller. - A client who asks to close the account and transfer assets quickly without explanation. - A sudden change in the signatories on an account. - Reluctance to say who is behind the account. **Scenario (illustration, not a real case): Assets moved out with no payment.** A custody client asks for a large block of securities to be transferred free of payment to an account at another institution abroad, explaining that the move is for administrative reasons. The custodian cannot find a link between the client and the receiving account. It asks for an explanation and supporting documents, reviews whether the account's other activity is consistent with this request, and informs the compliance officer. If the answers fail to explain the move, it holds the instruction while a report is considered. **Which supervisor applies:** Custodians are supervised according to where they are licensed: by the Capital Markets Authority onshore, by the DFSA in the DIFC and by the FSRA in ADGM. Banks that provide custody services are also covered by the AML duties that apply to banks. **FAQs** - **Does a custodian have to identify the owners behind a fund client?** The extent depends on the risk, the structure and the rules. Supervisors expect the custodian to understand who owns and controls the client, and to look through where the risk warrants it. - **Who has authority to instruct the custodian?** Only those who have been properly authorised and verified. You should keep an up-to-date list of authorised persons and check instructions against it. - **What is a free-of-payment transfer?** A transfer of assets without a matching payment. It can be legitimate, such as a move between accounts of the same owner, but it needs a clear reason because no price shows what value moved. - **How should custodians deal with sanctions?** Screen at onboarding and continuously, and act at once on a confirmed match by freezing assets and reporting as the rules require. Slow reaction is a serious failing. - **Do custodians report through goAML?** Yes, where there is suspicion. Custodians should register and have a clear process for escalating concerns. --- ### AML compliance for trust service providers in the UAE URL: https://adventant.com/sectors/trust-service-providers Published: 2026-10-19 Trusts separate legal ownership from benefit, which is useful and also easy to abuse. This page explains the AML risks for firms that set up and run trusts and what supervisors expect. **Main risk:** Ownership and benefit separated across settlors, trustees and beneficiaries **Key control:** Identify everyone connected with the trust and understand its purpose **Typical report:** Suspicious transaction reports through goAML A trust is an arrangement under which one person, the trustee, holds assets for the benefit of others, the beneficiaries, according to terms set by a settlor. Trusts are used for family planning, inheritance, charity and asset protection, all of them legitimate. The same features make trusts useful to people who want to hide ownership. Because legal title sits with the trustee, a quick look at a register may not reveal who benefits. A trust service provider that sets up or administers trusts is in a position of trust, and also of responsibility. Supervisors expect trust service providers to identify and verify everyone connected with a trust, to understand why the trust exists and where its assets come from and to keep records that would allow an investigator to follow the trail. The DFSA authorises trust service providers in the DIFC, and similar duties apply under other regimes. **Money laundering and terrorist financing risks** - **Hidden beneficial owners**: A trust's settlor, trustees, protectors and beneficiaries may be spread across countries. Without a full picture, the real person in control may not be visible. - **Discretionary and flexible terms**: Where trustees have discretion over who benefits, and when, the actual beneficiaries may change over time, which makes ongoing checks more important. - **Source of the trust assets**: The settlor's wealth is the foundation of the trust. If its origin is not clear, the trust becomes a way of washing it. - **Layering through companies**: Trusts often hold assets through companies in other jurisdictions, adding steps between the owner and the asset. - **Distributions**: Payments to beneficiaries, particularly in other countries or to third parties, are a key exit point. **What supervisors expect** - A compliance officer or MLRO with an understanding of trust structures and authority to refuse a settlor or beneficiary. - A business risk assessment that considers the types of trust, clients, countries and assets involved. - Identification and verification of settlors, trustees, protectors, beneficiaries and any person with effective control. - Source of wealth and source of funds enquiries on the settlor, supported by documents. - Understanding of the purpose of the trust and its structure, and a record of why complex arrangements are needed. - Sanctions and politically exposed person screening of all parties, with review of matches. - Ongoing review, monitoring of distributions, reporting through goAML, training, record keeping and independent testing. **Red flags** - A settlor who cannot or will not explain where the assets came from. - A trust with no clear purpose beyond privacy. - Frequent changes to beneficiaries or trustees without explanation. - Distributions to unrelated third parties or high-risk countries. - Pressure to set the trust up quickly, or to avoid checks. - A structure that has a trust, several companies and a foundation, with no commercial reason. **Scenario (illustration, not a real case): A family trust with a discreet protector.** A client asks a provider to set up a discretionary trust for his family, naming an unconnected individual abroad as protector and asking that the protector not appear in any documents the firm keeps. The provider explains that it must identify everyone with a role, including the protector, and asks why he wants the person's involvement to be hidden. If the client will not agree to the identification, the provider should decline the work. The refusal and the reasons should be recorded, and the compliance officer should consider whether a report is required. **Which supervisor applies:** Trust service providers in the DIFC are supervised by the DFSA. Providers in other zones or onshore are supervised by the authority that licensed them, and the rules may differ. Check the activities on your licence, because some firms act as trustees while others only administer trusts or provide registered offices. **FAQs** - **Who must be identified in a trust?** Generally the settlor, the trustees, any protector and the beneficiaries or classes of beneficiaries, plus anyone with effective control. The detail depends on the rules that apply to your licence. - **Is a trust a sign of money laundering?** No. Trusts have many lawful uses. The point is that they can hide ownership, so you need to understand the purpose and know the people involved. - **How should we deal with a discretionary trust where beneficiaries are not named?** Identify the class of beneficiaries and anyone who actually receives benefits, and review as circumstances change. Ask the client how the trustees will decide on distributions. - **Do we have to check the source of the trust assets?** Yes, in proportion to the risk. The settlor's wealth is the base of the trust, so you need to understand how it arose and where the assets come from. - **What if we find that a trust is being used for something improper?** Escalate to the compliance officer, avoid tipping off the client and consider a report. Do not carry on as if nothing has happened. --- ### AML compliance for crowdfunding platforms in the UAE URL: https://adventant.com/sectors/crowdfunding Published: 2026-10-19 Crowdfunding platforms bring together people who raise money and people who provide it. Both sides need checking. This page explains the main risks and what supervisors expect of an operator. **Main risk:** Fake campaigns and funders who use the platform to move money **Key control:** Check both the raiser and the funder, and what the money is for **Typical report:** Suspicious transaction reports through goAML A crowdfunding platform lets businesses or individuals raise money from many people, often through small contributions. Some platforms deal in loans, some in shares or other investments, and some in donations or rewards. The authorities supervise the investment and lending types in the DIFC and onshore. Two groups of people use the platform, and both can be a risk. A raiser can be a fake business set up to collect money and move it on. A funder can be using the platform to put illicit money into a legitimate-looking investment and receive it back as returns. The platform also serves as a place where money is held for a time, even briefly, between funders and raisers. Supervisors will expect the operator to control how that money moves and to be able to show who received what and why. **Money laundering and terrorist financing risks** - **Fake or misleading campaigns**: A project that is not what it claims, or does not exist, can collect funds from the public and send them elsewhere. - **Funders using the platform to place money**: A funder who invests money from an unclear source and later receives returns or repayments has converted it into something that looks clean. - **Linked parties on both sides**: Raisers and funders who are connected, and fund each other, can create the appearance of genuine activity. - **Cross-border contributions**: Funders in many countries make it harder to verify identities and sources, and to spot sanctions links. - **Terrorist financing and misuse of donations**: Where donations or small contributions are collected, the destination of the funds must be checked to avoid supporting prohibited groups. **What supervisors expect** - A compliance officer or MLRO with authority over onboarding of raisers and funders. - A risk assessment that considers the type of crowdfunding, the platform's customers and the countries involved. - Due diligence on raisers, including their owners, business, purpose and use of funds, and on funders in proportion to the amount. - Source of funds checks for larger contributions and for funders who invest repeatedly. - Screening of both sides against sanctions lists, with a process for handling matches. - Monitoring of how money moves between funders, the platform and raisers, and of unusual patterns such as linked parties. - Reporting through goAML, training, record keeping and independent testing. **Red flags** - A campaign whose description is vague, or whose business cannot be verified. - Funders who are connected to the raiser and fund their own campaign. - A funder who invests a large sum and asks to withdraw quickly. - Contributions from accounts that do not belong to the funder. - A raiser who asks for funds to be paid to a different company or country. - A sudden surge of contributions from unrelated people in the same location. **Scenario (illustration, not a real case): A campaign funded by people close to the raiser.** A new company launches a loan campaign and within days receives large contributions from several funders, all joined recently. Looking closer, the operator finds that they share an address and a device, and that one of the bank accounts used belongs to the raiser's director. The operator pauses the campaign, asks the parties to explain, and checks the source of the funds. If the pattern appears designed to give the campaign false momentum or to circulate money, the compliance officer considers a report. **Which supervisor applies:** Crowdfunding firms in the DIFC are supervised by the DFSA. Crowdfunding operators onshore are supervised by the Capital Markets Authority. Check your licence for the activities you may carry out, because the rules differ for investment, lending and donation platforms. **FAQs** - **Do we have to check every small funder?** You must apply a risk-based approach. Small contributions may need lighter checks, but you still need a way to spot repeated or linked small payments and to apply extra checks as amounts grow. - **What checks should be done on a raiser?** Identity of the business and its owners, what it does, why it is raising money, how the funds will be used and whether the story is credible. Visit or verify where you can. - **Who is responsible if a campaign turns out to be fake?** The operator has its own duties to check and monitor. Failure to do so can lead to supervisory action in addition to the harm to funders. - **Does the platform hold the money?** Often, at least briefly. Where it does, the controls over that money are important, because it can be used to pass funds through the platform. - **What about donation-based campaigns?** They carry their own risks, including diversion of funds and links to prohibited groups. Check the destination of the funds and the identity of the recipients. --- ### AML compliance for fund administrators in the UAE URL: https://adventant.com/sectors/fund-administrators Published: 2026-10-19 Fund administrators keep the books, process subscriptions and redemptions and often carry out investor checks for the fund. This page explains why that role matters for AML and what supervisors expect. **Main risk:** Investor checks done on behalf of funds that are not fully tested **Key control:** Clear ownership of investor due diligence and screening **Typical report:** Suspicious transaction reports through goAML A fund administrator performs the back-office tasks of a fund: calculating the net asset value, keeping the register of investors, processing subscriptions and redemptions and producing reports. Many also carry out investor due diligence and sanctions screening on behalf of the fund or its manager. That means the administrator is often where AML checks actually happen. If the administrator does them well, the fund is protected. If not, the fund and its manager may not know, because the work was delegated. Supervisors therefore look at who is responsible for what. Delegation is allowed in most cases, but it has to be written down, tested and overseen. The administrator has its own duties and the fund and manager keep theirs. **Money laundering and terrorist financing risks** - **Delegated checks with unclear ownership**: When the manager believes the administrator is checking investors and the administrator believes the opposite, checks are missed. - **Subscriptions from unclear sources**: The administrator sees money arrive and has to decide whether to accept it. Payments from third parties are the most common problem. - **Redemptions to third parties**: Paying proceeds to someone other than the investor, or to a different country, is a typical exit route for illicit funds. - **Investor register accuracy**: An inaccurate or incomplete register, especially where nominees are used, weakens everyone's ability to see who owns the fund. - **Volume and pressure**: Processing many investors at deadlines can lead to checks being rushed or skipped. **What supervisors expect** - A compliance officer or MLRO who understands fund operations and has authority to hold a subscription or redemption. - A business risk assessment that considers the funds administered, the investor base and the countries involved. - Written agreements with each fund or manager that state who does which AML tasks and how results are shared. - Investor due diligence, including beneficial owners, source of funds and source of wealth where the risk calls for it. - Sanctions and politically exposed person screening of investors and payments, with documented review. - Controls over redemption payments, particularly to third parties and other countries. - Reporting through goAML, training, record keeping and independent testing, including testing of work done for clients. **Red flags** - A subscription paid from an account in a different name. - A request to redeem and pay to a different person or country shortly after investing. - An investor who changes bank details just before redemption. - Delays in providing documents, followed by pressure to process quickly. - A manager who asks the administrator to accept an investor without the usual checks. - A register with many investors that have identical addresses or contact details. **Scenario (illustration, not a real case): A change of bank details just before redemption.** An investor in a fund asks for a large redemption and, in the same message, changes the payment details to an account in another country in the name of a company. The administrator's controls stop the payment. It asks for evidence that the new account belongs to the investor, speaks to the manager and records the response. If the explanation is not credible, it keeps the payment on hold and the compliance officer considers a report. A redemption that goes out unchallenged is the kind of failure that supervisors write about. **Which supervisor applies:** Fund administrators are supervised by the authority that licensed them. The Capital Markets Authority lists fund administrators among its regulated firms, and administrators in a financial free zone are supervised by that zone's regulator. Funds and administrators are often in different jurisdictions, so look carefully at your own licence. **FAQs** - **If a manager delegates investor checks to us, who is responsible?** Both. The manager remains responsible for the fund's AML duties and the administrator for its own. A clear written agreement saying who does what helps, but does not remove responsibility. - **Can we pay a redemption to a third party?** Only with caution. Supervisors expect payments to go to an account in the investor's name unless there is a good reason and extra checks. The reason and the checks should be recorded. - **What should be in a delegation agreement?** Which checks the administrator does, the standard to be met, how the manager can test it, what reports it receives, and what happens when problems arise. - **How do we deal with nominee investors?** By understanding who sits behind them and what checks the nominee does. The risk assessment should say when you rely on the nominee and when you look through to the underlying investors. - **Do we need our own MLRO?** Supervisors expect an appropriate person with the authority to act on AML matters. The arrangement should suit the size and risk of the business and be accepted by your regulator. --- ### AML compliance for single family offices in the UAE URL: https://adventant.com/sectors/single-family-offices Published: 2026-10-19 A single family office manages the wealth of one family. That looks like a private matter, but the AML rules still apply to it. This page explains what a family office should expect and where it is exposed. **Main risk:** Concentrated family wealth moved through layered structures **Key control:** Source of wealth records and a clear map of who owns what **Typical report:** Suspicious transaction reports through goAML A single family office is a private company that manages investments, property and administration for one family. It is not open to the public and has one client group. In the DIFC, such offices appear in the DFSA's list of designated businesses and professions, which means they have AML duties even though they serve only one family. The risk profile is particular. The wealth is concentrated and often large, it may have been built in many places over a long time, and it is usually held through a web of companies, trusts and accounts. At the same time the people running the office are close to the family, which can make it hard to ask difficult questions. Supervisors expect family offices to act as they would for any client: understand where the wealth came from, map the structure and watch for activity that does not fit. A family office that cannot explain its own family's wealth is exposed. **Money laundering and terrorist financing risks** - **Source of family wealth**: Wealth passed down or built across generations and countries may have a history that is hard to document. Gaps in that history need to be understood, not ignored. - **Complex structures**: Holding companies, trusts and foundations in different countries can make it difficult to see who really owns an asset. - **Politically exposed family members**: Some families include public officials or people connected to them. They require enhanced due diligence and senior sign-off. - **Informal practices**: A family office may run on trust and long relationships, with less documentation than a regulated firm would keep. - **Payments for the family and third parties**: Payments to many people, such as relatives, advisers, charities and employees, can hide the movement of funds if they are not recorded. **What supervisors expect** - A named compliance officer or MLRO, independent enough to ask difficult questions of the family. - A business risk assessment that considers the family's wealth, structures, countries and activities. - A clear map of the family structure and of each entity's owners and controllers. - Source of wealth records, supported by documents, for the main sources of family wealth. - Due diligence on counterparties, advisers and investment partners, and screening of the family and related parties. - Monitoring of significant payments and unusual movements, and records of the reasons for them. - Reporting through goAML, training, record keeping and independent testing proportionate to the office. **Red flags** - A family member who asks the office to move funds without a clear purpose. - Payments to third parties who are not connected to the family's activities. - A new structure introduced with no commercial reason. - Pressure to accept a counterparty without the usual checks because of a personal connection. - Adverse media about a family member that has not been examined. - Missing or inconsistent records of how wealth arose. **Scenario (illustration, not a real case): A transfer requested by a family member.** A senior family member tells the office to transfer a large sum to a company abroad, saying it is a private matter. The office has not heard of the company and has no contract or invoice. The compliance officer asks for documents and an explanation, and notes the request. The family member is irritated, but the office explains that it must be able to show a reason for each large transfer. If the explanation remains weak, the office declines to proceed and the compliance officer considers whether a report is needed. **Which supervisor applies:** Single family offices in the DIFC are supervised by the DFSA as designated businesses and professions. A family office in another jurisdiction answers to the authority that licensed it, and may be classed differently, so check how your licence describes your activity. **FAQs** - **Why does a family office have AML duties if it has only one client?** Because the risk lies in the wealth and the structures, not in the number of clients. The authorities treat a family office that carries out regulated or designated activity like other firms in that category. - **Who is the customer of a family office?** The family and its related entities. The office needs to identify them and understand how they are connected, including through trusts and companies. - **How much detail on family wealth do we need?** Enough to explain the main sources and to be supported by documents. The depth depends on the size and risk, and for a large family the history may need to be recorded in detail. - **Is discretion a problem?** Privacy is legitimate, but secrecy from the office is not. The office must know the real owners and the purpose of each structure. - **Does a small family office need an independent compliance officer?** The arrangement should suit the size and risk and be acceptable to the regulator. Independence from the family matters, because the compliance function must be able to challenge. --- ### AML compliance for listing and financial advisers in the UAE URL: https://adventant.com/sectors/listing-and-financial-advisers Published: 2026-10-19 Listing and financial advisers help companies raise money and list on markets. They are in the room when deals are shaped, which gives them both a view of the risk and a duty to act on it. **Main risk:** Issuers and investors whose owners and funds are not clear **Key control:** Know the issuer, the controllers and the source of the capital **Typical report:** Suspicious transaction reports through goAML Listing and financial advisers guide companies through listings, capital raising and corporate transactions. They check that a company meets the requirements of a market, help prepare documents and advise on structure. They are regulated by the Capital Markets Authority in the onshore market. The AML risk comes from the nature of the work. A company seeking a listing may be controlled by people whose identity or background is not fully visible, and the capital it raises may come from investors whose funds have not been checked. An adviser who vouches for the company without enough scrutiny helps give it credibility it may not deserve. Supervisors expect the adviser to treat the issuer as a client in the full sense: identify the real owners, understand the business and the reason for the transaction and be alert to signs that something does not fit. **Money laundering and terrorist financing risks** - **Opaque ownership of the issuer**: A company seeking a listing may be owned and controlled through layers of entities. The adviser needs to find the people at the end. - **Source of capital**: Investors who subscribe in an offering may be using funds from unknown sources, and the adviser may influence who is allocated shares. - **Shell companies and reverse mergers**: Listings of companies with little real business, or transactions designed to put a shell in front of the public, are a recognised risk. - **Market abuse around deals**: Information about a transaction can be misused before it is public. The proceeds of such abuse then need to be laundered. - **Politically exposed controllers**: Owners or directors with public positions or links need enhanced due diligence. **What supervisors expect** - A compliance officer or MLRO with authority to decline an engagement or a deal. - A business risk assessment that considers the types of issuers, sectors and countries the firm advises. - Due diligence on issuers, including identification of owners, controllers and directors, and understanding of the business and the purpose of the transaction. - Enquiries into the source of capital for significant investors and of the funds used in the transaction. - Screening of the issuer, its owners and other key parties against sanctions lists with documented review. - Escalation of concerns and reporting through goAML where there is suspicion. - Training, record keeping and independent testing proportionate to the firm. **Red flags** - An issuer whose business is thin, or whose accounts are inconsistent. - Owners who are reluctant to be identified or are hidden behind nominees. - A sudden rush to list with little explanation. - Investors who appear connected but present as independent. - Unusual fees or payments to third parties linked to the transaction. - A previous adviser who resigned without explanation. **Scenario (illustration, not a real case): A company in a hurry to list.** A company with a small, recently formed business and a large proposed valuation asks an adviser to support a listing, saying that existing owners hold their shares through offshore entities and prefer not to be named. The adviser should refuse to proceed without the identity of the real owners and without evidence of the business and the source of funds. If the issuer will not cooperate, the adviser should decline, record the reason and tell the compliance officer, who considers whether a report is needed. **Which supervisor applies:** Listing and financial advisers on the onshore market are supervised by the Capital Markets Authority. Advisers in a financial free zone answer to that zone's regulator. Check which regulator licensed you and what activities your licence covers. **FAQs** - **Is the issuer our client for AML purposes?** Yes, in the sense that you must identify it and understand its owners and business. The detail follows the risk, but advising an issuer you do not know is a clear supervisory concern. - **How far do we look at investors in an offering?** In proportion to your role. If you influence allocation or handle money, you may need to check investors. If not, you should still know enough to spot a concern. - **Can we rely on the issuer's lawyers or auditors?** You can use their work as part of your enquiries, but you remain responsible for your own checks and should satisfy yourself that the information is reliable. - **What if the issuer is in a high-risk sector?** Apply enhanced due diligence, involve senior management and consider whether you should act at all. The decision and its reasons should be recorded. - **Who decides whether to report?** The compliance officer or MLRO, after review. Staff should escalate promptly and not discuss the concern with the client. --- ### AML compliance for exchanges and market institutions in the UAE URL: https://adventant.com/sectors/exchanges Published: 2026-10-19 Exchanges do not usually deal with the end investor, but they decide who may trade, who may list and what is done about abuse. This page explains the AML duties that follow from that role. **Main risk:** Members, issuers and trading used to disguise the source of funds **Key control:** Membership and listing due diligence, with surveillance of trading **Typical report:** Suspicious transaction reports through goAML An exchange runs a market where securities, commodities or other instruments are traded. Market institutions and exchanges are supervised by the authority of the jurisdiction where they operate, and include securities markets and commodity exchanges. Most of the relationships with end investors sit with the brokers who trade on the exchange. The exchange's relationships are with its members, listed companies and other participants. Its AML role is therefore to decide who is allowed in, to watch what they do and to act when something does not look right. Strong admission standards and effective surveillance protect more than the exchange. They protect the integrity of the market and the reputation of the country as a place to do business. **Money laundering and terrorist financing risks** - **Admission of weak members**: A member with poor controls, or with owners of doubtful background, can bring risk to the whole market. - **Listings of doubtful issuers**: A company with hidden owners or a thin business can use a listing to raise money and give itself a veneer of legitimacy. - **Manipulative trading**: Trades that do not reflect real interest, such as wash trades or cross-trades between connected parties, can create false prices or move value. - **Cross-market and cross-border activity**: Activity that links several markets and countries is harder to see from the point of view of one exchange. - **Sanctions**: Participants and issuers must be screened, and action must be taken without delay if a sanctioned person is involved. **What supervisors expect** - A compliance officer or MLRO with authority to refer concerns, and board oversight of the AML programme. - A risk assessment of members, issuers, products and the geographies involved. - Due diligence on applicants for membership and listing, including owners, controllers and AML programmes. - Ongoing review of members and issuers, and a way to raise and track concerns. - Market surveillance that detects suspicious trading, with a route to share alerts with the supervisor and other authorities. - Screening of participants against sanctions lists and action on matches. - Reporting through goAML where suspicion arises, training, record keeping and independent testing. **Red flags** - An applicant whose owners are unclear or whose background has not been checked. - A member with repeated surveillance alerts that are not resolved. - Trading between accounts with common control that has no commercial reason. - A listing applicant with a business that cannot be verified. - Sudden changes in ownership of a member or issuer. - Participants that resist requests for information. **Scenario (illustration, not a real case): Cross-trades between connected accounts.** Surveillance flags repeated trades in a thinly traded security, always between the same two accounts at prices slightly above the last trade. Both accounts belong to members, and the exchange finds that they have a common director. The exchange asks both members for an explanation, reviews the trades, tells the supervisor and considers whether the activity indicates market abuse or the movement of value between connected parties. If it concludes that it does, the compliance officer considers a suspicious transaction report. **Which supervisor applies:** It depends on the market. Securities and commodities exchanges onshore are supervised by the Capital Markets Authority, and exchanges and market institutions in the DIFC by the DFSA. Check which authority recognised your institution and what its guidance says for market operators. **FAQs** - **Does an exchange have to identify investors?** Usually the relationship with the investor sits with the broker. The exchange's duty is to make sure that members meet proper standards and to watch the market. The detail depends on the rules that apply to your institution. - **How is AML different from market surveillance?** Surveillance focuses on market abuse such as manipulation and insider dealing, while AML focuses on the source and movement of funds. They overlap, and sharing information between them improves both. - **What should listing due diligence cover?** The issuer's owners and controllers, its business, its finances, the source of capital and any adverse information. The depth depends on the risk. - **Can an exchange suspend a member?** Within its rules and powers, yes. Having a clear and consistently used process for dealing with concerns is part of a credible programme. - **Who should an exchange tell about a concern?** Its supervisor, and where the rules require it, the Financial Intelligence Unit through goAML. The internal process should say who decides and how quickly. --- ### AML compliance for clearing houses and depositories in the UAE URL: https://adventant.com/sectors/clearing-and-depositories Published: 2026-10-19 Clearing houses and depositories sit at the heart of market plumbing. They settle trades and record ownership. This page explains what that means for AML duties and what supervisors expect. **Main risk:** Members and accounts used to move assets and cash without a clear owner **Key control:** Membership due diligence and monitoring of settlement and transfers **Typical report:** Suspicious transaction reports through goAML A clearing house or central counterparty stands between buyers and sellers, guaranteeing that trades are completed. A central depository records who owns securities and handles their transfer. Both deal mainly with members, such as brokers and banks, rather than with end investors. Their AML duties follow from that position. They must know their members, understand how those members use the services and watch for transfers and settlements that do not make sense. Because they handle the final record of ownership, they are in a unique position to see unusual movements of assets. Supervisors expect these institutions to maintain strong controls even though customer contact is limited, because a failure at this level can affect the whole market. **Money laundering and terrorist financing risks** - **Members with weak controls**: A member whose AML programme is poor can pass illicit activity through the clearing or depository system. - **Transfers of ownership without trades**: Moving securities between accounts without a sale can shift value between parties without a visible price. - **Collateral and margin**: Funds and assets posted as margin or collateral may come from sources that have not been checked, and may be returned to different parties. - **Nominee and omnibus accounts**: Where members hold assets for many underlying owners, the depository sees only the member and not the end owner. - **Sanctions and freezing**: The depository's records are used to identify and freeze assets of sanctioned persons, so accuracy and speed matter. **What supervisors expect** - A compliance officer or MLRO with authority and access to the board. - A risk assessment that looks at members, account types, products, collateral and geographies. - Due diligence on applicants for membership and regular reviews of existing members, including their AML controls. - Controls over transfers of ownership, free-of-payment movements and changes in account details. - Sanctions screening of members and, where practicable, of the owners recorded in the system, with the ability to freeze at once. - Monitoring of settlement, collateral and transfers, and a clear way to escalate concerns to the supervisor and authorities. - Reporting through goAML, training, record keeping and independent testing. **Red flags** - A member that moves large holdings between accounts without a trade. - A sudden change in the beneficial ownership recorded for a nominee account. - Collateral provided by an unrelated third party. - A member that is slow to provide information about the owners of accounts. - Repeated failed settlements followed by unexplained transfers. - Requests to change records urgently without supporting documents. **Scenario (illustration, not a real case): A transfer out of a nominee account.** A member asks a depository to move a large holding out of its nominee account into the account of a company abroad, without a sale. The depository's control requires the member to explain the reason and to identify the owner behind the nominee account. The explanation is vague and the new account holder has not been identified. The depository holds the request, asks for more information and, if the member cannot supply it, refers the matter to the compliance officer, who considers a report. **Which supervisor applies:** Clearing houses, central counterparties and depositories are supervised according to the market they serve. The Capital Markets Authority supervises those onshore and the DFSA those in the DIFC. Check which authority recognised your institution. **FAQs** - **Do central depositories have to know the end investor?** It depends on the structure of the market. Where accounts are held directly, the depository records the owner. Where nominees are used, it must understand how the member identifies owners and what controls it applies. - **What does a clearing house check on a member?** The member's ownership, licence, financial strength and AML controls, both at admission and during membership. The review should repeat when something changes. - **Why do free-of-payment transfers matter?** Because there is no price to show what value moved. They can be legitimate, for example within the same owner, but they need a clear reason and a record. - **How quickly must assets be frozen after a sanctions match?** Without delay. The institution should have a documented process, with named responsibilities, that works within hours, and it should test it. - **Should we report suspicious activity?** Yes, through goAML where the rules apply and suspicion arises. You should also have a way to tell your supervisor. --- ### AML compliance for commodity brokers in the UAE URL: https://adventant.com/sectors/commodity-brokers Published: 2026-10-19 Commodity brokers arrange trades in metals, energy and agricultural goods that cross many borders. The UAE is a major trading hub, so the AML spotlight on this sector is strong. **Main risk:** Trade-based laundering through mis-priced and mis-described goods **Key control:** Know the counterparties, the goods and the route of payment **Typical report:** Suspicious transaction reports through goAML Commodity brokers arrange the purchase and sale of commodities such as metals, energy and agricultural products on behalf of clients. They may deal on exchanges or arrange private trades. Their clients are often traders, producers and funds, and the transactions often cross several borders. Trade-based money laundering is the central concern. Because genuine trade involves large movements of goods and money across borders, criminals can mix illicit funds into it by misrepresenting the price, the quantity or the quality of goods, or by making payments through third parties. Brokers are close enough to the transaction to see when the economics are strange. Supervisors expect them to use that view, and to ask when a price, a route or a counterparty does not make sense. **Money laundering and terrorist financing risks** - **Over- and under-invoicing**: Pricing goods above or below their real value allows funds to move from one party to another under the cover of a trade. - **Phantom or multiple shipments**: Invoicing for goods that never move, or using the same shipment to justify several payments, creates a paper trail for money with no underlying trade. - **Third-party payments**: Settlement by companies other than the buyer and seller, or into accounts in unrelated countries, is a classic feature of trade-based laundering. - **High-risk goods and routes**: Some commodities, such as gold and oil, and some routes through high-risk or sanctioned countries, carry extra risk. - **Opaque counterparties**: Newly formed trading companies with few staff and little history appear frequently in suspicious trades. **What supervisors expect** - A compliance officer or MLRO who understands commodity trade and has authority to stop a deal. - A business risk assessment covering products, counterparties, routes, countries and payment methods. - Client and counterparty due diligence, including owners and controllers, with extra checks for newly formed or opaque companies. - Understanding of the commercial logic of each deal: who is buying, why, at what price, and how it will be shipped and paid for. - Sanctions screening of clients, counterparties, vessels and countries, with documented review of matches. - Monitoring of trading and payments for mispricing, third-party settlement and unusual routes. - Reporting through goAML, training, record keeping and independent testing. **Red flags** - A price that differs sharply from the market with no explanation. - Payment from or to a company that is not party to the contract. - Shipping routes that make no commercial sense. - A counterparty that is newly formed and handles very large deals. - Requests to change documents, amounts or payment details late in the deal. - Goods described in vague or inconsistent terms. **Scenario (illustration, not a real case): A deal priced well below the market.** A client asks a broker to arrange the sale of a cargo of metal to a buyer in another country at a price noticeably under the market, and asks for payment to be made to a third company. The broker asks why the price is so low and why the buyer is not paying directly. The answers are vague. The broker declines to proceed until shipping documents, contracts and ownership of the payer have been provided, records the discussion and, if the information does not satisfy it, the compliance officer considers a report. **Which supervisor applies:** Commodity brokers are supervised by the Capital Markets Authority onshore. Brokers dealing in other zones answer to the regulator that licensed them. If you deal in precious metals as a trader, see the page on precious metals and stones dealers as well. **FAQs** - **What is trade-based money laundering?** The use of trade transactions to move value across borders and hide the origin of funds, for example by misdescribing goods or prices. It is a main concern in a trading hub. - **How can a broker spot mispricing?** By comparing the price with market benchmarks and asking for an explanation of any large difference. A broker should keep records of the comparison and the answer. - **Do we have to check the vessels and routes?** In proportion to the risk, yes. Sanctions exposure often shows through vessels, ports and countries, not only through the names of the parties. - **Can we accept payments from third parties?** Only with a clear reason and extra checks. Many firms refuse them unless the payer is verified and its connection to the deal is understood. - **How does this relate to precious metals rules?** If you deal in precious metals, you may also fall under the rules for dealers in precious metals and stones. Check how your licence describes your activity. --- ### AML compliance for credit rating agencies in the UAE URL: https://adventant.com/sectors/credit-rating-agencies Published: 2026-10-19 Credit rating agencies do not move money for clients, so the risk is narrower than for most firms. It is not zero. This page sets out what supervisors expect and what a proportionate programme looks like. **Main risk:** Rated entities with hidden owners, and fees paid by third parties **Key control:** Know the client, who controls it and who pays the fees **Typical report:** Suspicious transaction reports through goAML A credit rating agency assesses the creditworthiness of companies, governments and financial products, and publishes ratings that investors use. It does not take deposits or move client funds. For that reason, its direct exposure to money laundering is lower than that of a bank or a broker. It is still within the regulated population. The Capital Markets Authority lists credit rating agencies among the firms it supervises, and the agency has relationships with clients, pays and receives fees and handles confidential information. A rating can also give credibility to an entity or product, which makes it valuable to someone who wants to appear legitimate. Supervisors will expect a proportionate programme: know who the clients are, understand who controls them and pays the fees, and have a way to escalate concerns. **Money laundering and terrorist financing risks** - **Clients with hidden ownership**: A rated entity whose owners are not clear can use a rating to gain trust that it may not deserve. - **Payments by third parties**: Fees paid by someone other than the rated entity, or from unexpected countries, need an explanation. - **Shell or newly formed issuers**: Entities with little track record seeking a rating to launch products can be an early step in a laundering or fraud scheme. - **Misuse of ratings**: A rating can be used in marketing to persuade investors, and a flawed process can lend credit to a scheme. - **Sanctions**: Clients and payers must be screened to avoid doing business with sanctioned persons. **What supervisors expect** - A named compliance officer with a proportionate programme, approved at senior level. - A business risk assessment that sets out what exposure the agency has and why it is low or higher in particular areas. - Client due diligence including owners and controllers, and understanding of who pays the fees. - Sanctions and politically exposed person screening of clients and payers. - Escalation of concerns about a client, including those raised by analysts during their work. - Reporting through goAML where there is suspicion, training, record keeping and independent testing proportionate to the firm. **Red flags** - A client that will not say who owns or controls it. - Fees paid by a company unrelated to the rated entity. - An urgent request for a rating with little supporting information. - A client whose accounts or information do not match what analysts find. - Pressure to give a rating that the analysis does not support. - A rated entity that appears to exist only on paper. **Scenario (illustration, not a real case): A fee paid by an unrelated company.** A recently formed company asks for a rating of a new debt product. The fee is paid by a different company abroad that is not mentioned anywhere in the application. The agency asks why, and is told it is a group arrangement, but cannot find any record of the link. The compliance officer asks for documents, reviews who the owners are and, if the answers are not satisfactory, declines the engagement and considers whether to report. **Which supervisor applies:** Credit rating agencies are supervised by the Capital Markets Authority onshore, and by the free-zone regulator where they operate in a financial centre. Check the licence for the activities permitted and the regulator responsible. **FAQs** - **Do rating agencies really need an AML programme?** They are among the firms the authority supervises, so they are expected to have a programme that suits the risk. It can be modest, but it must exist and work. - **Where is the real risk for a rating agency?** In who the clients are and who pays them. A rating can give credibility to an entity, so knowing the owners and the source of the fees matters most. - **Do we need transaction monitoring?** Probably only at a basic level, such as reviewing fee payments for unusual sources. The programme should be proportionate and explained in the risk assessment. - **What should an analyst do if they see a red flag?** Raise it with the compliance officer without alerting the client. A route to escalate that is quick and safe is an important control. - **How often should we review client files?** At least when the rating is renewed or something material changes. More often for higher-risk clients. The cycle should be in the policy. --- ### AML compliance for registrars in the UAE URL: https://adventant.com/sectors/registrars Published: 2026-10-19 Registrars keep the record of who owns a company's securities. The record only helps if it is accurate. This page explains the AML duties of a registrar and what supervisors expect. **Main risk:** Registers that hide the real owner behind nominees or false details **Key control:** Verify the holder and the authority for each change to the register **Typical report:** Suspicious transaction reports through goAML A registrar maintains the register of security holders for companies and funds. It records who owns what, processes transfers and may handle dividends and other payments. The Capital Markets Authority lists registrars among the firms it supervises. The AML significance lies in the integrity of the record. If a register hides the true owner, uses false details or is altered without proper authority, it becomes a tool for concealing ownership. Registrars are also in a position to see unusual patterns, such as many shares moving between connected holders. Supervisors expect registrars to verify the identity of holders, understand the structures behind them and check the authority behind every instruction to change the register. **Money laundering and terrorist financing risks** - **False or incomplete holder details**: Holders who give inaccurate details, or whose real owner is not recorded, defeat the purpose of the register. - **Nominee holdings**: Shares held through nominees can hide the beneficial owner. The registrar should know who the nominee acts for or satisfy itself that someone has checked. - **Transfers between connected holders**: A pattern of transfers between related holders, without a sale, may move value or build a controlling stake out of sight. - **Fraudulent instructions**: Forged or unauthorised instructions to change a register can transfer ownership to the wrong person. - **Dividend and payment redirection**: Changes to the bank details for payments to a holder are a common way to divert funds. **What supervisors expect** - A named compliance officer with authority to question changes to the register. - A risk assessment that covers the companies and funds served, the types of holders and the countries involved. - Identification and verification of holders in line with the risk, and understanding of the owners behind corporate and nominee holders. - Checks on the authority of anyone instructing a change, and on changes of bank details. - Sanctions screening of holders, with the ability to act promptly on a match. - Monitoring of transfers and unusual patterns, reporting through goAML where there is suspicion, training and record keeping. - Independent testing of controls proportionate to the firm. **Red flags** - A holder who will not supply identification or details of the owner. - A request to change bank details just before a dividend is paid. - Repeated transfers between holders with the same address or contact details. - Instructions that arrive from an unfamiliar person claiming authority. - Transfers that build a significant stake in small parcels. - A company that asks for ownership details to be hidden or changed without explanation. **Scenario (illustration, not a real case): New bank details before a dividend.** A long-standing holder emails the registrar a few days before a large dividend asking for payment to be made to a new account in another country in the name of a company. The email address is slightly different from the usual one. The registrar's procedure requires it to call the holder on a known number, ask for supporting documents and record the outcome. The holder cannot be reached. The registrar holds the payment, informs the compliance officer and considers whether the matter indicates fraud or laundering that should be reported. **Which supervisor applies:** Registrars are supervised by the Capital Markets Authority onshore, and by the regulator of a financial free zone where they operate in one. Check your licence and the guidance of the authority that issued it. **FAQs** - **Does a registrar need to know who the beneficial owner is?** It depends on the structure and the risk. A registrar should understand who sits behind corporate and nominee holders to the extent the rules and risk require, and should know what checks the nominee applies. - **How should we verify a change of bank details?** By contacting the holder through a known channel, not the one the request came from, and by asking for documents. Keep a record of what you did. - **What if the same address appears across many holders?** That is a pattern worth investigating. It may be innocent, such as a shared office, but may signal connected holders trying to hide a stake. - **Do registrars report suspicion?** Yes, through goAML where the rules apply. The compliance officer decides, after review. - **How often should holders be reviewed?** By risk. Higher-risk holders should be reviewed more often and whenever something changes, such as ownership or the pattern of transfers. --- ### AML compliance for real estate developers and brokers in the UAE URL: https://adventant.com/sectors/real-estate Published: 2026-10-19 Property is one of the easiest ways to store a large sum in one asset. That is why the UAE treats developers and agents as gatekeepers. This page covers what you are expected to check, report and record. **Main risk:** Large purchases funded in cash, crypto or through companies **Key control:** Source of funds and beneficial owner checks on buyers **Typical report:** Real estate activity reports and STRs through goAML A flat or villa holds a large amount of value in one asset, can be bought through a company and often resells at a profit that looks perfectly legitimate. People who want to move or store illegal money know this, so the UAE treats real estate developers and agents as designated non-financial businesses and professions, usually shortened to DNFBPs, with AML duties of their own. Developers, brokers and agencies are not banks, but they see something a bank may not: who is really buying, how the buyer found the money and whether the story makes sense. The rules expect them to use that view and to report what looks wrong. The market is also fast, international and driven by commission. A broker paid on completion has a reason to close the deal, so the programme has to be strong enough to hold when a good commission is on the line. Supervisors look for evidence that checks happen before a deal completes, not after. **Money laundering and terrorist financing risks** - **Where the money comes from**: A buyer paying a large sum, especially in cash or virtual assets, needs a believable explanation of the source. A buyer whose declared income cannot support the purchase is a warning in itself. - **Ownership through companies and nominees**: Buying through a newly formed company, or through someone acting for an unnamed principal, can hide the real owner. The agent still has to work out who ultimately owns and controls the buyer. - **Payments from third parties**: Money that arrives from an account that does not belong to the buyer, such as a relative, a friend or an unknown company, breaks the link between the buyer and the funds. - **Off-plan and repeated resale**: Buying off plan and reselling before completion, particularly by the same person or group, can give funds a clean-looking property history. - **Prices that do not make sense**: Prices well above or below the market, or sudden price changes between related parties, can be used to move value from one person to another. - **Higher-risk countries and public officials**: Buyers from higher-risk jurisdictions, and politically exposed persons and their families, need closer attention and senior sign-off. **What supervisors expect** - A named compliance officer with enough seniority to stop a transaction, and a registration on goAML so that you can report when required. - A written business risk assessment that looks at the buyers you attract, the products you sell, the countries involved and how payments arrive. - Due diligence on buyers and sellers before the deal completes, including identifying the individuals who ultimately own or control a company. - Understanding where the money comes from, in proportion to the size and risk of the deal, and recording what you saw. - Screening of buyers, sellers and their owners against sanctions lists, with a record of how any potential match was reviewed. - Reports through goAML when the rules require them, including real estate activity reports for the circumstances your supervisor has set, and suspicious transaction reports when you suspect wrongdoing. Always check the current triggers in the supervisor's guidance. - Staff training, records kept for the period the rules require, and an independent check that the programme works in practice. **Red flags** - A buyer who wants to pay a large part in cash, virtual assets or through unrelated third parties. - A purchase registered in the name of a new company whose owners are slow or unwilling to be identified. - A buyer who shows little interest in the property, its price or its condition. - Requests to split payments, change the buyer's name late in the process or hide who is paying. - Several linked purchases by people who appear connected but present themselves as unrelated. - A price that bears no relationship to comparable properties, with no explanation. **Scenario (illustration, not a real case): A quick cash purchase through a new company.** A buyer approaches an agency for a high-value apartment, offers to pay a large part in cash and asks for the purchase to be registered in the name of a recently formed company. He says he works in consultancy but cannot say who his clients are, and he is unhappy when asked for company documents. An agent who treats this as a normal quick sale has missed the point. The better response is to pause, ask for ownership documents and evidence of the source of funds, screen the company and its owners, record the outcome and, if the explanation does not stand up, escalate to the compliance officer, who decides whether a report is needed. Nobody has to prove a crime; they have to ask the right questions and keep a record of the answers. **Which supervisor applies:** It depends on where your business is registered and licensed. Real estate firms in the Dubai International Financial Centre fall under the DFSA's regime for designated businesses and professions, firms in Abu Dhabi Global Market under the ADGM Registration Authority, and firms on the mainland or in other free zones are generally supervised by the Ministry of Economy and Tourism. Land departments and other real estate bodies set their own licensing rules, which are separate from AML supervision. If you are unsure, ask your licensing authority which body supervises you for AML. **FAQs** - **Do real estate brokers have to register on goAML?** Firms in the real estate sector that are subject to the AML rules are expected to register so that they can submit reports when required. Registration is not the same as reporting: you file only when a reporting trigger applies. Confirm the current requirement with your supervisor. - **Do I have to do due diligence on the seller as well as the buyer?** Supervisors generally expect you to know both parties to a transaction. The depth depends on the risk, but a seller can be just as relevant to money laundering as a buyer, for example when a property is sold well below market value to a connected party. - **What counts as proof of the source of funds?** It depends on the story. For a salaried buyer it may be payslips and bank statements, for a business owner it may be accounts and a sale agreement, for an inheritance it may be a legal document. The test is whether the evidence makes sense for the amount and for the person. - **Can I take a deposit before I have finished the checks?** As a rule, due diligence should be finished before the relationship is concluded. If your supervisor allows any delay, it will be narrow and you should record why. Taking money first and checking later is one of the things examiners look for. - **What if the buyer pays through a mortgage?** A mortgage lender does its own checks, but that does not remove your duty. You still need to know who the buyer is and to notice a pattern such as a large deposit from an unexplained source or an unusual early repayment. --- ### AML compliance for gold, jewellery and precious stones dealers in the UAE URL: https://adventant.com/sectors/precious-metals-and-stones Published: 2026-10-19 Gold and diamonds are valuable, portable and easy to sell for cash, which is why the UAE watches this trade closely. This page explains what dealers are expected to check, report and keep on file. **Main risk:** Cash purchases and gold of unclear origin **Key control:** Know the customer, the source and the supply chain **Typical report:** Dealers in precious metals and stones reports (DPMSR) through goAML Gold and gemstones hold a great deal of value in a very small space. They can be carried across borders, sold quickly for cash and melted or recut so that their history is hard to trace. For anyone trying to launder money, they are close to ideal, and the UAE's position as a major trading hub has put the sector under particular scrutiny. The rules treat dealers in precious metals and precious stones as designated non-financial businesses and professions. That covers the refinery and the wholesaler as much as the retail jeweller. If you buy or sell in cash at or above the reporting threshold, you have obligations that apply whatever your size. Two questions run through the whole sector. Who is on the other side of this deal, and where did the metal or stone really come from? A dealer who can answer both, and show the paperwork, is in a far stronger position than one who cannot. **Money laundering and terrorist financing risks** - **Cash**: Many transactions in the trade are still settled in cash. Large or frequent cash payments, or payments split to stay under a limit, are the most obvious laundering route in the sector. - **Origin of the metal or stone**: Gold and stones can come from conflict-affected or high-risk areas, from illegal mining or from smuggling. Supervisors expect dealers to know their supply chain, and commonly refer to international due diligence guidance on responsible sourcing. - **Scrap, recycled gold and melting**: Scrap and melted gold has no visible history, which makes it easy to blend illicit metal with clean stock. Weight and purity checks, and a clear record of who sold it to you, matter. - **Trade-based laundering**: Invoices for shipments that are over-valued, under-valued or described loosely can be used to move money between countries under cover of genuine trade. - **Third parties and walk-in customers**: Customers who pay through someone else, buy on behalf of an unnamed person or are visiting briefly are harder to know. A high-value walk-in sale is not a reason to relax the checks. - **Sanctions exposure**: Gold has been used to get around sanctions. Dealers need to screen the customer, the counterparties and the countries involved, and act without delay on a confirmed match. **What supervisors expect** - A named compliance officer, and a goAML registration so that you can file the reports your supervisor requires. - A written business risk assessment that covers customers, products, countries, payment methods and supply chain. - Customer due diligence at the level of risk, including identifying beneficial owners of corporate buyers and sellers, and keeping copies of identification for every cash dealing that reaches the threshold. - Supply chain due diligence for what you buy: who sold it to you, where it was mined or refined, and any red flags about its route to market. - Screening against sanctions lists before you deal, with a record of how matches were reviewed. - Dealers in precious metals and stones reports through goAML for cash dealings at or above the set threshold, and suspicious transaction reports when you suspect wrongdoing. The threshold has been AED 55,000, but always confirm the current figure with your supervisor or the Financial Intelligence Unit. - Staff training, records kept for the required period, and independent testing of how the programme runs day to day. **Red flags** - A customer who insists on paying in cash and gets uncomfortable when asked for identification. - Repeated purchases just below the reporting threshold, or payments split across people or days. - A seller who cannot say where the gold or stones came from, or whose documents look inconsistent. - Prices that are well above or below the market for the weight and purity. - Shipments or invoices that do not match what the customer says the business does. - Customers from or paying through high-risk countries without a clear commercial reason. **Scenario (illustration, not a real case): A cash buyer who keeps returning.** A visitor buys a gold bar in cash and returns three days later for another, each time paying just under the reporting threshold. When asked for identification he says that he is buying for a friend and cannot name him. A dealer who treats each sale on its own sees two ordinary sales. A dealer who looks across the sales sees a pattern designed to stay under a limit, and an unnamed beneficial owner. The sensible response is to record both transactions together, ask for identification and an explanation, consider whether a report is required and escalate to the compliance officer. If the buyer refuses to cooperate, that refusal is itself a reason to decline the next sale and to think about a report. **Which supervisor applies:** It depends on where the business is licensed. Dealers on the mainland and in free zones that are not financial centres are generally supervised for AML by the Ministry of Economy and Tourism. Dealers in the Dubai International Financial Centre are covered by the DFSA's regime for designated businesses and professions, and those in Abu Dhabi Global Market by the ADGM Registration Authority. Trade bodies and free zones may add their own licensing rules, which are separate from AML supervision. **FAQs** - **Does a small jewellery shop have to follow these rules?** The rules apply to the activity, not to the size of the shop. A small retailer that deals in precious metals or stones in the ways the rules cover has duties, although the programme can be proportionate to the risk. Check with your supervisor if you are unsure whether a particular activity is in scope. - **What is a DPMSR?** It is a report submitted through goAML by dealers in precious metals and stones for cash dealings at or above a set threshold. It is a routine report triggered by the size and form of the payment, not by suspicion. A suspicious transaction report is separate and applies whenever you suspect wrongdoing, whatever the amount. - **Do I need to check where gold came from?** Yes, in proportion to the risk. Supervisors expect dealers to understand their supply chain and to take extra care with scrap, with gold from high-risk areas and with sellers who cannot show where it came from. Many dealers follow international responsible sourcing guidance and keep records of each step. - **Can I accept payment in cryptocurrency?** The AML duties do not disappear because the payment method is a virtual asset. You still need to know the customer, understand where the funds came from and report where the rules require it. Because virtual assets carry their own risks, many dealers choose not to accept them. Check your supervisor's current position. - **How long do I need to keep my records?** The rules set a minimum period, which is commonly at least five years, and your supervisor can explain how it applies to your records. Keep identification, transaction records, risk assessments and the reasons for your decisions together so that they can be produced quickly. --- ### AML compliance for high-value goods dealers in the UAE URL: https://adventant.com/sectors/high-value-goods Published: 2026-10-19 Watches, art, cars and other luxury goods hold value, travel easily and are often paid for in large sums. This page explains why dealers have AML duties and what a sensible programme looks like. **Main risk:** Expensive goods bought with funds of unclear origin and resold **Key control:** Know the buyer and the seller, and how each pays **Typical report:** Suspicious transaction reports through goAML Luxury goods such as watches, cars, yachts, art and antiques store a large amount of value in a form that can be carried, shipped and resold. A buyer who wants to turn illicit money into something that looks respectable, and can later be sold for a clean payment, has an obvious interest in such items. Dealers in high-value goods are treated as designated businesses in some jurisdictions, including Abu Dhabi Global Market. What counts as high-value, and which dealers are covered, is set by the rules that apply to your licence, so the first task is to check whether you are in scope and under which regime. The business is relationship-driven and discreet, and sales can close in a single visit. A good programme has to work in that setting: quick enough not to lose the customer, strong enough to answer the supervisor. **Money laundering and terrorist financing risks** - **Large cash and unusual payments**: Paying for a luxury item in cash, in virtual assets or through third parties is the main warning sign for a dealer. - **Buying on behalf of others**: A buyer who is acting for an unnamed person, or has the item delivered to someone else, may be hiding the real owner. - **Quick resale**: Buying and soon reselling, possibly at a loss, can convert illicit money into a seemingly legitimate sale payment. - **Valuation problems**: Art and antiques have subjective values, so over- or under-valuing items is a way to move value between parties. - **Export and cross-border delivery**: Items shipped out of the country shortly after purchase move value across borders with little trace. **What supervisors expect** - A named compliance officer with authority to refuse a sale, and a proportionate programme. - A business risk assessment that considers the goods you sell, the customers you attract, payment methods and delivery routes. - Customer due diligence for sales that fall within the rules, including identification of beneficial owners where the buyer is a company. - Understanding of where the funds come from for large purchases, and who is actually paying. - Sanctions and politically exposed person screening, with a record of how matches were reviewed. - Reports through goAML where the rules require them, and suspicious transaction reports when you suspect wrongdoing. - Training, record keeping for the required period, and an independent check that the programme works. **Red flags** - A customer who wants to pay a large amount in cash or through an unrelated party. - A buyer who is uninterested in the details or price of an expensive item. - An item bought and then offered for resale very soon afterwards. - Delivery to a different person or country than the buyer's own. - A customer who becomes uncomfortable when asked for identification. - A price that does not match the item's real market value. **Scenario (illustration, not a real case): A watch bought in cash and resold the next week.** A visitor buys a very expensive watch with a large payment in cash and returns a week later wanting to sell it back at a loss, asking for payment into an account in a different name. The dealer who sees two unrelated transactions has missed what the supervisor will see: a cash purchase converted into a bank payment. The dealer should record both transactions together, ask for an explanation and identification, speak to the compliance officer and, if the explanation is not credible, consider a report. **Which supervisor applies:** In Abu Dhabi Global Market, high-value goods dealers are supervised by the ADGM Registration Authority. Elsewhere, whether a dealer in luxury goods is covered depends on the goods and the rules that apply to the licence. For gold, jewellery and stones, see the page on precious metals and stones dealers. **FAQs** - **What counts as a high-value good?** The rules that apply to your licence set the scope and any threshold. Typical examples are watches, jewellery, art, cars and yachts. Check the guidance of your supervisor to see whether your goods and sales are covered. - **Do auction houses and galleries have duties?** If they deal in covered goods above the relevant level, they are likely to be covered. Both buyers and sellers need to be understood, because laundering can occur on either side. - **Can we accept cryptocurrency for a luxury item?** The AML duties apply whatever the payment method. Many dealers choose not to accept virtual assets, or apply extra checks. Check your supervisor's position. - **What if a customer is a regular?** Familiarity is not due diligence. Keep records up to date and watch for changes in the pattern of purchases. - **How do we deal with a refusal to give identification?** Do not complete the sale. Record the refusal and tell the compliance officer, who will consider whether a report is needed. --- ### AML compliance for law firms, lawyers and notaries in the UAE URL: https://adventant.com/sectors/law-firms Published: 2026-10-19 Lawyers are trusted advisers, which is exactly why criminals want to use them. This page explains when legal work comes within the AML rules, where the risk sits and how to run a programme that respects client confidentiality. **Main risk:** Legal work and client accounts used to give transactions credibility **Key control:** Identify the client, the real owner and the reason for the matter **Typical report:** Suspicious transaction reports through goAML Lawyers and notaries help clients buy property, set up companies, manage trusts, structure deals and move money. In doing so they give transactions legal form and a measure of respectability. That is useful to honest clients and equally useful to those who want to hide what they are doing. Not all legal work is within the AML regime. The rules apply to particular activities, such as buying and selling real estate, managing client money or assets, setting up and running companies and trusts, and similar transactions. A lawyer who acts only in a court case is generally outside the regime, but one who handles a property sale for a client is generally inside it. The first task for any practice is to work out which of its activities fall within the rules. Confidentiality matters. Information covered by legal professional privilege is treated differently under the rules, and a practice should take advice on exactly where the limits lie. That does not remove the duty to know the client and to refuse work that looks like laundering. **Money laundering and terrorist financing risks** - **Property transactions**: Buying and selling real estate for clients, especially where funds come through the firm's client account, is a classic route for placing illicit money. - **Company and trust formation**: Setting up companies, trusts and foundations that hide ownership, or acting as nominee, can help conceal who controls assets. - **Use of client accounts**: Passing money through the firm's account with little legal work to justify it gives the money the credibility of the firm. - **Clients seeking secrecy**: A client who values secrecy over a commercial reason, or who wants the firm to act without knowing the real principal, is a warning. - **Cross-border structures and complex transactions**: Layered deals across countries can be designed to defeat checking by any single adviser. **What supervisors expect** - A named compliance officer with authority to refuse instructions, and a practice-level programme. - A practice risk assessment covering clients, matters, countries and the way money moves through the firm. - Client due diligence before work begins, including the real owner of a corporate or trust client and the purpose of the matter. - Understanding of the source of funds where the practice handles or moves money, and a refusal to use client accounts as a bank. - Sanctions and politically exposed person screening of clients, with a record of review. - Reporting of suspicion in line with the rules, taking account of legal professional privilege, and care not to tip the client off. - Training, record keeping and independent testing proportionate to the practice. **Red flags** - A client who wants to move money through the firm's account without a legal matter behind it. - A client who refuses to identify the person for whom they act. - Transactions with no sensible commercial or legal reason. - Funds from or to third parties who have nothing to do with the matter. - Instructions that change the buyer or payer at the last minute. - A client who pressures the lawyer to work quickly and skip the checks. **Scenario (illustration, not a real case): A property purchase funded by several unrelated payers.** A client instructs a firm to buy a property through a newly formed company. The purchase funds arrive in the firm's client account from three different companies and an individual, none of whom is named in the instructions. The lawyer should not simply pass the money on. The practice should ask who the real buyer is, why several third parties are paying, where each of them got the money and whether the structure has a legitimate purpose. If the client cannot answer, the practice should decline to act, return nothing without advice and consider with the compliance officer whether any report can and should be made. **Which supervisor applies:** It depends on where the practice is based. Lawyers and legal businesses onshore, and notaries within the AML remit, are supervised by the Ministry of Justice. Law firms and notary firms in the DIFC fall under the DFSA's regime for designated businesses and professions, and lawyers in Abu Dhabi Global Market under the ADGM Registration Authority. Check your licence and ask your supervisor where it is unclear. **FAQs** - **Does all legal work fall under the AML rules?** No. The rules apply to specified activities, such as dealing in real estate, managing client money or assets and forming or running companies and trusts. The practice should map its own work against the rules and confirm any doubt with its supervisor. - **How does legal professional privilege affect reporting?** Privileged information is treated differently, and the extent of the protection depends on the facts and the rules. A practice should take advice on this point and record how it applies the position. It does not remove the duty to know your client. - **Can we hold client money?** You can, but a client account is not a bank account. Money should pass through only when there is a genuine legal matter behind it, and you should know where it came from and where it is going. - **Do notaries have the same duties?** Notaries who carry out activities within the AML remit have duties of the same kind, including identifying parties and reporting suspicion. The Ministry of Justice sets out which activities are in scope. - **What if a client is a long-standing one?** Familiarity does not replace due diligence. Keep files up to date and notice when the type of work or the pattern of payments changes. --- ### AML compliance for accountants and accounting firms in the UAE URL: https://adventant.com/sectors/accountants Published: 2026-10-19 Accountants see how money really moves through a business, which gives them an unusual view of what is normal and what is not. This page explains the AML duties that come with that view. **Main risk:** Books, structures and advice used to make illicit funds look real **Key control:** Understand the client's business and question numbers that do not fit **Typical report:** Suspicious transaction reports through goAML Accountants prepare accounts, advise on tax and structure, handle bookkeeping and payroll and sometimes help with transactions. The AML rules apply when they carry out certain activities for clients, such as buying and selling real estate, managing client money, setting up and running companies, or organising contributions for companies. The risk is that an accountant's work can give a business, or a set of figures, a credibility it does not deserve. Accounts that show profits that do not exist, or transactions that look like trade but are not, may be a way of explaining where the money came from. Accountants are well placed to notice when the numbers do not fit the business. Supervisors expect them to act on that, by asking questions, escalating concerns and, where the rules require, reporting. **Money laundering and terrorist financing risks** - **Inflated or fictitious turnover**: A business that records more income than it earns can use accounts to explain illicit funds as profits. - **Complex group structures**: Chains of companies, loans between related parties and unusual transfers can hide who owns the assets. - **Cash-heavy businesses**: Where cash is a large part of revenue, it is harder to prove that the recorded income is real. - **Services that help create structures**: Helping to set up companies, open accounts or act for clients in transactions can bring the accountant into direct contact with laundering risks. - **Clients seeking help to disguise**: A request to change dates, invoices or descriptions to suit a story is a clear warning. **What supervisors expect** - A named compliance officer with authority to refuse engagements, and a proportionate programme. - A risk assessment that covers the services provided, the sectors and the countries of clients. - Client due diligence at the start of an engagement, including the owners and controllers and the purpose of the work. - Understanding of the client's business, and ongoing attention to whether its figures and transactions make sense. - Sanctions and politically exposed person screening, with documented review of matches. - Reporting of suspicion through goAML and care not to alert the client. - Training, record keeping and independent testing proportionate to the firm. **Red flags** - A client whose accounts show profits that cannot be matched to real activity. - Requests to alter dates, descriptions or amounts to fit a story. - Large unexplained loans from or to related parties. - A client with a cash-heavy business and few records. - Frequent changes of ownership or director without explanation. - Pressure to complete work quickly and without the usual information. **Scenario (illustration, not a real case): Accounts that do not match the premises.** A small shop with a modest lease and two employees engages an accountant, and provides records showing turnover several times what the premises could support, much of it in cash. The accountant should ask how the business makes that revenue, check against what the shop could realistically sell and request evidence. If the explanation is weak, the accountant should decline to prepare accounts that rest on unsupported numbers, tell the compliance officer and consider whether a report is required. **Which supervisor applies:** Accountants and accounting firms are supervised by the Ministry of Economy and Tourism onshore, by the DFSA in the DIFC and by the ADGM Registration Authority in Abu Dhabi Global Market. Check your licence and the activities you perform, because the rules apply to specified services. **FAQs** - **Do all accounting services fall within the AML rules?** The rules apply to specified activities, so check which of your services are covered. Where you are unsure, ask your supervisor, and record the answer. - **What should an accountant do about suspicious numbers?** Ask the client for an explanation and evidence, record the answer and escalate to the compliance officer if it is unsatisfactory. Do not simply produce the accounts that the client wants. - **Do we have to do due diligence on small clients?** Yes, in proportion to the risk. The checks can be light for a low-risk client but must exist and be recorded. - **Can we tell the client we are considering a report?** No. Tipping off is an offence under the rules. Escalate internally and follow your compliance officer's advice. - **What records do we need to keep?** Client identification, engagement records, the reasons for decisions and any reports or escalations, for the period required by the rules, which is commonly at least five years. Check your supervisor's guidance. --- ### AML compliance for auditors and audit firms in the UAE URL: https://adventant.com/sectors/auditors Published: 2026-10-19 Auditors give assurance that accounts are fair. That makes them important gatekeepers, and it means they have duties of their own under the AML rules. This page explains what they are and how to meet them. **Main risk:** Clients whose accounts hide the true source or use of funds **Key control:** Client acceptance checks and professional scepticism **Typical report:** Suspicious transaction reports through goAML An audit gives users of accounts some confidence that the figures are reliable. That confidence is valuable to a business trying to look legitimate to banks, investors and regulators. Auditors therefore sit at a point where a mistake or a lapse can help launder money, even without anyone intending it. Auditors are covered by the AML framework as designated professionals. Registered auditors are supervised in the DIFC by the DFSA, and audit firms are also supervised by other authorities according to their licence. The Capital Markets Authority lists relevant audit firms among the businesses it supervises, because they audit the market's listed firms and regulated entities. The audit already involves scepticism: testing figures, asking questions and being alert to fraud. The AML requirements overlap with that work. They add formal duties to assess the risk of clients, to identify owners and to report where suspicion arises. **Money laundering and terrorist financing risks** - **Clients with false or inflated figures**: Accounts that overstate revenue or hide transactions can be used to explain the origin of money. - **Opaque ownership**: A client whose owners and controllers are not clear is harder to assess and may be a front. - **Related-party transactions**: Large dealings with connected parties, unusual loans and transfers can be a way to move money out of sight. - **High-risk sectors and countries**: Clients in cash-intensive businesses, or with links to high-risk countries, need extra care. - **Pressure and fee dependence**: A large client that pays substantial fees can create pressure not to ask difficult questions. **What supervisors expect** - A named compliance officer or MLRO with authority over client acceptance, and a programme approved at partner or board level. - A risk assessment that covers the firm's client base, sectors, countries and services. - Client acceptance and continuance procedures, including identification of owners and controllers, and understanding of the business. - Sanctions and politically exposed person screening of clients and key parties, with documented review. - Escalation of concerns found during audit work, and reporting through goAML where there is suspicion. - Training, record keeping and independent quality review of how the programme is applied. - Awareness of the relationship between audit independence and the AML duty to report. **Red flags** - A client who will not explain ownership or the source of its funds. - Revenue that cannot be matched to contracts, deliveries or bank records. - Large unexplained transactions with related parties. - A sudden change of auditors or directors without explanation. - Pressure to sign off quickly or to ignore inconsistencies. - Records that are missing or altered. **Scenario (illustration, not a real case): Revenue that bank records do not support.** During an audit, the team finds that recorded sales to several overseas customers are not matched by any payments in the company's bank statements, and that the customers cannot be contacted. Management says the payments were made in cash through a third party. The audit team treats the lack of evidence as a serious concern, raises it with the engagement partner and the firm's compliance officer, and considers whether the facts amount to a suspicion that must be reported. They keep to professional rules about not alerting the client improperly. **Which supervisor applies:** Registered auditors in the DIFC are supervised by the DFSA. Auditors in Abu Dhabi Global Market are supervised by the ADGM Registration Authority, and those onshore by the Ministry of Economy and Tourism. Audit firms that audit capital-market entities may also be relevant to the Capital Markets Authority. Check your own licence and registration. **FAQs** - **Does the AML duty conflict with audit confidentiality?** The rules recognise professional duties, but they do not remove the duty to report suspicion where it applies. The firm should have a clear policy on how the two fit together and take advice on difficult cases. - **How is AML different from fraud detection in an audit?** Fraud procedures focus on whether the accounts are materially misstated. AML focuses on the client, the owners and the source and use of funds. They overlap, and findings in one often matter to the other. - **Do we need to review clients once accepted?** Yes. Risk can change, so clients should be reviewed at least when they are re-appointed and whenever something material changes. - **Who decides whether to report?** The compliance officer or MLRO, after review, in consultation with the engagement partner where appropriate. Team members must escalate without discussing the concern with the client. - **Can a small audit firm have a simple programme?** Yes, if it is proportionate to the risk and covers the same areas: risk assessment, client acceptance, screening, reporting, training and review. --- ### AML compliance for insolvency firms and practitioners in the UAE URL: https://adventant.com/sectors/insolvency-practitioners Published: 2026-10-19 Insolvency practitioners take control of a failing business, its assets and its records. That gives them both a duty to look for wrongdoing and a role that needs AML controls of its own. **Main risk:** Assets and funds handled during a restructuring or liquidation **Key control:** Identify those who benefit, and trace where assets have gone **Typical report:** Suspicious transaction reports through goAML Insolvency practitioners are appointed to restructure, wind up or take control of businesses in financial difficulty. They collect and sell assets, deal with creditors, review past transactions and make distributions. In the DIFC and ADGM, insolvency firms and practitioners are covered by the AML rules for designated professionals. The work has two sides. On one side, practitioners are often the first to see what has happened inside a failed business, including signs of fraud and laundering. On the other, they handle assets and money, buy and sell property, and may be approached by people who want to buy at a discount or gain control of a business cheaply. Supervisors expect practitioners to apply AML controls to the people they deal with and to use their position to report what they find. **Money laundering and terrorist financing risks** - **Purchasers of distressed assets**: Buyers who pay in cash or through third parties for assets sold in an insolvency can use the process to launder funds. - **Records of past wrongdoing**: The practitioner may find evidence of laundering or fraud by the former management, and must decide what to do with it. - **Pre-insolvency transfers**: Assets moved out of a company shortly before failure, perhaps to related parties, can be proceeds of crime or a way to hide them. - **Creditor claims**: False or inflated claims, particularly from connected parties, can draw funds out of the estate. - **Handling of funds**: Money held in the estate and later distributed needs to go to the right people for the right reasons. **What supervisors expect** - A named compliance officer with authority over appointments, and a proportionate programme. - A risk assessment that covers the types of appointment, the sectors and countries involved. - Due diligence on the parties the practitioner deals with, including purchasers of assets, significant creditors and anyone who receives distributions. - Understanding of the source of funds for significant asset purchases, and of any links between buyers and former owners. - Sanctions and politically exposed person screening, with documented review. - Reporting of suspicion in line with the rules, including matters found in the company's records, and care not to alert the people involved. - Training, record keeping and independent testing proportionate to the firm. **Red flags** - A purchaser who offers cash for valuable assets. - A buyer with links to the former owners or directors. - Large transfers out of the company just before it failed. - Creditor claims from related parties that are inflated or unsupported. - Directors who are not cooperating or who destroy records. - Payment instructions that change just before a distribution. **Scenario (illustration, not a real case): A discounted sale of company assets.** During a liquidation, a buyer offers a cash payment for the company's equipment at a price below valuation. Checks show the buyer is a newly formed company owned through a nominee, and that a former director of the failed company has an interest. The practitioner refuses to deal until it has identified the real owner and source of funds, records its enquiries and, given the links to the former management, considers whether the matter indicates wrongdoing that should be reported. **Which supervisor applies:** Insolvency firms in the DIFC are supervised by the DFSA, and insolvency practitioners in Abu Dhabi Global Market by the ADGM Registration Authority. Practitioners onshore should check with the authority that licensed or registered them, because the regime depends on the appointment and the jurisdiction. **FAQs** - **Why do insolvency practitioners have AML duties?** Because they handle assets, deal with buyers and creditors and see records that may reveal wrongdoing. They are in a position to prevent a failed business from being used to launder money. - **Do we need to check every creditor?** In proportion to the risk. Significant claims, claims from related parties and claims that look unusual should be checked more closely. - **What should we do if we find evidence of laundering in the records?** Escalate to the compliance officer, preserve the records and consider a report. Do not warn the people concerned. - **Can we accept cash for assets?** It is higher risk. Many practitioners refuse it or set a low limit. If you accept it, check the buyer and the source of funds and record the reason. - **Who is responsible if a purchaser is a front?** The practitioner has a duty to carry out checks and can be criticised if they are not done. The checks should be recorded and repeated if circumstances change. --- ### AML compliance for company and corporate service providers in the UAE URL: https://adventant.com/sectors/company-service-providers Published: 2026-10-19 Company service providers set up and run the companies other people use. If the company is a front, the provider can be the only party who knows. This page explains the risks and what supervisors expect. **Main risk:** Companies and structures used to hide who really owns assets **Key control:** Identify the real owner and the reason for every structure **Typical report:** Suspicious transaction reports through goAML Company service providers, also called corporate service providers, help clients form companies, provide registered offices, act as directors or nominee shareholders and handle filings. They are often the first and sometimes the only professional to deal with a new company, which gives them an important role. Companies are a normal part of business, but they can also be used to hold assets, move money and hide who is behind a transaction. Shell companies with no real activity, and chains of companies in several countries, are a well-known feature of laundering schemes. The provider who set them up may be the only party who can say who is really in control. That is why supervisors place a high value on the checks a provider carries out at the start and the records it keeps. The aim is that anyone looking back should be able to trace a company to the real person who owns and controls it. **Money laundering and terrorist financing risks** - **Shell companies**: Companies with no real business that exist only to hold assets or move money can hide the origin and destination of funds. - **Nominee directors and shareholders**: Where a provider acts as a nominee, the real owner may appear nowhere in public records. The provider must know who they are and hold the information securely. - **Layered cross-border structures**: Companies owning companies in different jurisdictions make it difficult to see who is at the top. - **Use of the provider's address and services**: A registered office or mail address gives a company an appearance of substance it may not have. - **Client onboarding at a distance**: Many clients never visit. Remote onboarding makes it harder to verify identities and to see who is really giving instructions. - **Sanctions and high-risk countries**: Structures can be used to hide links to sanctioned people or places. **What supervisors expect** - A named compliance officer with authority to refuse a client or to end a relationship. - A business risk assessment that covers the types of company and client, the countries involved and the services provided. - Identification and verification of the real owners and controllers of every client company, to the end of the ownership chain. - Understanding of the purpose of each structure and of the source of the owners' wealth in proportion to the risk. - Strict control over nominee arrangements, with written records of who the real owner is. - Sanctions and politically exposed person screening, with documented review of matches and ongoing monitoring. - Reporting through goAML, training, record keeping for the required period and independent testing. **Red flags** - A client who wants a company with no clear business purpose. - An owner who refuses to be identified or who uses a series of intermediaries. - Requests for nominee arrangements that hide the real owner from the provider. - A group with companies in several countries and no commercial reason. - A company that is dormant for a long time and then handles large payments. - Pressure to set up quickly and without full documents. **Scenario (illustration, not a real case): Several companies at one address, one owner behind them.** A client orders four companies in different countries, all to use the provider's registered address, with different nominee directors and different named owners who share a surname and a phone number. The client says it is a family arrangement but cannot explain what each company will do. The provider asks for a plan for each, a record of the real owner and the source of funds. If the client cannot provide it, the provider should decline, record the refusal and have the compliance officer consider a report. **Which supervisor applies:** Company service providers in the DIFC are supervised by the DFSA, those in Abu Dhabi Global Market by the ADGM Registration Authority, and corporate service providers onshore by the Ministry of Economy and Tourism. Check your licence, since some firms operate in more than one jurisdiction and each has its own supervisor. **FAQs** - **What is a beneficial owner?** The natural person or persons who ultimately own or control a company, directly or indirectly. A provider must identify and verify them and take reasonable steps to confirm the result, rather than stopping at the first company in the chain. - **Can we provide nominee directors?** Many providers do, but it carries serious risk. You must know who the real owner is, understand the purpose and keep records securely. Many firms limit or avoid the service. - **Do we have to monitor after incorporation?** Yes. Ownership, activity and purpose can change, so you should review clients at a frequency set by risk and when something significant changes. - **What if a client wants to use our address only?** Providing a registered office is a regulated service, and you must still know the client and the purpose. A company that uses your address with no real activity needs close attention. - **Who decides whether to report?** The compliance officer, after review. Staff should escalate promptly and not tell the client that a report is being considered. --- ### AML compliance for real estate developers in ADGM URL: https://adventant.com/sectors/real-estate-developers-adgm Published: 2026-10-19 Real estate developers operating within Abu Dhabi Global Market are subject to ADGM's AML framework. This page covers who supervises them, what they must check and when they must report. **Main risk:** Large property transactions used to place and layer illicit funds **Key control:** Source of funds and beneficial owner checks at point of sale **Typical report:** Suspicious transaction reports through the ADGM Financial Intelligence Unit Real estate developers within ADGM are regulated as designated non-financial businesses under the ADGM AML framework. They must carry out customer due diligence, identify beneficial owners and report suspicious transactions. The ADGM Registration Authority supervises real estate developers in the zone and expects them to have a written AML programme proportionate to the size and risk of their business. Developers dealing in high-value units must pay close attention to the source of funds, the identity of the buyer and any third parties involved in the transaction. **Money laundering and terrorist financing risks** - **Cash and virtual asset purchases**: Large payments outside the normal banking channel, including in virtual assets, raise the risk of funds from unknown or illicit sources. - **Ownership through intermediaries**: A buyer acting through a company or nominee may conceal who ultimately owns the property. - **Third-party payments**: Funds arriving from an account not held by the named buyer break the audit trail between buyer and source. - **Politically exposed persons**: PEPs or their family members buying premium property at or above market value require enhanced due diligence. **What supervisors expect** - An AML policy and risk assessment specific to real estate development in ADGM. - Customer due diligence at onboarding and before completion, with documented source of funds. - Identification and verification of all beneficial owners behind corporate buyers. - Sanctions and PEP screening at onboarding and ongoing monitoring. - Reporting through the ADGM Financial Intelligence Unit when a transaction or enquiry raises concern. - Record keeping for the required period and staff training proportionate to role. **Red flags** - A buyer who cannot explain the source of funds or whose declared income does not support the purchase. - Payment in cash, virtual assets or from a third-party account. - A newly formed company with no apparent business history acquiring a high-value unit. - Pressure to complete quickly without full documentation. - Unusual price levels compared with market comparables. **Scenario (illustration, not a real case): Off-plan unit paid by a foreign company.** A buyer contracts for a high-value off-plan unit using a recently incorporated foreign company. Payment arrives from a third account. The developer asks for the company's beneficial owners, proof of the source of funds and an explanation of why the payment came from a different account. If the buyer cannot provide it before completion, the developer should decline and consider whether a report is appropriate. **Which supervisor applies:** Real estate developers operating within Abu Dhabi Global Market are supervised by the ADGM Registration Authority for AML purposes. **FAQs** - **Are ADGM real estate developers required to register with a supervisor?** Yes. Developers carrying out regulated AML activities in ADGM must register with the ADGM Registration Authority, which supervises compliance with the ADGM AML framework. - **When must customer due diligence be completed?** Before completion of the transaction or as soon as reasonably practicable during onboarding, and in any case before handing over keys or transferring title. - **What if a buyer refuses to provide source of funds?** The developer should not proceed with the transaction and should consider whether the refusal itself gives grounds for a suspicious transaction report. --- ### AML compliance for business centres in ADGM URL: https://adventant.com/sectors/business-centres-adgm Published: 2026-10-19 Business centres in ADGM provide registered offices, mail addresses and serviced workspace to a wide range of clients. Their proximity to company formation means they carry similar AML duties to corporate service providers. **Main risk:** Front companies using a legitimate address to appear credible **Key control:** Know who is behind each client company before providing a registered address **Typical report:** Suspicious transaction reports through the ADGM Financial Intelligence Unit Business centres operating in ADGM are designated non-financial businesses under the ADGM AML framework. They must carry out customer due diligence on clients who use their address or workspace services and report suspicious activity. Providing a registered office or mail address to a company with no real activity can make that company appear credible. Supervisors expect business centres to understand who is behind every client and what the client actually does. The ADGM Registration Authority supervises business centres and expects them to apply the AML framework proportionate to the risk their business model presents. **Money laundering and terrorist financing risks** - **Shell companies using a legitimate address**: A dormant company with a registered address at a business centre can appear to have substance it does not have. - **Multiple companies under one client**: A single client operating several companies from the same address makes it harder to understand the purpose of each. - **Undisclosed beneficial owners**: Where a company is controlled by someone who does not appear in its registration, the business centre may be the only point at which the real owner can be identified. - **High-risk jurisdictions**: Clients with links to sanctioned countries or territories listed as high-risk require enhanced due diligence. **What supervisors expect** - An AML policy and risk assessment specific to business centre services in ADGM. - Customer due diligence on every client, including identification and verification of beneficial owners. - Ongoing monitoring to detect changes in client status or unusual activity. - Sanctions and PEP screening at onboarding and on an ongoing basis. - Reporting through the ADGM Financial Intelligence Unit and record keeping for the required period. - Staff training proportionate to their exposure to client-facing risk. **Red flags** - A client who cannot explain what the company does or who ultimately controls it. - Multiple companies registered at the same address with overlapping ownership. - A client who requests mail handling for large volumes of financial correspondence. - Rapid changes in the named directors or shareholders shortly after incorporation. - Links to jurisdictions subject to ADGM or FATF advisories. **Scenario (illustration, not a real case): A client requests an address for several newly formed companies.** A client asks for registered addresses for three companies incorporated in the same week, each with a different named director. The stated business purpose is vague. The business centre asks for details of the beneficial owner behind all three, the purpose of each company and the nature of expected activity. If the client cannot provide clear answers, the business centre should decline and have the compliance officer consider a report. **Which supervisor applies:** Business centres operating in Abu Dhabi Global Market are supervised by the ADGM Registration Authority for AML purposes. **FAQs** - **Are business centres in ADGM required to register as DNFBPs?** Yes. Business centres in ADGM that provide registered office or address services are designated non-financial businesses and must comply with the ADGM AML framework. - **What due diligence is required before providing an address?** At minimum: identification and verification of the client and its beneficial owners, understanding the purpose of the company and its expected activity, and confirmation that the client is not subject to sanctions. - **Do we need to monitor ongoing use of the address?** Yes. You should monitor for signs of unusual activity, changes in ownership and any information that conflicts with what the client told you at onboarding. --- ### AML compliance for licensed commercial gaming operators in the UAE URL: https://adventant.com/sectors/commercial-gaming-operators Published: 2026-10-19 Commercial gaming is a new regulated sector in the UAE, and it brings the cash, speed and anonymity that money launderers look for. This page explains the risks and what the regulator expects of a licensed operator. **Main risk:** Deposits and play used to convert funds into winnings or refunds **Key control:** Player checks, source of funds and monitoring of deposits and withdrawals **Typical report:** Suspicious transaction reports through goAML The UAE has created a federal regulator for commercial gaming, the General Commercial Gaming Regulatory Authority, which licenses and supervises operators. Gaming is a sector with a long international history of AML problems, so operators entering the market are expected to design strong controls from the start. Gaming lets someone turn money into chips, credits or bets, play for a short time and cash out as winnings or refunds. A player who deposits a large sum, plays little and withdraws can convert illicit cash into something that looks like a lawful payout. Even real winnings can be a cover for funds that came from elsewhere. The channels matter as well. Online operators deal with players they never meet, in many countries, and with many payment methods. Physical venues deal with cash, chips and large numbers of walk-in players. Each setting needs its own controls. **Money laundering and terrorist financing risks** - **Low-play, high-deposit behaviour**: A player who deposits a large amount, plays little and withdraws is using the operator to move money and not to gamble. - **Cash and chips**: Large cash buy-ins, passing chips to others and cashing out chips bought with someone else's money obscure the origin of funds. - **Online accounts and mules**: Accounts opened under false or borrowed identities, or controlled by someone other than the named player, are a feature of online laundering. - **Collusion between players**: Players who deliberately lose to each other, or deliberately pass money through games, can move value between them. - **High rollers and politically exposed persons**: Big-spending players may include people whose wealth needs a clear explanation, including public officials. - **Payment methods**: Prepaid cards, virtual assets and third-party payments make it harder to link money to a verified player. **What supervisors expect** - A Compliance Officer or MLRO with real authority, and board-level ownership of the AML programme. - A business risk assessment covering players, products, channels, payment methods and countries. - Player due diligence at the points your licence conditions require, with stronger checks for large deposits, high spend and higher-risk players. - Source of funds checks for higher-risk players, and a refusal to pay out where the source is not understood. - Sanctions and politically exposed person screening, with documented review of matches. - Monitoring of deposits, play and withdrawals for unusual patterns, with alerts reviewed and recorded. - Reporting through goAML, staff training, record keeping and independent testing of the programme. **Red flags** - A player who deposits and withdraws with little or no play. - Deposits from accounts or cards in someone else's name. - Several accounts that share a device, address or payment method. - Chips passed between players or cashed out by someone other than the buyer. - A player who becomes upset when asked about the source of funds. - Betting that seems designed to lose, such as bets on opposing sides. **Scenario (illustration, not a real case): A large deposit, a few bets and a request to withdraw.** A new online player deposits a large sum by card, places a handful of low-risk bets and then asks to withdraw the whole balance to a different payment method. The operator's rules flag the pattern. An analyst checks that the card belongs to the player, asks about the source of funds and the reason for the withdrawal method, and holds the payout until the answers are reviewed. If the player cannot explain, the operator refuses to pay out to the new method, and the Compliance Officer considers a report. **Which supervisor applies:** Licensed commercial gaming operators in the UAE are supervised by the General Commercial Gaming Regulatory Authority. The conditions attached to your licence set out many of your duties, so read them alongside the AML framework, and ask the regulator if anything is unclear. **FAQs** - **Which regulator supervises gaming in the UAE?** Licensed commercial gaming operators are supervised by the General Commercial Gaming Regulatory Authority. The authority's licence conditions and guidance set many of the specific duties. - **When must we identify a player?** At the points set by your licence conditions and the AML rules, which can depend on the channel and the amounts involved. Many operators identify at registration and apply more checks as deposits or play increase. - **Can we pay winnings to a different account?** Supervisors generally expect payouts to go back to the player through a verified method, and treat payment to a third party or a new method as high risk. If you ever allow an exception, record why and apply extra checks. - **How do we handle problem gambling and AML together?** They are separate duties but can use the same signals. Unusual deposits or behaviour may indicate either. Make sure the teams share information within the limits of privacy rules. - **Do virtual assets create special problems?** Yes, because the funds are harder to link to a verified person. If the operator allows them, it needs additional controls such as wallet screening and strict identity checks. Follow the regulator's guidance on what is permitted. --- ## Knowledge hub explainers ### From suspicion to goAML report: the full journey URL: https://adventant.com/knowledge/from-suspicion-to-goaml-report Published: 2026-10-19 A suspicion has a route. It starts with a person on the front line, passes through your compliance officer and, where there are grounds to suspect, ends as a report to the UAE Financial Intelligence Unit (FIU) through goAML. The illustration shows who does what at each stage, where the decisions are made and where the records belong. **At a glance** - Three parties are involved: front-line staff, your compliance officer or MLRO, and the FIU. - The test for filing is suspicion, or reasonable grounds to suspect. It is not proof. - Every outcome needs a record, including a decision not to file. - Never discuss a report, or a possible report, with the customer. This is called tipping off. **Step by step** - **A concern is noticed**: A member of staff, or a monitoring alert, sees something that does not add up. The concern does not need to be proven. It only needs to be raised. - Activity that does not fit what you know about the customer. - An explanation that does not hold together. - Transactions arranged to stay below a limit. - **It is raised internally**: The concern goes to the compliance officer through an internal report form, with the facts as the person knows them. Staff should never need a manager's permission to do this, and managers should never discourage it. - **The compliance officer logs it and gathers the file**: The report is logged with a date and a reference. The officer pulls the relevant customer file, transactions and any earlier concerns, so the assessment rests on the full picture. - **Grounds to suspect are assessed**: The officer decides whether there are grounds to suspect, speaking to staff where needed and without alerting the customer. The assessment is proportionate: enough work to decide, not a full investigation. - **The decision is recorded either way**: If the officer files, the reasons are written down. If the officer decides not to file, the reasons are written down too, signed and dated. A recorded decision not to file shows that the process works. A concern that simply vanishes looks like one that was ignored. - **The report is submitted through goAML**: A good report lets a stranger follow it in two minutes. Choose the right report type: for example a suspicious transaction report for a transaction, a suspicious activity report for behaviour, and the sanctions-related reports where those apply. Check the FIU's current guidance for your sector. - Who: the customer and connected parties, with identification details. - What: the activity, with dates, amounts, accounts and counterparties. - Why it is suspicious: the specific features that do not fit. - What you did: checks made, explanations requested, decisions on the relationship. - Supporting material: documents and records attached or referenced. - **Follow-up, on both sides**: The FIU may ask for more information, and you should respond fully and on time. Your compliance officer also considers whether the relationship should continue and what extra controls now apply, then keeps the report, its confirmation and the supporting file together for the period the rules require. Five years is commonly cited, but confirm the period that applies to you. **Common mistakes** - Registering on goAML only when the first suspicion arrives. - Leaving former employees with access, or having no authorised person available. - Vague narratives such as “unusual activity noted”. - Waiting for proof before filing. - Choosing the wrong report type. - Keeping no record of decisions not to file. - Telling the customer, or anyone connected, about a report. - Ignoring follow-up requests from the FIU. **What to keep on record** - The internal report form, with date and reference. - The log of concerns received and decisions taken. - The compliance officer's assessment notes. - The signed and dated decision, with reasons. - The goAML submission confirmation. - The supporting customer file and any follow-up correspondence. --- ### The risk-based approach in one picture URL: https://adventant.com/knowledge/risk-based-approach-in-one-picture Published: 2026-10-19 A risk-based approach means your controls match the risks your business actually carries. It is not a generic checklist applied the same way to everyone. The illustration shows the whole chain on one page: the risk factors you look at, how they combine into a rating, and how the rating decides what you do. **At a glance** - Four groups of factors drive the rating: customer, geography, products and services, and delivery channels. - The same rating logic is used for the business as a whole and for each customer. - Higher risk means more checks, more senior approval and closer monitoring. Lower risk means lighter, but never none. - The rating is not fixed. It changes when the facts change. **Step by step** - **Identify the risks your business faces**: Start with a business-wide risk assessment. Look at who your customers are, where they and their money come from, what you sell and how you reach them. - Customer: type, ownership, occupation or industry, public roles. - Geography: where the customer, owners and counterparties are based. - Products and services: how easily they can move or hide value. - Delivery channels: face to face, remote, through introducers. - **Rate each factor and the controls that respond**: For each risk, consider how likely it is and how serious the effect would be, then how well your current controls reduce it. What is left after the controls is your residual risk, and that is what you need to manage. - **Rate each customer with the same factors**: At onboarding, apply the same four groups of factors to the individual customer. Write down why the customer is rated as they are, so another person can reach the same answer from the file. - **Match the controls to the rating**: The rating decides how much you do, not whether you do it. - Lower risk: lighter due diligence where the rules allow it, standard monitoring and a longer review cycle. - Medium risk: standard due diligence, regular monitoring and scheduled reviews. - Higher risk: enhanced due diligence, senior approval, closer monitoring and more frequent reviews. - **Review when risk changes**: Re-rate the customer when something changes, such as a new owner, a new product, adverse media, unusual activity or a move to a higher-risk location. Review the business-wide assessment on a schedule and when your business changes. - **Approve and record**: Senior management approves the business-wide assessment, and the approval is dated. Customer ratings, the reasons behind them and the extra approvals for higher-risk customers are kept on file. **Common mistakes** - Using one generic checklist for every customer. - Giving a rating without writing down the reason. - Rating almost every customer the same. - Treating the assessment as a one-off document that is never updated. - Rating customers as higher risk but applying no extra control. - Using a scoring model that nobody in the team can explain. **What to keep on record** - The approved, dated business-wide risk assessment. - A rating and written rationale on each customer file. - A list of higher-risk customers with the approvals given. - A log of reviews and the events that triggered them. --- ### Zero STRs does not mean zero risk URL: https://adventant.com/knowledge/zero-strs-does-not-mean-zero-risk Published: 2026-10-14 No STRs filed. Does that mean your AML controls are working? Not necessarily. A low number of Suspicious Transaction Reports (STRs) is not, on its own, evidence of effective AML compliance. The real question is whether you are identifying suspicious activity, investigating red flags and reporting when required. **At a glance** - Risk may be going undetected. Low or no STRs should prompt a review of how suspicious activity is identified. - Monitoring matters. Effective controls rely on sound judgement and meaningful transaction monitoring. - Measure effectiveness. Check whether your framework identifies and escalates suspicious activity appropriately. - A red flag is not proof of money laundering, but failing to investigate it is a compliance risk. **Step by step** - **Ask why the number is low**: A low count can be right for a lower-risk business. It can also mean staff are not spotting red flags, are not escalating them, or that monitoring is not set up to find them. Find out which. - **Know the red flags**: Red flags that should be spotted and escalated include: - Unusual investment funding. - Suspicious trading patterns. - Unusual cash transactions. - Unusual transaction structuring. - Unexplained source of funds. - Unusual property transactions. - Unexplained client funds. - Opaque ownership structures. - Inconsistent financial records. - Unusual related-party transactions. - **Check the monitoring**: Look at whether your monitoring rules or manual reviews fit the business's risks, whether alerts are reviewed, and whether the reviews show real judgement. - **Check the escalation route**: Staff should know how to raise a concern with the MLRO and feel able to do so. Count internal escalations as well as external reports: few of both is a warning sign. - **Investigate and report where necessary**: Spot the red flag, escalate it to the MLRO, investigate, and report where there are grounds to suspect. Record each decision, including decisions not to report. - **Measure effectiveness**: Test the framework periodically, for example through an independent review, sample checks of closed alerts and staff interviews. **Common mistakes** - Reading a low STR count as proof that controls are effective. - Treating a red flag as proof of laundering, or ignoring it because it is not. - Having no record of decisions not to report. - Never testing whether staff recognise the red flags for their role. **What to keep on record** - The internal escalation log, including cases not reported and why. - Alert reviews and their outcomes. - STRs filed and the supporting analysis. - Results of effectiveness testing or independent reviews. --- ### The customer looks legitimate. The transaction does not. URL: https://adventant.com/knowledge/customer-looks-legitimate-transaction-does-not Published: 2026-10-07 A clean KYC file does not always mean a clean transaction. Your customer may pass every check, but their activity can tell a different story. KYC tells you who the customer is. Transaction monitoring tells you what they are doing. **At a glance** - A verified identity does not make every transaction low risk. - Monitoring compares what the customer does with what you expected from them. - Funds that arrive and are moved on quickly, split, or sent to higher-risk places deserve a closer look. - Know your customer, and know their activity. **Step by step** - **Start from the customer profile**: KYC gives you the customer's identity, ownership, business and expected activity. That expected activity is the yardstick monitoring measures against. - **Follow the money**: The illustration shows a payment received and then moved on: part to an offshore account, then split between third parties, and some to a higher-risk jurisdiction. Each step on its own may look ordinary. Together they form a pattern. - **Know the red flags**: Signs that a transaction does not fit the customer include: - Unusual transaction patterns. - Unexpected counterparties. - Activity that does not match the customer profile. - Sudden spikes in transaction volume or value. - Frequent round-value or repetitive transactions. - Rapid movement of funds without a clear economic purpose. - Transactions involving higher-risk jurisdictions or entities. - **Review the alert**: Ask what the transaction is for, check it against the customer's profile and history, and gather any supporting information. Record what you found and your decision. - **Escalate where it is not explained**: If the activity remains unexplained, escalate to the compliance officer or MLRO, who decides whether there are grounds to report through goAML. - **Update the customer's risk**: Whatever the outcome, consider whether the customer's risk rating and expected activity still reflect reality, and update them if not. **Common mistakes** - Assuming a verified customer cannot be involved in suspicious activity. - Monitoring rules that do not reflect the business's own risks. - Closing alerts with no written rationale. - Never updating the expected activity recorded at onboarding. **What to keep on record** - Customer profiles with expected activity recorded. - Monitoring rules or scenarios and why they were chosen. - Alert reviews with their outcomes and reasoning. - Escalations to the MLRO and any reports filed. --- ### Source of wealth vs source of funds URL: https://adventant.com/knowledge/source-of-wealth-vs-source-of-funds Published: 2026-09-30 They sound similar, but they answer two different AML questions. Source of wealth asks how the customer built up their overall wealth. Source of funds asks where the specific money used in a transaction came from. Understanding both is essential for effective KYC, CDD and ongoing monitoring. **At a glance** - Source of wealth: how a person accumulated their overall wealth. The focus is long-term financial history. - Source of funds: the origin of the specific funds used in a transaction. The focus is short-term and transaction-specific. - Both should be plausible and consistent with each other and with what you know about the customer. - How much evidence you need depends on the customer's risk. **Step by step** - **Ask the right question**: Source of wealth: how did this customer come to have what they own? Source of funds: where did the money for this particular transaction come from, and how did it reach you? - **Source of wealth: typical origins**: Common explanations for overall wealth include: - Business ownership. - Employment income. - Investments. - Inheritance. - **Source of funds: typical origins**: Common explanations for the money in a transaction include: - A bank account held by the customer. - Salary. - Sale proceeds, such as from a property or a business. - An investment redemption. - **Check that the story holds together**: The funds for a transaction should make sense against the customer's overall wealth. A modest salary and a large cash purchase, for example, need an explanation that can be supported. - **Scale the evidence to the risk**: For lower-risk customers, a reasonable explanation may be enough. For higher-risk customers, including PEPs, you would expect supporting documents such as bank statements, sale agreements or company accounts. - **Record and revisit**: Record what the customer told you, what evidence you saw and your conclusion. Revisit it when the customer's activity or profile changes. **Common mistakes** - Treating source of wealth and source of funds as the same thing. - Accepting a one-word answer such as 'business' or 'savings' for a higher-risk customer. - Collecting documents without checking that they support the explanation. - Not linking the funds in a transaction back to the customer's known wealth. **What to keep on record** - Recorded source of wealth and source of funds explanations on the customer file. - Supporting documents for higher-risk customers. - A note of how the reviewer assessed plausibility. - Updates made when the customer's profile or activity changed. --- ### Your AML manual is up to date. But is your business actually compliant? URL: https://adventant.com/knowledge/aml-manual-up-to-date-but-compliant Published: 2026-09-23 An AML manual is only the starting point. It tells your team what to do. Real compliance means putting those policies into action every day, and being able to prove that you did. An AML manual sets the rules. Implementation proves compliance. **At a glance** - Eight areas turn a manual into practice: KYC verification, CDD, screening, monitoring, reporting, training, testing and evidence. - Supervisors look at what you do, not only at what your manual says. - Each policy should have a matching process, an owner and a record. - Regular testing shows whether the controls work as written. **Step by step** - **KYC verification and CDD**: Identify and verify every customer and their beneficial owners, understand the purpose of the relationship and rate the risk, exactly as your manual describes. - **Screening**: Screen customers against sanctions and PEP lists at onboarding and on an ongoing basis, and resolve possible matches with a recorded decision. - **Monitoring**: Monitor customer activity against what you expect from them, and review alerts promptly. Monitoring that nobody reviews is not a control. - **Reporting**: Make sure staff know how to raise a concern, that the compliance officer or MLRO reviews it, and that reports are filed where there are grounds to suspect. - **Training**: Train staff on the manual and on the red flags that apply to their role, and keep attendance and assessment records. - **Testing and evidence**: Test the controls regularly, through internal checks or an independent review, and keep the evidence. If it is not documented, it is hard to show that it happened. **Common mistakes** - Buying or copying a manual that does not match how the business works. - Updating the manual but not the processes and systems behind it. - No named owner for each control. - Training once at joining and never again. - Keeping no record of checks, so nothing can be shown at inspection. **What to keep on record** - The approved, dated AML manual and its review history. - Customer files that follow the manual's CDD steps. - Screening, monitoring and reporting records. - Training logs and the results of control testing. --- ### Your customer passed KYC. So why is the payment still blocked? URL: https://adventant.com/knowledge/passed-kyc-but-payment-blocked Published: 2026-09-18 Passing KYC does not always mean a payment will go through. KYC checks the customer. Cross-border payments face further compliance checkpoints along the way, at your bank, at correspondent banks and at the receiving bank. It is not just about the customer. It is about the whole payment journey. **At a glance** - KYC is the beginning, not the end, of the checks a payment faces. - Sanctions screening, country risk, correspondent bank checks and transaction risk indicators can each stop a payment. - Enhanced due diligence may be needed for higher-risk payments. - Clear, complete payment information and good records help payments move. **Step by step** - **KYC checks the customer**: Onboarding establishes who the customer is, who owns and controls them, and what business they do. That is the base for everything that follows, but it does not approve each payment. - **Sanctions screening**: Each payment can be screened for the parties, banks, vessels and places involved. A possible match, even a false one, can hold the payment until it is cleared. - **Country and jurisdiction risk**: Payments to or through higher-risk jurisdictions may face extra questions or restrictions, depending on each bank's policy and the rules that apply to it. - **Correspondent bank checks**: Cross-border payments often pass through one or more correspondent banks. Each applies its own controls and can ask for more information before it lets the payment through. - **Transaction risk indicators**: Banks look at whether the payment fits the customer's known activity: the amount, the purpose, the counterparty and the pattern. Something unusual can trigger a review. - **Enhanced due diligence where required**: Higher-risk payments may need more: supporting documents, an explanation of the purpose, or evidence of source of funds. Having these ready shortens delays. **Common mistakes** - Assuming a customer who passed KYC will never face payment checks. - Sending payments with vague or missing purpose information. - Not keeping invoices and contracts ready for bank queries. - Ignoring repeated payment holds instead of asking what is causing them. **What to keep on record** - Complete KYC and beneficial ownership records. - Supporting documents for significant or unusual payments. - Sanctions screening results and how possible matches were cleared. - Records of bank queries and the responses given. --- ### Cleared yesterday. Still clear today? URL: https://adventant.com/knowledge/pep-screening-is-not-a-one-time-check Published: 2026-09-16 A customer's risk profile can change. Someone who was not a Politically Exposed Person (PEP) at onboarding may become one later, or new information may change how you see them. That is why PEP screening is a continuing control, not a box ticked once. **At a glance** - Day one: the customer is screened and no PEP match is found. - Later: a new position, new exposure or new information can change the picture. - Ongoing screening picks up the change so you can review the customer's risk. - A change in PEP status should lead to a fresh risk assessment and the controls that match it. **Step by step** - **Screen during customer onboarding**: Check the customer, and where relevant their beneficial owners and authorised signatories, against PEP data before the relationship starts. Record the result and how any possible matches were resolved. - **Conduct ongoing screening**: Re-screen the customer base on a regular cycle and whenever your PEP data is updated. People are appointed, elected and promoted all the time, so a clear result last year says little about today. - **Monitor changes in PEP status and risk**: Watch for events that can change a customer's position. - A new public role or appointment. - A close family member or close associate becoming a PEP. - Adverse media or other new information. - A change in ownership or control of a corporate customer. - **Review the customer's risk assessment**: When a customer is identified as a PEP, re-rate them. Apply the enhanced measures your policy requires, such as senior management approval, establishing source of wealth and source of funds, and closer monitoring. - **Resolve possible matches properly**: Name matches are common. Use date of birth, nationality and other identifiers to confirm or discount a match, and write down how you reached the decision so another person could follow it. - **Keep the record**: Keep the screening results, the reviews they triggered and the approvals given. This is how you show a supervisor that screening is continuous, not a one-off. **Common mistakes** - Screening only at onboarding and never again. - Discounting possible matches without recording the reason. - Screening the customer but not the beneficial owners. - Identifying a new PEP but leaving the old risk rating in place. - Not knowing when the screening data was last updated. **What to keep on record** - Onboarding screening results for each customer. - Records of ongoing screening runs and the alerts they produced. - Updated risk assessments for customers whose status changed. - Senior management approvals for PEP relationships. --- ### Could ordinary trade payments hide money laundering? URL: https://adventant.com/knowledge/trade-based-money-laundering-red-flags Published: 2026-09-09 Trade-based money laundering (TBML) uses import and export transactions that look legitimate to disguise and move illicit funds. The paperwork can look perfectly normal. The risk sits in the gap between what the documents say and what really happened to the goods and the money. **At a glance** - TBML hides illicit money inside real or invented trade, so the proceeds appear to come from legitimate business. - The usual levers are the invoice value, the quantity, the quality or type of goods, the shipping documents, the route and who pays. - No single document proves TBML. The warning signs appear when you compare documents with each other and with what you know about the customer. - Customer due diligence, transaction monitoring, document checks and risk assessment work best together. **Step by step** - **Understand how TBML works**: Value is moved across borders by misdescribing trade. A buyer may pay far more than goods are worth, or far less, so that value shifts between the parties without anyone sending an obvious transfer. - **Know the methods**: Criminals use one or more of these approaches to make illicit money look like the proceeds of normal trade. - Invoices: overstating or understating the value of goods. - Quantity: reporting more or fewer goods than were shipped. - Quality: misrepresenting the type or grade of the products. - Shipping documents: creating differences between the paperwork and the actual shipment. - Trade routes: sending goods or money through complex or unnecessary jurisdictions. - Mode of payment: unexplained payments from or to third parties. - **Check the documents against each other**: Compare the invoice, the contract, the bill of lading or airway bill and the payment. Prices, quantities, descriptions, parties and dates should agree. Where they do not, ask why and record the answer. - **Check the trade against the customer**: The goods, volumes, counterparties and routes should make sense for the customer's business as you understood it at onboarding. A sudden new product line, a new region or a new trading partner deserves a question. - **Monitor the payments**: Look at who pays and who is paid. Payments from parties that are not part of the trade, split payments, or funds routed through unrelated jurisdictions are common signs that the trade is cover for something else. - **Escalate and record**: When something does not add up and the explanation does not resolve it, escalate it to your compliance officer or MLRO. They decide whether there are grounds to report, and the reasoning is kept on file. **Common mistakes** - Reviewing each document on its own and never comparing them. - Accepting a price without any sense of the normal market value of the goods. - Ignoring third-party payments because the customer explained them once. - Treating trade finance and logistics as outside the scope of AML checks. - Closing an alert without recording why the explanation was accepted. **What to keep on record** - Customer due diligence files that describe the expected trade activity. - Records of document checks, including any differences found and how they were resolved. - Monitoring alerts on trade payments and the outcome of each review. - Escalations to the compliance officer or MLRO and the decisions taken. --- ## Frequently asked questions ### AML basics Page: https://adventant.com/faqs#aml-basics The law, who it covers and the ideas behind it. **Q: What does AML compliance involve for a UAE business?** A: Depending on your activities, AML compliance includes checking customers and their ownership, assessing risks, monitoring transactions and reporting suspicious activity. Your business also needs appropriate procedures, employee training and records of the checks carried out. **Q: Which UAE law sets the AML rules?** A: The primary law is Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and illegal organisations, as published on the Ministry of Economy and Tourism's AML page. Each supervisor then issues its own rules and guidance for the firms it regulates, so the detailed requirements depend on your regulator. Check the current official texts, as they are updated. **Q: Does AML compliance apply to every UAE business?** A: Not in the same way. The rules apply to specific kinds of business, mainly financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers. Whether you are covered depends on your licence and what you actually do. If you are unsure, ask your licensing authority or take advice. **Q: Who counts as a DNFBP?** A: DNFBP stands for designated non-financial businesses and professions. It covers sectors such as real estate agents and developers, dealers in precious metals and stones, lawyers and notaries, accountants and auditors, corporate service providers and commercial gaming operators, and in ADGM some other businesses such as business centres. Whether a particular business is covered depends on its activities, so confirm with your supervisor. **Q: Do free zone companies have to follow UAE AML rules?** A: Yes. The law applies across the UAE, including free zones. What changes is the supervisor: for example the DFSA in the DIFC, the ADGM FSRA for financial firms in ADGM and the ADGM Registration Authority for DNFBPs there. Free zones that are not financial centres are generally supervised by the same bodies as the mainland. Check your licence. **Q: What is a risk-based approach?** A: It means your controls match the risks your business actually carries, rather than one checklist applied the same way to everyone. You look at your customers, geography, products and delivery channels, rate the risk, and apply stronger checks where the risk is higher and lighter ones where it is lower, with the reasoning written down. **Q: Which UAE regulator supervises my business?** A: It depends on your licence and activities. Financial institutions are generally supervised by the CBUAE, DFSA, ADGM FSRA or the CMA, while many DNFBPs fall under the Ministry of Economy and Tourism or the Ministry of Justice. Gaming operators are supervised by the GCGRA. We can help confirm which framework applies to you. --- ### goAML registration and reporting Page: https://adventant.com/faqs#goaml Registering with the FIU and what you report through it. **Q: What is goAML?** A: goAML is the online reporting platform of the UAE Financial Intelligence Unit (FIU). Businesses with reporting duties use it to submit reports such as suspicious transaction reports. Registering gives your business, and the named people who file for it, access to the platform. **Q: Who needs to register on goAML?** A: Businesses that have reporting obligations to the FIU need to register. That generally includes regulated financial institutions, DNFBPs and virtual asset service providers. Whether you must register depends on your activities and your supervisor, so confirm the position with them. **Q: Is goAML registration enough to make my business compliant?** A: No. Registering on goAML gives your business access to the UAE Financial Intelligence Unit's reporting platform. You must still carry out the AML duties that apply to your activities, including customer checks, monitoring and recordkeeping. **Q: What do I need before I register on goAML?** A: Typically your licence details, the people who will act as users, including the compliance officer or MLRO, and supporting documents set by the FIU. The exact requirements change, so follow the FIU's current registration guidance. Adventant can help prepare the registration, including user and role set-up. **Q: Who should be the goAML users in my business?** A: The roles should reflect who prepares reports and who approves them. The compliance officer or MLRO is usually central, because they decide whether a report is filed. Agree roles and responsibilities before you register so that nothing depends on one person being available. **Q: What reports are filed through goAML?** A: Suspicious transaction and suspicious activity reports are the main ones. Depending on your sector and supervisor, other reports can apply as well, for example for certain high-value cash transactions in some DNFBP sectors. Check which reports apply to your business. **Q: Can Adventant prepare our goAML reports?** A: Yes, we support goAML registration and regulatory reporting. The decision whether to report stays with your appointed compliance officer or MLRO, and responsibilities are agreed before we start. External support does not remove your business's own responsibility. --- ### MLRO and compliance officer Page: https://adventant.com/faqs#mlro Who must be appointed and what outsourcing allows. **Q: What does an MLRO do?** A: The Money Laundering Reporting Officer (MLRO) oversees the AML programme, receives internal concerns, decides whether a report should go to the FIU and is the main contact for the supervisor. The exact duties depend on the rules that apply to your sector. **Q: Does my business need an MLRO or compliance officer?** A: Regulated businesses are generally expected to appoint a compliance officer or MLRO with enough seniority, time and independence to do the job. The exact requirement differs by regulator and licence, so confirm it with yours. **Q: Can the MLRO role be outsourced?** A: Sometimes. Some firms may appoint an external officer, while others, such as certain firms regulated by the Central Bank, the DFSA, the ADGM FSRA or the CMA, may be required to keep the role in-house. Your regulator decides, so confirm before you outsource. **Q: Can you support our existing compliance officer or MLRO?** A: Yes. Adventant can assist with customer file reviews, policy updates and reporting preparation. Responsibilities are agreed before starting, including the decisions that remain with your appointed officer. External support does not remove your business's responsibility for meeting its AML obligations. **Q: Can a director or senior employee act as MLRO?** A: Possibly, but supervisors look at independence, available time and expertise. A person with heavy commercial targets or many other roles can create conflicts. If you combine roles, record how the conflicts are managed and check your supervisor's expectations. **Q: Does the MLRO have to be based in the UAE?** A: Requirements on location differ by regulator and licence. Supervisors expect the MLRO to be reachable, able to act promptly and accountable. Check your own regulator's requirement before you make the appointment. **Q: Who is responsible if the MLRO role is outsourced?** A: Your business and its senior management. Outsourcing a task or a role does not transfer responsibility for meeting your AML obligations. An outsourced officer supports your compliance but does not replace your own oversight. --- ### KYC and customer due diligence Page: https://adventant.com/faqs#kyc Knowing your customer, from onboarding to review. **Q: What is KYC and customer due diligence?** A: Know your customer (KYC) and customer due diligence (CDD) mean identifying who your customer is, verifying it, understanding why they want the relationship and checking the risk they pose, both at the start and as the relationship continues. **Q: What do I collect from an individual customer?** A: Generally proof of identity, where they live, the purpose of the relationship and, for higher-risk customers, the source of funds and wealth. The exact documents depend on the rules that apply to you and on the customer's risk rating. **Q: What do I collect from a company customer?** A: Generally its registration details, who owns and controls it, who is authorised to act for it, the nature of its business and the purpose of the relationship. You also need to identify the people who ultimately own or control the company. **Q: When is enhanced due diligence needed?** A: For higher-risk situations, such as politically exposed persons, high-risk countries, complex structures or unusual activity. It means deeper checks, usually senior approval, and closer ongoing monitoring than you apply to standard-risk customers. **Q: Can I use simplified due diligence?** A: Only where the rules allow it and your risk assessment supports it, with the reasoning recorded. It never removes sanctions screening or the duty to report suspicion. If anything changes or looks unusual, move back to full checks. **Q: What is the difference between source of funds and source of wealth?** A: Source of funds is where the money for a particular transaction or relationship comes from. Source of wealth is how the customer built their overall wealth. Higher-risk customers often need both explained and supported by evidence. **Q: How often should customer files be reviewed?** A: According to risk. Higher-risk customers are reviewed more often and standard-risk customers less often. You should also review when something changes, such as a new owner, a new country of activity or unusual behaviour. Set the schedule out in your policy and follow any period your regulator requires. **Q: What if a customer will not provide the information I ask for?** A: The rules generally expect you not to open or continue the relationship until due diligence is complete, and to consider whether the refusal itself is a reason to report. Take care not to tip off the customer. Record what you asked for and what happened. --- ### Beneficial ownership Page: https://adventant.com/faqs#beneficial-ownership Finding the real people behind a company. **Q: What is a beneficial owner?** A: A natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. A company is not the end of the trail. Your due diligence has to reach the people behind it. **Q: Is there an ownership percentage that makes someone a beneficial owner?** A: The rules set an ownership level at which a person counts, and the level depends on the rules that apply to you. Check the current level and definitions with your supervisor, then apply them consistently across your customer files. **Q: Does ownership percentage decide everything?** A: No. A person can control a customer without owning much of it, for example through voting rights, the power to appoint directors or influence exercised informally. Both ownership and control should be considered. **Q: How do I trace ownership through layers of companies?** A: Keep going until you reach people. Where a company owns part of the customer, get the same information for that company and continue upward, multiplying the stakes along each path. For example, 60% of a holding company that owns 50% of the customer is an effective 30% stake. **Q: Is a signed declaration from the customer enough?** A: A declaration is a starting point, not verification. Take reasonable steps to check it against documents or independent sources, and record what you relied on. **Q: What if nobody reaches the ownership level?** A: Look at control by other means first. If you still cannot identify an individual, record the steps you took and escalate. Depending on the rules that apply, you may need to treat a senior managing official as the beneficial owner, so confirm this with your supervisor. **Q: Why do nominee shareholders matter?** A: A nominee holds shares for someone else, so the nominee is not the beneficial owner. You need to find out who the nominee acts for and treat the arrangement as a higher-risk feature of the customer. --- ### Sanctions and PEP screening Page: https://adventant.com/faqs#sanctions-pep Checking names, handling matches and PEP risk. **Q: What is sanctions screening?** A: Checking your customers, their beneficial owners and relevant counterparties against the sanctions lists your obligations require, at onboarding and on an ongoing basis, and acting properly on any match. **Q: Which sanctions lists do I need to screen against?** A: The lists your obligations and risk require. In the UAE these include the lists published through the Executive Office for Control and Non-Proliferation, and other lists may apply to your risk. Check current official guidance for the exact lists. **Q: Who is a politically exposed person (PEP)?** A: Someone who holds or has held a prominent public function, such as a senior role in government, the judiciary, the military or a state-owned company. Family members and close associates are usually covered too, because they can be used to hold assets. **Q: What extra checks apply to PEPs?** A: Typically senior management approval, a clear understanding of the source of wealth and funds, and enhanced ongoing monitoring. A PEP is not automatically a refusal, but the extra checks and the decision should be recorded. **Q: What should I do if I find a confirmed sanctions match?** A: A confirmed match means freezing without delay, not tipping off, and reporting through the channels set out in current official guidance. Do not wait for the next routine review, and escalate to your compliance officer straight away. **Q: How often should screening be done?** A: At onboarding and then on an ongoing basis, including when sanctions lists change and when customer details change. A one-off check at the start of a relationship is not enough. **Q: What is a false positive and how do I handle it?** A: A hit that looks like a match because the names are similar but is not the same person. Compare other details such as date of birth, nationality and identification numbers, record why you cleared the hit, and escalate anything you cannot resolve. **Q: Can screening be outsourced?** A: Yes. Adventant provides outsourced screening and customer monitoring. As with any outsourcing, your business remains responsible for the outcome and for the decisions that are made. --- ### Transaction monitoring and suspicious reports Page: https://adventant.com/faqs#monitoring-reporting Spotting unusual activity and reporting it properly. **Q: What is transaction monitoring?** A: Reviewing customer activity against what you know about the customer, so that unusual or inconsistent behaviour is noticed, looked into and, where needed, reported. It runs for as long as the relationship does. **Q: What counts as suspicious activity?** A: Activity that does not fit what you know about the customer, has no clear economic purpose, or matches known red flags. The test is reasonable grounds to suspect, not proof. If you have grounds to suspect, you escalate. **Q: When must I file a suspicious transaction report (STR)?** A: When you have grounds to suspect that funds or activity are linked to money laundering, terrorist financing or a related offence. The report goes to the FIU through goAML. Check your sector rules for timing, and do not hold a report back while you gather more evidence. **Q: What is tipping off?** A: Warning the customer, or anyone connected to them, that a report has been made or is being considered. The law prohibits it. Keep reports and the reasons for them confidential and limit who is told. **Q: Who decides whether to file a report?** A: Your compliance officer or MLRO, after staff escalate their concern internally. The decision and the reasons should be recorded whether or not a report is filed. **Q: Can I report after the transaction has already happened?** A: Suspicion can arise after a transaction, and when it does you should escalate straight away and report promptly if the grounds exist. Record why and when the suspicion arose, and speak to your MLRO rather than waiting. **Q: What red flags should monitoring look for?** A: Examples include activity that does not match the customer's profile, payments split to stay under thresholds, funds moved quickly in and out, unexplained third-party payments, reluctance to explain a transaction and complex ownership with no clear purpose. **Q: Do I need transaction monitoring software?** A: The rules do not name a tool. A small business with low volumes may use documented manual reviews, while higher volumes usually need a system. What matters is that monitoring is effective for your risk, is documented and is actually followed. --- ### Policies, risk assessment, training and records Page: https://adventant.com/faqs#policies-training The documents and routines supervisors ask to see. **Q: Do I need a written AML policy?** A: Regulated businesses are generally expected to have written policies, controls and procedures that suit their business and are approved by senior management. A generic template that does not reflect what you actually do is a common weakness. **Q: What is a business risk assessment?** A: A documented assessment of how your business could be misused for money laundering or terrorist financing, looking at your customers, products, countries and delivery channels. It drives the controls you put in place and should be kept up to date. **Q: How often should we review our AML policies?** A: Review them regularly and whenever a relevant change occurs, such as new regulatory requirements, changes to your services or updated customer ownership information. Customer review schedules should reflect risk. Follow any specific review periods required by your regulator. **Q: How long do I have to keep AML records?** A: The rules set a minimum period. Five years is commonly cited, but confirm the period that applies to you with your supervisor. Keep customer due diligence records, transaction records, reports and training records so they can be produced on request. **Q: Who needs AML training and how often?** A: Staff whose roles touch customers, transactions or compliance, when they join and then regularly. Training should be tailored to the role and attendance should be recorded. Follow any specific frequency set by your regulator. **Q: What should AML training cover?** A: Your own firm's risks and procedures, how to spot red flags, how and when to escalate, tipping off, sanctions and recent changes in the rules. Practical examples from your business work better than generic slides. **Q: Do I need an independent AML review or audit?** A: Many supervisors expect the AML programme to be tested periodically by someone independent of those who run the controls. How often depends on your size, risk and regulator, so confirm the requirement that applies to you. --- ### Inspections, penalties and enforcement Page: https://adventant.com/faqs#inspections-penalties What supervisors check and what happens if you fall short. **Q: What happens in an AML inspection?** A: A supervisor typically asks to see your policies, risk assessment, customer files, screening and monitoring records, training records and reports, and may interview staff. Findings can lead to required remediation and, in some cases, penalties. **Q: What can a supervisor do if my business falls short?** A: The law provides for administrative penalties and supervisors can also require remediation. Penalty levels depend on the rules and the breach, so check the current official texts rather than relying on figures quoted online, which vary. **Q: Can directors or the MLRO be held personally responsible?** A: Supervisors expect senior management to own AML compliance. Whether and how individuals can be personally liable depends on the law and the facts, so take legal advice on personal exposure rather than relying on a general answer. **Q: How do I prepare for an inspection?** A: Keep your policies, risk assessment, customer files, screening and monitoring records, training records and reports organised and current. A mock review before the supervisor arrives shows you the gaps while there is still time to fix them. **Q: What is an independent AML compliance review?** A: A review by someone independent of the day-to-day controls that tests whether your AML programme is designed properly and works in practice, and reports findings and fixes. Adventant provides independent AML compliance reviews. **Q: Does being a small business reduce my AML obligations?** A: Your controls can be proportionate to your size and risk, but the obligations do not disappear. A small business should still assess its risks, know its customers, screen, keep records and report suspicion, and should write down its reasoning. --- ### Industry and regulator questions Page: https://adventant.com/faqs#sector-questions Real estate, gold, professions, virtual assets and free zones. **Q: Do real estate agents and developers have AML duties?** A: Yes, real estate is a DNFBP sector. High-value cash and similar transactions have had to be reported, with a threshold of AED 55,000, but always confirm the current figure with your supervisor or the FIU. Who supervises you depends on where you are registered and licensed. **Q: Do dealers in gold, precious metals and stones have AML duties?** A: Yes. They are DNFBPs and, on the mainland and in free zones that are not financial centres, are generally supervised for AML by the Ministry of Economy and Tourism. Reporting duties for certain transactions can apply, so confirm the current rules. **Q: Do lawyers and accountants have AML duties?** A: Yes, where they carry out the activities the rules cover. The supervisor depends on location: for example the Ministry of Justice for lawyers and notaries onshore, the Ministry of Economy and Tourism for accountants onshore, and the DFSA or the ADGM Registration Authority in the DIFC and ADGM. **Q: Who supervises commercial gaming operators?** A: The General Commercial Gaming Regulatory Authority (GCGRA) supervises commercial gaming operators. Confirm the rules that apply to your licence category with it. **Q: Which AML rules apply to virtual asset service providers?** A: VASPs are covered by the AML framework, and the supervisor depends on the licence: the CBUAE, the DFSA, the ADGM FSRA or the CMA, depending on where the firm is licensed and what it does. Check your licence to confirm which regulator applies. **Q: How do the DIFC and ADGM differ from the mainland?** A: Each financial centre has its own regulator and rulebook: the DFSA in the DIFC, and the ADGM FSRA and ADGM Registration Authority in ADGM. Onshore firms follow the Central Bank, the CMA, the Ministry of Economy and Tourism or the Ministry of Justice, depending on the sector. The UAE-wide law applies to all of them. **Q: I am not sure which category my business falls into. What should I do?** A: Start with your licence and a list of what your business actually does, then ask your licensing authority which supervisor applies. Adventant can help you confirm the framework that applies to your activities. --- ### Working with Adventant Page: https://adventant.com/faqs#working-with-adventant What we do, who we help and how to start. **Q: What AML services does Adventant provide?** A: Eleven services: an outsourced MLRO service; governance support for in-house MLROs; operational outsourcing of screening, risk assessment and ongoing monitoring; independent AML reviews and audits; regulatory inspections, gap assessments and remediation; goAML registration and regulatory reporting, including EOCN subscription and semi-annual reports; grievance filing for fine waivers; enterprise-wide risk assessments (EWRA); AML/CFT/CPF policies and procedures; AML training and awareness programmes; and implementation of TruDiligent AML software. **Q: Which businesses does Adventant work with?** A: UAE businesses supervised by the Central Bank, the DFSA, the CMA, the ADGM FSRA and Registration Authority, the Ministry of Economy and Tourism, the Ministry of Justice and the GCGRA, including DNFBPs and virtual asset businesses. **Q: Is Adventant a law firm?** A: No. Adventant is a Dubai-based compliance advisory firm. The information on this site is general guidance and not legal advice. For a legal opinion on your position, take advice from a lawyer. **Q: How much do Adventant's services cost?** A: It depends on what you need, including your activities, regulator, number of customers and the level of support. Get in touch and we will discuss your situation before anything is agreed. **Q: How do I get started?** A: Use the contact page for our WhatsApp, telephone and email details. Tell us what your business does and which regulator supervises you, and we will talk through the support that fits. --- ## Guides ### CBUAE AML/CFT Rulebook: Summary and Full PDF URL: https://adventant.com/guides/cbuae-aml-cft-rulebook Published: 2026-10-23 What the Central Bank's AML/CFT Rulebook covers, how it is organised, and a downloadable copy of the full rulebook for UAE financial institutions. **What this rulebook is** The AML/CFT Rulebook of the Central Bank of the UAE (CBUAE) sets out the anti-money laundering and counter-terrorist-financing obligations for the financial institutions it supervises, such as banks, exchange houses, finance companies, insurance firms and payment providers. It is published as a web rulebook on the CBUAE site rather than as a single file. To make it easier to read offline and share internally, we have compiled the full section into one PDF. The Central Bank remains the source and the authority; our copy is a convenience, not an official publication. **What the rulebook contains** Federal Decree-Law No. (10) of 2025 on anti-money laundering and combating the financing of terrorism and illegal organisations, which is the primary law. Cabinet Resolution No. (134) of 2025 containing the Executive Regulations, which set out how the law is applied in practice. The CBUAE Procedures, together with the Board of Directors' decision that brought them into effect. The AML/CFT guidance for licensed financial institutions, organised into Part I Overview, Part II Identification and Assessment of ML/FT Risks, Part III Mitigation of ML/FT Risks, Part IV Administration and Reporting, and Part V Appendices. Specific guidance on suspicious transaction reporting, on implementing targeted financial sanctions, and annexes with red-flag indicators and goAML rules. **How to use it** Use the rulebook to check the exact wording of an obligation, to brief a compliance officer or MLRO, or to support an internal policy. The articles are numbered, so you can refer to a specific requirement directly. Because rulebooks are amended, treat this PDF as a point-in-time copy. Before you rely on any text for a filing or a decision, confirm the current version on the CBUAE Rulebook site. **Who it applies to** This rulebook applies to institutions licensed and supervised by the Central Bank. Firms supervised by other UAE authorities, such as the DFSA, the ADGM FSRA, the SCA, the Ministry of Economy and Tourism, the Ministry of Justice or the GCGRA, follow their own rulebooks. If you are unsure which authority supervises you, Adventant can help you confirm it. Download: [CBUAE AML/CFT Rulebook (PDF)](/downloads/cbuae-aml-cft-rulebook.pdf) (Full rulebook, 651 pages, 6.5 MB. Source: the CBUAE Rulebook, retrieved 23 October 2026.) --- ### ADGM AML and Sanctions Rulebook: Summary and PDF URL: https://adventant.com/guides/adgm-fsra-aml-sanctions-rulebook Published: 2026-10-23 What the ADGM FSRA's Anti-Money Laundering and Sanctions Rulebook requires of firms in Abu Dhabi Global Market, with the full official rulebook to download. **What this rulebook is** The Anti-Money Laundering and Sanctions Rulebook (AML) is issued by the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM). It sets out the AML, counter-terrorist-financing and sanctions obligations for relevant persons operating in ADGM. This is the ADGM's own published rulebook, offered here as a downloadable copy. The FSRA remains the source and the authority. **What the rulebook covers** The scope and application of the rules, and the money laundering reporting officer and compliance arrangements a relevant person must have in place. Business risk assessment, customer risk assessment and the customer due diligence measures that follow, including enhanced due diligence for higher-risk situations. Ongoing monitoring, suspicious activity reporting, sanctions compliance and targeted financial sanctions, record-keeping, training and the FSRA's supervisory approach. **Who it applies to** The rulebook applies to relevant persons regulated by the ADGM FSRA. Firms in the DIFC follow the DFSA's module, and firms supervised onshore by the Central Bank, the SCA or a federal ministry follow their own rulebooks. Adventant can help you confirm which framework applies to you. **How to use it** Use it to check the exact wording of an ADGM requirement, to brief an MLRO, or to support an internal policy. Because rulebooks are amended, confirm the current version on the ADGM website before relying on any text for a filing or a decision. Download: [ADGM AML and Sanctions Rulebook (PDF)](/downloads/adgm-aml-sanctions-rulebook.pdf) (Official rulebook, 105 pages, 0.8 MB. Source: ADGM Financial Services Regulatory Authority, version 11.21, retrieved 23 October 2026.) --- ### DFSA AML, CTF and Sanctions Module (PDF) URL: https://adventant.com/guides/dfsa-aml-ctf-sanctions-module Published: 2026-10-23 What the DFSA's consolidated AML, Counter-Terrorist Financing and Sanctions Module requires of DIFC firms, with the full official module to download. **What this module is** The Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML) is part of the DFSA Rulebook and applies to firms and other relevant persons in the Dubai International Financial Centre (DIFC). The PDF is the DFSA's consolidated version of the module, offered here to download. The DFSA states that the consolidated version is a documentation tool with no legal effect, and that the authentic versions are those published on the DFSA website. The DFSA remains the source and the authority. **What the module covers** Application and the appointment and responsibilities of the Money Laundering Reporting Officer, together with the governance and systems and controls expected of a relevant person. The business risk assessment, customer risk assessment, customer due diligence and enhanced due diligence requirements, and reliance on third parties. Ongoing monitoring, suspicious activity reporting to the UAE Financial Intelligence Unit, sanctions and targeted financial sanctions compliance, record-keeping and training. **Who it applies to** The module applies to relevant persons regulated by the DFSA in the DIFC. Firms in ADGM follow the FSRA's rulebook, and onshore firms follow the Central Bank, SCA or the relevant federal ministry. Adventant can help you confirm which framework applies to you. **How to use it** Use it to check the exact wording of a DFSA requirement, to brief an MLRO, or to support an internal policy. Confirm the current version and the authentic rulemaking instruments on the DFSA website before relying on any text for a filing or a decision. Download: [DFSA AML, CTF and Sanctions Module (PDF)](/downloads/dfsa-aml-ctf-sanctions-module.pdf) (Official module, 78 pages, 1.1 MB. Source: DFSA, version 30/04-26, consolidated version, retrieved 23 October 2026.) --- ### GCGRA Commercial Gaming AML Policy Paper (PDF) URL: https://adventant.com/guides/gcgra-commercial-gaming-policy-paper Published: 2026-10-23 The GCGRA's policy paper on strengthening AML and CFT standards in the UAE's commercial gaming sector, with the full paper to download. **What this paper is** The Commercial Gaming Policy Paper is published by the General Commercial Gaming Regulatory Authority (GCGRA), the body that regulates the UAE's commercial gaming sector. It sets out strategic recommendations for strengthening anti-money laundering and counter-terrorist-financing (AML and CFT) standards in that newly established sector. This is the GCGRA's own document, offered here to download. It is a policy paper, meaning it sets direction and recommendations rather than binding rules. The GCGRA remains the source and the authority. **What the paper covers** The existing legal framework and AML/CFT provisions for commercial gaming in the UAE, alongside international standards, the FATF recommendations and comparable regulatory models. The key money laundering and terrorist financing risks in gaming, including anonymous transactions, exploitation of player accounts, third-party payments, foreign-jurisdiction transactions, multiple payment methods, VIP and high-value players, employee complicity and cash transactions. Targeted mitigation approaches for each risk, and recommendations such as completing a sectoral ML/TF risk assessment, closer coordination between regulators, and stronger due diligence, monitoring, controls and training for gaming operators. **Who it is relevant to** The paper is relevant to gaming operators and service providers in the UAE commercial gaming sector supervised by the GCGRA. Firms supervised by other UAE authorities follow their own frameworks. Adventant can help you confirm which authority supervises you and what it expects. **How to use it** Use it to understand how the GCGRA is approaching financial crime risk in gaming and the direction of travel for the sector. Because it is a policy paper, read it alongside any binding regulations the GCGRA issues, and check the GCGRA website for the current materials before relying on any text. Download: [GCGRA Commercial Gaming Policy Paper (PDF)](/downloads/gcgra-commercial-gaming-policy-paper.pdf) (Policy paper, 24 pages, 0.8 MB. Source: General Commercial Gaming Regulatory Authority, 2025, retrieved 23 October 2026.) --- ### CMA AML/CFT Guidance for Capital Markets (PDF) URL: https://adventant.com/guides/cma-amlcft-guidance-capital-market-sector Published: 2026-10-23 The CMA's AML and CFT guidance for the UAE capital market sector, with the full guidance document to download. **What this is** This is the AML/CFT Guidance for the Capital Market Sector, published by the UAE Capital Markets Authority (CMA), formerly the Securities and Commodities Authority (SCA). It sets out how the authority expects the firms it licenses to meet their anti-money laundering and counter-terrorist-financing obligations. The CMA does not publish a single consolidated rulebook as a file. This guidance is the authority's own substantive AML document for the sector, offered here to download. The CMA remains the source and the authority. **What the guidance covers** A risk-based approach to AML and CFT, business and customer risk assessment, and the customer due diligence and enhanced due diligence measures expected of licensed firms. Sanctions and targeted financial sanctions screening, ongoing monitoring, suspicious transaction and activity reporting to the UAE Financial Intelligence Unit, record-keeping, governance and training. **Who it is relevant to** The guidance is relevant to firms licensed by the CMA in the UAE capital market sector. Firms in the DIFC or ADGM follow the DFSA or FSRA, and firms supervised by the Central Bank or a federal ministry follow their own frameworks. Adventant can help you confirm which authority supervises you. **How to use it** Use it to understand what the CMA expects and to support your own policies and procedures. Because guidance and the related circulars are updated over time, check the CMA website for the current materials before relying on any text for a filing or a decision. Download: [CMA AML/CFT Guidance for the Capital Market Sector (PDF)](/downloads/cma-amlcft-guidance-capital-market-sector.pdf) (Guidance document, 19 pages, 2.2 MB. Source: the Capital Markets Authority (formerly SCA), September 2021, retrieved 23 October 2026.) --- ### UAE AML Law 2025: Decree-Law No. 10 (PDF) URL: https://adventant.com/guides/moet-uae-aml-law-2025 Published: 2026-10-23 The UAE's primary AML law, Federal Decree-Law No. 10 of 2025, as published on the Ministry of Economy and Tourism AML page, to download. **What this is** This is Federal Decree-Law No. (10) of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing, the UAE's primary AML law. It is published on the Ministry of Economy and Tourism (MoET) AML page, offered here to download. The MoET supervises designated non-financial businesses and professions (DNFBPs) in the UAE under this law. The MoET and the federal government remain the source and the authority. **What the law covers** The definitions and the money laundering, terrorist financing and proliferation financing offences, together with provisional measures, investigation and confiscation. The Financial Intelligence Unit, national coordination, supervisory authorities and administrative penalties, preventive measures and beneficial ownership, international cooperation and the final provisions. **Who it applies to** The law applies across the UAE. The MoET supervises DNFBPs under it, such as real estate agents, dealers in precious metals and stones, and company service providers. Financial institutions are supervised by the Central Bank, and firms in the DIFC or ADGM by the DFSA or the FSRA. Adventant can help you confirm who supervises you. **How to use it** Use it to check the exact wording of the law. The MoET also issues Executive Regulations, ministerial decrees and circulars for the businesses it supervises, so read this alongside those, and check the MoET page for the current materials before relying on any text for a filing or a decision. Download: [Federal Decree-Law No. 10 of 2025 on AML/CFT (PDF)](/downloads/moet-uae-aml-law-2025.pdf) (Federal law, 35 pages, 0.2 MB. Source: the Ministry of Economy and Tourism AML page, 2025, retrieved 23 October 2026.) --- ### goAML Registration in the UAE: A Practical Guide URL: https://adventant.com/guides/goaml-registration-guide Published: 2026-10-13, updated 2026-10-29 What goAML is, who needs to register, and how to prepare so your registration and later reporting go smoothly. goAML is the reporting platform of the UAE Financial Intelligence Unit (FIU). Businesses supervised for AML purposes use it to submit suspicious transaction and activity reports and, depending on their sector, other report types. This guide covers what to prepare, how registration fits into your wider AML programme, and what to have in place once you are registered. **Who needs to register** Financial institutions and designated non-financial businesses and professions (DNFBPs) that are subject to UAE AML law are expected to register on goAML so that they can report to the FIU when required. Your supervisor's guidance confirms what applies to your licence. Registration should happen before you need to file a report, not when a suspicion arises. **What to prepare before you start** - A valid trade licence and the entity's registration details. - Details of the appointed compliance officer or MLRO, who normally acts as the main reporting contact. - Identity documents for the people who will hold user accounts. - A clear decision on who holds each role in the system, so access matches your internal responsibilities. - Any authorisation letter or supporting documents the FIU requests during the process. - A working business email address that will be monitored, since FIU messages arrive through the platform and by email. The registration screens and document requirements are set by the FIU and can change, so check the current instructions on the FIU's goAML pages before you begin. **How the process usually runs** 1. Create the organisation's registration on the goAML portal and enter the entity details. 2. Register the compliance officer as the primary user and upload the requested documents. 3. Wait for the FIU to review and approve the request, and respond promptly to any query. 4. Once approved, add any further users your procedures need, with the right level of access. **Common reasons for delay** - Details that do not match the trade licence exactly. - Missing or unclear supporting documents. - A compliance officer whose appointment has not been formally made or notified. - Nobody checking the mailbox where FIU queries are sent. **Registration is the start, not the finish** Being registered does not, on its own, satisfy your AML obligations. What matters is being able to recognise a suspicion and report it properly. Before you need goAML in earnest, make sure: - Staff know how to escalate a concern internally, and to whom. - The compliance officer or MLRO reviews each escalation and records the decision and reasons, including decisions not to report. - Supporting information, such as customer due diligence, transaction records and the analysis behind the suspicion, is kept and easy to retrieve. - Everyone understands that the customer must not be told a report is being considered or has been made. **Other report types** Besides suspicious transaction and activity reports, some sectors file other report types through goAML, for example reports for real estate activity or certain cash transactions in precious metals and stones, and sanctions name match reports. Our [goAML reporting guide](https://adventant.com/blog/goaml-reporting-guide-uae) explains each report type, when to file and what a good report contains. **Before your first report** Do a dry run. Ask the compliance officer to walk through a mock case: what triggered the concern, what was checked, what the decision was and what would go into the report. It shows quickly whether the right information is being captured at the front line and whether anyone else could file if needed. **Keep access working** Review user accounts when people join or leave, keep the compliance officer's details up to date, and make sure more than one person knows how to file if the main user is unavailable. Hold credentials securely: shared logins and passwords kept on paper are a common finding in reviews. Our illustrated explainer [from suspicion to goAML report](https://adventant.com/knowledge/from-suspicion-to-goaml-report) walks through the whole reporting journey, and our [goAML reporting guide](https://adventant.com/blog/goaml-reporting-guide-uae) covers choosing and writing reports. If you would like help with registration or reporting, see our [goAML registration and reporting service](https://adventant.com/services/goaml-registration-regulatory-reporting). --- ### Customer Due Diligence Checklist for UAE Firms URL: https://adventant.com/guides/customer-due-diligence-checklist Published: 2026-10-13, updated 2026-10-28 A simple sequence for onboarding a new customer on a risk-based basis, from identification to ongoing review. Customer due diligence (CDD) is how you find out who you are dealing with, why they want your services and how much risk they bring. This checklist follows the order most UAE businesses use when they onboard a new customer. Treat it as a working sequence, not a substitute for your own procedures or your supervisor's guidance. **1. Identify the customer** Collect the basic identity details before anything else. What you need depends on whether the customer is an individual or an entity. - Individuals: full name, date of birth, nationality, identity document details and residential address. - Legal entities: registered name, legal form, licence or registration number, registered address and principal place of business. - Anyone acting on the customer's behalf: who they are and what authority they hold, such as a power of attorney or a board resolution. **2. Verify what you have been told** Identification is what the customer says. Verification is checking it against reliable, independent sources. For individuals that usually means a valid passport or Emirates ID. For entities it means the trade licence, the memorandum and articles of association, and the register of shareholders and directors. Keep copies, note who checked them and when, and record anything that did not match. **3. Understand ownership and control** For any entity, work out who ultimately owns or controls it. Follow the ownership chain through holding companies and trusts until you reach the natural persons at the top. Identify and verify each beneficial owner who meets the ownership or control test in your rules, and record the structure, ideally as a simple chart on the file. If no one meets the ownership test, identify who exercises control by other means, and failing that the senior managing official. **4. Understand the purpose of the relationship** Ask what the customer wants from you and what activity you should expect: the products or services, the likely volumes and values, the countries involved and how they will pay. This expected profile is what you later monitor against, so make it specific enough to be useful. **5. Screen the customer and related parties** - Sanctions lists, including the UAE Local Terrorist List and the UN Consolidated List. - Politically exposed persons (PEPs), their family members and close associates. - Adverse media that suggests involvement in financial crime. Screen the customer, the beneficial owners and the people authorised to act. Record how each possible match was resolved and who decided. Our insight on [why PEP screening is not a one-time check](https://adventant.com/knowledge/pep-screening-is-not-a-one-time-check) explains why this continues after onboarding. **6. Assess and rate the risk** Combine what you have learned about the customer, their geography, the product and the delivery channel into a risk rating, and write down the reasons. Another member of staff should be able to read the file and reach the same rating. The [risk-based approach in one picture](https://adventant.com/knowledge/risk-based-approach-in-one-picture) shows how these factors fit together. **7. Apply enhanced due diligence where the risk is higher** Higher-risk customers, including PEPs and customers linked to higher-risk countries, need more than the standard checks. Typical measures are: - Establishing [source of wealth and source of funds](https://adventant.com/knowledge/source-of-wealth-vs-source-of-funds), with supporting evidence. - Senior management approval before the relationship starts or continues. - Closer ongoing monitoring and more frequent reviews. Where your rules allow simplified due diligence for lower-risk customers, record why the customer qualifies. Simplified never means none. **8. Decide, and know when to stop** If you cannot complete CDD, for example because the customer will not explain their ownership or the documents do not hold together, do not start the relationship or carry out the transaction. Consider whether the circumstances are suspicious and should be escalated to your compliance officer or MLRO for a possible report through goAML. **9. Monitor and review** Due diligence is not a one-off. Monitor activity against the expected profile, re-screen as lists change, and review the customer file on a cycle set by the risk rating. Also review it when something changes, such as new owners, a new product or an unusual transaction. **10. Keep the records** Keep the identification and verification documents, the risk assessment, screening results and review notes for the period the law requires, in a form you can retrieve quickly for an inspection. > **Common gaps** Beneficial owners identified but not verified. Risk ratings with no reasons. Expected activity left blank. Files never reviewed after onboarding. Possible screening matches closed without a note. Need help putting this into practice? See our [risk assessment](https://adventant.com/services/business-customer-risk-assessments) and [screening and monitoring](https://adventant.com/services/outsourced-screening-customer-monitoring) services. --- ### How to Prepare for an AML Audit in the UAE URL: https://adventant.com/guides/preparing-for-independent-aml-review Published: 2026-10-13, updated 2026-10-28 An independent review tests whether your controls work in practice. Here is how to be ready for one. An independent AML review, sometimes called an AML audit, tests whether your AML programme is suitable for your business and whether it works in practice. It is carried out by someone who is not responsible for running the controls being tested. Preparing well does not mean polishing the paperwork. It means making sure what you do matches what your policies say, and that you can show it. **What a reviewer looks at** - Governance: who is accountable, how senior management oversees AML, and how the compliance officer reports. - The business-wide risk assessment: whether it reflects your actual customers, products, countries and channels, and whether it is current and approved. - Policies and procedures: whether they match the law, your supervisor's guidance and how the business really operates. - Customer due diligence: a sample of customer files, checked against your own procedures. - Screening and monitoring: how alerts are generated, reviewed, escalated and closed. - Suspicious activity reporting: the internal escalation route, the MLRO's decisions and goAML submissions. - Training, record-keeping and how previous findings were fixed. **Step 1: Confirm the scope and the timetable** Agree in writing what period the review covers, which entities and business lines are in scope, and what the reviewer will need from you. Name one person internally to coordinate requests, so documents arrive quickly and consistently. **Step 2: Assemble the core documents** - The approved AML policy and procedures, with version history. - The business-wide risk assessment and evidence of senior management approval. - The compliance officer's appointment and any supervisor notifications. - Management information and compliance reports to senior management. - Training materials, attendance records and assessment results. - Previous review or inspection findings and the remediation tracker. **Step 3: Test your own files first** Pick a small sample of customer files across different risk ratings and check them yourself. Are identity documents verified and in date? Are beneficial owners identified? Is there a written reason for each risk rating? Did higher-risk customers get enhanced due diligence and the required approval? Fixing a pattern you find now is far better than having it reported as a finding. **Step 4: Check that alerts and escalations are documented** Reviewers often sample closed screening and monitoring alerts. Each one should show what was reviewed, the conclusion and who made it. Look at your internal escalation log too, including cases the MLRO decided not to report and the reasons. A very low number of escalations is something a reviewer will ask about, as our insight on [why zero STRs does not mean zero risk](https://adventant.com/knowledge/zero-strs-does-not-mean-zero-risk) explains. **Step 5: Brief the people who will be interviewed** Reviewers usually speak to the compliance officer and to front-line staff. The aim is not to rehearse answers but to make sure people know the procedures that apply to their role, the red flags they should spot and how to raise a concern. **Step 6: Be candid about known gaps** If you already know something is weak, say so and show the plan to fix it. A known, tracked issue with an owner and a date is treated very differently from one the reviewer discovers on their own. **After the review** Expect a report that rates each finding by severity and recommends actions. Turn it into a remediation plan with an owner and a deadline for each action, report progress to senior management, and keep evidence of every fix. That evidence is what a supervisor will want to see at the next inspection. > **A useful test** Could you show a supervisor, within a day, the evidence that each control in your AML policy actually operates? If not, that is where to start. Adventant carries out [independent AML reviews](https://adventant.com/services/independent-aml-compliance-review) and helps firms close the findings through [regulatory inspection and remediation support](https://adventant.com/services/regulatory-inspections-remediation). --- ## Blog ### How to Choose an Outsourced MLRO or Compliance Officer in the UAE URL: https://adventant.com/blog/how-to-choose-an-outsourced-mlro-uae Published: 2026-10-14 Choose an outsourced MLRO or Compliance Officer by testing four things in order: that your supervisor allows the arrangement, that the person has the seniority and independence to challenge your management, that they will genuinely be available when you need them, and that the contract states who owns each task. Price comes last, because a cheap arrangement that fails a review is the most expensive option. **Key takeaways** - Confirm with your supervisor first that outsourcing the role is acceptable for your licence category, and keep the answer in writing. - Look for sector experience and a record of well-documented decisions, not just a certificate. - Ask exactly who will act for you, how much time they will give you and what happens when they are unavailable. - Put a written scope in place that separates what the outsourced officer does from what your management must still own. - Judge the arrangement after 90 days on evidence: the files, reports and decisions it has produced. **Why businesses outsource the compliance officer role** Most regulated businesses need someone who can own the anti-money laundering programme day to day: approve difficult onboarding decisions, review alerts, decide whether a suspicion should be reported and answer questions from the supervisor. For a small or growing firm, a full-time senior hire for that role can be hard to justify, hard to recruit and hard to cover when the person is on leave. That is the case for outsourcing. You get access to someone who has done the work before, on a basis that matches the size of your business. The risk is that the arrangement becomes a name on a form. A compliance officer who is never available, never challenges anything and never produces a record is not protection. It is a liability with a monthly invoice attached. One point is worth stating plainly before anything else. Outsourcing the task does not outsource the accountability. Your board or owners remain responsible for the business having an effective programme. A good outsourced officer makes that responsibility easier to carry. A poor one hides it until a review exposes it. **Step 1: Check what your supervisor allows** Rules on who may act as Compliance Officer or MLRO differ by sector and by supervisor. Some supervisors expect the role to sit with an approved individual inside the firm. Some allow outsourcing of specific tasks but not of the appointment itself. Others permit an external appointment under conditions such as approval of the individual, a written agreement and proof of access to records. Nobody can responsibly tell you which applies without knowing your licence category. So start there. Read the guidance from your supervisor, then ask them directly if anything is unclear. Keep the reply. If you are not sure who supervises you, the [regulator pages](https://adventant.com/industries) on this site set out the main authorities and the types of firm each one covers, but confirm the position for your own licence before you commit to a provider. > **Do this before you compare providers** Providers will happily quote for an arrangement your supervisor may not accept. Settle what is permitted first, so you only compare options that are actually open to you. **Step 2: Judge seniority, independence and sector fit** The compliance officer is expected to be senior enough to say no. That is the test to apply to every candidate. Look at the following. - **Relevant experience.** Has the person handled your type of business, such as payments, investment firms, real estate, precious metals or advisory firms? Risks, red flags and reporting duties differ, and a generalist will spend your money learning them. - **Decisions on record.** Ask how they document a decision to onboard a high-risk customer, to clear a screening alert or to report a suspicion. You are looking for a method that produces a readable file, not for confidence. - **Independence.** The officer should be free to escalate to your board without needing permission from the commercial team. Ask how conflicts are handled when a sale and a compliance concern point in opposite directions. - **Understanding of the regime.** They should explain, in plain language and without reciting jargon, how your business risk assessment drives your controls and how the supervisor is likely to approach your firm. - **Willingness to disagree.** In a first conversation, a good candidate will ask uncomfortable questions about your customers and your sales process. If they only agree with you, they will do the same in a review. **Step 3: Understand availability and cover** Availability is where outsourced arrangements most often disappoint. An officer who looks after many clients may be genuinely excellent and still be unable to answer your urgent question until tomorrow. That is not always a problem, but you need to know it in advance and design around it. Ask for specifics: how many hours a month are included, how quickly urgent matters are acknowledged and answered, who covers during leave and whether that person is named in the contract. Ask how many other clients the individual serves and whether any compete with you or share customers with you. Dependence on one individual is also a risk. If that person leaves the provider, what happens to your arrangement and to your records? (Image: Two professionals shaking hands over a signed agreement in front of a laptop) **Step 4: Get the scope in writing** Most disputes about outsourced compliance come from silence in the contract. Both parties assume the other will handle something, and nobody does. The table below shows a sensible starting split. Adjust it to your supervisor's rules and your own structure, but make sure every item has an owner. | Area | Typically the outsourced officer | Typically your management | | --- | --- | --- | | Business risk assessment | Leads the assessment, challenges assumptions, recommends controls | Provides accurate information on customers, products and channels; approves the result | | Onboarding decisions | Reviews high-risk and escalated cases; records the rationale | Collects documents on time; does not onboard against a refusal | | Screening and monitoring | Reviews escalated alerts and signs off decisions | Runs the day-to-day process; keeps tools and lists up to date | | Suspicious activity reporting | Assesses internal reports and decides whether to file | Ensures staff report concerns promptly; never discourages a report | | Training and awareness | Designs content and tracks completion | Releases staff for training; enforces attendance | | Regulator contact | Prepares responses and attends where permitted | Remains accountable and approves what is submitted | | Records | Specifies what must be kept and for how long | Stores records securely and keeps them accessible | Also settle access. The officer needs timely access to customer files, transaction information and staff. If getting that access requires three emails and a week, the arrangement will not work however good the person is. **Questions to ask before you sign** 1. Which supervisors and licence categories have you worked with, and which are you not suitable for? 2. Who exactly will act for us, and can we meet that person before we commit? 3. How many hours a month are included, and what happens if we need more? 4. Who covers during leave, and are they named in the agreement? 5. How do you record decisions, and can we see an example with the client details removed? 6. What do you do when you disagree with our management, and to whom do you escalate? 7. What happens to our records and files if the engagement ends? 8. What is outside the scope, and how are those items priced? **Red flags to walk away from** - A guarantee that you will pass an inspection or avoid action. Nobody can honestly promise that. - Unwillingness to name the individual who will act for you. - A fee that looks too low for the volume of work. Something will give, and it is usually the documentation. - A template pack with your name inserted and no questions about how your business really operates. - Reluctance to put the scope and responsibilities in writing. - No view on what your supervisor expects, or an assumption that all supervisors expect the same thing. (Image: Three advisers talking through a plan on a sofa in a modern office) **Pricing models: what you are actually buying** Providers usually price in one of three ways. A fixed monthly retainer gives you predictable cost and a defined number of hours or activities. Time and materials charges for the hours used, which suits irregular needs but can surprise you. A hybrid combines a smaller retainer with additional charges for defined events such as an onboarding backlog or an inspection. Whatever the model, compare like with like. Ask what the fee includes and what it does not. Regulatory reporting, remediation of old customer files, training sessions and attendance at supervisor meetings are the items most often priced separately. A lower headline fee with several add-ons can cost more than a higher all-inclusive one. We have deliberately not quoted figures in this article: the right price depends on your size, your customer base and your risk, and you should be wary of anyone quoting before they understand them. **Your first 90 days with an outsourced officer** A good arrangement starts with a diagnostic, not with paperwork. A sensible shape for the first three months looks like this. - **Month one: understand and assess.** The officer reviews your licence, customers, products and channels, reads your existing policies and samples customer files. You receive a short list of gaps ranked by risk. - **Month two: fix what matters most.** Update the business risk assessment, tighten onboarding for higher-risk customers, set escalation rules and agree how alerts and suspicions are recorded. - **Month three: establish a rhythm.** Start regular reporting to management, run first training sessions and test that records can be produced quickly on request. If the first 90 days produce only a policy manual, be cautious. Policies matter, but the evidence that a programme works is in the files, the decisions and the reports. **How to tell whether it is working** Review the arrangement after three months and then at least annually, against evidence rather than impressions. Useful questions include whether the business risk assessment is current and used, whether high-risk onboarding decisions have a recorded rationale, whether screening alerts are cleared with reasons, whether suspicious activity concerns reach the officer quickly, whether staff have been trained and whether you could hand a regulator a complete file tomorrow. An independent review by someone other than the officer is a sensible check once a year. **Where Adventant fits** Adventant provides [outsourced Compliance Officer and MLRO services](https://adventant.com/services/outsourced-compliance-officer-mlro) where an external appointment is permitted, and [specialist support for an in-house officer](https://adventant.com/services/compliance-officer-mlro-support) on defined tasks where it is not. We can also carry out an [independent AML compliance review](https://adventant.com/services/independent-aml-compliance-review) of an existing arrangement. If you want to talk through which model suits your licence, use the form below and we will take it from there. This article is general information, not legal advice. **FAQs** - **Can I outsource my MLRO or Compliance Officer in the UAE?** It depends on your licence category and your supervisor. Some supervisors expect the role to be held by an approved individual inside the firm, some allow specific tasks to be outsourced, and some allow an external appointment under conditions. Confirm the position with your supervisor before you engage a provider and keep the answer in writing. - **Does outsourcing transfer my legal responsibility?** No. Your board or owners remain accountable for having an effective AML programme. An outsourced officer helps you meet that responsibility but does not take it over. - **How much time should an outsourced officer give my business?** It depends on your size, customer volume and risk. Ask for an agreed number of hours, a stated response time for urgent matters and a named deputy for periods of leave. Treat a vague answer as a warning sign. - **What should the contract include?** At minimum: the named individual and deputy, a scope that lists what the officer does and what your management still owns, access to records and staff, response times, escalation routes, fee structure with exclusions, confidentiality, what happens to records at the end, and how the arrangement is reviewed. - **How do I know the arrangement is working?** Look for evidence: a current business risk assessment, documented decisions on high-risk customers, screening alerts cleared with reasons, regular reporting to management, completed training and records you could produce on request. An annual independent review gives a second view. --- ### How to Write an AML Business Risk Assessment That Stands Up to Review URL: https://adventant.com/blog/how-to-write-an-aml-business-risk-assessment-uae Published: 2026-10-14 An AML business risk assessment is a written, firm-wide judgement of how your business could be used for money laundering or terrorist financing, and how well your controls reduce that risk. Build it in six steps: gather facts, identify risk factors across customers, products, geographies and channels, rate inherent risk, test your controls to reach residual risk, agree actions, then document, approve and keep it current. **Key takeaways** - The assessment is about your whole business, not individual customers. It is the foundation that every other control should trace back to. - Start from your own data on customers, products, countries and channels. Generic templates produce generic, unconvincing results. - Rate risk before controls, then rate controls honestly. The gap that remains is the residual risk you must manage or accept. - Every material finding needs an action, an owner and a date, or the document is just a report. - Review it when your business changes, not just once a year. **What a business risk assessment is, and what it is not** The business risk assessment, often shortened to BRA, is your firm's own analysis of where it is exposed to money laundering and terrorist financing and how well it is protected. It looks at the business as a whole: the customers you serve, the products and services you offer, the places you operate or deal with, the channels through which you deliver and the transactions that follow. It is not the same as the risk rating you give an individual customer at onboarding. That is a customer risk assessment, and it comes after. The business assessment is the layer above, and it should shape how the customer-level rating works. If your assessment says that customers from a particular sector or region are your highest exposure, your onboarding procedure should treat them differently, and a reviewer should be able to see the link. **Why reviewers start here** Supervisors and independent reviewers commonly begin with the business risk assessment because it tells them whether the rest of the programme makes sense. If you cannot explain your risks, you cannot justify your controls. Policies that are heavy where risk is low and light where it is high suggest that the programme was copied rather than designed. A risk-based approach is a simple idea with a demanding consequence. You are expected to put more effort where the risk is higher and less where it is lower, and to be able to show your reasoning. The assessment is where that reasoning lives. Detailed requirements vary by sector and supervisor, so read the guidance that applies to your licence and use this article as a method, not as a rulebook. **Step 1: Gather the facts about your business** Write down what you actually do before you judge any risk. Pull together the data that describes your business as it stands today, rather than as it was when you were licensed. - Your business lines, products and services, including any new ones planned. - Your customer base: how many, what types (individuals, companies, trusts, foundations), how many are non-resident, how many are politically exposed persons and how many arrive through introducers. - The countries your customers, their owners and their counterparties are connected to. - How you meet customers: face to face, remotely, through agents or through other regulated firms. - How money moves: cash, bank transfer, cards, virtual assets, third-party payments, and the typical value and frequency. - Who does what inside the firm, which functions are outsourced and which tools you rely on. If a number is unknown, say so and note how you will find it. An honest gap in the data is better than a confident guess, and it often turns out to be your first action. **Step 2: Identify the risk factors** Group your analysis under the standard headings so it is easy to follow and easy to challenge: customers, products and services, geographies, delivery channels and, where relevant, transactions. The table gives examples of what tends to push risk up or down. Treat it as a prompt, not a checklist, and add factors specific to your sector. | Factor | Tends to raise risk | Tends to lower risk | | --- | --- | --- | | Customers | Complex ownership, cash-intensive activity, politically exposed persons, customers who are hard to verify, introduced business with limited access to the customer | Long-standing, well-understood customers, transparent ownership, regulated or listed entities, simple purpose of relationship | | Products and services | Fast or anonymous value transfer, high-value portable goods, products that can obscure ownership, new or untested offerings | Simple, low-value, traceable products with clear economic purpose | | Geographies | Links to jurisdictions with weak controls, high corruption, sanctions exposure or active conflict, and unexplained cross-border flows | Links to jurisdictions with strong, well-supervised regimes and clear transparency | | Delivery channels | Non-face-to-face onboarding without strong verification, reliance on agents or intermediaries, third-party payments | Direct relationships, verified in person or through robust digital checks | | Transactions | Large cash, rapid in-and-out movement, payments that do not fit the customer's profile, round-sum or structured payments | Predictable activity consistent with the customer's known business | (Image: A laptop showing charts next to a notebook and a mug on a desk) **Step 3: Rate the inherent risk** Inherent risk is the level of exposure before you take your controls into account. For each risk you identified, judge two things: how likely it is that the business could be used in that way, and how serious the consequences would be if it were. A simple three-level scale of low, medium and high is enough for most small and medium firms. More levels create the appearance of precision without improving the decision. Define each level in a sentence so that two different people would rate the same risk the same way. Write down the reason for every rating, however short. A page where every line says medium is a warning sign for a reviewer, because most businesses have a few risks that are clearly higher than the rest. If everything is medium, you probably have not decided anything. **Step 4: Test your controls and reach residual risk** For each material risk, list the controls that address it: onboarding checks, screening, monitoring, training, approval levels, restrictions on certain customers or products, record-keeping and reporting. Then judge whether each control exists, whether it is applied in practice and whether it works. Sampling a handful of customer files or alerts will tell you more than reading your own procedure. Residual risk is what remains once you account for the controls. A high inherent risk with strong, tested controls may be acceptable at a moderate residual level. A medium inherent risk with weak or untested controls can be more worrying than it looks. Be candid in this step. Rating your controls generously defeats the purpose and is easily exposed when someone else looks at your files. **Step 5: Agree the actions and your risk appetite** The assessment must lead somewhere. For each risk whose residual level you are not comfortable with, record an action, an owner and a date. Typical outcomes include tightening onboarding for a customer segment, adding a monitoring rule, restricting a product, improving training or deciding to stop serving a type of customer altogether. Add a short statement of risk appetite: the kinds of business you will accept, accept with enhanced measures, or decline. This turns an analysis into a decision tool, and it gives your sales team a clear line to work within. (Image: A planning board covered in coloured notes sorted into columns) **Step 6: Document, approve and keep it alive** Write the assessment so that a competent stranger could follow it: the date, the scope, the data used, the reasoning behind each rating and the action plan. Have senior management or the board approve it, and record that approval. Keep a version history so you can show how your view changed and why. Then treat it as a working document. Review it at least once a year and whenever something significant changes. Typical triggers include a new product or delivery channel, entry into a new market, a change in customer mix, a merger or acquisition, a major incident or a change in the rules or supervisory guidance. A business risk assessment that was accurate on the day of your licence application and has not been touched since is out of date. **An illustration: a small corporate services provider** The following example is hypothetical and not drawn from any real client. It shows how the steps fit together. A small firm sets up and administers companies for overseas owners. Gathering facts shows that most customers are non-resident, about a fifth have layered ownership and many arrive through introducers. The firm rates customers as high inherent risk, delivery channels as high because of introducers it has never met the owners of, and products as medium. Testing controls, the firm finds that identity checks on direct customers are strong, but beneficial ownership evidence for introduced customers is thin and screening of owners behind corporate shareholders is inconsistent. Residual risk for introduced customers stays high. The actions are to require direct verification of ultimate owners, to re-screen the introduced customer base and to set a rule that unverified owners mean no onboarding. Each action has an owner and a date, and management signs the document. **Common mistakes** - **Copying a template.** A generic assessment with your name on it will not reflect your risks, and a reviewer will see that quickly. - **Ignoring your own data.** Ratings with no numbers behind them are opinions. - **Rating everything medium.** It avoids hard decisions and tells a reviewer nothing. - **Not linking to controls.** If the assessment never changes a procedure, it is not working. - **Leaving it on the shelf.** An assessment that is never updated stops describing the business. - **Giving it to one person.** The people who run customer onboarding, sales and operations should contribute, or the document will miss real risks. **Where Adventant fits** Adventant prepares and updates [business and customer risk assessments](https://adventant.com/services/business-customer-risk-assessments) matched to your licence, products and customers, and links them to your [AML policies and procedures](https://adventant.com/services/aml-policies-procedures) so the controls follow the risks. If you have an assessment already, an [independent review](https://adventant.com/services/independent-aml-compliance-review) can test whether it holds up. Use the form below to start a conversation. This article is general information, not legal advice. **FAQs** - **What is the difference between a business risk assessment and a customer risk assessment?** The business risk assessment looks at the whole firm: its customers, products, geographies and channels in aggregate. A customer risk assessment rates one customer at onboarding and during the relationship. The business assessment should inform how customer ratings are designed. - **How often should a business risk assessment be updated?** Review it at least annually and whenever something significant changes, such as a new product, a new market, a change in customer mix, an acquisition, or a change in rules or supervisory guidance. - **Who should approve the assessment?** Senior management or the board should approve it, and the approval should be recorded. The Compliance Officer or MLRO usually leads the work, but accountability sits with the firm's leadership. - **Is a template enough?** A template can give you a structure, but it cannot supply your data or your reasoning. An assessment is convincing only when its ratings are tied to facts about your own customers, products, countries and channels. - **What do reviewers usually criticise?** Common criticisms are ratings with no stated reasons, an assessment that does not change any control, controls rated more generously than the evidence supports, and a document that has not been updated as the business changed. --- ### goAML Reporting in the UAE: STRs, SARs and Common Mistakes URL: https://adventant.com/blog/goaml-reporting-guide-uae Published: 2026-10-14, updated 2026-10-29 goAML is the online platform of the UAE Financial Intelligence Unit (FIU) through which regulated businesses submit reports such as suspicious transaction and suspicious activity reports. To report well, know which report types apply to your sector, file promptly when you have grounds to suspect rather than waiting for proof, write a clear narrative with supporting detail, keep a record of every decision including decisions not to file, and never tell the customer. **Key takeaways** - Have goAML access working before you need it. Our registration guide covers the steps; this article covers what happens after. - The reports available depend on your sector. Check which ones apply to you in the FIU's current guidance. - File a suspicion report when you have grounds to suspect, not when you have proof, and do it promptly. - A good report is specific: who, what, when, how and why it looks suspicious, with the evidence attached. - Keep a record of every escalation and decision, including the ones that end with no report. **What goAML reporting covers** goAML is the reporting system run by the UAE Financial Intelligence Unit. Regulated businesses use it to send the FIU the reports the law and supervisory guidance require. Financial institutions report through it, and so do designated non-financial businesses and professions such as real estate agents, dealers in precious metals and stones, company service providers, accountants, auditors and legal professionals, together with other categories such as virtual asset service providers. This article is about reporting: choosing the right report, deciding when to file and writing a report that stands up to review. Registration has to be in place first. If your business is not registered yet, or your users are out of date, start with our [goAML registration guide](https://adventant.com/guides/goaml-registration-guide). **The reports you may need to file** goAML supports several report types. Which ones are open to you depends on your type of entity, so confirm against the FIU's current guidance for your sector. The table lists those most commonly discussed and what each is for. | Report | What it is for | Who typically uses it | | --- | --- | --- | | STR (suspicious transaction report) | A suspicion that a transaction, or an attempted transaction, may involve proceeds of crime or terrorist financing | Reporting entities across sectors | | SAR (suspicious activity report) | A suspicion based on behaviour or activity, where no transaction has taken place or the concern is not tied to a single transaction | Reporting entities across sectors | | CNMR (confirmed name match report) | A confirmed match against the UAE Local Terrorist List or the UN Consolidated List, reported after the required freezing measures. It replaced the earlier funds freeze report | Any entity that confirms a match and freezes | | PNMR (partial name match report) | A possible match against those lists that cannot be confirmed or ruled out, with the relationship or transaction suspended while it is reviewed | Any entity that cannot clear a potential match | | REAR (real estate activity report) | Reporting of defined real estate transactions | Real estate agents, brokers and developers | | DPMSR (dealers in precious metals and stones report) | Reporting of defined transactions by dealers | Dealers in precious metals and stones | The thresholds and conditions attached to the sector-specific reports are set out in official guidance and can change. Build the current rules into your procedure and check them periodically, rather than relying on memory. **Choosing the right report type** - **A transaction or an attempt:** if the concern centres on a payment, transfer or purchase, including one that was attempted or declined, it is usually an STR. - **Behaviour without a transaction:** if the concern is about conduct, such as a customer who walks away when asked for source of funds, or information that does not add up before any money moves, it is usually a SAR. - **A sanctions match:** CNMR and PNMR cover the UAE Local Terrorist List and the UN Consolidated List only. A hit on another list, such as OFAC, EU or UK lists, is handled under your own sanctions policy, and you then consider separately whether it gives grounds for a suspicion report. - **A sector report:** REAR and DPMSR are triggered by the defined conditions for your sector, not by suspicion. Meeting the conditions means filing, even when nothing looks wrong. - **Not sure:** record the facts, the options you considered and why you chose one, and check the FIU's current guidance. A reasoned choice is easier to defend than a guess. **When to file a suspicion report** The test is suspicion, or reasonable grounds to suspect, not proof. You are not expected to investigate a customer, establish that a crime has happened or be certain. You are expected to notice that something does not add up, to look at it with proportionate care and to report promptly if it still concerns you. Waiting for certainty is a common reason reports are late. Staff should know that they can raise a concern internally without needing a manager's permission, and managers should never discourage a report. The compliance officer then assesses the concern, decides whether to file and records the reasoning either way. The law prohibits tipping off, which means warning the customer, or anyone connected, that a report has been made or is being considered. Check the precise wording and exceptions with your adviser or supervisor, and make sure every member of staff understands the basic rule: do not discuss it with the customer. (Image: A laptop and loose papers on a wooden desk, ready for a file review) **What a good report contains** The FIU receives a great many reports. The ones that help are specific, coherent and supported. Structure your narrative so a stranger can follow it in two minutes. 1. **Who:** the customer and any connected parties, with identification details and their relationship to your business. 2. **What:** the activity or transaction in question, including dates, amounts, currencies, accounts and counterparties. 3. **Why it is suspicious:** the specific features that do not fit, such as activity inconsistent with the customer's profile, an explanation that does not hold, or structuring to avoid thresholds. 4. **What you did:** checks already made, explanations requested and any decision about the relationship. 5. **Supporting material:** the documents and records that back the narrative, attached or referenced. Avoid vague wording such as “unusual activity noted”. Say what was unusual and why it matters. Equally, avoid padding the report with every fact you hold. Clear, relevant detail is more useful than volume. **From alert to report: a process that works** 1. A member of staff or a monitoring alert raises a concern through an internal report form, with the facts as they know them. 2. The compliance officer logs it with a date and reference and gathers the relevant file. 3. The officer assesses whether there are grounds to suspect, speaking to staff where needed, and without alerting the customer. 4. The decision to file or not to file is recorded with its reasoning, signed and dated. 5. If filing, the report is completed and submitted promptly through goAML and the confirmation is kept. 6. The officer considers whether the relationship should continue and what extra controls apply, then follows up on any request from the FIU. Step four is the one most often missing. A recorded decision not to file, with clear reasons, is evidence that your process works. A concern that vanished without a record looks, to a reviewer, like a concern that was ignored. **A final check before you submit** - Could someone outside your business follow the narrative without calling you? - Do the dates, amounts and names match your own records exactly? - Is it the right report type for what you found? - Are the supporting documents attached or clearly referenced? - Is the decision record signed and dated, and kept with the file? - Has knowledge of the report stayed with the people who need to know? **Mistakes that cause trouble** - **No working access.** If nobody can log in when a suspicion arises, the report is late before it starts. Keep users current, as set out in the [registration guide](https://adventant.com/guides/goaml-registration-guide). - **Vague narratives.** A report that cannot be understood without calling you is a weak report. - **Waiting for proof.** Suspicion is the test. Delay can itself become the problem. - **Choosing the wrong report type.** Know the difference between a transaction-based and an activity-based suspicion, and between a confirmed and a partial sanctions match. - **No record of decisions not to file.** You cannot show your reasoning later if you did not write it down. - **Telling the customer.** Never discuss a report or a possible report with the person concerned. - **Ignoring follow-up requests.** If the FIU asks for more information, respond fully and on time. (Image: A professional reviewing figures on a tablet next to a calculator) **Records and ongoing quality** Keep each report, its confirmation and the supporting file together, for at least as long as the rules require. Five years is commonly cited, but confirm the period that applies to you. Keep a simple log of internal reports received, decisions taken and reports filed, with dates, so you can show your volumes and your turnaround times. Review the log every quarter. A sudden rise or fall in internal reports can reveal a training gap or a process problem. Run a short test once or twice a year. Pick a hypothetical concern, walk it through your process with the people involved and see where it stalls. It takes an hour and reveals more than reading the procedure. **Where Adventant fits** Adventant supports [goAML registration and regulatory reporting](https://adventant.com/services/goaml-registration-regulatory-reporting), including designing the internal escalation process and helping compliance officers choose the right report and structure it. Where alert volumes are the challenge, our [operational outsourcing service](https://adventant.com/services/outsourced-screening-customer-monitoring) can help review and record alerts. Use the form below to tell us what you need. This article is general information, not legal advice, and reporting requirements change, so always check current guidance from the FIU, the EOCN and your supervisor. **FAQs** - **What is the difference between an STR and a SAR?** A suspicious transaction report concerns a transaction or attempted transaction. A suspicious activity report concerns behaviour or activity where no transaction has occurred or the concern is not tied to one transaction. Use the report type the FIU's guidance indicates for your situation. - **Which report do I file for a possible sanctions match?** If screening confirms a match against the UAE Local Terrorist List or the UN Consolidated List, apply the required freezing measures and file a confirmed name match report (CNMR). If you cannot confirm or rule out the match, file a partial name match report (PNMR) and suspend while you review. Follow the deadlines in the EOCN's current guidance. - **Do I need proof before I file?** No. The test is suspicion or reasonable grounds to suspect. You are not expected to prove wrongdoing, and waiting for certainty is a common cause of late reports. - **Can I tell the customer I have filed a report?** No. The law prohibits tipping off. Staff should not discuss a report, or a possible report, with the customer or anyone connected. Confirm the exact wording and any exceptions with your adviser or supervisor. - **How long should I keep reporting records?** Keep the report, its confirmation and the supporting file for at least the period your rules require. Five years is commonly cited, but confirm the period that applies to your sector with your supervisor. --- ### Is Your AML Programme Inspection-Ready? A Practical Checklist URL: https://adventant.com/blog/aml-inspection-readiness-checklist-uae Published: 2026-10-14 An AML programme is inspection-ready when you can show, quickly and with evidence, that it is designed around your risks and that it operates in practice. Check eight areas: governance, risk assessment, policies, customer due diligence, screening and monitoring, reporting, training and records. For each one, apply the one-hour test: if a reviewer asked for the evidence, could you produce it within an hour? **Key takeaways** - Reviewers test evidence, not intentions. A policy you cannot show is being followed carries little weight. - Apply the one-hour test to every area: can you produce the proof quickly and in an orderly way? - Sample your own files regularly. Reviewers pick their own, so find the problems first. - Most findings are not exotic. They are out-of-date assessments, thin customer files and undocumented decisions. - A 30-day focused effort closes most of the gaps that matter before an inspection. **What inspections and independent reviews look at** Supervisors and independent reviewers generally work in the same three ways. They read your documents, they test a sample of your customer files, alerts and decisions, and they talk to your people. Inspections may be planned or may come at short notice, and they may look at the whole programme or at one theme. The exact approach differs between supervisors and sectors, so read the guidance that applies to your licence. The preparation below works whichever it is. The consistent feature is that reviewers want evidence that the programme works in practice. A well-written manual is a starting point. What persuades is a customer file that shows the checks were done, a screening alert that was cleared with a reason, a suspicious activity concern that was escalated and decided, and staff who can explain what they would do. **The one-hour test** For each area below, ask yourself a simple question. If a reviewer asked for the evidence today, could you put it in front of them within an hour, in an orderly state? If the answer is no, you have found a gap that is worth closing, even if the underlying work was done. Evidence that exists but cannot be found counts for little on the day. **The checklist: eight areas and the evidence to hold** **1. Governance** - A named Compliance Officer or MLRO, with the supervisor's approval where it is required, and a named deputy. - A clear description of the role, its authority and its reporting line to the board. - Regular written reporting to management or the board, and minutes showing it was discussed. - Where the role is outsourced, the written agreement, the scope and evidence that you monitor the arrangement. **2. Business risk assessment** - A current, approved business risk assessment based on your own data. - Evidence it was reviewed when the business changed. - An action plan with owners and dates, and proof the actions were completed. - A visible link between its findings and your procedures. **3. Policies and procedures** - Written policies and procedures that match what your staff actually do. - A version history, an approval record and a review date. - Role-specific instructions, such as an onboarding checklist and an escalation route. - Evidence that staff know where to find them. **4. Customer due diligence** - Complete files for individuals and companies: identity, purpose of relationship, source of funds where relevant and the people behind each legal entity. - Evidence of beneficial ownership checks that go to the natural persons, not only to the first corporate layer. - A risk rating for each customer with the reasons, and enhanced measures for higher-risk ones, including senior approval. - Ongoing review dates that are actually met. **5. Screening and monitoring** - Evidence that customers, owners and counterparties are screened against the lists you are required to use, at onboarding and afterwards. - Every alert cleared or escalated with a recorded reason, a name and a date. - A method for re-screening when lists change, and proof it runs. - Monitoring rules suited to your business, tested and adjusted, with a record of how alerts were reviewed. **6. Reporting** - Registration on the FIU's goAML platform and current users. - An internal reporting form and a log of concerns, decisions and reports filed. - Reasons recorded for decisions not to file. - Evidence of prompt reporting, and of responses to follow-up requests. **7. Training** - A training plan covering all staff, with deeper content for roles such as onboarding, sales and the compliance team. - Attendance records, dates, content and, where used, test results. - Evidence that new joiners are trained promptly. - Examples of content that reflects your actual business, not only generic material. **8. Records and data** - A retention schedule that meets the period your supervisor requires. - Secure storage, and the ability to retrieve a customer file, a screening result or a report quickly. - Clear ownership of each record type. - A documented approach to data accuracy, so that what you hold is up to date. (Image: A reviewer working through documents at a desk with a laptop) **How reviewers sample, and how to do it first** Reviewers rarely accept a list you have chosen. They select customers, alerts and decisions themselves, often weighted towards higher-risk ones, and they follow each from beginning to end. They check dates, consistency and reasoning. They ask whether what is written in the file matches what happened. You can copy the method. Each month, pick a handful of files: one from each of your risk levels, one introduced customer, one that has been open a long time and one onboarded recently. Walk each through the full process. Was the identity evidence complete and in date? Were owners identified? Was the rating justified? Was screening done and recorded? Was periodic review on time? Write down the gaps, fix them and keep the log. A log showing you found and fixed your own problems is itself good evidence. **Interviews: prepare your people** Reviewers speak to staff as well as managers. They ask practical questions: what would you do if a customer refused to say who owns the company, if a screening alert looked like a possible match, if a colleague asked you to speed up an onboarding or if a customer behaved oddly with cash. Staff who answer confidently, and in line with the procedure, show that training works. Staff who say they would ask someone else, without knowing whom, show the opposite. Run short, informal practice sessions. Use realistic scenarios from your own business. Make sure everyone knows who the compliance officer is, how to reach them and that they will never be penalised for raising a concern. **Findings that recur** Reviews turn up many of the same issues, and that is useful because it means they can be prevented. The most common ones tend to be the following. - A business risk assessment that is out of date or not tied to your data. - Customer files with missing or expired documents and incomplete beneficial ownership evidence. - Screening that happens but is not recorded, or alerts closed without reasons. - Decisions about suspicious activity that are not written down. - Training that is generic, infrequent or not tracked. - A compliance officer without enough time, authority or independence. - Outsourced services that nobody monitors. - Procedures that describe a process that is not actually followed. **A 30-day plan to close the gaps** - **Week one: scope and baseline.** Walk through the eight areas and mark each green, amber or red using the one-hour test. Appoint an owner for every amber and red item. - **Week two: fix the foundations.** Update the business risk assessment if it is stale, confirm governance and approvals and make sure registration and users on the FIU platform are current. - **Week three: repair the files.** Sample customer files, close the obvious gaps, collect missing documents and record ratings with reasons. Review a month of screening alerts and make sure each has a recorded outcome. - **Week four: people and proof.** Run training or refresher sessions, practise interview scenarios and assemble an evidence folder organised by area so that anything can be produced quickly. (Image: A small team working through a plan together around a table) **Self-assessment or independent review?** A self-assessment, done honestly, is valuable and costs little. Its weakness is that people tend to rate their own work generously and miss what they have become used to. An independent review by someone who did not design or run the programme gives a fresh view, tests the evidence rather than the intentions and gives you a record that you asked the hard question yourself. Many firms do a self-assessment each quarter and bring in an independent reviewer once a year or ahead of a known inspection. Independence matters: the reviewer should not be the person who runs your day-to-day compliance. **Where Adventant fits** Adventant carries out [independent AML reviews and audits](https://adventant.com/services/independent-aml-compliance-review) and provides [inspection support and remediation](https://adventant.com/services/regulatory-inspections-remediation) that test your programme against the areas above and give you a ranked list of findings with practical fixes. We can also help close the gaps afterwards, from [policies and procedures](https://adventant.com/services/aml-policies-procedures) to [customer due diligence](https://adventant.com/services/outsourced-screening-customer-monitoring) and [staff training](https://adventant.com/services/aml-training). Use the form below to start a conversation. This article is general information, not legal advice. **FAQs** - **What do AML inspectors usually ask for first?** Practices differ between supervisors, but the business risk assessment, the policies and procedures, evidence of governance and a sample of customer files are common starting points. Have your evidence organised so that you can produce it quickly. - **How much notice will I get?** It varies. Some reviews are announced in advance and some come at short notice. The safest approach is to stay ready all the time, using regular self-checks rather than a last-minute scramble. - **What is the most common weakness?** Missing or thin evidence. Work is often done but not recorded, so the firm cannot show it. Customer files with gaps, screening outcomes without reasons and undocumented decisions on suspicions appear regularly. - **Should staff be interviewed during a review?** Reviewers often speak to staff as well as managers. Practise realistic scenarios so people know what to do and whom to ask, and so they feel able to raise concerns. - **Is an independent review required?** Requirements depend on your sector and supervisor, so check the guidance that applies to you. Even where it is not required, an independent review is a sensible way to test whether the programme works and to prepare for supervisory attention. --- ### KYC and Beneficial Ownership in the UAE: An Onboarding Checklist URL: https://adventant.com/blog/kyc-and-beneficial-ownership-checklist-uae Published: 2026-10-14 Good KYC means identifying each customer, verifying that identity from reliable independent sources, understanding why they want the relationship, working out who ultimately owns and controls any company, rating the risk and keeping the file current. For companies, the key step is to follow ownership through every layer until you reach the real people behind it, and to verify them rather than simply accept what the customer tells you. **Key takeaways** - Customer due diligence is a process, not a form: identify, verify, understand purpose, assess risk and keep reviewing. - For a company, trace ownership and control to the natural persons, however many layers sit in between. - Verify beneficial owners from independent evidence. A signed declaration on its own is not verification. - Higher-risk customers need more: source of funds and wealth, senior approval and closer monitoring. - If you cannot complete due diligence, do not onboard, and consider whether the situation should be reported. **What KYC and customer due diligence cover** Know your customer, usually shortened to KYC, is the everyday name for customer due diligence. In substance it has five parts. You identify the customer. You verify that identity using reliable, independent documents or data. You understand the purpose and intended nature of the relationship. For a legal entity, you establish who ultimately owns and controls it. And you keep the information current and monitor activity against what you know. Rules differ between sectors and supervisors in their details, including what must be collected, when, and in which circumstances simplified or enhanced measures apply. Treat this article as a practical structure and check the specifics against the guidance that applies to your licence. **Onboarding an individual** The aim is simple: be confident that the person is who they say they are and understand why they are dealing with you. A sound file for an individual usually holds the following. - A valid identity document, checked for authenticity, expiry and that the photograph matches the person. For remote onboarding, use a method that gives you real assurance, such as liveness checks, rather than a photo sent by message. - Full name, date of birth, nationality, country of residence and contact details, matching the document. - Address evidence where your procedure or the risk requires it. - Occupation or business activity, and the purpose of the relationship in the customer's own words. - Source of funds, and source of wealth where the risk calls for it. - Results of screening against sanctions and politically exposed person lists, with the date and outcome recorded. Write down anything that does not fit, together with how you resolved it. A file that shows a question was asked and answered is stronger than a spotless-looking file that tells nobody anything. **Onboarding a company** Companies add complexity because there is a legal entity and, behind it, people. You need to understand both. A typical company file covers the following. - Registration documents and trade licence, checked as current and consistent with the name and activities the customer gives you. - Constitutional documents showing how the company is governed and who may bind it. - A list of directors and authorised signatories, each identified and verified to the standard you apply to individuals. - A structure chart showing every shareholder layer up to the natural persons who own or control the company. - A clear description of what the company does, who its customers and suppliers are, and where it operates. - Evidence of why it wants to deal with you and what activity to expect. - Screening of the company, its owners, directors and signatories. **Beneficial ownership: following the chain to real people** A beneficial owner is a natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. The relevant rules set the ownership level at which someone counts as an owner and also recognise control through other means, such as voting rights, the power to appoint directors or influence exercised informally. Check the current threshold and definitions that apply to you. Where the customer is owned by other companies, you keep going until you reach people. Where no individual can be identified through ownership, the rules generally look next at who exercises control and, as a last resort, at senior management, but you must be able to show that you tried properly first and why the fallback applies. The table sets out common situations and a sensible response. | Situation | What to do | | --- | --- | | Owned directly by one or more individuals | Identify and verify each owner above the threshold. Check that the shareholder register supports what the customer says. | | A company owns the customer | Obtain the same ownership information for that company and continue upward until you reach the natural persons. Keep the chart. | | A trust or foundation is involved | Identify the settlor or founder, trustees or council, protector and beneficiaries or classes of beneficiary, plus any person with effective control. Obtain the trust or foundation documents. | | Nominee shareholders or directors | Establish who the nominator is. Nominees are not the beneficial owners. Treat the arrangement as a risk factor and ask why it exists. | | A publicly listed or regulated company | Simplified measures may be available where the rules allow. Record why they apply and keep the evidence. | | Ownership cannot be established | Do not proceed on assumption. Escalate, consider refusing or ending the relationship and think about whether a report is warranted. | (Image: Two people reviewing a form on a clipboard across a table) **Verify, do not just ask** Collecting a signed declaration of ownership is a good start and a poor finish. Verification means testing what you were told against independent evidence: the shareholder register, official registry extracts where available, certified identity documents for the owners and, for higher-risk customers, additional corroboration. If the paperwork a customer gives you contradicts itself, or the customer is reluctant to explain, treat that as information in its own right. **Risk rating and when to go further** Give each customer a risk rating at onboarding and write down the reasons. Your rating method should follow from your business risk assessment. Some features commonly justify enhanced due diligence. - The customer or an owner is a politically exposed person, or closely connected to one. - Links to higher-risk jurisdictions, or to sanctions exposure. - Complex or opaque structures with no clear commercial reason. - Cash-intensive businesses or sectors with a history of misuse. - Wealth or activity that does not fit what you know about the customer. - Adverse media or other negative information. - Non-face-to-face onboarding without strong verification, or heavy reliance on introducers. Enhanced due diligence typically adds several layers: a deeper look at the source of funds and the source of wealth, approval from a more senior person before you proceed, more frequent reviews and closer monitoring. Source of funds is where the money for this relationship comes from. Source of wealth is how the customer built their overall wealth. A property developer who is investing, for example, should be able to explain both the origin of this particular payment and the way their business generated its capital. **Keeping files current** A file that was perfect on the day of onboarding goes stale. Set review periods by risk, with higher-risk customers reviewed more often, and make sure the reviews actually happen. Add event-driven reviews as well. A change of ownership, a new jurisdiction, a significant change in activity, a screening hit or adverse media should each prompt a fresh look, whatever the calendar says. At each review, refresh expired documents, confirm the ownership structure has not changed, check the activity against the original purpose and re-screen. Record the outcome, even when nothing has changed. A signed and dated review that says nothing has changed is evidence you looked. **When you cannot complete due diligence** If a customer cannot or will not provide what you need, do not open the relationship or carry out the transaction, and consider ending an existing one. Do not let commercial pressure, a promise that the documents will follow, or a long-standing relationship talk you out of this. Think also about whether the circumstances create a suspicion that should be escalated to your compliance officer, and handle that without alerting the customer. **Mistakes that reviews keep finding** - Stopping at the first corporate shareholder instead of following ownership to the people. - Accepting a declaration with no supporting evidence. - Expired identity documents that were never refreshed. - A risk rating with no reasons, or one that never changes. - Skipping enhanced measures for politically exposed persons or complex structures. - Relying on an introducer without checking what the introducer actually did. - Periodic reviews that are scheduled but not carried out. - No record of how a discrepancy was resolved. (Image: An adviser reviewing paperwork at a desk beside a laptop) **A simple onboarding sequence** 1. Collect the application and ask the customer to explain the purpose and expected activity. 2. Identify and verify the customer and, for companies, every director and signatory. 3. Build the ownership chart to the natural persons and verify them. 4. Screen the customer, owners and connected parties, and record the results. 5. Rate the risk and write down the reasons. 6. For higher risk, obtain source of funds and wealth evidence and senior approval. 7. Approve, decline or escalate, and record who decided and why. 8. Set the review date and any special monitoring conditions. **Where Adventant fits** Adventant supports customer due diligence through our [operational outsourcing service](https://adventant.com/services/outsourced-screening-customer-monitoring), covering onboarding checks, screening, customer risk assessment and ongoing monitoring, including remediating older customer files. We also write [onboarding policies and procedures](https://adventant.com/services/aml-policies-procedures) that go to the real owners. Use the form below to tell us what you need. This article is general information, not legal advice. **FAQs** - **What is a beneficial owner?** A natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. The rules set the ownership level that counts and also recognise control by other means. Check the current definition that applies to your sector. - **Is a signed declaration enough to verify beneficial ownership?** No. A declaration is a starting point. Verify it against independent evidence such as the shareholder register, official registry extracts where available and identity documents for the owners. - **What if I cannot identify any beneficial owner?** Do not proceed on assumption. The rules generally look next to who exercises control and, as a last resort, to senior management, but you must show that you tried properly first. Escalate and consider refusing or ending the relationship. - **What is the difference between source of funds and source of wealth?** Source of funds is where the money for this particular relationship or transaction comes from. Source of wealth is how the customer built their overall wealth. Enhanced due diligence often asks for both. - **How often should I review customer files?** Set the frequency by risk, with higher-risk customers reviewed more often, and add reviews triggered by events such as a change of ownership, a screening hit or a shift in activity. Make sure the reviews actually happen and are recorded. --- ### Sanctions and PEP Screening: How to Build a Process You Can Defend URL: https://adventant.com/blog/sanctions-and-pep-screening-process-uae Published: 2026-10-14 A defensible screening process names the lists you check, screens customers, owners and relevant counterparties at onboarding and again when lists or circumstances change, works every alert through the same documented steps, escalates anything it cannot clear, and keeps a record of who decided what and why. A confirmed sanctions match means freezing without delay, not tipping off and reporting through the channels set out in current official guidance. **Key takeaways** - Screening has two jobs: complying with sanctions and identifying politically exposed persons so you can apply extra care. - Write down which lists you use, how often you re-screen and who is responsible. Vague answers fail reviews. - Most alerts are false positives. What matters is that each is cleared consistently and with a recorded reason. - A confirmed match is urgent. Know in advance who acts and how, because there is no time to work it out on the day. - A cleared alert with no record is, to a reviewer, an uncleared alert. **What screening is for** Screening serves two purposes that are often mixed together. The first is sanctions compliance: making sure you do not deal with, and do promptly freeze the assets of, persons and entities that appear on the sanctions lists you are required to follow. The second is the identification of politically exposed persons, so that you can apply a higher level of scrutiny to relationships that carry greater risk of corruption and misuse. The two have different consequences. A sanctions match can require immediate action. A politically exposed person is not wrongdoing in itself, and many are entirely legitimate customers, but the relationship needs more care. A good process keeps them separate in its logic and its records. **Which lists and sources to use** At a minimum, UAE businesses are generally expected to screen against the United Nations Security Council consolidated list and the UAE local terrorist list, and to follow the guidance of the Executive Office for Control and Non-Proliferation, which publishes the official sources and the notification routes. Some firms add other lists because of their customers, their banking partners or their markets. That is a business decision, and it should be a conscious one that is recorded in your procedure. Use official sources for the lists themselves, and check that your copy is current. If you rely on a commercial tool, confirm which lists it covers and how quickly it updates, and do not assume that its coverage matches your obligations. For politically exposed persons there is no single official list, so firms combine commercial data, public sources and their own judgement. Whatever you choose, document it. **Who to screen, and when** - **At onboarding:** the customer, every beneficial owner, director and authorised signatory, and any other party who has a significant role in the relationship. - **On a schedule:** re-screen your whole customer base regularly. How often depends on your risk, but it must be defined and followed. - **When lists change:** new designations can appear at any time. Your process should catch them quickly, either by continuous screening or by re-screening promptly when the lists are updated. - **On events:** a change of ownership, a new signatory, a new counterparty or a payment to an unfamiliar party should each trigger a fresh check. - **Counterparties where relevant:** if you process or arrange payments, consider screening the other side as well, not only your own customer. **Manual or automated?** A small firm with few customers can screen manually against the official lists if it follows a clear method and records each check. Once volumes grow, manual screening becomes error-prone, and a tool is sensible. Tools are not magic. They need careful configuration, because settings that are too loose bury your team in noise and settings that are too tight miss genuine matches. Good results also depend on good data. Names transliterated inconsistently, missing dates of birth and nationalities, and shortened company names all reduce accuracy. Whichever route you take, test it. Create a few dummy records with names close to listed entries and check that the system alerts on them. Keep the test results. It is excellent evidence that your process works as intended. **Working through an alert** Most alerts will be false positives, caused by common names, partial matches or similar spellings. The aim is not to avoid alerts. It is to resolve each one the same way every time, using the same evidence, and to leave a trail. 1. Log the alert with a date, a reference and the list that produced it. 2. Compare every identifier you hold against the listed entry: full name, date and place of birth, nationality, passport or identity numbers, address, and for entities the registration number, country and activity. 3. Decide the outcome using defined categories, shown in the table below. 4. Write the reasoning in plain words, naming the identifiers that were compared and how they differ or match. 5. Have a second person review any decision that clears a close call, and have the compliance officer approve anything escalated. 6. File the record with the customer file. | Outcome | What it means | What happens next | | --- | --- | --- | | Clear | Identifiers show the customer is a different person or entity | Record the reasoning and close. No further action. | | Escalate | You cannot rule the match in or out with the information you hold | Gather more information, involve the compliance officer, and consider a partial name match report. | | Possible match | Several identifiers match but not all, or identifiers are missing | Treat with urgency. Pause the relationship or transaction where appropriate and follow current official guidance on notification. | | Confirmed match | The customer or counterparty is the listed person or entity | Freeze without delay, do not deal, do not tip off and report through the channels set out in current official guidance. | (Image: Screens showing monitoring dashboards with charts and indicators) **Politically exposed persons** A politically exposed person is someone who holds, or has held, a prominent public function, and the definition normally extends to close family members and close associates. The category is broad and can include domestic and foreign officials, senior figures in state-owned bodies and members of political parties and international organisations. Check the exact definition in the rules that apply to you. Being a politically exposed person is not a reason to refuse a customer. It is a reason to apply enhanced measures: senior approval before onboarding, a closer look at the source of wealth and the source of funds, and tighter ongoing monitoring. Document why you accepted the relationship and what extra steps you took. Think too about how long to keep applying the measures after someone leaves office, and write that down as a policy rather than deciding case by case. **If you find a confirmed or possible sanctions match** This is the one part of screening where time matters most. The expectation is that assets of a listed person are frozen without delay, that you do not deal with them, and that you tell the authorities through the proper route. Current guidance describes the expected speed and the reports to submit, including the funds freeze report and the partial name match report, so check it now rather than during an incident. Make sure that people know in advance who has authority to freeze, who files the report and how, and that nobody speaks to the customer about it. Rehearse it. A short exercise once a year, in which the team talks through a hypothetical confirmed match and sees whether everyone knows their part, is worth far more than a paragraph in a manual. **Records that make decisions defensible** A reviewer will pick alerts at random and ask you to show what happened. For each, you should be able to produce the following. - The date and time of the alert and the list or source that produced it. - The person or entity screened and the identifiers used. - The identifiers on the listed entry and how they compared. - The outcome, the reasoning and the name of the person who decided. - Any second review or escalation, with dates. - For clear outcomes, enough detail that someone else would reach the same conclusion. **Mistakes to avoid** - Screening only at onboarding and never again. - Relying on a tool without knowing which lists it covers or how often it updates. - Leaving owners, directors and signatories out of scope. - Closing alerts with a one-word reason, or no reason at all. - Treating a politically exposed person as an automatic refusal, or as no different from anyone else. - No plan for a confirmed match, and no named person with authority to act. - Never testing the system with realistic dummy records. (Image: Glass office towers rising into a clear blue sky in Dubai) **In-house or outsourced?** Many firms keep decisions in-house but outsource the heavy first-line work. A provider reviews raw alerts, clears the obvious false positives against a documented method and escalates the rest to your compliance officer. That can save time and improve consistency, provided the provider follows your written criteria and you still own the decisions that matter. Whatever you outsource, check the quality: sample a set of cleared alerts every quarter and see whether you would have reached the same decision. **Where Adventant fits** Adventant helps firms run sanctions and PEP screening, from writing [alert-handling procedures](https://adventant.com/services/aml-policies-procedures) to reviewing alerts on your behalf through our [operational outsourcing service](https://adventant.com/services/outsourced-screening-customer-monitoring). Use the form below to tell us what you need. This article is general information, not legal advice. Sanctions obligations carry serious consequences and change often, so check current official guidance for your sector. **FAQs** - **Which sanctions lists must UAE businesses screen against?** UAE businesses are generally expected to screen against the United Nations Security Council consolidated list and the UAE local terrorist list, and to follow the guidance of the Executive Office for Control and Non-Proliferation. Some firms add other lists based on their customers and markets. Confirm what applies to your sector. - **How often should I screen my customers?** At onboarding, then regularly and whenever lists or circumstances change. How often depends on your risk, but the frequency must be defined, followed and recorded. Continuous screening is one way to catch new designations quickly. - **Is a politically exposed person a reason to refuse a customer?** No. It is a reason to apply enhanced measures, such as senior approval, closer checks on the source of wealth and funds and tighter monitoring, and to record why you accepted the relationship. - **What should I do if I find a possible sanctions match?** Treat it as urgent, escalate to your compliance officer, do not tell the customer, and follow current official guidance on freezing and reporting, including the partial name match report where relevant. Plan this in advance so people know their roles. - **What records should I keep for cleared alerts?** The date, the list, the identifiers compared, the outcome, your reasoning and the name of the person who decided, plus any second review. A reviewer should be able to reach the same conclusion from the record alone. ---