The sector in brief
An audit gives users of accounts some confidence that the figures are reliable. That confidence is valuable to a business trying to look legitimate to banks, investors and regulators. Auditors therefore sit at a point where a mistake or a lapse can help launder money, even without anyone intending it.
Auditors are covered by the AML framework as designated professionals. Registered auditors are supervised in the DIFC by the DFSA, and audit firms are also supervised by other authorities according to their licence. The Capital Markets Authority lists relevant audit firms among the businesses it supervises, because they audit the market's listed firms and regulated entities.
The audit already involves scepticism: testing figures, asking questions and being alert to fraud. The AML requirements overlap with that work. They add formal duties to assess the risk of clients, to identify owners and to report where suspicion arises.
Where the risk sits
Clients with false or inflated figures
Accounts that overstate revenue or hide transactions can be used to explain the origin of money.
Opaque ownership
A client whose owners and controllers are not clear is harder to assess and may be a front.
Related-party transactions
Large dealings with connected parties, unusual loans and transfers can be a way to move money out of sight.
High-risk sectors and countries
Clients in cash-intensive businesses, or with links to high-risk countries, need extra care.
Pressure and fee dependence
A large client that pays substantial fees can create pressure not to ask difficult questions.
Who supervises you
Registered auditors in the DIFC are supervised by the DFSA. Auditors in Abu Dhabi Global Market are supervised by the ADGM Registration Authority, and those onshore by the Ministry of Economy and Tourism. Audit firms that audit capital-market entities may also be relevant to the Capital Markets Authority. Check your own licence and registration.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A named compliance officer or MLRO with authority over client acceptance, and a programme approved at partner or board level.
- A risk assessment that covers the firm's client base, sectors, countries and services.
- Client acceptance and continuance procedures, including identification of owners and controllers, and understanding of the business.
- Sanctions and politically exposed person screening of clients and key parties, with documented review.
- Escalation of concerns found during audit work, and reporting through goAML where there is suspicion.
- Training, record keeping and independent quality review of how the programme is applied.
- Awareness of the relationship between audit independence and the AML duty to report.
Red flags to watch
- A client who will not explain ownership or the source of its funds.
- Revenue that cannot be matched to contracts, deliveries or bank records.
- Large unexplained transactions with related parties.
- A sudden change of auditors or directors without explanation.
- Pressure to sign off quickly or to ignore inconsistencies.
- Records that are missing or altered.
A worked example
Revenue that bank records do not support
During an audit, the team finds that recorded sales to several overseas customers are not matched by any payments in the company's bank statements, and that the customers cannot be contacted. Management says the payments were made in cash through a third party. The audit team treats the lack of evidence as a serious concern, raises it with the engagement partner and the firm's compliance officer, and considers whether the facts amount to a suspicion that must be reported. They keep to professional rules about not alerting the client improperly.
How Adventant helps
Questions answered
Does the AML duty conflict with audit confidentiality?
The rules recognise professional duties, but they do not remove the duty to report suspicion where it applies. The firm should have a clear policy on how the two fit together and take advice on difficult cases.
How is AML different from fraud detection in an audit?
Fraud procedures focus on whether the accounts are materially misstated. AML focuses on the client, the owners and the source and use of funds. They overlap, and findings in one often matter to the other.
Do we need to review clients once accepted?
Yes. Risk can change, so clients should be reviewed at least when they are re-appointed and whenever something material changes.
Who decides whether to report?
The compliance officer or MLRO, after review, in consultation with the engagement partner where appropriate. Team members must escalate without discussing the concern with the client.
Can a small audit firm have a simple programme?
Yes, if it is proportionate to the risk and covers the same areas: risk assessment, client acceptance, screening, reporting, training and review.