The sector in brief
Most money in the economy passes through a bank at some point. That position makes banks the first line of defence against money laundering and terrorist financing, and the first place a supervisor looks. A bank is expected to know who its customers are, to understand why they use the account and to notice when the activity stops making sense.
This page covers licensed banks and the UAE branches of foreign banks. A branch is not a separate company, but it is still expected to run a credible local programme: its own risk assessment, a Compliance Officer or MLRO who can act on UAE obligations, and reporting to the UAE Financial Intelligence Unit through goAML. Group policy can set the framework, but it cannot replace local responsibility.
Scale makes the job harder. A retail bank may handle millions of transactions a month for people it will never meet. A private or correspondent bank may handle a small number of very large and complicated relationships. The controls that suit one do not suit the other, which is why supervisors ask for a programme built on the bank's own risk assessment and not a copy of a template.
Where the risk sits
Correspondent and cross-border payments
A bank that clears payments for other banks often cannot see the end customer. The danger is moving funds for a respondent whose own controls are weak, or whose customers sit in higher-risk jurisdictions.
Trade finance
Letters of credit, invoices and shipping documents can be over-valued, under-valued, duplicated or invented to justify moving money across borders. The UAE's role as a trading hub makes trade-based laundering a particular concern.
Politically exposed persons and private wealth
Wealth arrives from many countries, and some of it belongs to or is controlled by public officials and their families. Establishing source of wealth, and not only source of funds, is the difficult part.
Layered corporate customers
Chains of holding companies, nominee arrangements and shell companies can hide who really owns and controls an account. A bank that stops at the first layer of ownership has not finished its due diligence.
Cash and structuring
Cash deposits split into smaller amounts to avoid attention, or large cash movements that do not fit the customer's business, remain a classic warning sign.
Sanctions and proliferation financing
Banks must screen customers and payments against the UAE local terrorist list and the United Nations lists, and act without delay when a true match is confirmed. A slow or inconsistent response is a serious failing.
Who supervises you
Your supervisor depends on where the bank is licensed. A bank licensed by the Central Bank of the UAE is supervised by the CBUAE, and a bank authorised in Abu Dhabi Global Market is supervised by the FSRA. A foreign bank branch is supervised by the authority that licensed the branch, not by the home regulator of the parent. Banks in other financial free zones answer to their own free-zone regulator. If you are unsure, your licence names the authority.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A Compliance Officer or MLRO with real authority, direct access to senior management and the board, and enough resource to do the job properly.
- A written business-wide risk assessment that covers customers, products, countries and delivery channels, refreshed on a regular cycle and whenever something material changes.
- Customer due diligence scaled to risk: simplified where the risk is demonstrably low, standard for most customers and enhanced for higher-risk ones, including politically exposed persons.
- Identification of beneficial owners, and reasonable steps to verify them, rather than relying on a declaration alone.
- Screening of customers, owners and payments against sanctions lists, with a documented process for reviewing potential matches and freezing without delay when a match is confirmed.
- Transaction monitoring tuned to the bank's own products and customers, with alerts investigated, closed with a recorded reason and escalated when suspicion remains.
- Suspicious transaction and activity reporting through goAML, and strict care never to tip off the customer.
- Regular training, records kept for the period the rules require (commonly at least five years, so check your supervisor's guidance) and independent testing of the whole programme.
Red flags to watch
- Account activity that does not match what the customer said about their business when the account was opened.
- Large or frequent cash deposits followed quickly by transfers abroad.
- Funds that enter and leave an account within days, leaving little behind.
- Customers who are reluctant to explain ownership, or whose ownership keeps changing.
- Trade documents with values, quantities or counterparties that do not add up.
- Payments to or from countries that have no obvious link to the customer's business.
A worked example
A new trading company and an unexplained pattern
A newly incorporated trading company opens an account and says it will import electronics. Three months later the account receives transfers from several unrelated companies in different countries, each just below the level at which the bank triggers an enhanced review. Within a day the money is forwarded to a company abroad that the customer cannot explain. No single transfer looks alarming, but together they do not fit an electronics importer. A good monitoring programme alerts on the pattern, the analyst asks the relationship manager for invoices and contracts, and if the explanation does not hold up the Compliance Officer decides whether to file a report. The bank acts on the pattern and the missing explanation, not on proof of a crime.
How Adventant helps
Questions answered
Does a foreign bank branch need its own MLRO?
Supervisors expect a branch to have a local Compliance Officer or MLRO who can act on UAE obligations, including filing reports through goAML. Group functions can support the branch, but responsibility for local compliance should not sit only at head office. Check your supervisor's guidance for the exact requirement.
How often should a bank refresh its risk assessment?
No single date suits every bank. Most review at least once a year and again when something material changes, such as a new product or a new market. Your supervisor's guidance and your own board-approved policy set the frequency.
Is simplified due diligence allowed?
Yes, where the risk is demonstrably low and the rules permit it. It is not the same as doing nothing: you still identify the customer, monitor the relationship and document why the lower level was appropriate.
What happens after a bank files a suspicious report?
The report goes to the UAE Financial Intelligence Unit through goAML. The bank must not tell the customer, and it keeps managing the relationship carefully while it waits for any direction. Filing is a legal obligation once the threshold of suspicion is met, not an accusation.
Can a bank outsource parts of its AML work?
Parts of the work, such as screening support or file reviews, can be supported by an outside firm. Accountability stays with the bank and its senior management, and supervisors expect the bank to oversee the provider and show how it checks the quality of the work.