The sector in brief
Payment service providers cover a wide group: firms that process card and online payments for merchants, issue accounts or wallets, initiate payments on behalf of customers or support retail payments of other kinds. In the UAE they are licensed by the Central Bank, and the retail payment services regime applies to many of them.
Their customers are often merchants and users they never meet. Onboarding is digital, volumes are high and money can move in seconds. That speed is the product, and it is also the risk, because there is less time between a payment being made and the funds being out of reach.
A supervisor will expect the firm's controls to be as modern as its product. That means automated checks at onboarding, monitoring that works in real time or close to it, and clear ownership of the AML programme inside what is often a fast-growing technology business.
Where the risk sits
Merchant risk
Merchants that are not what they claim, such as shell businesses used to pass illicit funds through the payment system, or businesses in higher-risk sectors, can put the whole provider at risk.
Remote onboarding and identity fraud
When no one meets the customer, false or stolen identities are a constant risk. Verification tools need to be tested and not simply trusted.
Mule accounts
Accounts opened by real people who are then used to receive and forward criminal proceeds are common in digital payments. Behavioural monitoring is needed to spot them.
Speed and cross-border reach
Funds can arrive and leave within minutes, across borders and between partners, so that detection after the fact is often too late.
Reliance on partners
Banks, card networks, agents and technology vendors are woven into the payment chain. The provider must understand where its own responsibility starts and ends.
Fraud overlapping with laundering
Scams, account takeovers and chargeback abuse produce criminal proceeds that then need to be moved. Fraud and AML teams that do not share information leave gaps.
Who supervises you
Payment service providers and retail payment service providers licensed by the Central Bank of the UAE are supervised by the CBUAE. Providers in a financial free zone answer to that zone's regulator. Your licence and the category of payment service you are authorised to provide determine the specific rules that apply.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A named Compliance Officer or MLRO with real authority, plus board and senior management who understand the AML risks of the product.
- A risk assessment that covers each product, merchant type, customer type, country and delivery channel, refreshed when new products launch.
- Merchant and customer due diligence that fits the risk, with beneficial owner checks and ongoing review.
- Sanctions and politically exposed person screening at onboarding and during the relationship.
- Monitoring tuned to the firm's real flows, with fast alert handling and clear thresholds for escalation.
- Reports through goAML, training that reflects how staff really work, and records kept for the required period.
- Independent testing of systems as well as policies, including how the firm's models and rules were designed and tuned.
Red flags to watch
- A merchant whose trading profile changes sharply, or whose volumes do not match its stated business.
- Accounts that receive many small payments and quickly forward them to another account.
- Repeated use of the same device or address across several unrelated accounts.
- Refund or chargeback patterns that suggest a merchant is cycling money.
- Customers who give inconsistent details during onboarding.
- Payments to or from sectors or countries that the provider has not assessed.
A worked example
A new online merchant whose volume jumps
A new merchant says it sells accessories online. In its first week it processes a handful of sales. In the fourth week volume rises tenfold, most payments come from cards issued in several different countries and many are refunded to different cards. The provider's rules should flag the sudden change. An analyst would look at the merchant's website, deliveries, refund pattern and device data, speak to the merchant and, if needed, hold settlement while the explanation is sought. If the story does not hold, the Compliance Officer decides on a report and on whether to end the relationship.
How Adventant helps
Questions answered
Is a payment service provider the same as a bank for AML purposes?
Not the same, but the core duties are alike: know your customer, monitor, screen and report. What differs is the product risk, which is why the programme should be built from your own risk assessment rather than a bank template.
Can we rely on the bank or card scheme's checks?
Their checks do not replace yours. You are responsible for your own customers and merchants, and supervisors expect your own programme to function even if a partner has strong controls.
How strict does remote identity verification need to be?
It needs to be reliable for the risk. Many firms combine document checks, liveness tests and data checks, and add extra steps for higher-risk cases. Whatever you use, test how well it catches false identities and keep records of the results.
How should fraud and AML teams work together?
By sharing alerts and findings. Fraud cases often reveal laundering and the other way round. A single case management process, or at least a regular exchange, closes the gap.
What happens when volumes grow quickly?
Controls must grow too. Supervisors expect resourcing, systems and alert backlogs to be monitored by management. A growing alert queue that is never cleared is a finding waiting to happen.