AML / CFT Compliance

Federal Decree-Law No. 10 of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing. It was issued on 30 September 2025, took effect on 14 October 2025, and repealed and replaced Federal Decree-Law No. 20 of 2018. Its Executive Regulations were issued as Cabinet Resolution No. 134 of 2025 and took effect on 14 December 2025. The new law brings proliferation financing into its title, extends the money laundering offence to conduct through digital systems and virtual assets, and defines virtual assets and their service providers. A policy that still cites the 2018 law and Cabinet Decision No. 10 of 2019 is citing repealed instruments, which is the first thing an examiner will notice.

The business risk assessment, sometimes called the enterprise-wide risk assessment, is the institution's own documented assessment of its money laundering, terrorist financing and proliferation financing risks across customers, products and services, delivery channels, geographies and transactions. It sets inherent risk against the effectiveness of controls to reach a residual rating, and it has to be approved by senior management, kept up to date and made available to the supervisor. The annual report is that assessment refreshed for the year: what changed in the business and in the national and sectoral risk picture, how the ratings moved, which controls were tested, and what the Board is being asked to approve. One is the method and the baseline. The other is the yearly evidence that the method is being used.

Treating the system as a model and testing whether it does what the institution believes it does. We prepare controlled test data containing names and transactions that should alert, with deliberate variations such as transliteration differences, reordered name parts, missing dates of birth and partial identifiers, and measure how many the system catches. We measure the false positive rate and what drives it, test the sensitivity of results to the matching threshold, sample below the threshold to see what is being missed, check that sanctions and watchlist updates load completely and on time, and trace the data from the core system into the screening input to find customers and fields that never reach the engine. The output is a validation report with findings graded by severity, of the kind a supervisor or internal audit can rely on.

The work can, the responsibility cannot, and two different things are often confused. Article 20 of the Executive Regulations (Cabinet Resolution No. 134 of 2025) lets an institution rely on a third party to apply customer due diligence measures only where that third party is itself regulated and supervised and complies with due diligence and record-keeping requirements, and even then the institution remains responsible for the accuracy of the measures. A managed KYC service is not that kind of reliance. It is outsourcing: our analysts prepare onboarding files, periodic reviews and enhanced due diligence research to the institution's own procedures and risk ratings, the institution's compliance function reviews and approves each file, and the records sit where the institution can produce them on request. For CBUAE licensees an outsourcing arrangement that touches a critical operation also falls under the Operational Risk Management Regulation in force from 14 September 2026, which requires an outsourcing register and, where a Critical Operation could be disrupted, the Central Bank's prior no-objection.

No. The compliance officer role is a statutory appointment that belongs to the institution and is subject to the supervisor's fitness and propriety expectations. We support that person: drafting and quality-reviewing suspicious transaction and activity reports, preparing regulatory returns, building the management information, and coaching a newly appointed officer through the first cycles. The judgement to report and the act of filing through goAML remain with your appointed officer.

In the UAE, institutions supervised by the Central Bank, the Securities and Commodities Authority, the Virtual Assets Regulatory Authority, the DFSA in the DIFC and the FSRA in the ADGM, and designated non-financial businesses and professions supervised by the Ministry of Economy and the Ministry of Justice. Across the GCC the same method applies under each jurisdiction's own law and the standards of the Financial Action Task Force, and we confirm the current instruments at the start of each engagement, since this is an area where they change often.

No. Software selection is advice on a purchase you make: a requirements specification built from your risk assessment and volumes, a long list, scored demonstrations against your own test cases, reference checks and a recommendation. We have no reseller agreements and receive nothing from any vendor. The same independence is why we can validate a system after it is installed.