Documentation

Because UAE supervisory authorities inspect the written record, not your general good-faith conduct. An inspector reviewing a customer file checks whether the risk rating, beneficial ownership look-through, and screening result were actually recorded — not whether you personally believe the work was done well. A business that performs CDD correctly but never documents it is, from the inspector's perspective, indistinguishable from a business that skipped CDD altogether, because there is no evidence to examine either way.

At minimum: a board-approved AML/CFT policy and procedures manual, a documented business-wide risk assessment, the Compliance Officer/MLRO appointment record, CDD files for customers with beneficial ownership identification, sanctions/PEP screening evidence, staff training attendance records, and — where applicable — the internal escalation trail and goAML submission confirmation for any STR/SAR filed. The exact depth expected scales with the size and complexity of the business, but every category above should exist in some form for any in-scope entity.

The risk assessment and CDD advisory engagements design and implement the underlying methodology — what risk factors matter, how customers are categorised, what triggers enhanced due diligence. Documentation is the discipline of capturing, organising, and maintaining the written evidence that this methodology was actually applied to real customers and real decisions, in a form that can be retrieved and produced on request. You can have a well-designed methodology and a poorly documented file, or vice versa — the two are related but distinct pieces of work.

Not necessarily. Retention alone does not satisfy the obligation if the entity cannot locate and produce the relevant record within the timeframe a supervisory authority gives during an inspection. A record technically kept somewhere — in an unindexed folder, a departed employee's inbox, or scattered across different staff members' files — that cannot be retrieved on request reads, on inspection, almost identically to a record that was never kept.

UAE AML law requires customer identification records, CDD documentation, and transaction records to be retained for a minimum prescribed period following the end of the business relationship or the date of the transaction, and produced to the competent authority on request. The precise retention period and any sector-specific variation should be confirmed against the current Cabinet Decision text and any applicable sector-regulator rulebook, since retention requirements are refined periodically through amendments.

An outdated Register of Beneficial Owners — one that does not reflect a share transfer, new investor, or change in control that has already happened — is a common and specifically-tested inspection finding under Cabinet Decision No. 58 of 2020 and the AML/CFT framework more broadly. It signals that the entity's documentation is not being maintained in step with actual business events, which supervisors treat as a governance gap in its own right, separate from any issue with the underlying transaction record.

Yes. The absence of a match is itself something that needs to be recorded — the fact that screening was run, on what date, against which list, and with what result — because an inspector cannot distinguish 'screening happened and found nothing' from 'screening never happened' unless the negative result is logged as clearly as a positive one would be.

A disposition note is the documented decision made about a specific sanctions or PEP screening alert — whether it was cleared as a false positive, escalated for further review, or confirmed as a genuine match requiring action. Without it, an alert log shows that the screening tool generated a warning but does not show that a human being actually reviewed and decided what to do about it, which is the substantive step an inspector is testing for.

Where genuine training occurred without contemporaneous documentation, PNPC works with the entity to reconstruct as accurate a record as possible — confirmed dates, content covered, and attendee names based on available evidence such as calendar invites, presentation materials, or attendee recollection — while being transparent that a reconstructed record is weaker evidence than a contemporaneous one, and building a forward process so this gap does not recur.

Both, depending on scope. Where a genuine policy and methodology already exist but the supporting paper trail is missing or disorganised, the engagement focuses on capture, indexing, and retrieval design. Where the underlying policy itself is missing, outdated, or was copied from an unadapted template, PNPC drafts or substantially revises it as part of the same engagement — documentation and the substance behind it are scoped together where the gap analysis shows both are needed.

A typical inspection involves reviewing the policy and risk assessment documents for currency and completeness, then pulling a sample of individual customer files to test whether the documented procedure was actually followed — checking the risk rating assigned, the beneficial ownership look-through, the screening evidence, and any escalation trail. Inconsistency between the written policy and what the sampled files actually show is the most common and most damaging type of finding.

PNPC prioritises the document categories most likely to be tested first — the policy manual, risk assessment, MLRO appointment record, and a representative sample of customer files — and can typically produce an inspection-ready core file within one to two weeks on a compressed timeline, with the fuller file (complete customer base indexing, full training history reconstruction) continuing in parallel.

Both models exist. A one-time build is appropriate where a business needs its current gap closed and is confident it can maintain the file going forward. Most PNPC clients, however, take the ongoing retainer option, since the annual review cycle, event-driven updates (Compliance Officer changes, ownership changes, new Cabinet Decisions), and continuous capture of new customer files and screening results are what keep a documentation set from drifting back into disorganisation within a year or two of the initial build.

No. Complete, accurate, and current documentation materially improves the entity's position on inspection and is the strongest evidence a business can offer that its programme actually operates, but the inspecting authority retains full discretion over its findings, and even well-documented programmes can receive observations or findings based on the specific facts reviewed. No adviser can guarantee a regulatory outcome that depends on the supervisor's own judgment.

goAML registration and Compliance Officer activation give the entity the ability to file reports; documentation is the separate record proving the risk assessment, policies, CDD, screening, and training that should sit behind that registration actually exist and are current. The two are commonly engaged together, since a goAML registration with no documented programme behind it is precisely the 'registered but hollow' pattern supervisory authorities flag most often on inspection.

For clients with entities spanning both India and the UAE, our Dubai team leads the UAE AML/CFT documentation build directly, while our India offices coordinate any parallel India-side compliance record-keeping under the same engagement — so a group operating in both jurisdictions maintains a consistent documentation methodology rather than two disconnected filing systems built by unrelated advisers.

There is no absolute requirement that internal AML/CFT documentation be maintained in Arabic specifically — many UAE DNFBPs, particularly free zone entities and those with international customer bases, maintain their compliance file in English. What matters more than the language chosen is that the record is genuinely accessible and translatable on request: if a Ministry of Economy or Central Bank inspector needs a document explained or translated, the entity should be able to provide that promptly. Where any specific document has already been submitted to a UAE authority in Arabic (such as certain licensing or governmental correspondence), PNPC keeps that original alongside any English working version rather than substituting one for the other.

UAE AML/CFT law does not require physical paper storage specifically — a digital record is acceptable provided it is genuinely retrievable, accurate, and can be produced to a supervisory authority within the timeframe requested. What matters is not the medium but whether the entity can actually locate and produce the record on demand. PNPC increasingly builds documentation files as structured digital repositories rather than physical binders, since digital indexing generally makes retrieval faster and more consistent than a paper-based system.

The underlying document categories are broadly the same — policy, risk assessment, CDD evidence, screening records, training logs, escalation trail — but the specific supervisory framework, submission channel, and correspondence process differ. A Ministry of Economy-supervised mainland or non-financial free zone DNFBP is inspected and reported to under the federal AML/CFT Law directly, while a DIFC entity sits under the DFSA's own AML rulebook and an ADGM entity under the FSRA's, each layered on top of, and generally aligned with, the same federal law but administered through that free zone's own regulator. Building a documentation file for the wrong framework — even a complete one — does not satisfy the entity's actual regulator.

Yes, in substance, though the depth can reasonably scale to the size of the business. Even a dormant or low-activity DNFBP that remains licensed for a designated activity is expected to have a documented risk assessment, an adopted policy, a designated Compliance Officer, and a goAML registration — the absence of customer transactions reduces the volume of CDD files to maintain, but does not remove the governance-level documentation obligation. An inspector reviewing a dormant entity will still expect to see the governance file, even if the customer-file section is thin.

PNPC builds each entity's documentation file correctly calibrated to its own governing supervisor, then layers a consolidated group index on top that cross-references each entity's individual file — rather than merging separate legally distinct entities' records into a single undifferentiated file, which creates confusion about which entity a given document actually belongs to. Any group-level policy adopted centrally is also formally localised and re-adopted at each individual entity, since a group policy that was never formally adopted by the specific UAE entity being inspected does not, on its own, satisfy that entity's obligation.

Generally not the complete internal file as-is. PNPC typically prepares a condensed, appropriately scoped summary pack for external due diligence purposes — confirming the policy exists and is current, the risk assessment methodology, Compliance Officer designation, and screening practice — without necessarily sharing individual customer CDD files, which may themselves be confidential to those customers. The right level of disclosure depends on what the requesting party genuinely needs to see and any confidentiality obligations owed to the entity's own customers.

This is precisely why PNPC builds documentation to be self-explanatory and indexed for a new reader, not dependent on one person's memory of why a decision was made. A well-built file records the reasoning behind a risk rating or a screening disposition at the time it was made, so an incoming Compliance Officer — or PNPC, on an ongoing retainer — can pick up the file and understand it without needing the departed individual to explain it verbally.

Automation tools can reasonably support documentation work — generating a first-draft screening disposition template, organising a document index, or flagging inconsistencies for human review — but the substantive judgment calls (a customer's risk rating, whether an alert is a genuine match, whether a suspicion rises to STR/SAR level) need to remain a documented human decision by someone with actual authority, not an unreviewed automated output. An inspector testing a file is ultimately testing whether a person exercised and recorded genuine judgment, and a file that reads as entirely auto-generated with no evidence of human review invites exactly that question.

No. Where a genuine compliance activity occurred without contemporaneous documentation, PNPC will help reconstruct an accurate record — clearly noting it as a reconstruction and the date it was actually compiled — but will not create a document dated to falsely suggest it existed at an earlier time. Backdating a record to misrepresent when it was created is a form of falsification that, if discovered on inspection, is treated far more seriously than an honest, dated gap ever would be.

PNPC treats client AML/CFT documentation with the same confidentiality standard applied to all client records, accessible only to the engagement team working on it, and is not shared with any third party without the client's instruction or a valid legal requirement to disclose. The documentation itself, once built, remains the client's own record — PNPC's role is to build, organise, and where engaged on a retainer, help maintain it, not to hold it as PNPC's property.

The obligation to retain customer identification, CDD, and transaction records for the applicable minimum prescribed period does not automatically end when the business itself closes — the records need a responsible party and an accessible location for the remainder of that period, even after the entity has wound down. This is a detail businesses closing down frequently overlook, assuming that ceasing operations also ends the record-keeping obligation.

There is a practical overlap in underlying source material — the same customer, invoice, and transaction records often support both an AML CDD file and a VAT or Corporate Tax filing position — but the two documentation obligations are legally separate, run under different laws, and are reviewed by different authorities (the FTA for tax, the Ministry of Economy or relevant AML supervisor for AML/CFT). PNPC's integrated view across tax, accounting, and AML advisory means an inconsistency between what a customer's AML file says and what the underlying transaction ledger shows is more likely to be caught internally before either regulator finds it separately.

They are separate exercises with different objectives — a statutory audit expresses an opinion on financial statements, while an AML documentation review tests inspection-readiness of the compliance file — but PNPC frequently schedules them in a coordinated cadence for clients using both services, since much of the same underlying customer and transaction detail is relevant to both, and coordinating timing avoids asking the client for the same source documents twice.

The goAML platform's periodic re-registration/confirmation cycle itself is largely a portal-level exercise, but the underlying documentation that should be current at that point includes the Compliance Officer's up-to-date appointment record, any change in authorised contact details, and confirmation that the organisation profile still accurately reflects the entity's current licensing and ownership status. PNPC treats the re-registration date as a natural trigger to also check the wider documentation file for currency, rather than treating it as a purely mechanical portal task.

The core document categories are the same across DNFBP types, but the specific content within each category differs with the business — a real estate brokerage's CDD files emphasise source-of-funds evidence for high-value property transactions and buyer/seller beneficial ownership, a precious metals dealer's documentation centres on cash-transaction threshold monitoring, and a corporate service provider's file emphasises beneficial ownership look-through for the entities it forms and any nominee arrangements it provides. PNPC calibrates the documentation depth and emphasis to the entity's actual DNFBP category rather than applying a single generic template across all three.

UAE AML/CFT law focuses on the entity's ability to produce records to the competent authority within the requested timeframe rather than mandating a specific storage location, though practical retrievability is easier when records (whether physical or cloud-hosted) are accessible to the UAE-based Compliance Officer without unnecessary delay caused by cross-border access restrictions or a parent company's unrelated data-residency policy. PNPC advises confirming with the entity's specific IT/data setup that whoever needs to produce a record in the UAE can actually retrieve it promptly, regardless of where it is technically hosted.

A properly executed digital signature is generally acceptable evidence of approval, provided the signing process itself is genuinely attributable to the signatory and the platform used preserves an audit trail of who signed and when. What matters to an inspector is clear, verifiable evidence that senior management or the board actually approved the document — the exact signing mechanism matters less than whether that evidence is credible and traceable.

The original foreign-language document should be retained as the authoritative record, with an English (or, where relevant, Arabic) translation or summary attached so the document is usable during a UAE inspection without unnecessary delay. PNPC does not discard or replace the original — the translation supplements it rather than substituting for it, since the original remains the legally operative document.

Part of PNPC's documentation build now includes a specific access-continuity check — confirming that more than one authorised person (typically the Compliance Officer and a deputy, or PNPC on a retainer basis) can retrieve records from whatever system or repository holds them, so that a single departed staff member's disabled login does not become the reason a record cannot be produced on an inspector's timeline.

The most common non-inspection triggers PNPC sees are a bank's periodic AML due diligence review of a business customer, an investor or acquirer's due diligence ahead of a financing round or sale, a correspondent banking relationship review, and internal escalation following a Compliance Officer's own discovery that the file is thinner than assumed. Each of these can arrive with a compressed timeline similar in pressure to an actual inspection notice, even though no regulator is directly involved.

PNPC flags the specific inaccuracy to the client directly and corrects the record honestly — noting what the file previously stated, what is actually accurate, and the date of correction — rather than silently overwriting it or leaving it uncorrected. An inaccurate record discovered and honestly corrected before an inspection is a materially different, and much better, position than the same inaccuracy being discovered by an inspector first.

PNPC, as a professional services firm advising the entity, operates under its own professional and regulatory obligations, which can include reporting duties in specific circumstances under the AML/CFT framework, separate from the client's own reporting obligation as the DNFBP. This is not a reason to avoid documentation work — quite the opposite, a business that documents honestly and addresses genuine issues transparently is in a fundamentally different position than one that conceals them, and PNPC's role is to help build a defensible, honest programme, not to manage around any adviser's own professional obligations.

PNPC agrees a fixed, written fee for a documentation engagement before work begins, scoped to the actual size of the customer base, the number of entities involved, and how much of the underlying record already exists in some usable form versus needing to be reconstructed from scratch. A single-office corporate service provider with a small customer base and a multi-branch real estate brokerage with years of historical files require materially different depth of work, so PNPC does not publish a single flat figure that would either overcharge simple engagements or undercharge complex ones.

No, not automatically. A new product, a materially different customer segment, or a newly formed mainland or free zone entity needs its own documentation coverage — checked against whichever supervisory framework actually governs the new activity or entity — rather than being assumed to already fall within the scope of an existing file built for a different business activity or entity. PNPC treats each of these expansions as a trigger to extend, not just re-use, the documentation file.