Drafting of AML policies and procedures

This engagement is the production of the written, board-approved policy manual and operating procedures themselves — the document set covering CDD/EDD tiers, beneficial ownership identification, sanctions/PEP screening, escalation, record-keeping, and STR/SAR filing procedure. It is drafted from a risk assessment (existing or produced alongside) and precedes the day-to-day CDD advisory and staff training work, which apply the policy in practice.

Doing so leaves a document that describes a generic business, not yours — and supervisory authorities specifically test whether the policy's content matches the entity's actual customer base, transaction patterns, and controls. A template with the name changed is a recognised, recurring inspection finding, not a shortcut that saves time in the long run.

UAE AML/CFT expectations are that the policy is adopted at the appropriate senior governance level — typically the board of directors or equivalent senior management for smaller entities — reflecting genuine institutional ownership of the compliance function, not a document produced and filed away by a junior staff member without formal sign-off.

Where a current risk assessment already exists, a complete, board-approved policy manual typically takes around 4–6 weeks from the initial scoping call, covering fact-finding, drafting, internal review, and formal approval. Where the risk assessment needs to be produced concurrently, the realistic window extends to roughly 5–8 weeks. More complex entities with multiple customer categories or cross-border exposure take longer.

At minimum: the business-wide risk assessment methodology and its findings; standard, simplified, and enhanced Customer Due Diligence procedures with entity-specific triggers; beneficial ownership identification and verification; sanctions and PEP screening cadence; ongoing transaction monitoring; the internal escalation pathway to the Compliance Officer; the goAML STR/SAR filing procedure and the no-tipping-off rule; record-keeping and retention; and the designated Compliance Officer's authority and the annual review cycle.

The policy needs to define, in terms specific to the entity's own customer base and risk assessment, exactly which customer profile qualifies for simplified treatment — not a generic reference to 'low-risk customers.' It must also state explicitly that simplified due diligence can never apply automatically as a default, and can never apply to a customer or jurisdiction carrying elevated risk indicators regardless of how the relationship is otherwise structured.

A global group policy is a useful starting reference but rarely satisfies UAE requirements on its own. It needs to be localised to reference the specific provisions of the AML/CFT Law, the goAML reporting channel, the UAE Compliance Officer's specific authority and portal registration, and any UAE-specific risk factors such as local sanctions lists and DNFBP activity thresholds that a global template will not capture.

In practice they are usually issued as one coordinated manual, but conceptually the policy states the entity's principles and risk appetite (for example, the categories of customer requiring enhanced due diligence), while the procedures set out the specific operational steps staff follow to give effect to that policy (for example, the exact documents collected and the approval sign-off required for an enhanced due diligence onboarding). Both need to be present and aligned for the document to be operable.

At minimum annually, and additionally whenever there is a material change in the business — a new product or service line, a new customer segment or geographic market, a change in ownership or control, or a relevant new Cabinet Decision, Ministerial Decision, or FATF guidance update. A policy that has not been revisited in several years is itself a common and easily identified inspection finding.

A properly drafted and consistently implemented policy is the standard against which a business's conduct is judged on inspection — it does not guarantee that criminal activity will never occur through the business, but a business that can demonstrate it followed a documented, board-approved, risk-based programme in good faith is in a materially different position than one with no policy or one that ignored its own documented red flags.

A written policy that is not being followed in practice is treated on inspection as close to equivalent to having no policy at all, since supervisors sample customer files to test whether the documented procedure matches what staff actually did — a strong policy with inconsistent underlying files is a standard, easily identified finding.

Yes. DIFC entities regulated by the DFSA and ADGM entities regulated by the FSRA operate under their own AML rulebooks specific to those financial free zones, layered on the federal AML/CFT Law. A policy drafted against the mainland Ministry of Economy framework will not directly satisfy a DIFC or ADGM entity's specific supervisor, even though the underlying AML principles are broadly aligned.

The nominee should be sufficiently senior and empowered within the organisation to act independently — able to escalate concerns, request further information, and where necessary pause a transaction pending review, without needing case-by-case sign-off from someone whose interests might conflict with reporting. The policy document needs to describe that authority explicitly, not just assign a title.

PNPC agrees a fixed, written fee before work begins, scoped to the complexity of the business — a single-office corporate service provider and a multi-branch real estate brokerage require materially different depth of drafting. Fees also depend on whether the risk assessment is produced concurrently or already exists.

PNPC drafts the policy and can provide ongoing advisory support to a designated internal Compliance Officer, but the statutory Compliance Officer/MLRO role must generally be held by a suitably senior individual within the regulated entity itself, since the role requires day-to-day authority an external adviser cannot exercise. Some sector rulebooks have specific requirements on who can hold the designation, which we scope precisely rather than assuming one model fits every client.

If the entity is licensed or otherwise falls within VASP regulation under VARA or another emirate-level VASP regulator, the policy needs a dedicated section addressing the additional, generally more stringent expectations attached to virtual-asset activity — including identifying-information requirements that travel with a virtual asset transfer (a travel-rule-style obligation), wallet/custody-related risk factors, and screening considerations specific to virtual asset counterparties. A standard DNFBP template that treats virtual assets as just another payment method under-serves this risk.

Beyond naming the DFSA or FSRA as the applicable supervisor instead of the Ministry of Economy, the specific rulebook provisions each regulator has issued — on CDD thresholds, reporting mechanics, and record-keeping — need to be reflected in the substantive clauses themselves, not just the cover page. A DIFC or ADGM entity's policy also typically needs to reference that regulator's own AML rulebook by name and section, since a generic reference to 'UAE AML law' without the free-zone-specific rulebook citation reads as incomplete to that regulator on inspection.

The core structure — CDD/EDD, beneficial ownership, screening, escalation, record-keeping, governance — is common across DNFBP categories, but the specific risk indicators, transaction-level red flags, and documentation standards differ materially by sector. A real estate broker's policy needs source-of-funds documentation standards calibrated to high-value, sometimes cash-adjacent property transactions and buyer/seller-side CDD; a corporate service provider's policy needs a look-through methodology for the client on whose behalf a company is being formed, including where an intermediary is instructing on behalf of an undisclosed end client.

The DNFBP obligation for dealers in precious metals and stones attaches to cash transactions (or connected transactions) at or above the threshold prescribed by the Ministry of Economy. A business that only occasionally approaches that threshold still needs a documented policy and a monitoring process to actually identify when a transaction or a connected series of transactions crosses it — the obligation is not avoided simply because most individual transactions fall below the line, since connected transactions structured to stay under the threshold are themselves a recognised red flag.

The policy should always be drafted to reflect the risk assessment's findings, not the other way around — if a drafting-stage discussion reveals the policy needs to say something the risk assessment does not support (for example, a broader simplified due diligence category than the risk assessment justifies), the correct fix is to revisit and, if warranted, update the risk assessment first, then draft the policy to match it, rather than drafting a clause the underlying risk analysis does not actually support.

Each entity that independently meets the DNFBP or regulated-entity definition generally needs its own board-approved, entity-specific policy reflecting its own licence, customer base, and supervisory authority — a holding company does not typically operate the policy for a licensed operating subsidiary. Where entities share genuinely common customer bases, systems, and governance, a coordinated group framework with entity-specific annexes can be efficient, but each entity's board or senior management still needs to formally adopt its own applicable version.

UAE regulatory correspondence and inspections are conducted with Arabic as the official language, though English-language policy documents are commonly accepted in practice by the Ministry of Economy and most sector regulators, particularly for internationally staffed businesses, provided the entity can produce an accurate Arabic version or translation if specifically requested. PNPC confirms the specific expectation with the entity's applicable supervisor during scoping rather than assuming one language is always sufficient.

The policy needs to state explicitly whether, and under what conditions, the entity can place any reliance on due diligence already performed by a third party (such as an introducing broker or another regulated entity), and if so, what evidence of that third party's own compliance standing must be obtained and retained before any reliance is placed. Reliance on a third party does not remove the entity's own ultimate responsibility for the adequacy of the CDD performed on its own customer.

Yes — the record-keeping and retention section should specify the format records are held in, how they are backed up or protected against loss, and how they can be retrieved and produced to a supervisory authority within the timeframe requested. A retention clause that is silent on format and retrievability leaves ambiguity about whether a scanned copy is acceptable, how long backups are retained, and who is responsible for retrieval when a request arrives.

Yes. Digital or remote onboarding (sometimes referred to as e-KYC) carries its own delivery-channel risk considerations under the AML/CFT Law's risk-based approach — identity verification without an in-person document check typically needs a specific method (video verification, certified digital identity checks, or equivalent) described in the policy, along with how that method satisfies the same underlying verification standard as an in-person check.

ESR and AML/CFT policy drafting are separate regimes with separate legal triggers and separate supervisors, and the Ministry of Finance discontinued the ESR notification and report filing requirement for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024 — so for most entities today ESR is, at most, a closed historical-period question rather than a live ongoing obligation. An AML/CFT policy drafting engagement does not cover ESR, and an ESR filing from the years it was live never satisfied any AML/CFT policy requirement.

No — drafting produces the written policy and procedures; an independent AML/CFT audit is a separate, subsequent exercise that tests whether the operating programme (onboarding files, screening records, escalation decisions) actually matches what the policy describes. Many entities commission drafting first and an independent audit some months into live operation, once there is enough operating history to test.

The governance and authority clause is finalised against whoever is actually confirmed as the Compliance Officer/MLRO at sign-off, since the document needs to name a real, currently accountable individual for the clause to be credible on inspection — if the nominee changes mid-engagement, PNPC updates the relevant clause and any associated goAML registration before the policy is issued, rather than issuing a document naming someone who has since left the role.

PNPC can prioritise a drafting engagement and compress the calendar-time elements (scheduling, review turnaround) where there is a genuine deadline, but the substantive fact-finding, risk assessment alignment, and internal stress-test stages are not steps we skip under time pressure, since a policy drafted without them recreates the generic-template problem in a compressed timeframe rather than solving it.

The policy should name the specific list sources the entity screens against — at minimum the UAE Local Terrorist List and the UN Consolidated Sanctions List, plus any additional lists relevant to the entity's specific customer or transaction profile — rather than a vague reference to 'applicable sanctions lists' that gives front-line staff no way to confirm they are screening against the right sources.

There is no single fixed statutory countdown for every possible regulatory update, but the expectation under the AML/CFT Law's risk-based approach is that a material change in the legal or regulatory framework is reflected in the policy within a reasonable period, and certainly before the next scheduled annual review if the change affects a substantive obligation the entity is currently operating under. Waiting for the next annual review cycle to incorporate a change that already affects live customer relationships is not advisable.

Generally yes, in substance if not necessarily in a single combined binder — each entity's policy needs to reflect its own actual licensed activity, DNFBP category, and specific risk indicators, since a corporate service provider's beneficial-ownership look-through obligations and a real estate broker's source-of-funds documentation standards are materially different in application even though both sit under the same overarching AML/CFT Law.

Both. The UAE's AML/CFT Law and its Cabinet Decisions are themselves shaped by, and periodically updated to reflect, the Financial Action Task Force's international standards and any UAE-specific follow-up actions from FATF mutual evaluation processes, so a policy drafted with only the letter of the Cabinet Decision in mind, without an eye to the FATF standard it implements, can miss the direction the regulation is evolving in.

If the entity holds a licence for an activity that falls within a DNFBP category, the obligation to have a board-approved policy in place attaches once the entity is licensed and positioned to begin operating, not only once it has active customers — a business that intends to start onboarding customers imminently should have its policy drafted and approved before the first customer relationship begins, not retrospectively once one already exists.

An M&A-context review starts by assessing the target's existing policy and its actual operating history — inconsistencies between the document and the customer files, any unresolved inspection findings, undisclosed prior STR/SAR filings — before deciding whether the existing policy can be adopted, needs targeted remediation, or needs a full rebuild post-completion. The output is a risk report for the acquirer's decision-making as much as a drafting deliverable.

A properly drafted, board-approved AML/CFT policy is generally the document a bank's own AML due diligence team wants to see when assessing a business customer, and having one ready — rather than assembling something in response to the bank's specific request — materially speeds up that process. The policy does not need separate content for a bank's request specifically; the same document that satisfies your own regulator generally satisfies a bank's diligence question as well.

The substantive obligations are the same regardless of headcount, but the depth of the escalation hierarchy, the number of approval layers for enhanced due diligence, and the granularity of role-specific procedures scale with organisational complexity — a 5-person business may have a single escalation step to one Compliance Officer, while a 200-person business needs a documented multi-tier escalation path across branches or departments before a matter reaches the Compliance Officer's desk.

Minor administrative updates (a change of registered office address, an updated internal phone extension) do not require PNPC's involvement, but any change to a substantive clause — CDD/EDD triggers, screening cadence, escalation authority, retention periods — should go through the same review discipline as the original drafting, since an informally edited substantive clause can drift out of alignment with the risk assessment or the underlying legal requirement without anyone noticing until an inspection tests it.