Topic Summary
What Is a Basic AML Policy for a UAE Company and Why It Matters
To write a basic AML policy for a UAE company, you document the controls that prevent money laundering and terrorist financing. It covers risk assessment, customer due diligence, UBO records, monitoring, goAML reporting, record keeping and training, aligned with Federal Decree-Law No. 20 of 2018.
Preparing to Write a Basic AML Policy for a UAE Company
Preparing to Write a Basic AML Policy for a UAE Company
Core Sections Every Basic AML Policy Must Contain
A basic AML policy needs eight sections: purpose and scope, governance, risk assessment, customer due diligence, UBO and sanctions screening, monitoring, goAML reporting, and record keeping with training. Together they show regulators a working framework, as set out by the UAE Cabinet decisions.
Customer Due Diligence and UBO Controls in Your Policy
Your policy must require identity checks for every customer, identification of anyone owning or controlling 25% or more, and enhanced checks for PEPs. Set out these AML KYC requirements clearly: evidence collected, who approves exceptions, and how often files refresh.
Reporting Suspicious Activity Through goAML
Regulated entities and DNFBPs must register on goAML and file suspicious transaction reports with the UAE Financial Intelligence Unit without delay. Your policy should name the filer, set escalation timelines and forbid tipping off. The portal has processed over 100,000 reports ( CBUAE, 2024).
Maintaining and Updating Your AML Policy Over Time
Review your AML policy annually and whenever your business, customers or the law change. Train staff on joining and yearly, log every update, and keep evidence ready for banks and regulators.
Your Next Step
To write a basic AML policy for a UAE company, appoint an officer, assess risk, document CDD, UBO, screening, goAML and records, then review yearly. Draft yours using the eight sections above, and speak with the Dubai South Business Hub team about setting up or renewing your free zone company with compliance-ready foundations.
To write a basic AML policy for a UAE company, you document how your business detects and prevents money laundering. The UAE remains on the FATF regular follow-up list in 2026, and banks now ask for this document at onboarding. This guide is for free zone compliance officers and owners who need a working policy they can adopt this month.
What Is a Basic AML Policy for a UAE Company and Why It Matters
To write a basic AML policy for a UAE company, you document the controls that prevent money laundering and terrorist financing. It covers risk assessment, customer due diligence, UBO records, monitoring, goAML reporting, record keeping and training, aligned with Federal Decree-Law No. 20 of 2018.
Legal Basis for an AML Policy in the UAE
Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 set the duties. The Central Bank of the UAE (CBUAE) supervises financial institutions, while the Ministry of Economy and Ministry of Finance oversee designated non-financial businesses and professions (DNFBPs). Serious breaches can carry penalties up to AED 5 million.
Picture a free zone trading company asked for its policy during bank onboarding. It only had a downloaded template, and the account opening slipped by weeks. Our guide on anti money laundering duties for Dubai businesses covers the wider obligations.
Who Needs a Written Policy
Regulated and DNFBP-type companies need one by law. Everyone else needs one to satisfy banks and counterparties. Proportionality applies: a small consultancy with low-risk clients can run on a two-page policy, but it can't run on none.
Preparing to Write a Basic AML Policy for a UAE Company
Before you write a basic AML policy for a UAE company, appoint a compliance officer and map your customers, products, geographies and delivery channels. A simple risk assessment shapes every control, so the document reflects how you actually trade.
Appoint a Compliance Officer and Define Governance
Name a compliance officer and a deputy. In a micro-company, the founder can hold the role, provided a deputy covers absences. Record management sign-off and reporting lines, and tie them to your corporate governance for a UAE free zone company documents.
Run a Simple Business Risk Assessment
Use a low, medium, high rating model.
Score customer type, country, product and channel.
Flag cash, PEPs and complex structures.
Record the method and review date.
A trading firm, for example, rates clients from high-risk jurisdictions as high and applies enhanced due diligence.
Core Components of a Basic UAE AML Policy
Feature | Policy Component | What to Document |
|---|---|---|
Governance and compliance officer | Named officer and deputy | Management approval, reporting lines, version log |
Business risk assessment | Three-tier risk model | Scoring method, high-risk indicators, review date |
Customer due diligence and UBO | CDD, EDD and 25% UBO rule | Documents collected, approvers, file refresh cycle |
Sanctions screening and monitoring | UN and UAE Local Terrorist List checks | Screening at onboarding and on list updates, red flags |
goAML reporting, records and training | STR filing, retention, staff training | Filing owner, five-year retention, attendance logs |
Gather Supporting Corporate Records
Collect your trade license, shareholder register, UBO register and organisation chart. Keep them at least five years, in line with company records you must keep in the UAE. A Dubai South Business Hub company should have this file ready for bank review.
Core Sections Every Basic AML Policy Must Contain
A basic AML policy needs eight sections: purpose and scope, governance, risk assessment, customer due diligence, UBO and sanctions screening, monitoring, goAML reporting, and record keeping with training. Together they show regulators a working framework, as set out by the UAE Cabinet decisions.
Step 1: Set Purpose, Scope and Responsibilities
State the legal basis and who is bound.
Define management, officer and staff roles.
Add a header: version 1.0, approval date, next review date.
Step 2: Define CDD, EDD and Screening Rules
List standard CDD triggers and documents.
Apply enhanced checks to PEPs and high-risk countries.
Screen buyers against the UAE Local Terrorist List before the first invoice.
Step 3: Add Monitoring, Reporting and Record Keeping
Staff escalate unusual cash payments within 24 hours.
File through goAML. Never tip off the customer.
Keep records five years.
Customer Due Diligence and UBO Controls in Your Policy
Your policy must require identity checks for every customer, identification of anyone owning or controlling 25% or more, and enhanced checks for PEPs. Set out these AML KYC requirements clearly: evidence collected, who approves exceptions, and how often files refresh.
KYC Documents to Collect by Customer Type
Individuals: Emirates ID or passport, proof of address.
Companies: license, MOA, shareholder register, signatories.
Higher risk: source of funds and wealth.
UBO Identification and Register Alignment
Match customer ownership data to the official register, and re-verify when ownership changes. See our guide to UBO registration in the UAE. If you find a nominee shareholder hiding real control, escalate to enhanced due diligence.
Reporting Suspicious Activity Through goAML
Regulated entities and DNFBPs must register on goAML and file suspicious transaction reports with the UAE Financial Intelligence Unit without delay. Your policy should name the filer, set escalation timelines and forbid tipping off. The portal has processed over 100,000 reports (CBUAE, 2024).
goAML Registration and Roles
Register the entity and compliance officer before your first live transaction. Define the money laundering reporting officer and a deputy, and log access. Our goAML registration guide walks through it.
Internal Escalation and Tipping-Off Rules
Staff report to the officer immediately.
The officer decides whether to file.
Document the decision either way.
Tipping off is a criminal offence.
Example: payments split just under a threshold, unexplained, get escalated and filed.
Maintaining and Updating Your AML Policy Over Time
Review your AML policy annually and whenever your business, customers or the law change. Train staff on joining and yearly, log every update, and keep evidence ready for banks and regulators.
Training, Testing and Independent Review
Run induction and an annual 60-minute session with a short quiz. Keep attendance logs in the compliance file, and arrange periodic internal or independent audit.
Linking Your Policy to Banking and License Renewal
CBUAE supervises more than 40 licensed commercial banks, and many request your policy at onboarding and periodic review. A free zone company cleared review by presenting a dated policy, risk assessment and training log. Weak paperwork is a common cause of rejection, so keep everything with your corporate records.
Your Next Step
To write a basic AML policy for a UAE company, appoint an officer, assess risk, document CDD, UBO, screening, goAML and records, then review yearly. Draft yours using the eight sections above, and speak with the Dubai South Business Hub team about setting up or renewing your free zone company with compliance-ready foundations.
References
Frequently Asked Questions
