Topic Summary
What Records Must a UAE Company Keep for AML Purposes and Why It Matters
A UAE company must keep customer due diligence files, beneficial ownership data, transaction records, suspicious transaction reports, risk assessments and training logs. Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 require them to be accurate, retrievable and kept for at least five years ( UAE Cabinet , 2019).
Customer Due Diligence and UBO Records Every Free Zone Company Needs
Customer Due Diligence and UBO Records Every Free Zone Company Needs
Transaction and Suspicious Transaction Records and goAML Filings You Must Retain
Retain invoices, contracts, bank statements and payment instructions so each transaction can be reconstructed. Keep every goAML submission, acknowledgement and escalation note. Never tell a customer a report was filed: tipping off is a criminal offence.
Step-by-Step Guide to Building Your AML Record-Keeping System
Set up the system in six steps: appoint a compliance officer, complete a risk assessment, standardise customer templates, register on goAML, set retention and access rules, then test with an internal audit. Each step produces records you must keep when answering what records a UAE company must keep for AML purposes.
Governance, Training and Policy Records Supervisors Ask For
Supervisors expect written policies, the risk assessment, appointment records, training logs, screening results, audit reports and management approvals. Dated, signed, version-controlled AML record keeping UAE reviewers can trust proves the programme works in practice.
How Long to Keep AML Records and How to Store Them
UAE rules require at least five years, counted from the end of the relationship, completion of an occasional transaction or account closure. Records must be secure, retrievable and available to supervisors and the FIU. That sets the AML record retention period UAE inspectors apply.
Building an Audit-Ready AML File for Your Dubai South Free Zone Company
An audit-ready file brings the risk assessment, policies, customer files, UBO register, transaction evidence, goAML records and training logs into one indexed system. Review quarterly, fix gaps in writing and keep proof. That's the practical answer to what records a UAE company must keep for AML purposes.
The UAE remains on the FATF regular follow-up list in 2026 (Central Bank of the UAE, 2024), and supervisors expect records within days, not weeks. This guide shows compliance officers and owners what records a UAE company must keep for AML purposes, and how to organise them.
What Records Must a UAE Company Keep for AML Purposes and Why It Matters
A UAE company must keep customer due diligence files, beneficial ownership data, transaction records, suspicious transaction reports, risk assessments and training logs. Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019 require them to be accurate, retrievable and kept for at least five years (UAE Cabinet, 2019).
The Legal Basis for AML Record Keeping
The Decree-Law sets the core duties. The Cabinet Decision details due diligence and retention. Picture a regulator asking for a customer onboarded two years ago: you'd need identity, ownership and transaction evidence in one pack. The anti money laundering duties for Dubai businesses explain the wider framework.
Why Missing Records Cost More Than Missing Reports
A gap in a file is treated as a control failure, even without proven wrongdoing. Administrative fines can reach into the millions of dirhams. Banks may also freeze accounts: a trading company that can't show the source of funds for a large receipt will be stuck while it rebuilds paperwork.
Who Needs to Comply in a Free Zone
Free zone status doesn't exempt you from federal AML law.
Designated non-financial businesses and professions (DNFBPs) carry direct duties.
Other companies still face bank KYC and UBO expectations.
Example: a Dubai South real estate brokerage runs a full AML programme, while a consulting firm keeps UBO and bank KYC files.
Customer Due Diligence and UBO Records Every Free Zone Company Needs
Keep a verified file per customer: identity documents, trade license, proof of address, ownership structure, UBO details for anyone holding 25% or more, source of funds, relationship purpose and risk rating. Update it when circumstances change and record each review date. Good AML record keeping UAE supervisors respect starts here.
Identity and Corporate Documents
Emirates ID or passport with visa pages.
Trade license, articles and incumbency certificate.
Signatory evidence and board resolutions.
Banks commonly review corporate files every 12 to 18 months.
UBO Register and Ownership Evidence
Identify any individual owning or controlling 25% or more. Keep the register, the ownership chart and the change history. If a share transfer lifts someone to 30%, update both the same week. See UBO registration in the UAE for the filing side.
Source of Funds, Risk Rating and Review Logs
For higher-risk customers, document source of funds and wealth, plus your rating rationale. Date every PEP and sanctions screening. A PEP-linked customer should only be onboarded after senior management sign-off, stored in the file.
Transaction and Suspicious Transaction Records and goAML Filings You Must Retain
Retain invoices, contracts, bank statements and payment instructions so each transaction can be reconstructed. Keep every goAML submission, acknowledgement and escalation note. Never tell a customer a report was filed: tipping off is a criminal offence.
Transaction Files That Support Reconstruction
Contracts, invoices, shipping papers and payment confirmations.
Links between counterparties, amounts and dates.
Cash and high-value evidence, such as buyer identity and payment trail on a gold sale.
goAML Reports and Internal Escalation Notes
Register before you need to file; goAML registration in the UAE is covered separately. The FIU has processed over 100,000 suspicious transaction reports through goAML (Central Bank of the UAE, 2024). Record decisions not to report too, with your analysis.
Confidentiality and Tipping-Off Controls
Limit STR files to the MLRO (Money Laundering Reporting Officer) and authorised staff. Keep them apart from the customer file. A relationship manager stays out of the case entirely.
Step-by-Step Guide to Building Your AML Record-Keeping System
Set up the system in six steps: appoint a compliance officer, complete a risk assessment, standardise customer templates, register on goAML, set retention and access rules, then test with an internal audit. Each step produces records you must keep when answering what records a UAE company must keep for AML purposes.
Step 1: Appoint a Compliance Officer and Document the Role
Sign a board resolution naming the officer.
Record authority, reporting line and deputy.
File qualifications and training evidence.
Step 2: Complete and Date a Business Risk Assessment
Assess customers, products, geographies and channels.
Link high-risk jurisdictions to enhanced due diligence.
Keep version history and review annually.
Step 3: Standardise Customer File Templates and Checklists
One checklist per customer type.
Block onboarding until the UBO declaration is attached.
Date every document.
Step 4: Register on goAML and Test Access
Store the registration confirmation and user roles.
Test filing before an urgent case.
Log user changes.
Governance, Training and Policy Records Supervisors Ask For
Supervisors expect written policies, the risk assessment, appointment records, training logs, screening results, audit reports and management approvals. Dated, signed, version-controlled AML record keeping UAE reviewers can trust proves the programme works in practice.
AML Records a UAE Company Must Keep and Minimum Retention
Feature | Record Type | Minimum Retention |
|---|---|---|
Customer due diligence and KYC files | ID, license, source of funds, risk rating | 5 years after relationship ends |
UBO register and ownership evidence | Register, ownership charts, change history | 5 years after relationship ends |
Transaction records and supporting documents | Invoices, contracts, payment confirmations | 5 years after transaction completes |
goAML STRs and acknowledgements | Filed reports, analysis, escalation notes | 5 years, longer if a case is open |
Training logs, policies and audit reports | Attendance sheets, approved policies, audit findings | 5 years as good practice |
Policies, Procedures and Approval Trails
Keep board-approved AML and sanctions policies with approval dates. When a regulatory change triggers an update, store the new version beside the old one. Our guide to record keeping rules for UAE businesses adds detail.
Training Logs and Staff Screening
File attendance sheets, content outlines and assessment results. New joiners should finish AML training in their first month, with annual refreshers after. Keep pre-employment screening evidence too.
How Long to Keep AML Records and How to Store Them
UAE rules require at least five years, counted from the end of the relationship, completion of an occasional transaction or account closure. Records must be secure, retrievable and available to supervisors and the FIU. That sets the AML record retention period UAE inspectors apply.
Retention Periods and When the Clock Starts
If a relationship ends in March, keep the file until at least March five years later. Extend retention when an investigation or request is pending.
Storage Standards and Retrieval Speed
Digital storage with access controls and backups.
Indexed, searchable files.
Formats authorities accept.
Record Retention After Company Closure
Closure doesn't end the duty. Appoint a custodian and document the storage arrangement. See keeping company records after closure.
Building an Audit-Ready AML File for Your Dubai South Free Zone Company
An audit-ready file brings the risk assessment, policies, customer files, UBO register, transaction evidence, goAML records and training logs into one indexed system. Review quarterly, fix gaps in writing and keep proof. That's the practical answer to what records a UAE company must keep for AML purposes.
A Practical Index for Your Compliance Folder
Group by governance, customer, transaction and reporting.
Use consistent names and dates.
Keep a master register of record locations.
Common Gaps Found During Reviews
Expired passports (one review found ten).
UBO registers not updated after ownership changes.
Missing rationale for risk ratings.
Final Checklist: What Records a UAE Company Must Keep for AML Purposes
Knowing what records a UAE company must keep for AML purposes comes down to due diligence and UBO files, transaction evidence, goAML submissions, governance documents and five-year retention. Complete, dated records show regulators and banks your controls work.
Review your files against this guide, close the gaps, and speak with the Dubai South Business Hub team about setting up a free zone company with the right records from day one.
References
Frequently Asked Questions
