An AML programme is a filing cabinet, not a policy document

The UAE's anti-money-laundering framework sits in Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decision No. 10 of 2019, with sector-specific expectations layered on top by whichever supervisor licenses your activity.

Firms usually have the policy. What they often cannot do is show the work.

The four things an inspection looks for

A risk assessment that is yours. A business-wide risk assessment copied from a template, with no reference to your actual customers, products, delivery channels and geographies, is worse than none — it demonstrates that the exercise was performed without being done.

Customer due diligence you can reconstruct. Not that a file exists, but that you can show what was verified, when, by whom, and what happened at the point the risk rating changed.

Screening with a decision trail. Every alert that was closed needs a reason recorded at the time. "Reviewed and cleared" written eighteen months later is not a record; it is a recollection.

Reporting that happened when it should have. Suspicious transaction reports go to the Financial Intelligence Unit through goAML. What matters on inspection is the interval between the trigger and the report, and whether the delay is explicable from the file.

The part that is genuinely hard

Beneficial ownership. Corporate structures in this market routinely run through several jurisdictions, and the honest answer is often that identification takes weeks. The framework does not accept "the structure was complex" as a conclusion, but it does accept a documented, escalating effort. Record the attempts, not just the outcome.

Where to read it

The decree-law and Cabinet Decision are on the UAE Legislation platform. Your sector guidance — a banking rulebook, a securities regulation, a virtual asset rulebook, or the DNFBP material for non-financial businesses — is published by your own supervisor. Which one binds you depends on your licence, not on your activity as you describe it.