What Should an AML Policy Include? A UAE Checklist

Essential sections

• Scope and legal framework: the laws and regulator rules that apply to your business, including Federal Decree-Law No. 10 of 2025
• Governance: board oversight, the compliance officer and MLRO roles, and reporting lines
• Business-wide risk assessment: customers, products, channels, geographies and technology
• Customer due diligence: identification, verification, beneficial ownership and risk rating
• Enhanced and simplified due diligence: when each applies and what it involves
• Sanctions: screening, freezing without delay and reporting through goAML
• Transaction monitoring: scenarios, alerts, reviews and, for crypto, on-chain monitoring
• Suspicious activity reporting: internal escalation, goAML filing and no tipping-off
• Record-keeping: what is kept, for how long and where
• Training: who is trained, on what and how often
• Independent review: how the programme is tested and kept up to date

Make it specific to your business

Regulators quickly spot copied templates. Your policy should reflect your real products, customers and systems, name the people responsible, and match what your staff actually do. A policy that says one thing while operations do another can be worse than a short, accurate one.

Sector add-ons

• VASPs: Travel Rule, wallet screening, token risk and the requirements of VARA, ADGM or the DFSA
• Real estate: REAR reporting and source-of-funds checks on property payments
• Precious metals and stones: DPMSR reporting and supplier due diligence

Keep it alive

Review the policy at least annually and whenever the law, your regulator's rules or your business model changes. The UAE replaced its federal AML law in 2025, so policies written before then are likely to need updating.