UAE AML inspection readiness: what supervisors check and how to prepare

Who can be inspected

Any business in scope of Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025, can be examined by its supervisory body. That covers financial institutions and DNFBPs — real estate brokers, dealers in precious metals and stones, corporate service providers, accountants and auditors, law firms and exchange houses. See who must comply and what they must do.

What inspectors typically ask for

• Your business-wide risk assessment, and evidence it is reviewed when things change.
• Written AML/CFT policies and procedures, approved at the right level.
• The appointment and registration of your compliance officer or MLRO, including goAML registration.
• Customer due diligence files: identification, beneficial ownership, risk ratings and enhanced due diligence for higher-risk customers.
• Screening records showing checks at onboarding and ongoing re-screening when lists change.
• Alert and case decisions with a documented audit trail, including transaction monitoring where you handle flows of funds.
• Suspicious transaction and activity reports filed through goAML, and internal escalation records.
• Training records and evidence of an independent review or audit of the AML programme.

The gaps inspectors find most often

• A risk assessment that exists on paper but does not match the actual customer base or products.
• Screening done at onboarding but never repeated when sanctions lists change.
• Beneficial ownership identified but not verified, or not recorded with reasoning.
• Alerts cleared with no written rationale — an inspector cannot follow the decision.
• Policies copied from a template that staff have never been trained on.

How to prepare

1. 1Work through the UAE AML Inspection Readiness Checklist — 20 practical points across governance, risk assessment, CDD, screening, reporting and records.
2. 2Close the gaps you find, and record what you changed and when.
3. 3Pull a sample of customer files and check each one tells a complete story: who the customer is, why they were accepted, how they were screened and what happened since.
4. 4Brief the person who will meet the inspector — usually the MLRO — on where every record lives and how quickly it can be produced.

Firms that screen with LexisNexis tools and monitor with ComplianceSuite typically keep screening results, alert notes and case histories in one place, which makes inspection requests faster to answer. Compliance consultants can also run a mock inspection before the real one.