ADGM Anti-Money Laundering and Sanctions Rules and Guidance (AML Rulebook)chapter by chapter

Rule 1.2.11.2 Application

Relevant Persons must determine which AML Rulebook chapters apply based on their type, such as Authorised Persons, Representative Offices, DNFBPs, or Non-Profit Organisations, as set out in the application section.

Rule 1.3.1-1.3.31.3 Responsibility for Compliance

The Governing Body must establish, maintain and monitor AML and sanctions compliance policies and controls, while Governing Body, Senior Management and MLRO exercise due skill, care and diligence.

Rule 4.1.1-4.1.24.1 General Requirements

Firms must establish and maintain Senior Management-approved AML and TFS policies and controls, screen employees, and review their effectiveness at least annually.

Rule 4.2.1-4.2.24.2 Groups, Branches and Subsidiaries

ADGM groups must apply group-wide AML and targeted financial sanctions policies to branches and subsidiaries, notify the Regulator if foreign law blocks implementation, and document reliance on equivalent regulation.

Rule 4.3.14.3 Group Policies

Groups must adopt information-sharing policies covering customer due diligence and money laundering risk data, with confidentiality safeguards, and provide group compliance functions with needed customer information.

Rule 4.4.1-4.4.34.4 Notifications

Firms must immediately notify the Regulator in writing of known or suspected money laundering, sanctions or bribery breaches, and report suspected third-party cases as soon as possible.

Rule 4.5.1-4.5.64.5 Record Keeping

AML records, including CDD documents, SARs and MLRO reports, must be kept for at least six years and provided immediately to the Regulator or law enforcement on request.

Rule 4.5.1-retRecord Retention — CDD/business-partner due diligence documents, customer business-relationship rec

Customer due diligence records, business relationship records, SARs/STRs and MLRO reports must be kept six years from the latest triggering event.

Rule 4.5.34.5 Risk Assessment Documentation

Regulated firms must document their business risk assessment, its use, customer risk methodology and risk-rating determinations, and provide them to the Regulator immediately on request.

Rule 4.6.14.6 Annual AML Return

Relevant Persons must submit the prescribed AML return to the regulator by end of April each year covering the preceding calendar year, unless licensed after 1 November.

Rule 4.7.14.7 Co-operation with the Regulator

Firms must be open and co-operative with the Regulator in all dealings, and must conduct all Regulator communications in English.

Rule 4.8.14.8 Employee Disclosures

Employees who disclose money laundering information to the Regulator or other relevant bodies such as the FIU or police must not be prejudiced for doing so.

Rule 4.9.1-4.9.44.9 High Risk Jurisdictions

Firms must keep current lists of high-risk jurisdictions under increased monitoring and call for action, screen customers against them in CDD, avoid branches there, and not rely on third parties from call-for-action jurisdictions for CDD.

Rule 5.1.15.1 The Risk-Based Approach

Firms must assess money laundering and terrorist financing risks through an objective, proportionate, documented risk-based assessment that is periodically updated.

Rule 6.1.1-6.1.56.1 Assessing Business Money Laundering Risk

Firms must identify and assess business-wide money laundering risk with Senior Management approval, keep it current, assess risks before launching new products, and regularly review AML and TFS controls.

Rule 7.1.17.1 Assessing Customer Money Laundering Risk

Firms must conduct a risk-based customer money laundering risk assessment before establishing a business relationship, assign a risk rating, and refresh it as part of ongoing customer due diligence.

Rule 7.1.27.1 High-Risk and PEP Determination

When assigning a high-risk rating, firms must weigh prescribed customer, product, delivery-channel and geographic risk factors, automatically rate foreign PEPs high-risk, and rate domestic or international-organisation PEPs high-risk when relationships are higher risk after CDD.

Rule 7.1.3-7.1.47.1 Low-Risk Determination

Low-risk customer ratings must consider prescribed customer, product, delivery-channel and geographic risk factors, drawing on credible sources such as FATF, IMF, World Bank and OECD evaluations.

Rule 7.2.1-7.2.47.2 Prohibited Business Relationships

Firms must not establish relationships where beneficial owners cannot be identified, deal with shell banks, or knowingly keep anonymous, fictitious-name or undisclosed nominee accounts.

Rule 8.1.1-8.1.28.1 Requirement to Undertake CDD

Establish Standard Customer Due Diligence (CDD) when commencing business relationships or for transactions over USD 15,000, and apply Enhanced CDD for high-risk customers.

Rule 8.2.1-8.2.38.2 Timing of CDD

Firms must complete customer due diligence when establishing a relationship, permitting deferred verification only where laundering risk is low and completed within 20 Business Days.

Rule 8.3.1-8.3.28.3 Standard CDD - Identification and Verification

Firms must identify and verify customers and anyone acting for them, obtaining specified identity details for natural persons, body corporates, foundations and trusts, applying life insurance beneficiary measures, and screening for politically exposed person status.

Rule 8.3.3-8.3.68.3 Beneficial Owner Identification

Relevant entities must identify beneficial owners of body corporates, partnerships, trusts and foundations, using 25% ownership or control thresholds and listed or government-owned exemptions.

Rule 8.4.18.4 Enhanced Customer Due Diligence

For high-risk, call-for-action jurisdiction, or unhosted-wallet customers, firms must apply enhanced customer due diligence, including verifying source of funds and wealth, enhanced monitoring, and senior management approval.

Rule 8.5.18.5 Simplified Customer Due Diligence

Simplified Customer Due Diligence can be applied for customers assessed as low risk, allowing for reduced verification and monitoring frequency.

Rule 8.6.1-8.6.38.6 Ongoing Customer Due Diligence

Ongoing customer due diligence requires transaction monitoring for profile consistency, periodic review of CDD information and risk ratings, and screening against Sanctions Lists.

Rule 8.7.18.7 Failure to Conduct or Complete CDD

Where customer due diligence cannot be completed, firms must decline or terminate transactions and relationships, return funds, and consider filing a suspicious transaction report.

Rule 8.8.1-8.8.38.8 Portability of CDD Information

Authorised Persons sharing a common customer must provide requested CDD information free of charge, with customer written consent, no more than once every 12 months per customer, and transfer it promptly.

Rule 9.1.1-9.1.29.1 Reliance on a Third Party's CDD

Reliance on third-party customer due diligence is permitted only if immediate necessary information is obtained and appropriate AML standards are met.

Rule 9.2.1-9.2.39.2 Know Your Business Partner

Businesses must establish and verify identities of partners, maintain updated information, and conduct ongoing due diligence to address verification gaps.

Rule 9.3.1-9.3.49.3 Outsourcing Elements of CDD

Firms outsourcing customer due diligence must keep responsibility and liability, avoid providers in jurisdictions subject to a call for action, vet suitability, document a binding agreement, and run periodic assurance reviews.

Rule 9.3.59.3 Money Services Agent/Group Register

Authorised Persons must keep a current register of money services agents and group members available to the Regulator, include them in AML and TFS compliance monitoring, and retain suspicious transaction assessment records for six years.

Rule 9.3.5(2)-retRecord Retention — Records of the Payment Transaction SAR/STR-filing assessment (Money Services age

Money services agents and group members must retain records of payment transaction SAR/STR-filing assessments, with sources and materials, for six years from the assessment date.

Rule 10.1.1-10.1.310.1 Correspondent Banking

Before opening a correspondent banking relationship, a bank must perform CDD on the respondent bank, obtain senior management approval, and never deal with shell banks.

Rule 10.2.310.2 Electronic Fund Transfers and the Travel Rule

Relevant Persons must apply the travel rule, keeping required originator and beneficiary information with transfers and acting on transfers lacking that information.

Rule 10.3.3-10.3.610.3 VA/FRT Transfers and the Travel Rule

Virtual asset transfer providers must apply travel rule information requirements, verify originator data, conduct enhanced due diligence on unhosted wallet transfers, and quarantine transfers with missing information.

Rule 10.4.110.4 Audit

The internal audit function must regularly review AML/TFS policies and compliance, focusing on specific testing and communication with management.

Rule 10.5.110.5 Anonymous and Nominee Accounts

Regulated firms must not establish or maintain anonymous accounts, accounts in fictitious names, or nominee accounts held for an undisclosed beneficial party.

Rule 11.1.111.1 Resolutions and Sanctions

Firms must maintain sanctions controls, screen against sanctions lists, freeze matched assets immediately, and notify the Regulator immediately of any actual or potential sanctions contravention.

Rule 11.2.111.2 Government, Regulatory and International Findings

Persons must maintain systems to stay informed of UAE and international AML/CFT findings and sanctions, apply prescribed countermeasures, and notify the Regulator immediately of known non-compliance.

Rule 12.1.1-12.1.612.1 Appointment of an MLRO

Firms must appoint a senior, experienced, independent UAE-resident MLRO and a deputy (except representative offices), replace a departing MLRO immediately, and ensure the MLRO deals openly with the Regulator.

Rule 12.2.112.2 Qualities of an MLRO

A firm must ensure its MLRO has direct senior management access, adequate qualifications, resources and staff, independence to act autonomously, and timely unrestricted access to customer and transaction information.

Rule 12.3.112.3 Responsibilities of an MLRO

The MLRO must manage AML/TFS compliance, respond to suspicious activity, and ensure training and policy alignment with regulations.

Rule 12.4.1-12.4.312.4 Reporting

The MLRO must report semi-annually to senior management on AML effectiveness reviews, compliance, suspicious activity reports and related matters; senior management must promptly assess, act on deficiencies, record outcomes, and copy the Regulator.

Rule 13.1.1-13.2.113.1-13.2 Training Content and Frequency

Relevant Employees must receive AML and TFS training at least annually, tailored to the firm's risk profile and covering MLRO roles, legislation, typologies, and reporting obligations.

Rule 13.3.1-13.3.213.3 Record-Keeping

Firms must record AML training dates, training nature and names of employees trained, retaining these records for at least six years from the training date.

Rule 13.3.2-retRecord Retention — AML/TFS training records (dates, nature of training, Employees trained)

Firms must keep AML/TFS training records, including dates, nature of training and employees trained, for six years from the date training was given.

Rule 14.2.1-14.2.314.2 Internal Reporting Requirements

Firms must maintain systems to detect suspicious transactions and require employees to promptly report money laundering or terrorist financing suspicions to the MLRO, with disciplinary policies for non-reporting.

Rule 14.3.1-14.3.514.3 Suspicious Activity/Transaction Reports

MLROs must investigate notifications of suspicious activity promptly, determine if a SAR/STR is needed, and file as required, with documented reasoning.

Rule 14.4.114.4 Suspension of Transactions and No Tipping-Off

Persons must not carry out transactions suspected of money laundering or terrorist financing until the FIU is informed, and must not tip off anyone about investigations.

Rule 14.5.114.5 Record-Keeping

Financial institutions must retain all MLRO notifications and filed SAR/STRs for a minimum of six years.

Rule 14.5.1-retRecord Retention — Records of MLRO notifications and Suspicious Activity/Transaction Reports filed

Firms must keep records of MLRO notifications and suspicious activity/transaction reports filed for six years from the date each report was made.

Rule 15.1.1-15.2.315.1-15.2 Registration Criteria and Application

To obtain DNFBP registration, demonstrate adequate AML/TFS resources and notify the Regulator of any material changes during application processing.

Rule 15.3.1-15.3.215.3 DNFBP Notifications

DNFBPs must promptly notify the ADGM Regulator of changes to name, legal status, address, MLRO, governing body, senior management or beneficial ownership, and give at least 10 Business Days' written notice before ceasing business.

Rule 15.4.115.4 Disclosure of Regulatory Status

Firms must not misrepresent their regulatory status, and must not use or reproduce the Regulator's logo without express written permission and compliance with any usage conditions.

Rule 16.1.1-16.1.216.1 Responsibility for NPO Compliance

NPO governing bodies must oversee AML and targeted financial sanctions compliance, and must maintain information on the NPO's purpose, controllers, fund controls, and beneficiary identity checks.

Rule 16.2.116.2 Record Keeping

Non-profit organisations must keep records of domestic and international transactions detailed enough to verify funds were received and spent for the NPO's purpose, for at least six years.

Rule 16.2.1-retRecord Retention — NPO records of domestic and international transactions evidencing fund receipt/u

NPOs must keep records of domestic and international transactions evidencing receipt and use of funds consistent with stated purpose, retained six years from the transaction date.

Rule 16.3.1-16.3.216.3 Co-operation

Authorised firms must deal openly and cooperatively with the Regulator, keep it informed of significant events, and on request provide information, records, system access, staff availability and truthful, prompt answers.