DFSA Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML)chapter by chapter

1.2.1(2)1.2 Responsibility for compliance with this module

Document senior management's AML governance duties (e.g. in a Board/AML committee charter or terms of reference) and require members to evidence active, informed oversight of AML matters.

4.1.1(a)4.1 The risk-based approach

Design and operate a documented risk-based approach (RBA) methodology that identifies AML risk drivers and sets proportionate mitigation measures.

4.1.1(b)4.1 The risk-based approach

Embed quality-control standards (objectivity, evidentiary basis, documentation, periodic review/update) into the templates and governance process used for every AML risk assessment (business and customer).

5.1.1(a)-(b)5.1 Assessing business AML risks

Produce and maintain a documented Business (Enterprise-Wide) AML Risk Assessment covering all prescribed risk categories (customer, geographic, product/service, channel, transaction, and new business/technology risk).

5.1.1(c)5.1 Assessing business AML risks

Establish a governance gate (e.g. new product/customer approval committee or sign-off process) that requires reference to the business risk assessment before launching new products, onboarding new customer segments, or changing the business profile.

5.1.25.1 Assessing business AML risks

Feed the outputs of the business risk assessment into the AML policy/procedure suite, control design, resource/budget allocation, and the customer risk assessment methodology, with a documented traceability link.

5.1.3(2)5.1 Assessing business AML risks (New products, business practices and technologies)

Implement a mandatory pre-launch AML risk assessment/sign-off for all new products, business practices, delivery channels, partners and technologies, with mitigation measures agreed before go-live.

5.2.1(a); 5.2.1(aa); 5.2.1(b)(iii)5.2 AML systems and controls

Develop, document and keep current a full suite of AML policies, procedures, systems and controls tailored to the firm's risk profile, formally approved by senior management, and mapped to the applicable Rules and Federal AML legislation.

5.2.1(b)(i)5.2 AML systems and controls

Design and deliver a regular AML management information (MI) pack to senior management covering the operation and effectiveness of AML systems and controls and the firm's money laundering risk profile.

5.2.1(b)(ii)5.2 AML systems and controls

Implement PEP screening capability (manual process or automated screening tool/database) covering customers, Beneficial Owners, and, for life insurance business, policy beneficiaries and their Beneficial Owners.

5.2.1(c)5.2 AML systems and controls

Conduct periodic independent effectiveness reviews/testing of the AML systems and controls framework and document conclusions and remediation actions.

6.1.1(1)6.1 Assessing customer AML risks

Perform and document a customer money laundering risk assessment for every customer, and assign a risk rating (e.g. low/medium/high or numeric scale).

6.1.1(2)6.1 Assessing customer AML risks

Sequence onboarding workflow so the customer risk assessment and rating is completed before CDD begins for new customers, and trigger a re-assessment of existing customers when material new information or events arise.

6.1.1(3)6.1 Assessing customer AML risks

Build a customer risk assessment template/questionnaire that captures each of the prescribed factors (identity/Beneficial Owner, purpose and nature of relationship, customer business/ownership/control, geography, product/service/transaction, life policy beneficiary where relevant, and linkage to the business risk assessment).

6.1.2(1) and (3)6.1 Assessing customer AML risks (Factors indicating higher money laundering risk)

Incorporate the full list of prescribed higher-risk customer, product/service/channel and geographic risk factors into the customer risk scoring methodology/questionnaire, with a documented, reasoned (not purely mechanical) determination of risk rating.

6.1.3(1) and (3)6.1 Assessing customer AML risks (Factors indicating lower money laundering risk)

Incorporate the full list of prescribed lower-risk customer, product/service and geographic risk factors into the customer risk scoring methodology, enabling Simplified CDD eligibility to be determined on a documented, reasoned basis.

6.1.46.1 Assessing customer AML risks (Business relationship not to be established if ownership arrangements prevent identification of beneficial owners)

Build a hard-stop control in the onboarding process that blocks establishment of any business relationship with a legal person/arrangement customer where one or more Beneficial Owners cannot be identified (e.g. due to bearer shares or similar untraceable ownership).

6.1.56.1 Assessing customer AML risks (Shell Banks)

Implement a screening/due diligence check to identify Shell Banks (no physical presence, not part of a regulated, supervised financial group) and prohibit onboarding or continuing any relationship with them.

6.1.66.1 Assessing customer AML risks (Anonymous or fictitious accounts)

Implement account-opening controls that prohibit anonymous, fictitious-name or undisclosed-nominee accounts, requiring verified identification of the true account holder/beneficial party for every account.

6.1.76.1 Assessing customer AML risks (Use of numbered or abbreviated accounts for internal purposes)

Maintain a control framework for any numbered/abbreviated-name accounts confirming internal-use-only restriction, application of standard CDD/record-keeping, and unrestricted access for AML, monitoring, compliance and audit staff to the underlying account holder information.

7.1.1(1)(a)7.1 Requirement to undertake customer due diligence

Perform full CDD (identification, verification, BO identification, understanding of business) for each customer prior to/at onboarding.

7.1.1(1)(b)7.1 Requirement to undertake customer due diligence

Trigger the EDD workflow automatically whenever a customer is risk-rated high in the customer risk assessment system.

7.2.1(1)(a)7.2 Timing of customer due diligence

Complete identification, verification and understand-the-business steps of CDD before/at the point of establishing the business relationship (subject to the 7.2.2 deferral exception).

7.2.1(1)(b)7.2 Timing of customer due diligence

Implement an ongoing CDD/monitoring programme covering the customer for the life of the relationship (see section 7.6 for detailed measures).

7.2.1(2)(a)-(c)7.2 Timing of customer due diligence

Establish a trigger-event process to re-open and refresh CDD (re-verify identity/Beneficial Owners, update information) whenever any of these three trigger conditions arises.

7.2.2(1)7.2 Timing of customer due diligence

Implement a documented deferred-verification exception process including a risk assessment, account-restriction safeguards, and a 30-day verification-completion tracker.

7.2.2(2)(a)-(b)7.2 Timing of customer due diligence

Maintain an escalation and documentation process for late-verification cases, with root cause recorded and an expedited completion plan.

7.2.2(2)(c)7.2 Timing of customer due diligence

Maintain a log of all deferred-verification non-compliance events during the year for inclusion in the annual AML Return submission.

7.2.2(3)7.2 Timing of customer due diligence

Track and comply with any DFSA-specified verification deadlines and be prepared to cease the relationship if directed.

7.2.2(4)7.2 Timing of customer due diligence

Document a formal deferred-verification policy within the AML Policies & Procedures manual, approved by senior management.

7.3.1(1)(a)7.3 Customer due diligence requirements

Collect the prescribed identification data (per Rule 7.3.2) and independently verify it for every customer.

7.3.1(1)(b)7.3 Customer due diligence requirements

Perform Beneficial Owner identification and verification for each customer per Rules 7.3.3/7.3.5/7.3.6 as applicable.

7.3.1(1)(c)7.3 Customer due diligence requirements

Complete a documented business/ownership-structure profile for every legal-person/arrangement customer.

7.3.1(1)(d)7.3 Customer due diligence requirements

Apply the ongoing CDD programme (transaction monitoring, periodic review, risk-rating review) described in section 7.6 for every customer relationship.

7.3.1(2)(a)-(b)7.3 Customer due diligence requirements

Obtain and verify a power of attorney/authorisation mandate and identity documents for any authorised representative/agent before allowing them to act for the customer.

7.3.1(3)7.3 Customer due diligence requirements

Maintain an approved list of acceptable reliable/independent verification sources (government ID, registries, reputable databases) and use only these for CDD verification.

7.3.2(2)7.3 Customer due diligence requirements

Use a standard natural-person KYC form capturing and verifying each of these six specified data points.

7.3.2(3)7.3 Customer due diligence requirements

Use a standard corporate-customer due diligence checklist capturing and verifying all ten specified data/document items.

7.3.2(4)7.3 Customer due diligence requirements

Collect and verify a certified foundation charter/by-laws and guardian-appointment documentation before onboarding a foundation customer.

7.3.2(5)7.3 Customer due diligence requirements

Collect and verify a certified trust deed and trustee-appointment documentation before onboarding a trust customer.

7.3.3(2)(a)-(b)7.3 Customer due diligence requirements

Build and maintain an ownership/control chart tracing through to the ultimate natural-person controller(s) for every corporate customer.

7.3.3(4)7.3 Customer due diligence requirements

Apply the senior-management-as-Beneficial-Owner fallback designation only after documented exhaustive identification efforts have failed and no money laundering suspicion exists.

7.3.3(5)7.3 Customer due diligence requirements

Maintain a documented audit trail of every step taken in the failed Beneficial Owner identification exercise.

7.3.5(2)7.3 Customer due diligence requirements

Complete a foundation Beneficial-Owner identification schedule listing each of these roles/persons.

7.3.5(3)7.3 Customer due diligence requirements

Capture sufficient descriptive/class information at onboarding to allow future identification of class-designated recipients ahead of any payout.

7.3.5(4)7.3 Customer due diligence requirements

Perform and document identity verification for the specific recipient immediately prior to processing any foundation payout/transfer.

7.3.6(2)7.3 Customer due diligence requirements

Complete a trust Beneficial-Owner identification schedule listing each of these roles/persons.

7.3.6(3)7.3 Customer due diligence requirements

Capture sufficient descriptive information on class-designated beneficiaries at onboarding to support future identification ahead of distribution/vesting events.

7.3.6(4)7.3 Customer due diligence requirements

Perform and document identity verification for the actual beneficiary immediately prior to processing any trust distribution or vested-rights exercise.

7.3.7(2)(a)7.3 Customer due diligence requirements

Capture and record the named beneficiary's name in the policy file as soon as the beneficiary is named.

7.3.7(2)(b)7.3 Customer due diligence requirements

Capture sufficient descriptive information on class-designated policy beneficiaries as soon as they are identified/designated, to support future identification at payout.

7.3.7(4)7.3 Customer due diligence requirements

Perform and document identity verification of the beneficiary (and any Beneficial Owner of the beneficiary) immediately before authorising any policy payout.

7.3.8(1)7.3 Customer due diligence requirements

Screen every customer, Beneficial Owner, and (for life policies) beneficiary/beneficiary's Beneficial Owner against PEP databases/lists at onboarding and when beneficiaries are designated.

7.3.8(2)(a)/(3)(a)7.3 Customer due diligence requirements

Route all PEP relationships/payouts through a documented senior-management approval step before onboarding, continuing, or paying out.

7.3.8(2)(b)/(3)(b)7.3 Customer due diligence requirements

Obtain and document independent corroborating evidence of source of wealth and source of funds for every PEP relationship.

7.3.8(2)(c)/(3)(c)7.3 Customer due diligence requirements

Apply an enhanced/increased transaction-monitoring regime specifically to PEP-linked relationships.

7.4.1(a)7.4 Enhanced customer due diligence

Apply an EDD information-gathering checklist capturing additional identity data, business-relationship rationale, and transaction rationale for high-risk customers.

7.4.1(b)7.4 Enhanced customer due diligence

Set an accelerated CDD-refresh cycle (shorter than the standard periodic review cycle) for all high-risk customers.

7.4.1(c)7.4 Enhanced customer due diligence

Obtain and document independent corroborating evidence of source of funds and source of wealth for every high-risk customer.

7.4.1(d)7.4 Enhanced customer due diligence

Apply enhanced/increased transaction monitoring specifically to high-risk customer relationships.

7.4.1(e)7.4 Enhanced customer due diligence

Route all high-risk customer onboarding/continuation decisions through documented senior-management sign-off.

7.4.1(f)7.4 Enhanced customer due diligence

Implement a control requiring first-payment source verification against the specified eligible institution categories for applicable high-risk account openings.

7.5.1(2)7.5 Simplified customer due diligence

Ensure any Simplified CDD modifications applied to low-risk customers are documented and justified by reference to the specific risk assessment, avoiding a one-size-fits-all reduction.

7.6.1(1)(a)7.6 Ongoing customer due diligence

Operate a transaction-monitoring system (manual and/or automated) that flags transactions inconsistent with the customer profile.

7.6.1(1)(b)7.6 Ongoing customer due diligence

Configure monitoring rules/thresholds to specifically flag complex, unusually large, or economically unjustified transaction patterns for closer review.

7.6.1(1)(c)7.6 Ongoing customer due diligence

Conduct and document an enquiry (customer contact, source-of-funds check, rationale assessment) for every flagged complex/unusual transaction.

7.6.1(1)(d) and (2)7.6 Ongoing customer due diligence

Implement a periodic CDD-refresh review programme (risk-based frequency, more frequent for high-risk customers) plus event-triggered reviews on material change.

7.6.1(1)(e) and (2)7.6 Ongoing customer due diligence

Implement a periodic risk-rating review programme plus event-triggered risk-rating reassessment upon material change.

7.6.27.6 Ongoing customer due diligence

Run ongoing sanctions screening of the full customer base, their businesses, and transactions against UN and other applicable sanctions lists.

7.7.1(1)(a)-(e)7.7 Failure to conduct or complete customer due diligence

Implement a documented CDD-failure response protocol requiring Front Office/Operations to halt onboarding, freeze/decline transactions, and terminate/suspend and unwind existing relationships where CDD cannot be completed (subject to the tipping-off/FIU-direction exceptions).

7.7.1(1)(f)7.7 Failure to conduct or complete customer due diligence

Include a mandatory SAR-consideration step in the CDD-failure protocol, documented regardless of outcome.

8.1.1(3)(a)8.1 Reliance on a third party

Obtain and document the third party's full CDD information immediately upon initiating reliance (not just basic name/address).

8.1.1(3)(b)8.1 Reliance on a third party

Confirm and document the third party's ability/commitment to supply certified CDD documents on request without delay.

8.1.1(3)(c)8.1 Reliance on a third party

Verify and document that the foreign third party is subject to, and supervised for, FATF-standard AML requirements before relying on it.

8.1.1(3)(d)8.1 Reliance on a third party

Confirm the third party has not used a CDD exception for the elements being relied upon, and record the confirmation.

8.1.1(3)(e)8.1 Reliance on a third party

Verify the currency of the CDD information obtained from the third party before relying on it, refreshing where necessary.

8.1.1(4)8.1 Reliance on a third party

Verify and document that the Group's AML policy and (where applicable) Group-level supervision meet FATF standards before relying on the exemption for a Group member.

8.1.1(5)8.1 Reliance on a third party

Perform own CDD to remediate any deficiencies identified in third-party CDD, without delay.

8.1.1(6)8.1 Reliance on a third party

Maintain overall ownership and oversight of CDD outcomes regardless of third-party reliance, retaining the ability to demonstrate compliance to the DFSA.

8.1.2(1)8.1 Reliance on a third party

Perform and document a structured jurisdiction assessment covering all listed factors before relying on a third party in that jurisdiction.

8.1.2(2)8.1 Reliance on a third party

Use only vetted, current, reliable information sources in jurisdiction assessments and document source reliability.

8.1.2(3)8.1 Reliance on a third party

Retain full documentation of assessment methodology, sources, and materials considered for each reliance assessment.

8.2.18.2 Outsourcing

Retain ownership/oversight of outsourced CDD functions, including monitoring the outsourced service provider's performance and maintaining a binding outsourcing agreement.

8.3.1(1)(a)8.3 Money Service Providers

Maintain and keep updated an agent register and produce it to the DFSA upon request.

8.3.1(1)(b)8.3 Money Service Providers

Incorporate agents into the AML compliance programme (training, policies) and conduct ongoing monitoring of agent compliance.

8.3.1(1)(c)8.3 Money Service Providers

Identify and comply with local AML requirements in each jurisdiction of operation (direct or via agents).

8.3.1(1)(d)8.3 Money Service Providers

Screen and assess payment transaction information (payer/payee/beneficiary) to determine SAR reporting need.

8.3.1(1)(e)8.3 Money Service Providers

File SARs in all relevant impacted jurisdictions and provide transaction information to relevant AML authorities as required.

8.3.1(2)8.3 Money Service Providers

Use only reliable, current information sources when assessing payment transactions for SAR purposes.

8.3.1(3)8.3 Money Service Providers

Retain documentation of the SAR assessment process, sources and materials for each assessment.

9.2.1(a)9.2 Correspondent banking

Conduct and document CDD on the prospective respondent bank prior to relationship onset.

9.2.1(b)9.2 Correspondent banking

Collect detailed information on the respondent bank's management, activities and operating jurisdictions as part of due diligence.

9.2.1(c)9.2 Correspondent banking

Research and document the respondent bank's reputation, supervisory quality and regulatory/enforcement history using public sources.

9.2.1(d)9.2 Correspondent banking

Perform and document an assessment of the respondent bank's AML control framework against FATF standards.

9.2.1(e)9.2 Correspondent banking

Obtain documented senior management sign-off before onboarding a new correspondent banking relationship.

9.2.1(f)9.2 Correspondent banking

Document the allocation of AML/CDD responsibilities between the Authorised Firm and the respondent bank (e.g., in the correspondent banking agreement).

9.2.1(g)9.2 Correspondent banking

Verify and document the respondent bank's CDD-standard equivalence for direct-access customers and its ability to supply CDD information on request.

9.2.1(h)9.2 Correspondent banking

Prepare and retain a documented rationale confirming all correspondent banking due diligence requirements (a) to (g) are satisfied.

9.2.2(a)9.2 Correspondent banking

Screen prospective respondent banks to confirm they are not Shell Banks before relationship onboarding.

9.2.2(b)9.2 Correspondent banking

Assess and monitor respondent banks, at onboarding and on an ongoing basis, for evidence they permit Shell Bank use of their accounts, and exit relationships where identified.

9.3.3(a)9.3 Electronic fund transfers

Identify and verify payer identity prior to executing any fund transfer where not already done.

9.3.3(b)9.3 Electronic fund transfers

Capture and retain complete transaction detail records for every fund transfer to enable reconstruction.

9.3.49.3 Electronic fund transfers

Populate the payment message with the required minimum payer/payee identifying data for cross-border transfers of $1,000 or less.

9.3.59.3 Electronic fund transfers

Include one additional specified payer identifier in the payment message for higher-value cross-border transfers.

9.3.69.3 Electronic fund transfers

Ensure batch transfer files include verified payer data and complete, traceable payee data for every individual transfer in the batch.

9.3.79.3 Electronic fund transfers

Configure domestic transfer messaging to meet one of the two permitted payer-information standards, and ensure the capability to supply full payer details within the mandated timeframes upon request.

9.3.89.3 Electronic fund transfers

Retain all collected payer/payee information records for fund transfers per record-retention requirements.

9.3.99.3 Electronic fund transfers

Block/reject execution of any fund transfer where required payer/payee information cannot be obtained or recorded as mandated.

9.3.109.3 Electronic fund transfers

Implement monitoring (real-time and/or post-event) to detect incoming cross-border transfers missing required payer/payee data.

9.3.119.3 Electronic fund transfers

Identify and verify payee identity on receipt of cross-border transfers where not already verified.

9.3.129.3 Electronic fund transfers

Retain the complete payer/payee data set accompanying each fund transfer passed through as intermediary.

9.3.139.3 Electronic fund transfers

Retain a five-year record of all payer/payee information received where technical limitations break the information chain.

9.3.149.3 Electronic fund transfers

Implement automated (straight-through-processing-compatible) controls to detect cross-border transfers missing required data while passing through as intermediary.

9.3.159.3 Electronic fund transfers

Develop and maintain documented risk-based policies/procedures for handling fund transfers lacking required payer/payee information (reject, amend, follow-up).

9.3A.29.3A Additional requirements for Crypto Token transfers

Develop, implement and maintain Crypto Token transfer AML policies and procedures, including specific decision criteria for incomplete-information transfers (reject/reverse/delay/permit).

9.3A.39.3A Additional requirements for Crypto Token transfers

Implement Crypto Token transaction monitoring/blockchain analytics capability covering transaction tracing and wallet-address risk screening.

9.3A.4(1)9.3A Additional requirements for Crypto Token transfers

Perform and document VASP counterparty due diligence for every CTT of $1,000 or more before execution.

9.3A.4(2)(a)9.3A Additional requirements for Crypto Token transfers

Establish and record the identity of the VASP counterparty involved in the CTT.

9.3A.4(2)(b)9.3A Additional requirements for Crypto Token transfers

Gather and document information on the VASP's business nature, reputation, and applicable AML regulatory/supervisory regime.

9.3A.4(2)(c)9.3A Additional requirements for Crypto Token transfers

Assess and record the expected nature, volume and value of the Crypto Token transfer as part of due diligence.

9.3A.4(2)(d)9.3A Additional requirements for Crypto Token transfers

Evaluate and document the adequacy and effectiveness of the VASP's AML control framework before proceeding with the CTT.

9.3B.19.3B Additional requirements for NFT and Utility Token transfers

Apply the full set of section 9.3A Crypto Token transfer controls (risk policies, transaction monitoring, VASP counterparty due diligence for transfers of $1,000 or more) to the DNFBP's NFT/Utility Token transfer activity.

9.4.19.4 Audit

Commission and complete periodic independent (internal or external) audit reviews of the AML control framework and compliance status.

10.2.1(1)10.2 Relevant United Nations resolutions and sanctions

Implement an ongoing UN sanctions monitoring and screening programme (systems and controls) covering customers, transactions and counterparties against UN Security Council resolutions/sanctions lists.

10.2.1(2)10.2 Relevant United Nations resolutions and sanctions

Ensure sanctions systems and controls are designed to satisfy the specific requirements of Article 21 of Cabinet Decision No. 74 of 2020 (e.g., applying/cancelling freezing orders, transaction prohibitions, reporting).

10.3.1(1)10.3 Government, regulatory and international findings

Implement a process to monitor, log and assess findings/notices issued by the UAE government, Central Bank, FIU, National Committee, FATF, enforcement agencies and DFSA, and apply resulting countermeasures where relevant.

10.3.1(4)10.3 Government, regulatory and international findings

Confirm findings-monitoring systems and controls are capable of supporting compliance with Article 21 of Cabinet Decision No. 74 of 2020.

10.3.1(5)10.3 Government, regulatory and international findings

File an immediate written notification to the DFSA whenever non-compliance with a finding is identified, including full details of the person and the non-compliance.

11.2.1(1)11.2 Appointment of a MLRO

Appoint a named MLRO with documented responsibility for AML implementation and day-to-day compliance oversight.

11.2.1(2)11.2 Appointment of a MLRO

Conduct and document a suitability, seniority and independence assessment of the MLRO candidate prior to and during appointment.

11.2.1(3)11.2 Appointment of a MLRO

Verify and maintain evidence that the appointed MLRO is UAE-resident, unless the firm is a Registered Auditor or Representative Office, or a residency waiver has been granted by the DFSA.

11.2.311.2 Appointment of a MLRO

Appoint and document a deputy MLRO to act during the MLRO's absence.

11.2.411.2 Appointment of a MLRO

Maintain a proactive DFSA engagement protocol ensuring timely, open disclosure of reportable information.

11.2.511.2 Appointment of a MLRO

Perform due diligence and ongoing monitoring of the suitability of any outsourced MLRO.

11.3.1(a)11.3 Qualities of a MLRO

Assess and document the MLRO's fitness, propriety, competence and AML legislative knowledge.

11.3.1(b)11.3 Qualities of a MLRO

Establish and document a direct reporting line/access channel between the MLRO and senior management.

11.3.1(c)11.3 Qualities of a MLRO

Provide the MLRO with adequate budget, staffing and trained support resources.

11.3.1(d)11.3 Qualities of a MLRO

Position the MLRO role at a sufficiently senior level with independent decision-making authority, free from undue influence.

11.3.1(e)11.3 Qualities of a MLRO

Grant the MLRO unrestricted, timely access to all systems, records and information needed for AML oversight and SAR decision-making.

11.4.1(a)11.4 Responsibilities of a MLRO

Assign the MLRO documented day-to-day operational responsibility for AML compliance oversight.

11.4.1(b)11.4 Responsibilities of a MLRO

Establish and operate a defined internal channel through which employees notify the MLRO of suspicious activity.

11.4.1(c)11.4 Responsibilities of a MLRO

Investigate every internal notification and determine/document the appropriate follow-up action (including SAR assessment).

11.4.1(d)11.4 Responsibilities of a MLRO

File SARs with the FIU whenever required under Federal AML legislation.

11.4.1(e)11.4 Responsibilities of a MLRO

Designate the MLRO as the sole liaison for AML-related regulatory/authority communications.

11.4.1(f)11.4 Responsibilities of a MLRO

Operate a process to track and respond promptly to regulator/authority information requests.

11.4.1(g)11.4 Responsibilities of a MLRO

Ensure the MLRO reviews and actions all Chapter 10 findings/sanctions notices relevant to the firm.

11.4.1(h)11.4 Responsibilities of a MLRO

Design, implement and maintain the firm's AML training curriculum and awareness programme.

11.4.1(i)11.4 Responsibilities of a MLRO

Conduct periodic reviews of AML policies/procedures/systems/controls and produce update recommendations.

12.1.1(a)12.1 Training and awareness

Deliver mandatory AML training to all relevant employees on a regular, risk-based schedule (DFSA expects at least annually for Authorised Firms).

12.1.1(b)12.1 Training and awareness

Design AML training content to cover all required knowledge areas: legislation, internal policies, suspicious activity recognition, notification procedures, ML typologies/trends, roles/responsibilities, and Chapter 10 findings.

12.1.1(c)12.1 Training and awareness

Tailor AML training content by business line/role based on the firm's risk assessment, differentiating risk levels across products/customers/channels.

13.2.113.2 Internal reporting requirements

Implement a transaction/activity monitoring programme (manual and/or automated) designed to detect suspicious activity.

13.2.213.2 Internal reporting requirements

Implement a mandatory, prompt internal escalation procedure requiring employees to notify the MLRO of known/suspected money laundering or terrorist financing.

13.3.1(a)13.3 Suspicious Activity Report

Conduct and document a prompt internal inquiry into every notification received.

13.3.1(b)13.3 Suspicious Activity Report

Make and document a formal SAR-filing determination for every notification received.

13.3.1(c)13.3 Suspicious Activity Report

Submit the SAR to the FIU without delay whenever the determination requires filing.

13.3.1(d)13.3 Suspicious Activity Report

Notify the DFSA immediately after each SAR is filed with the FIU.

13.3.213.3 Suspicious Activity Report

Document the rationale whenever a notification does not result in a SAR filing.

13.3.313.3 Suspicious Activity Report

Ensure governance/policy explicitly protects the MLRO's unfettered authority to file SARs without requiring sign-off from any other person.

13.4 (Guidance para 1)13.4 Tipping-off

Implement and enforce a tipping-off prohibition covering all employees, prohibiting any disclosure of SAR filings, SAR content, or related investigations to customers or third parties.

13.5 (Guidance)13.5 Freezing assets

Maintain a process to immediately implement and comply with any DFSA-imposed restriction or Court order freezing/restraining suspect assets, coordinating with the FIU as required.

14.1.1(1)14.1 Groups, branches and subsidiaries

Extend the group AML policy, procedures, systems and controls to cover all branches, Subsidiaries and DIFC Group entities.

14.1.1(2)14.1 Groups, branches and subsidiaries

Perform a jurisdictional gap analysis comparing local AML requirements to DIFC standards for each overseas branch/Subsidiary and mandate application of the higher standard where local law allows.

14.1.1(3)(a)14.1 Groups, branches and subsidiaries

Submit a written notification to the DFSA identifying the jurisdiction and the specific restriction preventing equivalent/higher AML standards.

14.1.1(3)(b)14.1 Groups, branches and subsidiaries

Design and implement compensating controls/additional risk-mitigation measures for the affected branch/Subsidiary.

14.1.2(a)14.1 Groups, branches and subsidiaries

Distribute current AML policy/procedure documents to all Group entities, branches and Subsidiaries and confirm receipt/acknowledgement.

14.1.2(b)14.1 Groups, branches and subsidiaries

Prepare and retain a documented assessment justifying why the Relevant Person is satisfied the higher-standard requirement is met for each relevant branch/Subsidiary.

14.2.1(a)14.2 Group policies

Develop and maintain a Group information-sharing policy covering CDD and ML risk data exchange between Group entities.

14.2.1(b)14.2 Group policies

Implement confidentiality/data-protection safeguards (access controls, data-sharing agreements) governing intra-Group AML information exchange.

14.2.1(c)14.2 Group policies

Monitor Group-wide ML risk developments and implement mitigating actions for the entity's exposure to Group risk.

14.2.1(d)14.2 Group policies

Provide entity-level ML risk data/input into the Group-wide AML risk assessment.

14.2.1(e)14.2 Group policies

Establish a process for providing customer account/transaction data to Group compliance, audit and AML functions on request for AML purposes.

14.3.114.3 Notifications

Maintain and operate a DFSA notification procedure covering the four trigger events in Rule 14.3.1, ensuring 'as soon as possible' written notification.

14.4.1(a)14.4 Record keeping

Retain complete CDD documentation (initial and ongoing) for each customer for a minimum six-year retention period.

14.4.1(b)14.4 Record keeping

Retain full business-relationship records, transaction records enabling reconstruction, and internal suspicious/unusual activity analysis for six years.

14.4.1(c)14.4 Record keeping

Retain copies of all Rule 13.2.2 notifications for the six-year retention period.

14.4.1(d)14.4 Record keeping

Retain SARs and all supporting documentation/analysis in a secure repository for six years.

14.4.1(e)14.4 Record keeping

Retain all correspondence with the Financial Intelligence Unit for six years.

14.4.1A14.4 Record keeping

Maintain records in a form that permits immediate retrieval and production to the DFSA or law enforcement on request.

14.4.2(a)-(b)14.4 Record keeping

Maintain a documented business-wide ML risk assessment and a record of how it informed the customer risk assessment methodology under Rule 6.1.1(1).

14.4.2(c)-(d)14.4 Record keeping

Maintain documented customer risk assessments and risk-rating determinations for each customer, retrievable on immediate request.

14.4.314.4 Record keeping

Implement controls over offshore record storage arrangements to ensure DIFC-standard compliance, accessibility, and immediate availability for inspection.

14.4.4(a)14.4 Record keeping

Conduct and document a legal review of secrecy/data protection legislation applicable to jurisdictions where AML records are held.

14.4.4(b)14.4 Record keeping

Obtain and store certified copies of affected records in an accessible jurisdiction promptly upon identifying a restrictive legislation issue.

14.4.514.4 Record keeping

Maintain a training log recording dates of training, nature of training, and names of employees trained, for AML training and awareness.

14.5.114.5 Annual AML return

File the annual AML Return on the DFSA portal by 30 September each year for the preceding 1 August-31 July period.

14.6.1(a)14.6 Communication with the DFSA

Embed an open/cooperative-engagement standard for all DFSA interactions in internal policy and staff conduct guidance.

14.6.1(b)14.6 Communication with the DFSA

Ensure all correspondence, filings and meetings with the DFSA are conducted/documented in English.

14.7.114.7 Employee disclosures

Implement whistleblower/non-retaliation protections for employees making AML-related disclosures to the DFSA or other relevant bodies.

15.1.115.1 Registration and notifications

Complete and submit the DNFBP registration application form via the DFSA electronic portal.

15.1.2(1)(a)15.1 Registration and notifications

Compile and submit fit-and-proper evidence (covering senior management, beneficial owners, Group entities and related persons) as part of the registration application.

15.1.2(1)(b)15.1 Registration and notifications

Establish and document AML resources, systems, controls, policies and procedures sufficient to demonstrate registration readiness.

15.1.315.1 Registration and notifications

File the DNFBP annual information return via the DFSA portal by 31 January each year for the preceding calendar year.

15.1.415.1 Registration and notifications

Operate a change-notification process to inform the DFSA of the listed changes via the DFSA portal.

15.2.1(1)15.2 Request to withdraw registration

Submit written notice to the DFSA at least 14 days before ceasing DNFBP business activities.

15.2.1(2)15.2 Request to withdraw registration

Ensure the withdrawal notice package includes the cancellation request, reason explanation, and all relevant supporting documents.

15.3.1(a)15.3 Disclosure of regulatory status

Review all external communications, marketing and stationery to ensure accurate representation of the DNFBP's DFSA regulatory status.

15.3.1(b)15.3 Disclosure of regulatory status

Control use of the DFSA logo, obtaining express written DFSA permission and complying with any use conditions before any use.

15.3A.2(1)15.3A Whistleblowing

Develop and implement a whistleblowing policy covering reporting channels and an assessment/escalation process for regulatory concerns.

15.3A.2(2)15.3A Whistleblowing

Ensure the whistleblowing policy and procedures are documented in writing.

15.3A.2(3)15.3A Whistleblowing

Conduct periodic reviews of the whistleblowing policy and update it as needed.

15.3A.315.3A Whistleblowing

Maintain a whistleblowing log recording each reported regulatory concern and its assessment outcome.

15.4.1(3)15.4 Transitional

One-off 2018 transitional certification obligation; retain historical evidence that the certification was made if the firm was registered as a DNFBP prior to the 2018 commencement date.

16.2.116.2 General

Legacy record-retention bridge obligation; no current action expected as the applicable retention periods (typically around six years) would have expired long before 2026.

16.3.116.3 Specific relief – Ancillary Service Provider and DNFBPs

Automatic one-off deeming provision effective 14 July 2013; no ongoing action, though firms relying on this deemed registration should retain historical evidence of their pre-2013 Ancillary Service Provider/DNFBP status for audit trail purposes.