AML compliance services in Dubai, UAE
Understand your risks. Put controls into practice.
Brainstorm Chartered Accountants helps relevant UAE businesses establish, review and strengthen risk-based AML programmes. Connect policies, customer checks, screening, monitoring and reporting with clear responsibilities and evidence.
What does AML compliance involve?
AML compliance services help relevant businesses manage money-laundering, terrorist-financing and proliferation-financing risks through due diligence, monitoring, reporting and governance.
Controls that work.
- Identify and assess risk
- Document your decisions
- Review and improve
Start with business risk
Assess customers, jurisdictions, products, services, payment methods, ownership structures and delivery channels. Use the findings to design proportionate controls.
Know the customer and beneficial owner
Identify and verify who you are dealing with, who ultimately owns or controls the customer, and the purpose and expected activity of the relationship.
Monitor, escalate and report
Review activity throughout the relationship. Document concerns, escalate them through the responsible compliance function and make required reports through the appropriate channels.
Demonstrate implementation
Retain evidence of checks, decisions, approvals, staff training and corrective action. Review whether the controls operate as described in your policies.
AML means Anti-Money Laundering. CFT means Combating the Financing of Terrorism. CPF means Combating Proliferation Financing.
Current rules.
Business-specific application.
Your obligations depend on your regulated activities and supervisory framework. A policy template or portal registration alone does not establish compliance.
The federal framework
The framework includes Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. The executive regulations became effective on 14 December 2025. Relevant sector guidance and supervisory requirements must also be considered.
Our support translates applicable requirements into risk assessments, procedures, responsibilities and evidence for your business.
AML support for relevant DNFBPs.
Designated Non-Financial Businesses and Professions include the categories below. Confirm applicability from your activities and regulator; the list is not a substitute for an entity-specific assessment.
Real estate agents & brokers
Review customer identity, beneficial ownership, corporate buyers, third-party payments and cross-border exposure relevant to your transactions.
Precious metals & stones dealers
Assess high-value goods, cash exposure, intermediaries, trade flows, customer profiles and supply-chain risks.
Auditors & accountants
Determine which professional activities fall within the applicable AML framework, then establish suitable customer and transaction controls.
Trust & company service providers
Understand legal entities, shareholders, directors, authorised representatives and the individuals who ultimately own or control the customer.
We support relevant businesses across Dubai, the UAE mainland and all free zones. Free-zone status alone does not remove applicable AML obligations.
From assessment
to working controls.
Choose an initial review, a new framework or focused support for identified gaps. The engagement is scoped around your sector, operating model and risk profile.
Health check & remediation
Understand your current position
Review policies, files, risk assessments and controls. Identify operational gaps and prioritise corrective actions by risk, urgency, owner and evidence needed for closure.
Discuss AML supportBusiness & customer risk
Apply proportionate controls
Develop enterprise-wide and customer risk assessments covering geography, activity, transactions, ownership, products and delivery channels. Document the methodology and reassessment triggers.
Discuss AML supportPolicies & governance
Make responsibilities explicit
Create or update AML/CFT/CPF procedures. Support compliance-officer and MLRO workflows, management oversight, customer acceptance, approvals and escalation responsibilities.
Discuss AML supportKYC, CDD & beneficial ownership
Understand who you deal with
Verify customer identity, corporate records, authorised representatives and ultimate beneficial owners. Document business purpose, expected activity and the resulting customer risk rating.
Discuss AML supportEDD, funds & wealth
Examine higher-risk relationships
Apply additional checks where required: ownership analysis, source of funds, source of wealth, supporting evidence, management approval and enhanced monitoring.
Discuss AML supportPEP & sanctions screening
Review alerts and retain decisions
Establish screening, potential-match review, false-positive analysis, escalation and required action procedures. Address PEP risk and targeted financial sanctions with appropriate evidence.
Discuss AML supportMonitoring, reporting & goAML
Connect concerns to the right action
Develop ongoing monitoring, red-flag and STR/SAR workflows. Support goAML readiness, registration documentation, user requirements and reporting procedures.
Discuss AML supportTraining & record keeping
Help staff act and document
Provide role-based training on risks, due diligence, screening, red flags, confidentiality and escalation. Establish records that reconstruct checks, decisions and approvals.
Discuss AML supportIndependent review & inspections
Test the framework in practice
Review customer files, governance and control effectiveness with appropriate independence. Prepare inspection evidence and track findings, root causes, remediation and completion.
Discuss AML supportThe right checks.
The right depth.
A risk-based approach connects identity, ownership, expected activity and ongoing review. More complex or higher-risk situations may require additional evidence and controls.
KYC and customer identification
Collect and verify appropriate identity or corporate documents, trade licence, address, activities, signatory authority and the purpose of the relationship. Evaluate the information rather than simply storing it.
UBO and ownership analysis
Trace ownership and control through relevant layers to the natural persons who ultimately own or control the entity under applicable criteria. Document verification and unresolved questions.
CDD and customer risk rating
Understand the business, expected transactions and geographic exposure. Apply the approved methodology, screening, customer acceptance procedures and ongoing monitoring.
EDD for higher risk
Document why enhanced checks are required and what was done. Measures may include additional verification, detailed transaction explanations, management approval and closer monitoring.
Source of funds versus source of wealth
Source of funds concerns the origin of money in the transaction or relationship. Source of wealth concerns how overall wealth was accumulated. Evidence should fit the circumstances.
PEPs and sanctions are distinct
PEP status does not establish wrongdoing; apply the relevant risk controls. A potential sanctions match requires prompt assessment and action under applicable targeted financial sanctions procedures.
Recognise concerns.
Escalate responsibly.
Monitoring compares activity with the customer’s profile, expected transactions and economic purpose. A warning sign calls for assessment; it is not automatically proof of a crime.
Red flags to assess
Examples include unexplained third-party payments, unclear beneficial owners, unusual cash activity, inconsistent documents, unexpected jurisdictions, rapid fund movements and reluctance to provide information.
A documented escalation route
Define who receives internal concerns, evaluates evidence, decides reporting actions and retains the record. Protect confidentiality and address tipping-off risk in staff procedures.
Required suspicious transaction or activity reports must be made promptly to the UAE Financial Intelligence Unit through the applicable reporting process. Do not wait for a routine compliance review to address a live reporting obligation.
goAML registration is one part of compliance.
Ministry guidance requires DNFBPs to register on goAML. We support readiness, registration information and STR/SAR procedures. The reporting entity and its responsible compliance function retain their statutory duties.
STR means Suspicious Transaction Report. SAR means Suspicious Activity Report. Registration must be accompanied by suitable risk assessments, customer checks, monitoring, governance, training and records.
A framework built
around your operations.
Move from understanding risk to documented implementation and ongoing review.
Understand the business
Review activities, customers, services, ownership, jurisdictions, payment methods and operating model.
Map financial-crime risk
Assess customer, geographic, product, service, transaction, delivery-channel and ownership exposure.
Review existing controls
Examine policies, files, screening, monitoring, reporting procedures and training evidence.
Prioritise the gaps
Document weaknesses and agree remediation priorities based on risk and urgency.
Build or update the framework
Develop the required methodologies, procedures, forms, checklists and escalation routes.
Implement the controls
Translate procedures into workflows with clear responsibilities and decision records.
Train relevant staff
Use practical, role-specific guidance so employees understand checks, red flags and escalation.
Review effectiveness
Test controls and update them when regulation, risks, customers or business activities change.
Can you show
what happened and why?
An assessment starts with your existing framework and representative evidence. The final request list depends on scope and confidentiality requirements.
Business and governance information
Trade licence, activities, ownership structure, supervisory details, organisational roles, compliance responsibilities and management reporting.
Policies and risk assessments
Current AML/CFT/CPF manual, enterprise-wide assessment, customer-risk methodology, forms, review history and remediation plans.
Customer and due-diligence evidence
Identity and corporate records, UBO evidence, risk ratings, screening results, CDD/EDD records, relevant funds or wealth evidence and approvals.
Monitoring and review records
Monitoring procedures, alert decisions, reporting workflows, training logs, testing results and corrective-action evidence. Share sensitive material only through agreed secure channels.
Check your control coverage
- Assigned governance and management oversight.
- Business-wide and customer risk assessments.
- KYC, UBO verification and proportionate CDD/EDD.
- PEP, sanctions and higher-risk relationship controls.
- Ongoing monitoring and customer reassessment.
- Internal escalation, reporting and confidentiality.
- Training, record keeping and compliance testing.
- Independent review and tracked remediation.
Frequent gaps include generic policies, outdated assessments, missing UBO evidence, unsupported EDD decisions and screening without a retained decision trail.
Professional insight.
Practical implementation.
Our Dubai-based team considers the connections between financial records, ownership structures, business activity and compliance controls.
Risk-based support
Tailor the work to your customers, sector, complexity and actual exposure rather than treating every relationship identically.
Operational clarity
Connect policies with procedures, forms, responsibilities, evidence and monitoring that employees can understand.
Reviewable outcomes
Document findings, risks, root causes, action owners and priorities. Track evidence of remediation and revisit control effectiveness.
Clarity before you begin.
Understand the scope, responsibilities and practical purpose of your AML programme.
What do AML compliance services cover?
Support can include risk assessments, policies, customer and beneficial-owner checks, screening, monitoring, goAML procedures, training and compliance reviews. The agreed scope reflects your business and supervisory requirements.
Who needs DNFBP compliance support?
Relevant categories include real estate agents and brokers, precious metals and stones dealers, auditors and accountants, and trust or company service providers. Applicability depends on the activities performed and the regulatory framework.
Is goAML registration the same as full compliance?
No. Registration provides access to a reporting platform. An AML programme also needs appropriate risk assessment, due diligence, monitoring, governance, reporting procedures, training and record keeping.
Does every customer need enhanced due diligence?
No. Apply due diligence according to risk and applicable requirements. Higher-risk relationships can require additional verification, funds and wealth checks, management approval and enhanced monitoring.
Does PEP status or unusual activity prove wrongdoing?
No. PEP status and transaction red flags require appropriate assessment and controls. Decisions should consider the facts, supporting evidence and applicable requirements.
Can you review an existing AML manual or KYC files?
Yes. A review can assess outdated provisions, missing procedures, customer records, UBO evidence, risk ratings, screening, EDD and inconsistencies between policy and actual practice.
Can you help prepare for an inspection?
Yes. Readiness support can review governance, policies, risk assessments, customer files, monitoring, training and remediation evidence. It does not guarantee a particular regulatory outcome.
How often should policies and customer ratings be reviewed?
Keep policies current when regulation, activities, risks or processes change. Customer reviews should follow applicable requirements and the approved risk-based schedule, with closer monitoring for higher risk.
Do you support businesses in all free zones?
Yes, for relevant activities and subject to the applicable supervisory framework. Free-zone incorporation does not by itself determine whether AML duties apply.
What should we do if the programme is outdated?
Start with a gap assessment and prioritised remediation plan. Address urgent concerns through your responsible compliance function while updating the wider framework.
Build confidence in your controls.
Tell us your sector, activities, supervisory framework, existing AML arrangements and the areas you want reviewed. We’ll discuss the appropriate assessment scope and next steps.