Anti-Money Laundering Audit Requirements in UAE (2026)

AML audits are now mandatory for most UAE businesses. Following the UAE's FATF grey-listing in 2022 and subsequent delisting in 2024, the Federal AML framework has undergone a complete overhaul. Every designated non-financial business and profession (DNFBP) and every financial institution must now demonstrate robust anti-money laundering controls — and prove it through independent audits.

The consequences of failure are severe. The Financial Intelligence Unit (FIU) and sectoral supervisory bodies have issued fines exceeding AED 10 million for AML deficiencies. Some companies have lost their licences entirely. The era of treating AML as a checkbox exercise is over.

This guide covers every aspect of AML audit requirements in the UAE for 2026 — who needs one, what auditors examine, the regulatory framework, common deficiencies, and preparation strategies. For professional audit support, visit the FindCPA auditor directory.

See also: Compliance Audit for Regulated Industries, IT Audit and Data Security, Forensic Accounting in UAE.

What Is an AML Audit in the UAE?

An AML audit is an independent assessment of whether a business has implemented adequate anti-money laundering and counter-terrorist financing (AML/CTF) controls as required by UAE Federal Decree-Law No. 20 of 2018, its implementing regulations, and applicable sectoral guidance. The audit evaluates policies, procedures, customer due diligence records, transaction monitoring, suspicious activity reporting, sanctions screening, and employee training programmes.

The distinction between a statutory financial audit and an AML audit is critical to understand.

A financial audit examines whether your financial statements present a true and fair view. An AML audit examines whether your internal controls effectively prevent your business from being used as a channel for money laundering or terrorist financing.

AML audit vs. financial audit:

The regulatory framework. UAE AML legislation operates on three levels:

1. Federal Decree-Law No. 20 of 2018 (amended) — the primary AML law
2. Cabinet Decision No. 10 of 2019 (amended) — implementing regulations
3. Sectoral guidance — issued by each supervisory authority (CBUAE, SCA, DFSA, FSRA, Ministry of Economy, Ministry of Justice)

Each supervisory authority translates the federal requirements into sector-specific audit expectations.

Who Must Undergo an AML Audit in the UAE?

All financial institutions (banks, exchange houses, insurance companies, finance companies, payment service providers) and all designated non-financial businesses and professions (DNFBPs) — including auditors, accountants, real estate agents, dealers in precious metals and stones, corporate service providers, and lawyers — must undergo AML audits. The supervisory authority for each category determines the audit frequency, scope, and reporting requirements.

The scope of AML audit requirements in the UAE is broader than many business owners realise.

Entities subject to AML audit requirements:

Common misconception. Many small businesses believe AML audits only apply to banks. This is incorrect. If you are a real estate brokerage, a gold dealer, an accounting firm, or a corporate service provider, you are a DNFBP and you must have an AML compliance programme — and prove its effectiveness through an independent audit.

Free zone companies. Free zone authorities are increasingly mandating AML audits for their licensed entities, particularly in DIFC, ADGM, DMCC, and DAFZA. Even if a free zone has not yet mandated a formal AML audit, the federal law still requires all businesses to maintain AML controls.

What Do AML Auditors Examine?

AML auditors examine seven core areas: governance and compliance structure, risk assessment methodology, customer due diligence (CDD) and know-your-customer (KYC) records, ongoing monitoring and transaction surveillance, suspicious activity report (SAR) filing procedures, sanctions and PEP screening, and employee training and awareness programmes. The depth of examination depends on the entity's risk profile and regulatory category.

The audit scope is comprehensive and documentation-intensive.

Core audit areas and what auditors look for:

1. Governance and compliance structure. Auditors verify that the company has appointed a qualified compliance officer, that the compliance function reports directly to senior management or the board, that the compliance officer has adequate authority and resources, and that the board demonstrates active AML oversight through documented meeting minutes.

2. Enterprise-wide risk assessment. Every UAE business subject to AML requirements must conduct and document an enterprise-wide money laundering risk assessment. Auditors evaluate whether the risk assessment covers all products, services, customers, delivery channels, and geographic exposure. They check whether the methodology is documented, whether risks are rated consistently, and whether mitigating controls are proportionate to identified risks.

3. Customer due diligence (CDD). This is where most audit findings occur. Auditors sample customer files and verify:

• Identity verification documents are valid and properly certified
• Beneficial ownership is identified to the ultimate natural person
• Source of funds and source of wealth are documented
• Risk rating is assigned and justified
• Enhanced due diligence (EDD) is applied to high-risk customers
• CDD is refreshed at intervals proportionate to risk rating

4. Transaction monitoring. Auditors assess whether the company has systems to detect unusual or suspicious transactions. For financial institutions, this means automated monitoring systems with documented thresholds and calibration logic. For DNFBPs, this may mean manual monitoring procedures with documented criteria for what constitutes unusual activity.

5. Suspicious activity reporting. Auditors check that SARs are filed with the Financial Intelligence Unit (goAML platform) promptly, that the decision to file or not file is documented with reasoning, and that SAR filing does not require approval from the customer relationship owner.

6. Sanctions and PEP screening. Customers and beneficial owners must be screened against UAE sanctions lists, UN sanctions lists, and other applicable lists. Politically exposed persons (PEPs) must be identified and subjected to enhanced due diligence. Auditors verify screening is conducted at onboarding and periodically thereafter.

7. Training. All relevant employees must receive AML training. Auditors check training records, assess whether training content is relevant to employee roles, and verify training frequency meets regulatory expectations.

What Are the Penalties for AML Non-Compliance in the UAE?

UAE AML penalties are among the harshest in the region. Administrative fines range from AED 50,000 to AED 50 million per violation for legal entities. Criminal penalties include imprisonment of up to 10 years and fines up to AED 5 million for individuals. Supervisory authorities can also suspend or revoke licences, appoint external monitors, and impose remediation deadlines with escalating fines for non-compliance.

The penalty framework operates on two tracks: administrative and criminal.

Administrative penalties (imposed by supervisory authorities):

Criminal penalties (imposed by courts):

Money laundering: imprisonment of 1 to 10 years and a fine of AED 100,000 to AED 5,000,000. Terrorist financing: imprisonment of 3 to 15 years.

Recent enforcement trends. The UAE has dramatically increased AML enforcement since the FATF evaluation. In 2025 alone, the CBUAE imposed fines exceeding AED 45 million on exchange houses and financial institutions for AML deficiencies. The Ministry of Economy fined over 200 DNFBPs for failure to register with goAML or maintain adequate compliance programmes.

How Should You Prepare for an AML Audit?

Preparation for an AML audit should begin at least three months before the audit date. Focus on five priorities: completing your annual enterprise risk assessment, conducting a self-assessment of CDD file quality (sample at least 20% of high-risk customers), verifying that all SAR decisions are documented, ensuring sanctions screening is current, and confirming training records are complete for all staff. Address gaps before the auditor arrives — remediation after an audit finding is far more costly.

Effective preparation follows a structured timeline.

Three-month preparation timeline:

Month 1 — Policy and governance review. Update your AML policy to reflect any regulatory changes from the past year. Verify that your compliance officer's appointment letter is current. Review board meeting minutes for evidence of AML oversight. Confirm your goAML registration is active and your designated reporter has current access.

Month 2 — CDD file remediation. This is the most time-intensive step. Pull a sample of customer files across all risk ratings. Check for missing documents, expired identification, undocumented beneficial ownership, and missing source of funds/wealth declarations. Prioritise high-risk and PEP files. Document all remediation actions with dates.

Month 3 — Systems and records. Test your sanctions screening system to confirm lists are current. Run a sample of transactions through your monitoring parameters. Verify that all SARs and non-SAR decisions from the past year are properly documented. Compile training attendance records for all employees.

Documentation the auditor will request:

• AML/CTF policy and procedures manual (current version)
• Enterprise-wide risk assessment (dated within past 12 months)
• Compliance officer appointment letter and job description
• Board/management committee minutes referencing AML oversight
• Customer file samples (auditor selects)
• Transaction monitoring rules and calibration records
• SAR filing log and decision documentation
• Sanctions screening records and match resolution
• Training records and materials
• goAML registration confirmation
• Independent testing or internal audit reports

What Are the Most Common AML Audit Findings?

The five most common AML audit findings in UAE businesses are: incomplete beneficial ownership documentation (especially for multi-layered corporate structures), inadequate risk assessment methodology lacking documented rationale, failure to apply enhanced due diligence to high-risk customers, outdated or uncalibrated transaction monitoring parameters, and insufficient documentation of the decision not to file a suspicious activity report.

Understanding common findings helps you avoid them.

Finding frequency based on 2025 UAE enforcement data:

Beneficial ownership — the number one problem. UAE businesses struggle most with beneficial ownership documentation for corporate customers with complex structures. When a company is owned by another company, which is owned by a holding entity in another jurisdiction, tracing the ultimate beneficial owner requires documentation at every layer. Auditors will flag any customer file where the chain of ownership is not documented to the ultimate natural person holding 25% or more.

Risk assessment methodology. Many businesses complete a risk assessment by filling in a template without documenting why they assigned specific risk ratings. Auditors want to see the reasoning — why is this product high-risk? What data informed this geographic risk rating? A risk assessment without documented rationale is treated as no risk assessment at all.

EDD failures. When a customer is rated high-risk but the file contains the same documentation as a low-risk customer, auditors flag this as a control failure. Enhanced due diligence means additional measures — more frequent CDD updates, senior management approval, source of wealth verification, closer transaction monitoring. If the file shows no evidence of these additional measures, the finding is critical.

How Do AML Audit Requirements Differ by Sector?

AML audit requirements vary significantly by sector in the UAE. Financial institutions face the most prescriptive requirements with specific transaction monitoring system standards and capital-linked thresholds. Real estate agents must demonstrate property transaction CDD. Precious metals dealers need cash transaction controls above AED 55,000. Accountants and auditors must show CDD procedures for client engagements involving company formation, financial transactions, or real estate.

Each supervisory authority tailors AML audit expectations to the sector's specific money laundering risks.

Sector-specific audit focus areas:

Financial institutions. The CBUAE requires automated transaction monitoring systems for banks and exchange houses. Auditors test these systems by running known suspicious patterns through the monitoring parameters to verify they generate alerts. They also examine the alert disposition process — how quickly alerts are investigated, what percentage are closed as false positives, and whether the false positive rate suggests the thresholds need recalibration.

DNFBPs. The Ministry of Economy supervises DNFBPs through a risk-based approach. Not every DNFBP will receive an on-site audit every year, but all must maintain auditable AML programmes. When an audit occurs, it typically focuses on registration with goAML, completion of the enterprise risk assessment, CDD files for a sample of clients, and evidence of employee training.

How Do You Select an AML Auditor?

Select an AML auditor who is approved by your supervisory authority, has specific AML audit experience in your sector, holds relevant certifications (CAMS, ICA Diploma, CFE), employs a risk-based audit methodology aligned with FATF standards, and can provide actionable recommendations — not just findings. Check their track record by requesting references from similar businesses. An AML audit should improve your controls, not just list your weaknesses.

Not all auditors are qualified to conduct AML audits.

Auditor selection criteria:

• Regulatory approval. Some supervisory authorities (CBUAE, DFSA, FSRA) maintain approved auditor lists. Verify your auditor is on the relevant list before engagement.
• AML-specific expertise. A statutory financial audit firm may not have AML audit capabilities. Ask specifically about their AML audit methodology, team qualifications, and the number of AML audits they conduct annually in your sector.
• Certifications. Look for team members holding CAMS (Certified Anti-Money Laundering Specialist), ICA Diploma in Governance Risk and Compliance, or CFE (Certified Fraud Examiner). These certifications indicate specialised knowledge beyond general audit competence.
• Methodology. The auditor should use a risk-based methodology aligned with FATF Recommendations and UAE regulatory expectations. Ask to see their audit programme or methodology document before engagement.
• Remediation support. The best AML auditors provide prioritised recommendations with practical implementation guidance. A report that lists 50 findings without prioritisation or remediation suggestions is unhelpful.

Expected costs. AML audit fees vary significantly based on entity size, complexity, and sector:

Find an Auditor in Dubai →

Frequently Asked Questions

Is an AML audit mandatory for all UAE companies? AML audits are mandatory for all financial institutions and all DNFBPs (accountants, real estate agents, precious metals dealers, lawyers, corporate service providers). Standard trading companies outside these categories are not currently required to undergo a dedicated AML audit, though they must still comply with the federal AML law if they encounter suspicious transactions.

How often must an AML audit be conducted? Most supervisory authorities require an annual AML audit. Some require more frequent assessments — the CBUAE may require quarterly AML reporting from higher-risk financial institutions, and the DFSA requires annual compliance returns with the possibility of ad hoc reviews.

Can the same firm conduct both our financial audit and AML audit? Yes, in most cases the same firm can conduct both audits. However, some supervisory authorities (particularly the CBUAE for banks) may require or recommend that the AML audit be conducted by a separate team or firm to maintain independence. Check your specific regulator's requirements.

What happens if our AML audit reveals significant deficiencies? You will typically receive a remediation deadline from your supervisory authority. Failure to remediate within the deadline triggers escalating fines. For critical findings (such as complete absence of CDD records or failure to file SARs), the supervisory authority may appoint an external monitor or impose immediate restrictions on new customer onboarding.

Keep Reading: Compliance Audit for Regulated Industries · IT Audit and Data Security · Forensic Accounting in UAE · UAE Auditor Directory