An outsourced MLRO in the UAE answers a requirement many companies discover only at their first inspection. A compliance officer here is not a title on the organisation chart but a person the law obliges every reporting entity to appoint: financial institutions, VASPs and all categories of DNFBP. Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 require each such company to have a designated person responsible for AML — the MLRO (Money Laundering Reporting Officer). It is the MLRO who receives internal reports of suspicious transactions, decides whether an STR is filed through goAML, answers requests from the Financial Intelligence Unit (FIU) and prepares the annual report to management.
For a small company in Dubai, keeping such a specialist on the payroll is expensive, and naming a random employee to the role is risky: the company answers for that person’s decisions. Dynasty Business Adviser provides an outsourced AML compliance officer in the UAE: a designated specialist runs your AML function on a monthly subscription — client screening, goAML reporting, liaison with the regulator, the annual report — without anyone joining your staff.
Discuss outsourcing your compliance officer →
Why a company needs an appointed MLRO and what the law says
MLRO in the UAE
Appointing a person responsible for AML is one of the four core obligations an inspector checks first, alongside goAML registration, the AML policy and staff training. The logic of the law is simple: an anti-money laundering system does not work without a specific individual who takes the decisions and carries responsibility for them.
The MLRO must be appointed formally — by a resolution of the company’s manager, with the role written into the AML policy. The MLRO’s details are entered during goAML registration in the UAE: the account in the system is tied to the responsible person, and it is through that account that STRs, SARs and PNMRs are filed. If no MLRO has been appointed, the company cannot meet its reporting obligation at all, and at inspection this is treated as a breach in its own right.
Liability under the new law is an administrative fine of AED 10,000 to AED 5,000,000 per breach, with possible restrictions on the powers of management, suspension or revocation of the licence and publication of the sanction in the media (Article 17 of Federal Decree-Law No. (10) of 2025). No appointed MLRO, no policy and no goAML registration each count as a separate breach. The full breakdown of AML fines and penalties in the UAE is in our article AML fines and penalties in the UAE.
What a compliance officer actually does
The MLRO’s duties are set out in the Executive Regulations and in the company’s AML policy. In practice the work falls into five areas.
- Receiving internal reports. Employees who notice signs of a suspicious transaction pass the information to the MLRO. The MLRO records the report, requests any further details and takes a decision.
- Deciding whether to file an STR. The MLRO assesses whether there are grounds for a suspicious transaction report (STR) or a suspicious activity report (SAR) and, if there are, files it through goAML. The decision and its reasoning are documented — including a decision not to file.
- Liaison with the FIU. The MLRO answers requests from the Financial Intelligence Unit, provides documents and explanations, and carries out instructions to suspend transactions.
- Sanctions screening. Checking clients, their beneficial owners and counterparties against the UAE and UN sanctions lists, identifying PEPs and filing a PNMR where there is a partial name match. How these reports are prepared is covered in STR, SAR and PNMR through goAML.
- Annual report to management. An assessment of how the AML system performed over the year: the number of checks and reports, the risks identified, a review of the risk assessment and the policy, and the training plan.
Table 1 — MLRO functions and what the regulator checks
| Function | What the MLRO does | What the inspector will ask for |
|---|---|---|
| Internal reports | Receives, records, requests further data | Internal reporting log |
| STR / SAR | Takes the decision and files through goAML | Decision register, filing confirmations |
| Liaison with the FIU | Answers requests, carries out instructions | Correspondence and response times |
| Screening | Checks clients and UBOs against lists, files PNMRs | Screening results in client files |
| Annual report | Assesses the system, proposes changes | Report signed by the manager |
Outsourced or in-house: cost and risk compared
The law does not require the MLRO to be an employee. It requires that a responsible person be appointed, hold the necessary qualifications and have access to all of the company’s information. A company therefore has three options: hire a specialist, assign the function to an existing employee or outsource it.
Table 2 — Options for appointing an MLRO
| Criterion | In-house specialist | Existing employee | Outsourced |
|---|---|---|---|
| Cost | Full salary, visa, insurance | No direct cost, but no qualification either | Fixed monthly subscription |
| Qualification | Depends on who you hire | Usually none | Specialists with practical DNFBP experience |
| Continuity | Leave or resignation — the function stops | Combined with the day job | A team, cover without downtime |
| Liability | Company + employee | Company + employee | Company + contract with SLA |
| Best suited to | Large companies with a high client flow | A stop-gap | Small and medium businesses, groups of companies |
For a company with a single licence and a few dozen clients a year, an in-house MLRO is an unnecessary expense. Assigning the function to an untrained accountant or office manager is the riskiest option of all: at inspection that person will be asked about the procedures and will not be able to answer. Outsourcing solves both problems: the function is performed by a qualified specialist without interruption, at a fixed cost.
Compare the cost of outsourcing for your company →
How our subscription works
Outsourced MLRO services from Dynasty in Dubai are a monthly subscription with a dedicated specialist and a defined service level.
What is included:
- formal appointment of our specialist as the company’s MLRO, with the resolution drawn up and the role entered in the AML policy;
- linking the goAML account to the appointed person, or support with registration if the company is not yet registered;
- screening of new clients, their beneficial owners and counterparties against sanctions lists and for PEP status at onboarding;
- receiving internal reports from staff, taking decisions on STRs, SARs and PNMRs and filing them through goAML;
- responding to requests from the FIU and the supervisory authority, and support during an inspection;
- the annual report to management and the annual review of the risk assessment.
SLA and response times. The time allowed for reviewing an internal report and for answering a request from the regulator is fixed in the contract. FIU requests take priority: work on them starts on the day they are received. Each company is assigned a lead specialist and a deputy — the function does not stop while someone is on leave.
Reporting to you. Every month you receive a summary: how many clients were screened, what decisions were taken, whether the regulator sent any requests. Every MLRO decision is documented and kept on file for at least 5 years.
What stays on your side
Outsourcing the MLRO does not remove the company’s responsibility for complying with the law — it ensures that the obligations are met. A few things remain with you.
Passing on information. Client-facing staff must pass details of new clients to the MLRO in good time and report suspicious transactions. We train them to do this when the subscription starts.
Access to data. The MLRO must have access to client files, transaction data and company documents — otherwise there is no basis for a decision.
Approving documents. The AML policy, the risk assessment and the annual report are signed by the company’s manager. If these documents do not yet exist, drafting them is a separate service.
Business decisions. The MLRO recommends declining a high-risk client or requesting additional documents; the final decision on whether to work with a client is taken by management — and management carries responsibility for it.
Sector specifics
The MLRO function is the same in law, but the substance of the work differs from one sector to another.
- Real estate. The bulk of the work is checking buyers and the source of funds in each transaction, and identifying PEPs and non-residents from higher-risk jurisdictions. More in AML for real estate agents in Dubai.
- Gold and jewellery (DPMS). Monitoring cash transactions from AED 55,000, checking counterparties along the supply chain, and taking DMCC requirements into account. More in AML for DPMS in the UAE.
- Crypto and VASPs. Obligations at the level of a financial institution, a threshold of AED 3,500 for occasional transactions, transaction monitoring and dealings with the sector regulator. More in AML for VASPs in the UAE.
- Corporate service providers. Checking founders and UBOs at company formation, controls over nominee services, and updating beneficial ownership data within 15 working days. This is our own DNFBP category, so we know the procedures from the inside.
How we work
- Diagnostic. We review the licence, the activities, the client base and the current state of the AML system: whether there is a goAML registration, a policy, training.
- Appointment. We prepare the resolution appointing the MLRO, amend the AML policy and link the goAML account.
- Launch. We set up the procedure for staff to pass on information, brief the team and begin screening the existing client base.
- Ongoing service. We run the function on subscription: screening, decisions, reporting, answers to the regulator and a monthly summary for you.
- Annual cycle. We prepare the annual report, review the risk assessment and update the policy when the law or the business changes.
If the company has no goAML registration or AML policy yet, that work is completed before the subscription starts — separately or as part of our end-to-end AML/CFT compliance services in Dubai and the UAE.
Cost
Outsourced compliance officer services are paid as a monthly subscription. The amount depends on the company’s category, the number of licences in the group and the volume of client flow: a real estate agency with a few dozen transactions a year and a corporate service provider with hundreds of incorporations place different demands on the MLRO.
The subscription covers the appointment of the specialist, client screening, decisions and reporting on STRs, SARs and PNMRs, liaison with the regulator, the monthly summary and the annual report. The cost is fixed in the contract after a free diagnostic. One-off work — goAML registration and drafting the AML documents — is not part of the subscription and is charged separately.
Appoint an MLRO before the regulator notices you have none
Send us your type of activity and the number of companies — within one working day we will tell you the best way to formalise the appointment and quote the subscription cost.
WhatsApp / phone: +971 52 634 1022
Get a free diagnostic →
Information current as of October 2026. Legal basis: UAE Federal Decree-Law No. (10) of 2025, UAE Cabinet Resolution No. (134) of 2025. This page is for general information only and does not constitute legal advice.
