An AML policy and procedures in the UAE are not a box-ticking exercise. They are the second item an inspector asks for, right after confirming goAML registration. Federal Decree-Law No. (10) of 2025 and its Executive Regulations, Cabinet Resolution No. (134) of 2025, require every financial institution, every VASP and all categories of DNFBP to hold a written anti-money laundering policy built on the company’s own risk assessment. A policy downloaded from the internet does not meet that requirement: it says nothing about your clients, your products or the countries you work with, and in most cases it still cites the repealed Federal Decree-Law No. (20) of 2018.
Dynasty Business Adviser drafts AML policies and procedures for a specific company in Dubai and the other emirates: we carry out the risk assessment, write the policy and the CDD/EDD procedures, prepare the KYC forms and hand over a set you can take to a Ministry of Economy inspection or to your bank’s KYC review.
Order your AML policy and procedures →
Which documents a company must hold
The law does not stop at “have a policy”. Cabinet Resolution No. (134) of 2025 describes a whole system of internal documents, and an inspector asks for each one. The minimum set for a DNFBP looks like this:
Table 1 — Mandatory set of AML documents for a company in the UAE
| Document | What it contains | Why the inspector wants it |
|---|---|---|
| AML/CFT policy | Principles, areas of responsibility, appointment of the MLRO, reporting procedure | Confirms the system exists and has been approved by management |
| ML/TF/PF risk assessment | Risks by client, product, country and delivery channel, with an overall risk rating | The basis for every other procedure |
| CDD / EDD / SDD procedures | When standard, enhanced and simplified customer due diligence apply | Shows how the company actually verifies its clients |
| KYC forms | Forms for individuals and legal entities, including UBO identification | Evidence that due diligence is really being carried out |
| Training log | Programme, dates, participants, results | Proof that staff have been trained |
| Record-keeping procedure | What is kept, where and for how long — at least 5 years | The retention requirement of the Regulations |
These documents depend on one another: the CDD procedures follow from the risk assessment, the KYC forms from the procedures, and the training log shows that staff know them. Take one element away and the rest lose their meaning: a policy without a risk assessment is a declaration; a risk assessment without procedures is analysis with no consequences.
The requirement is the same on the mainland and in the free zones. A company in DMCC, IFZA, RAKEZ or Meydan that falls within a DNFBP category must hold the same set as a company with a DED licence; only the supervisor differs — the DFSA and the FSRA in the DIFC and ADGM, and in most other cases the Ministry of Economy. Banks ask any DNFBP for its policy and risk assessment when opening an account and at every annual KYC review, whatever its zone of registration.
The 2025 law also requires companies to take into account the risk of financing the proliferation of weapons of mass destruction (PF). Older policies have no such section, because before the reform there was no separate offence of that kind. The changes are covered in detail in our article the new UAE AML law 10/2025.
Why an AML policy template does not pass inspection
“AML policy template UAE” is one of the most common searches in this field, along with “AML CFT policy template” and “anti money laundering policy UAE PDF”. The logic is simple: the law requires a document, the document is online, download it and the obligation is met. At inspection that logic breaks down for four reasons.
- The template cites a repealed law. Most templates in open circulation were written for Federal Decree-Law No. (20) of 2018 and Cabinet Decision No. (10) of 2019. Both were repealed, on 14 October and 14 December 2025 respectively. The inspector sees an outdated reference on page one and concludes that nobody maintains the system.
- The template contains no assessment of your risks. The Regulations require procedures to be built on a risk assessment of your business specifically. A template “for a company in the UAE” describes a real estate agency in Dubai and a gold dealer in DMCC in identical terms — yet their clients, thresholds and supervisors all differ.
- The thresholds and deadlines do not match the Regulations. Templates written before 2025 have no AED 3,500 threshold for VASPs, no proliferation financing section and no current deadline for updating UBO data.
- The template has not been implemented. The policy sits in a folder, staff have never read it, KYC forms are not completed and there is no training log. The inspector asks an employee two questions about the procedures — and the system falls apart.
That is why we do not sell a template. We draft a set around your activity and help you put it into practice. What a policy must actually contain, point by point, is set out in our article what goes into an AML policy.
Risk assessment: how it is built around a specific business
The assessment of money laundering, terrorist financing and proliferation financing risk is the central document of the set. It determines which clients the company checks under standard due diligence and which under enhanced due diligence, which transactions fall under monitoring and when an STR is filed. An AML risk assessment in the UAE is written from the company’s licence, client base and markets, not from a generic scoring sheet.
We build the assessment across four dimensions:
- Clients. Individuals or legal entities, residents or non-residents, the presence of PEPs, the complexity of ownership structures, the transparency of the UBO.
- Products and services. Which transactions the company carries out for clients, whether cash settlements are involved, whether the company participates in the movement of client funds.
- Geographies. Countries of registration and operation of clients, countries of counterparties, the presence of jurisdictions on FATF lists.
- Delivery channels. Face-to-face dealings or remote onboarding, work through intermediaries, online transactions.
Each dimension is assigned a risk level, and an overall risk profile for the company is derived from them. The procedures follow directly from it: which combination of factors triggers EDD, which additional documents are requested, how often a client file is refreshed. The risk assessment must be revisited whenever the business changes — a new line of activity, a new country, a new type of client — and in any case on a regular basis.
Get a risk assessment for your company →
Thresholds that must be written into the procedures
Cabinet Resolution No. (134) of 2025 sets specific thresholds at which customer due diligence or a special transaction procedure becomes mandatory. A company’s procedures must state them word for word — the inspector checks the figures.
Table 2 — Thresholds under Cabinet Resolution No. (134) of 2025
| Transaction | Threshold | Who it applies to |
|---|---|---|
| Occasional transactions | from AED 55,000 | Financial institutions |
| Occasional wire transfers | from AED 3,500 | Financial institutions |
| Occasional virtual asset transactions | from AED 3,500 | VASPs |
| Cash transactions in precious metals and stones | from AED 55,000 | Dealers in precious metals and stones (DPMS) |
| Transactions in the gaming sector | from AED 11,000 | Commercial gaming operators |
| Beneficial ownership threshold | 25% | All companies when identifying the UBO |
| Record retention period | at least 5 years | All obliged entities |
These figures are what templates written before the reform lack most. If a company handles several types of transaction, each threshold is written into the procedures separately, with the documents to be requested once it is reached. More on the thresholds in our article AML thresholds in the UAE.
The UBO requirements in the UAE use a 25 percent test: the beneficial owner is the natural person who directly or indirectly owns or controls 25% or more of the company. Information on beneficial owners and nominee directors is updated within 15 working days of any change, and the register is kept in the UAE. Where a client’s structure includes a foundation or a trust, identifying the UBO requires a separate procedure — we include that as well.
What we deliver
On completion the company receives a set ready for approval by management and for presentation at inspection:
- an AML/CFT policy describing the system, the roles and the procedure for reporting through goAML;
- an ML/TF/PF risk assessment by client, product, country and delivery channel;
- CDD, EDD and SDD procedures with the criteria for applying each and the list of documents required;
- KYC forms for individuals, for legal entities and for identifying the UBO;
- a transaction monitoring procedure and the decision process for filing STRs, SARs and PNMRs;
- a training log template and a record-keeping procedure with retention of at least 5 years.
Every document cites the current Federal Decree-Law No. (10) of 2025 and Cabinet Resolution No. (134) of 2025 and contains the current thresholds. The policy is approved by the head of the company — we prepare the approval form as well.
Implementation: who we train and in what
Documents only start working once staff understand what to do with them, so the handover of the set comes with implementation.
- The managing director and the MLRO receive a walkthrough of the entire policy: areas of responsibility, the decision process for filing an STR, interaction with the FIU through goAML, and the procedure for reviewing the risk assessment. If the company has no appointed compliance officer, that function can be outsourced.
- Client-facing staff learn how to complete KYC forms, how to tell standard due diligence from enhanced due diligence, how to recognise the signs of a suspicious transaction and how to pass the information to the MLRO. This is where the KYC and CDD requirements in the UAE turn from text into daily practice.
- Accounting and operations are briefed on the thresholds, the record-keeping procedure and transaction monitoring.
The briefing uses the company’s own documents rather than abstract examples: staff work through their own KYC forms, their own thresholds and their own suspicious transaction scenarios. So whichever employee the inspector questions, the answer matches the policy.
The training is recorded in the log: programme, date, participants, results. That log is one of the documents requested at inspection. A full AML/CFT staff training course is a separate service.
How we work
- Diagnostic. We study the licence, the licensed activities, the client base, the countries of operation and the documents the company already has.
- Risk assessment. We build the company’s risk profile by client, product, geography and delivery channel.
- Drafting. We write the policy, the CDD/EDD/SDD procedures, the KYC forms and the monitoring and record-keeping procedures — around your activity and the current law.
- Review. We go through the documents with the managing director and the MLRO and adjust them to the specifics of the business.
- Approval and implementation. We hand over the set, prepare the approval form, brief the staff and complete the training log.
If the company is not yet registered with goAML, it makes sense to run the registration in parallel: the responsible person named in the policy and the goAML account must match.
Timeline and cost
The drafting time depends on the company’s category, the number of licensed activities and the size of the client base: a company with one licence and a homogeneous client base gets its set faster than a group with several lines of business.
The service includes the diagnostic, the risk assessment, the full set of documents, review with the managing director and the MLRO, the approval form and the staff briefing. Payment is a one-off fee. The cost is fixed in the contract before work begins — after a free diagnostic at which we determine your category and the documents you need. If you need the whole AML package at once — goAML registration, documents, MLRO appointment and training — that is our end-to-end AML compliance service.
Get AML documents that pass inspection
Send us your licence and a short description of your clients — within one working day we will tell you which documents you need and quote the cost.
WhatsApp / phone: +971 52 634 1022
Get a free diagnostic →
Information current as of October 2026. Legal basis: UAE Federal Decree-Law No. (10) of 2025, UAE Cabinet Resolution No. (134) of 2025. This page is for general information only and does not constitute legal advice.
