AML Compliance Officer Duties in the UAE

If you run a RAK ICC registered agent, a corporate service provider or any other designated business, appointing an AML compliance officer is not optional — it is a legal requirement. The role, and the exact duties that come with it, are defined by Article 21 of Cabinet Decision No. 10 of 2019, the implementing regulation of Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism. This guide sets out the five statutory AML compliance officer duties in full, explains the Declaration and Confirmation a RAK ICC agent files with the Registrar, and shows how our AML compliance team builds a function that stands up to a Ministry of Economy inspection.

What is an AML compliance officer under UAE law?

An AML compliance officer (sometimes called the AMLCO or, where the reporting role is emphasised, the MLRO) is the individual a regulated business appoints to own its anti-money-laundering and counter-terrorist-financing programme. The requirement flows from Federal Decree-Law No. 20 of 2018 and is given detail by Cabinet Decision No. 10 of 2019. Article 20 of that Decision deals with the appointment; Article 21 sets out the tasks the officer must actually perform.

The officer is expected to be independent, sufficiently senior, and resourced to do the job properly. In practice they sit at the centre of the firm's controls: they decide whether a transaction is suspicious, whether to file a report, how policies are kept current, and how staff are trained. Because the role carries real legal weight, the UAE framework treats a weak or absentee compliance officer as a compliance failure in its own right — not a mere internal HR matter.

Why does a RAK ICC registered agent need a compliance officer?

RAK ICC registered agents form and administer companies, which places them squarely within the population of DNFBPs that the UAE AML framework regulates. Corporate service providers, auditors, real estate brokers, dealers in precious metals and stones, and certain legal professionals all fall in the same bracket. Every one of them must appoint a compliance officer and operate an AML/CFT programme — the same discipline that underpins compliant UAE company incorporation.

RAK ICC reinforces this with a specific document: a Declaration and Confirmation addressed to the Registrar, in which the registered agent confirms that its appointed compliance officer complies with the tasks in Section 8 Article 21 of Cabinet Decision No. 10 of 2019. In other words, RAK ICC does not just assume agents are compliant — it asks them to put it in writing, signed by an authorised signatory. That makes the five Article 21 tasks the exact benchmark every agent is measured against.

What are the five key tasks of the compliance officer (Article 21)?

Article 21 of Cabinet Decision No. 10 of 2019 lists five key tasks. These are the duties a RAK ICC registered agent confirms its compliance officer performs, and the checklist any Supervisory Authority will test against. The table summarises each task and how often it applies.

The rest of this guide takes each task in turn, because the difference between a compliant agent and a penalised one is almost always in the detail of how these five duties are actually carried out.

Tasks 1 and 2: detecting and reporting suspicious transactions

The first two tasks are the heart of the role. Task 1 requires the officer to detect transactions relating to any crime — which in practice means monitoring client activity for red flags. Task 2 goes further: the officer must review, scrutinise and study records, receive data on suspicious transactions, and then decide either to notify the UAE Financial Intelligence Unit (FIU) or to retain the transaction with documented reasons — all while maintaining complete confidentiality.

Two points matter for compliance. First, suspicious transaction reports (STRs) are filed to the FIU through its goAML portal, so the business must be goAML-registered before any suspicion arises — not after. Second, confidentiality is a legal duty: a compliance officer must not "tip off" a client that a report has been, or may be, made. Getting either wrong — a missed report, or an unlawful disclosure — is exactly the kind of failing that draws enforcement.

Task 3: reviewing AML rules and semi-annual reporting

Task 3 is about keeping the programme alive. The compliance officer must review the internal rules and procedures for combating money laundering and terrorist financing, check that they remain consistent with the Decree-Law and the Decision, assess how well the firm actually applies them, and propose updates where needed. Crucially, the officer must then prepare and submit semi-annual reports on these points to senior management — and send a copy to the relevant Supervisory Authority, enclosed with senior management's remarks and decisions.

This creates a fixed governance rhythm: every six months, the AML programme is reviewed, reported up to leadership, and shared with the regulator. For a RAK ICC registered agent, that semi-annual report is also the evidence trail that backs up the Declaration and Confirmation filed with the Registrar. Skipping it does not just weaken controls — it undermines the very statement the agent has signed.

Task 4: ongoing AML training for employees

Task 4 requires the compliance officer to prepare, execute and document ongoing training and development programmes for the firm's employees on money laundering, terrorist financing, the financing of illegal organisations, and the means to combat them. The emphasis on "ongoing" and "document" is deliberate: a single induction session is not enough, and training that cannot be evidenced counts for little in a review.

Effective programmes are role-specific — front-office staff who onboard clients need CDD and red-flag training, while senior managers need to understand their reporting and governance obligations. Keeping an attendance and content record for each session turns training from a box-tick into defensible evidence that the firm takes its obligations seriously. It is the same standard we apply across our company formation and compliance engagements.

Task 5: cooperating with the Supervisory Authority and FIU

The final task is cooperation. The compliance officer must collaborate with the Supervisory Authority and the FIU, provide them with all requested data, and allow their authorised employees to view the records and documents needed to perform their duties. In practice, this means keeping records organised and retrievable so that a request for information can be answered promptly and completely.

For DNFBPs, the Supervisory Authority is typically the Ministry of Economy, which conducts risk-based inspections. An agent that can produce its CDD files, STR decisions, semi-annual reports and training logs on request demonstrates a functioning programme. One that cannot — even if it technically "has" a compliance officer — signals a control gap. Retaining AML records for at least five years is the baseline expectation that makes this cooperation possible.

How does a registered agent confirm compliance to the RAK ICC Registrar?

RAK ICC operationalises all of this through a short Declaration and Confirmation letter to the Registrar. In it, the registered agent confirms and declares that its appointed compliance officer is compliant and adheres to the Compliance Officer Tasks as stated in Section 8 Article 21 of Cabinet Decision No. 10 of 2019. The letter names the registered agent, names the compliance officer, quotes the five key tasks, and is signed by an authorised signatory.

The document is deceptively simple, but it is a formal attestation. By signing it, the agent is representing to the Registrar that the five Article 21 tasks are genuinely being performed — not merely that a compliance officer exists. That is why the declaration should only be signed once the underlying function is real: goAML registration in place, policies written, training delivered, and the semi-annual reporting cycle running.

What happens if the compliance officer function fails?

UAE AML/CFT obligations are enforced. Administrative penalties for failings — a missing or non-compliant compliance officer, unreported suspicious transactions, inadequate policies or poor record-keeping — are imposed under Federal Decree-Law No. 20 of 2018 and its implementing decisions, and they can be significant [VERIFY current AED range]. For a RAK ICC registered agent, enforcement can also mean regulatory action affecting the agent's ability to operate.

The economics strongly favour getting it right. Setting up a compliant function is a modest, predictable cost; a penalty, remediation exercise and reputational hit are neither.

Who can be a compliance officer, and can you outsource it?

A compliance officer must be competent, independent and senior enough to challenge the business and make reporting decisions without pressure. For larger firms this is an in-house appointment. For many smaller RAK ICC agents and DNFBPs, however, it is more practical to outsource the function to a specialist consultancy that provides the officer, the systems and the reporting as a managed service.

Whichever route you choose, the Article 21 tasks do not change — the standard is the same for in-house and outsourced arrangements. The comparison below shows what a compliant function looks like versus the common shortfalls that attract penalties.

How to set up a compliant AML function

Meeting the Article 21 obligations is a repeatable, five-step process. Follow it and the Registrar declaration becomes an accurate statement rather than an aspiration.

1. Appoint a qualified compliance officer — independent, senior and resourced, whether in-house or outsourced.
2. Register on goAML — set up the FIU account and a workflow for filing suspicious transaction reports.
3. Implement AML policies and CDD — write and apply policies, customer due diligence and a risk assessment aligned to Cabinet Decision No. 10 of 2019.
4. Train staff and schedule reporting — deliver and document ongoing training, and run the semi-annual reporting cycle to senior management and the Supervisory Authority.
5. File the Registrar declaration and retain records — submit the Declaration and Confirmation to RAK ICC and keep AML records for at least five years.

This is the exact workflow our team delivers as a managed AML compliance service, so your controls, evidence and Registrar declaration all line up.