Your UAE AML Policy May Already Be Out of Date: 7 Mistakes That Fail an MOE Inspection

Regulators don’t just want an AML policy — they want a current, accurate, activity-specific one that matches what you actually do. With the UAE’s framework overhauled in 2025 and a FATF evaluation on the horizon, examiners are reading these documents closely. Here are the seven mistakes that turn a policy into a finding.

Citing laws that have been repealed

This is the fastest finding of all. The legal foundation has moved twice in recent years, and most template policies haven’t kept up:

• The AML law itself — Federal Decree-Law No. 10 of 2025 (effective 14 October 2025) repealed and replaced Federal Decree-Law 20 of 2018 (as amended by 26/2021 and 7/2024), and added a proliferation-financing framework. A policy citing 20/2018 as the governing law is now behind.
• Beneficial ownership — Cabinet Decision 58/2020 was repealed; UBO procedures now sit under Cabinet Decision 109 of 2023.
• UBO penalties — Cabinet Resolution 53/2021 was replaced by Cabinet Decision 132 of 2023.

The rules those instruments contained (like the 15-working-day UBO update requirement) largely survive — they’ve just been re-anchored to the new law. A policy that cites the old numbers looks, to an examiner, like it was never reviewed.

Getting the CDD scope wrong for real estate brokers

Real estate brokers and agents are DNFBPs (Designated Non-Financial Businesses and Professions), and their CDD rule is stricter than many policies assume: brokers must apply customer due diligence on every purchase/sale transaction they broker — there is no de minimis threshold. The AED 55,000 figure that appears in so many policies is the cash (and virtual-asset) trigger for filing a Real Estate Activity Report (REAR) with the FIU — not a CDD threshold. A policy that only does CDD above AED 55,000 leaves every smaller deal uncovered — direct non-compliance.

Treating CDD as something only “high-risk” customers get

The PEP “sunset” that doesn’t exist

Many policies declassify a Politically Exposed Person a fixed period — often 12 months — after they leave office. The UAE definition covers persons who are or have been entrusted with prominent public functions, with no automatic expiry. Former-PEP treatment is risk-based only: status continues after office, and any downgrade must come through a documented risk assessment approved by the MLRO — not a calendar.

Wrong citations (and confusion) around STR/SAR and TFS

Suspicious Transaction / Activity Reports and Targeted Financial Sanctions are different obligations under different rules, and policies routinely cross-wire them — for example citing a terrorism-list (TFS) instrument for STR/SAR timelines. STRs/SARs must be filed without delay via goAML; sanctions freezes must be actioned immediately with the relevant report filed in the regulator’s specified window. Internal SLAs (say 24–48 hours) are fine — but the policy must cite the correct legal source and not contradict itself on timing.

An unnamed or over-committed MLRO

Two related governance gaps: the MLRO is left blank in the approval block, and the policy promises the MLRO role “is not combined with any other function.” For a small brokerage that’s often untrue on day one — creating a policy-versus-practice gap an inspector will probe. Name the MLRO, and where roles genuinely overlap, commit to the defensible standard: not combined with conflicting, revenue-generating functions.

Structural and reference errors that signal “never reviewed”

• Missing section headings (a table of contents that lists sections the body doesn’t actually have).
• “Federal Law No. 20 of 2018” where it should read “Federal Decree-Law” — small, but examiners notice.
• Referencing an outdated National Risk Assessment instead of the current National Strategy for AML/CFT/CPF 2024–2027.

The 2026 legal stack your AML policy must reflect

Get those right, apply CDD to everyone, fix the broker CDD scope and the PEP rule, name your MLRO — and your policy stops being an inspection risk. If yours still reads like 2021, it’s time for a refresh. (See also our guide to a free-zone AML inspection and remediation.)