AML Audit services UAE Checklist for DNFBPs: Risk Assessment, UBO, Screening, Monitoring and Reporting Evidence

# **AML Audit services UAE Checklist for DNFBPs: Risk Assessment, UBO, Screening, Monitoring and Reporting Evidence** Money laundering compliance in the UAE has become increasingly focused on whether businesses can demonstrate that their controls work in practice. For Designated Non-Financial Businesses and Professions (DNFBPs), maintaining an AML policy is only one part of the compliance process. Businesses must also be able to produce reliable evidence showing how risks are identified, customers are assessed, beneficial owners are verified, transactions are monitored and suspicious activity is reported. The UAE introduced Federal Decree by Law No. 10 of 2025 concerning Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, supported by Cabinet Resolution No. 134 of 2025 on the executive regulations. The Ministry of Economy and Tourism also issued updated DNFBP guidance in March 2026. These developments make regular [**AML Audit services UAE**](https://ascglobal.ae/our-services/risk-advisory/aml-audit-services-uae) reviews increasingly relevant for businesses operating under the Ministry's supervision. For Indian-owned companies, entrepreneurs and professional firms operating in Dubai, Abu Dhabi and other UAE emirates, an effective aml audit can help transform AML compliance from a collection of documents into an evidence-based control framework. What Does an AML Audit Mean for UAE DNFBPs? An anti money laundering audit is an independent examination of whether an organisation's AML/CFT/CPF framework is properly designed, implemented and operating as intended. The review normally considers the company's risk assessment, customer due diligence, beneficial ownership controls, sanctions screening, transaction monitoring, suspicious transaction reporting, record keeping, employee training and governance arrangements. The important distinction is between having a policy and being able to demonstrate implementation. A company may have an AML manual, but an auditor may still identify weaknesses if customer files do not match the policy, risk classifications are outdated, UBO information cannot be supported or transaction reviews are not properly documented. The latest UAE DNFBP guidance specifically emphasises periodic review, updating of customer risk classifications and maintaining a risk assessment framework that responds to changes in internal operations and external risk factors. 1. Business-Wide AML Risk Assessment Risk assessment should be the starting point of an AML Audit services UAE checklist. A DNFBP should understand the money laundering, terrorist financing and proliferation financing risks associated with its customers, services, delivery channels and geographic exposure. The March 2026 guidance explains that DNFBPs should maintain an appropriate risk assessment framework and ensure customer risk classifications influence the level of due diligence applied. During an aml audit, auditors can examine whether the business-wide risk assessment covers its actual activities rather than relying on a generic template. Evidence may include the methodology used for scoring risk, customer and geographic risk factors, service-level risks, management approval, documented assumptions and records showing when the assessment was last reviewed. This is particularly relevant where a business has expanded into new services, started dealing with international customers or changed its ownership structure. 2. Customer Risk Classification and CDD Customer Due Diligence is another major area within aml audit services. DNFBPs need to establish who their customers are, verify relevant information and understand the purpose and intended nature of the business relationship. The UAE guidance also requires customer risk profiles to help compare expected customer behaviour with actual activity. An anti money laundering audit should therefore test a sample of customer files rather than simply checking whether CDD forms have been completed. The review should determine whether identification documents are valid, customer information is consistent across records, risk ratings are supported by evidence and enhanced due diligence has been applied where increased risk is identified. For businesses serving international clients, family-owned groups or customers using complex corporate structures, the quality of CDD documentation can become especially important. 3. UBO Identification and Verification Ultimate Beneficial Owner identification is one of the most important elements of the UAE AML framework. The March 2026 DNFBP guidance states that, for legal persons and legal arrangements, DNFBPs must identify natural persons owning or controlling 25% or more of the entity. It also explains that, in certain circumstances, beneficial ownership may need to be examined below the 25% threshold when control is exercised through other arrangements or connected ownership. As part of AML Audit services UAE, auditors should therefore trace ownership through the complete structure instead of relying only on the shareholder names shown on a basic company document. The audit evidence may include incorporation documents, shareholder registers, ownership charts, identification documents, corporate registry records and information concerning individuals who exercise effective control. This can be particularly useful for Indian-owned UAE businesses where ownership may involve family members, overseas holding companies or multiple entities across different jurisdictions. 4. Sanctions, PEP and Adverse Media Screening Screening controls should demonstrate that a business actively checks relevant customers and associated persons against applicable sanctions and other risk indicators. The updated UAE DNFBP guidance addresses sanctions and adverse media screening and expects businesses to consider sanctions exposure when establishing customer risk profiles. The Ministry of Economy and Tourism has also published 2026 circulars concerning updates to high-risk countries and jurisdictions subject to increased monitoring. An aml audit should assess whether screening takes place at onboarding and whether appropriate ongoing screening is performed. The review should also examine how potential matches are investigated and resolved. Evidence should show the screening date, person or entity screened, result, investigation of potential matches, decision-making and escalation where necessary. A screenshot showing that a customer was searched once may not provide the same level of assurance as a complete and consistently maintained screening trail. 5. Transaction Monitoring and Unusual Activity Transaction monitoring is another key area to examine during AML Audit services UAE. Customer activity should be compared with the customer's known profile, expected behaviour, business purpose, risk classification and other relevant information. Higher-risk relationships may require enhanced monitoring and more frequent review. The March 2026 guidance stresses the importance of documented monitoring methods, thresholds and review processes. For a real estate business, for example, auditors may review unusually large transactions, third-party payments, inconsistent customer information or transactions that do not appear aligned with the customer's stated profile. For accounting or corporate service businesses, attention may instead focus on complex ownership structures, unusual fund movements, unexplained transactions or activities involving higher-risk jurisdictions. The objective of an anti money laundering audit is not to assume that an unusual transaction is suspicious. Instead, the objective is to determine whether the business has an appropriate process for identifying, investigating, documenting and escalating unusual activity. 6. Suspicious Transaction Reporting Suspicious Transaction Reporting must also be supported by adequate evidence. Under Federal Decree by Law No. 10 of 2025, the UAE Financial Intelligence Unit receives Suspicious Transaction Reports and related information from financial institutions, DNFBPs and virtual asset service providers. An [**AML Audit services UAE**](https://ascglobal.ae/our-services/risk-advisory/aml-audit-services-uae) review should examine whether the organisation has a defined escalation process and whether employees understand how potentially suspicious activity reaches the responsible compliance function. Auditors may review internal alerts, investigation records, escalation decisions, reporting documentation and evidence supporting cases where no report was ultimately filed. It is also important to verify that employees understand tipping-off restrictions and that confidential suspicious activity information is handled appropriately. 7. AML Governance, Training and Record Keeping A strong AML framework also depends on people and governance. An aml audit should consider whether responsibilities have been clearly allocated to management, the compliance function and other employees involved in customer onboarding or transaction processing. Training records should demonstrate that relevant employees receive appropriate AML/CFT/CPF training and understand the risks associated with their roles. Record keeping should also be tested. Evidence should be organised so that customer due diligence, risk assessments, screening records, monitoring activities, investigation documents and reporting decisions can be retrieved efficiently when required. Good documentation is particularly valuable when businesses need to demonstrate the history of a compliance decision rather than simply its current status. 8. Independent Review and Remediation The purpose of aml audit services is not only to identify deficiencies but also to provide management with a structured view of how those deficiencies can be addressed. The March 2026 DNFBP Guidelines emphasise independent audit arrangements and review of areas such as AML policies, training, transaction monitoring, case management, record keeping and remediation of previous findings. Audit results should be appropriately communicated to senior management and the relevant governance body. A useful audit report should distinguish between documentation gaps, process weaknesses and control failures. Each finding should ideally have a responsible owner, remediation action and target completion date. Final Checklist for UAE DNFBPs For businesses preparing for an AML Audit services UAE review, the central question should be simple: can the organisation prove that its AML framework operates effectively? The evidence should connect risk assessment with customer risk ratings, customer risk ratings with due diligence, UBO information with ownership verification, screening results with investigation records, and transaction alerts with documented decisions and reporting where required. The UAE's current AML legislation and the updated 2026 DNFBP guidance make an evidence-based approach increasingly important. ASC Global UAE provides AML Audit services UAE support for businesses seeking a structured review of their AML controls, documentation and compliance evidence. For Indian entrepreneurs and growing UAE businesses, conducting periodic reviews can help management identify gaps early and maintain a more organised, transparent and audit-ready compliance framework. Authentic Sources Consulted UAE Ministry of Economy and Tourism – Anti-Money Laundering Crimes Legislations UAE Ministry of Economy and Tourism – DNFBP Guidelines, March 2026 Federal Decree by Law No. 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing UAE Ministry of Economy and Tourism – 2026 AML/CFT/CPF Circulars