Internal Controls for AML Compliance

Introduction

In the fight against money laundering and terrorist financing, strong internal controls are the backbone of an effective Anti-Money Laundering (AML) compliance program. For financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs) in the UAE—including jewellers, real estate brokers, lawyers, accountants, and trust service providers—implementing robust internal controls is not just a best practice but a regulatory requirement under Federal Decree-Law No. 20 of 2018, Cabinet Decision No. 10 of 2019, and guidance from supervisory authorities such as the Ministry of Economy, DFSA (DIFC), and FSRA (ADGM).

Internal controls ensure that AML policies move beyond paper and are embedded into daily business operations, enabling businesses to detect, prevent, and report suspicious activity effectively.

________________________________________

1. Governance and Oversight

• Board and Senior Management Accountability: The board of directors and senior management are responsible for approving AML policies and ensuring they are implemented across the organization.

• Tone from the Top: Leadership must demonstrate commitment to AML compliance, setting the standard for organizational culture.

________________________________________

2. Appointment of MLRO / Compliance Officer

• A dedicated Money Laundering Reporting Officer (MLRO) must be appointed.

• The MLRO should have independence, authority, and access to all relevant data.

• Responsibilities include oversight of AML policies, monitoring, reporting to the FIU via goAML, and serving as the main contact point for regulators.

________________________________________

3. Written Policies and Procedures

• AML Policy Manual: A comprehensive manual should outline customer due diligence, reporting, monitoring, sanctions screening, escalation, and record-keeping requirements.

• Updates: Policies must be reviewed regularly to reflect new FATF recommendations and UAE regulatory changes.

________________________________________

4. Risk-Based Approach (RBA)

• Conduct enterprise-wide risk assessments considering customer profiles, geography, products, and delivery channels.

• Classify customers into low, medium, and high-risk categories.

• Allocate enhanced monitoring to high-risk clients (e.g., Politically Exposed Persons – PEPs).

________________________________________

5. Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)

• Establish standard onboarding procedures with reliable identification documents.

• Apply EDD where risks are higher, including verification of the Ultimate Beneficial Owner (UBO).

• Monitor for unusual or complex transactions inconsistent with customer profiles.

________________________________________

6. Transaction Monitoring Systems

• Implement automated or manual systems to flag suspicious activities such as:

o Structuring (smurfing) of transactions.

o Frequent large cash transactions.

o Rapid movement of funds without clear purpose.

• Ensure red flag alerts are reviewed promptly by compliance staff.

________________________________________

7. Reporting Mechanisms

• Suspicious Transaction Reports (STRs): File promptly with the FIU via goAML.

• Large Cash Transaction Reports (LCTRs): Mandatory for cash transactions over AED 55,000.

• Sector-Specific Reports: DNFBPs like jewellers must also file DPMSR reports when required.

________________________________________

8. Segregation of Duties and Internal Checks

• Avoid conflict of interest by separating responsibilities between staff handling onboarding, transaction processing, and compliance review.

• Regular spot checks and internal audits strengthen accountability.

________________________________________

9. Training and Awareness

• Provide regular AML training to employees across all levels.

• Training should cover AML laws, customer due diligence, red flags, and reporting procedures.

• Maintain logs of all training sessions for regulatory inspection.

________________________________________

10. Record Keeping

• Maintain all customer records, identification documents, and transaction histories for at least five years.

• Ensure records are accessible during inspections or audits by regulators.

________________________________________

11. Independent Testing and Audit

• Conduct regular independent AML audits to test the effectiveness of internal controls.

• Audits should assess compliance with UAE laws, FIU reporting requirements, and FATF standards.

• Findings must be documented and addressed with corrective actions.

________________________________________

12. Continuous Improvement

• Internal controls must evolve with emerging risks, technological changes, and new regulatory requirements.

• Establish a cycle of policy review, staff training, and system upgrades to maintain effectiveness.

________________________________________

Conclusion

Internal controls are not a one-time exercise but an ongoing discipline that integrates governance, risk management, monitoring, reporting, and training. For DNFBPs and financial institutions in the UAE, a strong system of AML internal controls ensures compliance with regulations, mitigates financial crime risks, and enhances trust with clients and regulators.

A business with weak controls risks heavy penalties, reputational damage, and regulatory sanctions, while those with robust systems demonstrate resilience and integrity in the global marketplace.

________________________________________

About Us

Sheikh Anwar Accounting and Auditing LLC is a Dubai-based auditing and compliance advisory firm specializing in AML frameworks, corporate tax, VAT, and transfer pricing. We support businesses in designing and testing AML internal controls to meet UAE regulations and FATF standards, ensuring operational integrity and regulatory compliance.

📍 Address: Dubai Creek Tower, M 35, Dubai, UAE

📞 Contact: info@sa-auditors.com | +971-XXX-XXXX

🌐 Website: www.sa-auditors.com