AML compliance and MLRO requirements for businesses in the UAE are important for companies that fall under regulated sectors. In order to fight against illegal financial crimes and increase transparency in all areas of business, the UAE has enacted stricter laws regarding money laundering. Companies that are subject to these AML laws will have to follow different policies, assess risks, keep track of transactions, and report unusual transactions to the appropriate governing authority. Businesses must understand their obligations and have suitable compliance systems to comply with the law and avoid penalties and regulatory action as more laws come into effect.
UAE authorities are enforcing anti-money laundering (AML) regulations on the activities conducted by an organization and not necessarily by its location. As a result, mainland companies and free zone companies that are regulated by an industry will likely be subject to AML compliance. All financial institutions, certain types of regulated non financial companies, all virtual asset service providers and numerous professional and trade organizations will have specific obligations regarding compliance with these rules. A company that does not comply with regulations will be exposed to serious financial penalties, such as fines and restrictions on their business license, as well as damage to its reputation.
Understanding AML Compliance in the UAE
AML compliance means having the procedures, controls and processes your business is able to put in place to help you prevent money laundering or other types of financial crimes. In the UAE, regulated entities are required to identify the risks they are exposed to as well as monitor all financial transactions and report any suspicious activities to the relevant authorities. The purpose of the AML compliance framework is to create a level of transparency and protect the financial infrastructure in the UAE.The key objectives of AML compliance are:
- To prevent money laundering
- To detect suspicious transactions related to finances
- To protect businesses from the risk of financial crime
- To promote regulatory transparency
- To build trust and integrity in the UAE businesses
Which Businesses Must Comply with AML Regulations?
Although not all UAE based businesses must comply with AML regulations, many must comply with anti-money laundering requirements because they are part of one of the categories defined by the law. The AML compliance obligations placed on a company’s business activities are unrelated to its company size or geographic location. The following types of companies must comply with AML regulations:
- Banks
- Exchange Houses
- Insurance Companies
- Finance Companies
- Providers of Payment Services
- Real Estate Agents
- Issuers and Retailers of Precious Metal or Precious Stones
- Independent Accountants and Auditors
- Companies and Trust Service Providers
- Virtual Asset Service Provider (VASP)
AML Requirements for Mainland Companies
Mainland companies are required to follow the AML regulations when conducting business that is regarded as regulated under UAE legislation. It is essential for mainland companies whio offer services within the financial sector, real estate industry, or offer company formation services to develop AML controls and reporting procedures. To be in compliance with laws, mainland companies that conduct business in a regulated industry must:
- Develop and implement AML policy and procedures
- Register with goAML system
- Perform Customer Due Diligence
- Appoint an Compliance Officer (MLRO)
- Report Suspicious Activity
- Conduct Regular risk Assessments
AML Requirements for Free Zone Companies
Under the AML regulations in the UAE free zones, all businesses must meet the requirements of the law. Free zone companies are not excluded just because they have an exemption. It is essential to comply with anti-money laundering legislation if you are a free zone business and following any of the regulated activities financially. As well as there being similar AML obligations for both free zone businesses and Mainland registered businesses. Your obligations may include:
- Have an anti-money laundering compliance program in place
- Register with the goAML system
- Appoint a competent Money Laundering Reporting Officer (MLRO)
- Monitor the activities of your assessments
- Make reports to the appropriate regulator where required
Who Is Exempt from AML Compliance?
Some businesses will not be required to comply with AML regulations if they perform activities that are not covered by the regulated actor. For example, the exemption will be based on what type of activity the business is involved in rather than size or revenue. Businesses must thoroughly review their activities to determine if they should be exempt from AML requirements. Some examples of generally exempt entities are:
- Small businesses outside of a regulated sector
- Businesses that do not have any exposure to financial transactions
- Non-profit organizations that do not fall under any of the regulated categories
What Is an MLRO?
An MLRO ( Money Laundering Reporting Officer ) is a person designated as the primary compliance professional in charge of managing the AML compliance program of an organization. The MLRO is responsible for monitoring and recognizing suspicious transactions and ensuring that all compliance programs are up to date with regulations, reporting obligations, etc.
The MLRO provides a communication vehicle between the organization and its regulators. Therefore, the organization must appoint a qualified person who has appropriate experience, expertise, and authority to perform these duties effectively.
Is Appointment of an MLRO Mandatory?
Appointment of an MLRO and compliance officer is a requirement for all regulated entities in the country of the UAE. The requirement includes reporting entities, as it pertains to money laundering legislation such as financial institutions, DNFBPs, VASPs and all other regulated entities that qualify under the Anti-Money Laundering (AML) regulation. All businesses that are legally required to appoint an MLRO and compliance officer include the following:
- Banks
- Insurance Companies
- Real Estate Agents
- Gold Dealers
- Accounting Firms
- Audit Firms
- Company Formation Service Providers
- Virtual Asset Service Providers
Main Responsibilities of an MLRO
The main functions of the MLRO are to assist in achieving compliance with anti money laundering (AML) laws through prevention of money laundering and other financial crimes. The MLRO must have the ability to work independently as needed but be able to report directly to the senior management as appropriate. The MLRO’s primary responsibilities are as follows:
- Identify and report suspicious transactions
- Review transactions on a client by client basis
- Complete and submit RTRs ( Suspicious Transaction Reports )
- Manage the company’s AML compliance program
- Monitor internal control systems
- Conduct risk assessments
- Provide anti-money laundering (AML) training to employees
- Work with the FIU ( Financial Intelligence Unit )
- Keep current with all AML policies and procedures
Risk Based Approach Under UAE AML Regulations
All regulated businesses operating in the UAE must take into consideration a risk based system. In doing so, businesses must establish and evaluate the type as well as the level of risk for customers, geographical location, and transaction. Depending on risk levels, customers with a higher level of risk will require increased supervision and additional types of verification measures. Examples of risk indicators include but are not limited to:
- Customer Profile
- Geographic Area
- Transaction History
- Business Relationship
- Source of Funds
Customer Due Diligence (CDD) Requirements
As part of complying with Anti-Money laundering regulations, businesses are required to perform CDD on all customers who are opening an account or requesting to engage in a business relationship. It includes identifying the customer, understanding the purpose of the business relationship and monitoring high risk business relationships. Generally, the following are considered CDD measures:
- Identify the customer
- Gather information about the customer
- Understand how the customer will use your services
- Continuously monitor all of the customer’s transactions
- Update the customer’s information whenever it is necessary
Ultimate Beneficial Owner (UBO) Identification
The regulated entities must always identify their UBO behind corporate structures and legal entities as part of the regulations in place. By knowing the UBO, it creates more transparency and allows authorities to assist in tracking the ownership structure and arrangements. The following requirements must be met by businesses:
- Verify Ownership
- Maintain Accurate Records
- Update Ownership when you are notified of a change
- Retain Support Documentation
goAML Registration Requirements
goAML is the official reporting system of the Financial Intelligence Unit (FIU) of the United Arab Emirates. Reporting entities must register on the goAML website to file their suspicious transactions reports and any other required filings with the FIU. Businesses using the goAML system will be able to:
- File Suspicious Transaction Reports
- Submit Suspicious Activity Reports
- File High Risk Transactions
- Communicate with the Financial Intelligence Unit
AML Compliance for Real Estate Companies
Real estate companies are subject to the UAE Anti- Money Laundering (AML) regulations. Regulators seek to ensure that these business activities are monitored and report all occurrences related to financial transactions that are significant in amount, requiring high levels of scrutiny. Real estate companies will be required by the UAE government to do the following:
- Conduct Customer Due Diligence
- Register with goAML
- Appoint a Money Laundering Reporting Officer (MLRO)
- Report Suspicious Transactions
- Maintain Appropriate Records of Transactions
AML Compliance for Accounting and Audit Firms
For accounting and auditing firms to comply with AML legislation, they may be required to conform their operations in any case of establishing a client’s name or managing their funds under their or client’s control. As such, accounting and audit firms are subject to the same expertise and standards found in other professional services. Each firm must take the following actions:
- Conduct a Risk Assessment
- Verify Customers
- Monitor for AML Activity
- Report Suspicious Transactions
- Have Compliance Controls in Place
Penalties for AML Non-Compliance
UAE authorities impose significant sanctions on companies that do not comply with the requirements of the AML act. Enforcement measures may be imposed on the individuals involved as well as the businesses involved. Penalties may include:
- Imposing fines of AED 100,000 to AED 1,000,000
- Suspending the Business License
- Creating Criminal Liability
- Reputation Damage
- Taking legal action against directors or employees responsible for compliance
How Businesses Can Strengthen AML Compliance
A compliance program that is proactive can assist businesses in effectively managing risk, as well as complying with regulatory obligations. As such, from time to time, businesses should carefully evaluate their AML procedures and ensure that their employees understand their respective responsibilities. Some of the best easy to strengthen a proactive compliance program include:
- Regular AML Training
- Updating of your Internal Policies
- Conducting Periodic risk Assessments
- Monitoring Customer Transactions
- Maintaining Accurate Business Records
- Regularly Reviewing Compliance Controls
- Engaging Outside Professional AML Advisors
Conclusion
AML compliance and MLRO requirements for businesses in the UAE play a vital role in protecting the country’s financial system from money laundering and related crimes. Companies that are operating in the regulated sectors of the economy have to implement AML controls, register with the government goAML system, have a qualified MLRO and have ongoing monitoring procedures in place. By meeting their regulatory responsibilities, developing a strong culture of compliance, and reducing their risk, businesses will be able to build trust with both regulators and stakeholders.
