Does a UAE audit firm need to carry out an AML business risk assessment?
Yes. Every DNFBP, including an audit firm, must identify, understand, manage, assess, document, and continuously update the money laundering, terrorist financing, and proliferation financing risks arising within its business. This business-wide risk assessment underpins the whole risk-based approach and must take account of the National Risk Assessment findings.
The assessment should be proportionate to the nature and size of the practice and should consider client types, the covered services offered, delivery channels, and geographic exposure. The written study, and the information supporting it, must be retained and made available to the supervisory authority on request. The outcomes then drive the intensity of customer due diligence, monitoring, and the internal policies the firm adopts.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 19(1)(a) - duty to identify, assess, and document crime risks on a risk-based approach.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5 - risk identification and mitigation proportionate to the business.
For more details, consult the full text of Cabinet Resolution No. 134 of 2025 or seek guidance from your AML compliance officer.