How must UAE firms use the National Risk Assessment results?
UAE law expects regulated firms to treat the National Risk Assessment as a direct input to their own compliance frameworks, not as background reading. When a firm identifies, assesses and mitigates its money laundering risks, it must do so taking into account the risk-based approach and the results of the NRA. Customer due diligence measures and their scope must also have due regard to the outcomes of the national assessment.
In practice this means mapping the national threats and higher-risk sectors onto the firm’s own customer base, products and geographies, then adjusting policies, risk ratings and monitoring where the NRA reveals exposure the firm had underestimated. Supervisors will look for evidence that the NRA genuinely influenced the firm’s controls.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 19(1)(b): CDD scope must have due regard to the outcomes of the national risk assessment.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5: risk identification and mitigation must take the NRA results into account.
For more details, consult the full text of the Executive Regulations or seek guidance from your AML compliance officer.