How often must a UAE accounting firm conduct an independent AML audit?
UAE AML law requires regulated firms, including accounting and audit practices operating as DNFBPs, to maintain an independent audit function that tests the effectiveness of their AML/CFT policies, procedures, systems, and controls. While the executive regulations frame this as a risk-based requirement rather than fixing a single calendar date for every firm, an annual independent review is the widely accepted standard and aligns with supervisory expectations.
The review should be genuinely independent of the staff who run day-to-day compliance, so that weaknesses are surfaced honestly. Findings must be reported to senior management or the partners, with a clear remediation plan and timelines. Smaller firms may scale the exercise to their size and risk profile, but they cannot skip it: an untested programme is treated as a governance gap.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 21 — requires internal policies, controls, and an independent audit function to test the AML/CFT programme.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 22 — requires appointment of a compliance officer whose work the audit function reviews.
For more details, consult the full text of Cabinet Resolution No. 134 of 2025 or seek guidance from your AML compliance officer.