How often must a UAE firm review its own AML risk assessment?
UAE law does not set a single fixed date for reviewing a firm’s risk assessment. Instead it requires firms to identify, understand, manage, assess, document and continuously update their crime risks. The Executive Regulations reinforce this by requiring the risk assessment study to be updated on an ongoing basis and made available to the authorities on request.
In practice, most firms conduct a formal review at least annually, and update sooner when a trigger occurs. Triggers include the publication of a new National Risk Assessment, entry into a new product or market, a significant change in the customer base, a new regulatory requirement, or a material incident. The guiding principle is that the assessment should always reflect the firm’s current risk reality.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 19(1)(a): firms must continuously update their crime risks.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5(1)(b): the risk assessment study must be updated on an ongoing basis.
For more details, consult the full text of Federal Decree-Law No. 10 of 2025 or seek guidance from your AML compliance officer.