What AML records must a UAE law firm keep and for how long?
A UAE law firm must retain all records, documents and data relating to transactions and to its customer due diligence, whether the transactions are domestic or international, and make them immediately available to the competent authorities on request. In practice this covers client identification and verification files, beneficial owner information, account and transaction records, the enterprise risk assessment, internal suspicious activity reports and copies of any reports filed with the FIU.
Records must be kept for at least five years, usually running from the end of the business relationship or the completion of the transaction. Reliable retention matters because supervisors test record keeping during inspections and because the firm may need to reconstruct a transaction long after a matter closes. Files should be stored securely, remain retrievable, and be complete enough to demonstrate why the firm accepted, monitored or reported a client.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 19(1)(f) - requires retention of all transaction and CDD records and their immediate availability to authorities.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations) Article 25 - sets the minimum five-year retention period.
For more details, consult the full text of Federal Decree-Law No. 10 of 2025 or seek guidance from your AML compliance officer.