What is an Enterprise-Wide Risk Assessment (EWRA) for a UAE law firm?
An Enterprise-Wide Risk Assessment is the documented exercise in which a law firm identifies, understands, and assesses the money laundering and terrorist financing risks across its whole business, so that its controls can be built around those risks. It underpins the risk-based approach that runs through the UAE AML framework.
A sound EWRA looks at the firm’s client base, the countries and jurisdictions it deals with, the services and transactions it offers, and its delivery channels, then rates the resulting risk and shows how each risk is mitigated. The firm must keep the assessment current, taking into account the findings of the national risk assessment, and review it when its business or the threat environment changes. The EWRA is one of the first documents a supervisor will ask to see, because it justifies the design of the firm’s policies, due diligence, and monitoring.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5 — requires DNFBPs to identify, assess, and document their crime risks.
· Federal Decree-Law No. 10 of 2025, Article 19 — requires a documented, continuously updated risk-based approach.
For more details, consult the full text of Cabinet Resolution No. 134 of 2025 or seek guidance from your AML compliance officer.