What is the difference between a National Risk Assessment and a firm’s own risk assessment?
A National Risk Assessment and a firm’s own risk assessment operate at different levels but connect closely. The National Risk Assessment is the State’s view of money laundering, terrorist financing and proliferation financing risk across the whole economy. It is led by the National Committee, covers threats and sectors nationally, and sets the direction for supervision and policy.
A firm’s own assessment, sometimes called the enterprise-wide or business-wide risk assessment, is specific to that business. It examines the firm’s particular customers, products, channels and geographies. Crucially, the firm must take the results of the National Risk Assessment into account when preparing its own, so the national picture flows down into individual controls. One is strategic and national; the other is operational and firm-specific.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 14(2): the National Committee assesses risk at the national level, while Article 19(1)(a) sets the firm-level obligation.
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5: firm assessments must take the National Risk Assessment into account.
For more details, consult the full text of Federal Decree-Law No. 10 of 2025 or seek guidance from your AML compliance officer.
The new UAE AML/CFT Law, Federal Decree-Law No. 10 of 2025 explained