What is the difference between the National Risk Assessment and a business risk assessment in the UAE?
The National Risk Assessment (NRA) is a macro-level, country-wide evaluation of money laundering, terrorist financing and proliferation financing threats and vulnerabilities, coordinated by the NAMLCFTC. It tells the whole market which crimes and sectors the UAE considers most exposed.
A business risk assessment, often called an enterprise-wide risk assessment (EWRA), is a micro-level study that a single regulated entity performs on its own customers, products, delivery channels and geographies. The two are linked: firms must take the NRA findings into account and pay particular attention to the most serious national threats when scoring their own inherent and residual risk. The NRA sets the backdrop; the business assessment applies it to the firm’s specific circumstances.
Legal Reference (UAE):
· Federal Decree-Law No. 10 of 2025, Article 19(1)(a) — each FI, DNFBP and VASP must identify, assess, document and update its own risks using the risk-based approach.
· Federal Decree-Law No. 10 of 2025, Article 19(1)(b) — CDD scope must reflect the outcomes of the national risk assessment.
For more details, consult the full text of Federal Decree-Law No. 10 of 2025 or seek guidance from your AML compliance officer.