What records must a UAE firm keep to evidence its AML risk assessment?
A UAE firm must be able to show its work. The Executive Regulations require firms to document the processes used to identify and assess risks, along with the related information, to retain the relevant study, and to update it on an ongoing basis. The study and its supporting material must be provided to the concerned authorities on request.
Federal law reinforces this by requiring firms to retain the risk assessment study and related information and to make it available to the Supervisory Authority when asked. Good practice is to keep a clear record of the methodology, the risk factors considered, the data relied on, the conclusions reached, and each subsequent review. Without this documentation, a firm cannot demonstrate that its risk-based approach is sound.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025 (Executive Regulations), Article 5(1)(b): firms must document, retain and update the risk assessment study.
· Federal Decree-Law No. 10 of 2025, Article 19(1)(a): the risk assessment study must be retained and provided to the Supervisory Authority on request.
For more details, consult the full text of the Executive Regulations or seek guidance from your AML compliance officer.