Most businesses do not struggle to produce an AML policy. The difficulty starts when they need to explain what happened with a particular customer.
Why was the customer rated low risk? Who reviewed the screening alert? Was the ownership information checked before the relationship began?
The answers may exist, but finding them can involve several folders, an old email chain and a call to the employee who handled onboarding.
An inspection evidence file brings those answers together. For businesses managing AML compliance in Dubai, it provides a practical way to demonstrate how procedures work in everyday transactions.
What Is an Inspection Evidence File?
An inspection evidence file is an organised set of records supporting your AML programme. It connects policies with the customer checks, assessments, approvals and follow-up work carried out under them.
It does not need to be one large PDF. A secure digital folder structure can work, provided records are controlled, accessible and connected.
The important point is whether someone unfamiliar with the work can understand it. A passport establishes one part of the customer’s identity. It does not explain the customer’s risk rating or why a particular payment was accepted.
Your evidence should make those decisions understandable.
Check Your Regulatory Position First
Before collecting documents, confirm which authority supervises your business and what it expects.
The Ministry of Economy and Tourism supervises specified designated non-financial businesses and professions, or DNFBPs, within its mainland and commercial free zone remit. Relevant persons within the DIFC are subject to applicable DFSA AML requirements.
The federal framework includes Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. Sector requirements and supervisory guidance also need consideration.
Use the sections below as a filing approach, then adjust them to your obligations and inspection scope.
1. Keep Policies and Responsibilities Together
Start with approved AML procedures, previous versions, the compliance officer’s appointment and internal reporting arrangements.
Earlier versions matter. A customer onboarded two years ago may have been assessed under a different procedure. Keeping that version helps explain the checks required at the time.
Include compliance reports and relevant management decisions. If management agreed to address overdue customer reviews, retain the deadline, assigned responsibility and subsequent progress.
A note saying “compliance discussed” offers little explanation. Someone reading it later should be able to understand the problem and the response.
2. Explain the Risks Behind Your Procedures
Your business risk assessment should reflect how your business operates.
A property brokerage dealing with corporate buyers will have different concerns from a jewellery retailer serving mainly individual customers. The assessment should explain those differences through relevant customer, geographic, service, transaction and delivery-channel risks.
Keep the methodology, supporting information, findings and approval together.
Then show how the assessment affected your controls. If complex ownership was identified as a concern, where does your onboarding process address it?
This connection matters more than an isolated risk score. Review the assessment when business circumstances change, rather than waiting automatically for its scheduled review.
3. Make Customer Files Tell the Whole Story
Customer records often become fragmented because several people contribute to them. Sales collects documents, operations enters information and compliance reviews the risk.
Use one customer reference to connect their work.
Depending on applicable requirements and circumstances, keep:
- Identity and verification records.
- Company documents and ownership information.
- Beneficial ownership checks.
- The purpose of the relationship.
- Customer risk assessments and supporting reasons.
- Additional enquiries and approvals, where required.
- Later reviews and relevant correspondence.
For a corporate property buyer, the trade licence alone may leave ownership questions unanswered. Preserve the documents and analysis used to establish who ultimately owns or controls the business.
Where source-of-funds or source-of-wealth checks are required, retain the evidence and explain how it was assessed.
Businesses using managed KYC services should also agree where records will be held and how their team can access them.
4. Record Why Screening Alerts Were Cleared
A screening result becomes difficult to interpret when it lacks a date, search details or reviewer’s explanation.
Keep the names and relevant identifiers searched, sources used, results, review date and conclusion.
Sanctions screening, politically exposed person checks and adverse media reviews should remain distinguishable because they raise different questions.
Suppose a name produces a potential match. If identifying details establish that it concerns someone else, record those details. “False positive” is a conclusion; the file also needs the reasoning.
Check that historical results remain available if you change screening providers. Losing access to an old platform should not leave earlier decisions unsupported.
5. Follow Unusual Activity Through to a Decision
Consider a buyer who asks an unrelated company to pay on its behalf.
The arrangement raises questions, but the file needs more than a note saying “third-party payment reviewed.” Keep the enquiry, information received, assessment and resulting action together.
Monitoring records should make it possible to follow a concern from discovery through escalation and resolution.
Where reporting is required, retain relevant goAML submission evidence, supporting analysis and follow-up communications.
Restrict access to suspicious reporting material. Confidentiality and tipping-off obligations need to be respected, so these records should not sit in customer folders available to everyone.
6. Show What Employees Learned
Training evidence should go beyond a presentation and attendance list.
Keep training dates, materials, attendance, proportionate knowledge checks and follow-up records together. The examples should reflect employees’ actual responsibilities.
An onboarding employee may need practice working through an incomplete ownership chart. Someone handling payments needs to recognise arrangements that require further enquiry.
If an employee misses training or struggles with an assessment, record what happens next.
This gives the business a more useful picture of staff understanding than attendance figures alone.
7. Keep Track of Problems Until They Are Resolved
Compliance reviews will sometimes find missing records or inconsistent decisions. Your file should show how the business responds.
An AML gap assessment can help identify areas requiring attention before inspection preparation begins.
Record each finding, its significance, the person responsible, the deadline and the action taken.
Check whether the fix worked. Uploading missing documents may repair existing files, while reviewing newer files helps establish whether the underlying process improved.
Never backdate a check or create an approval that did not happen. Record the actual discovery date and corrective work.
8. Make Records Easy to Retrieve
Create an index showing where records are held, who maintains them and who has access.
Consistent filenames, customer references and version histories make retrieval easier. Avoid overwriting earlier evidence when updating a record.
Retention periods must follow applicable requirements. DFSA AML Rule 14.4.1, for example, specifies at least six years for listed records, calculated from the latest relevant event identified in that rule. That should not be treated as a universal period for every Dubai business.
Consider investigations, legal holds and longer applicable preservation obligations before deleting records.
Give the File a Trial Run
Choose three customer files with different risk profiles. Ask a colleague who did not prepare them to trace the checks, approvals and subsequent reviews.
Notice where explanations are missing or documents cannot be opened. Give each problem an owner and deadline.
This exercise exposes filing problems before they become difficult inspection questions.
Need help reviewing your records? Discuss your preparation needs with Vertex Compliance through its AML periodic inspection service.
Frequently Asked Questions
1. What belongs in an AML inspection evidence file?
Include records supporting governance, risk assessments, customer checks, screening, monitoring, training and corrective actions. Adjust the contents to your business activity, applicable requirements and the documents requested for inspection.
2. Is an AML policy enough for an inspection?
No. A policy explains what employees should do. Completed checks, assessments, approvals and follow-up records help demonstrate how those procedures were applied to actual customers and transactions.
3. Can the evidence file be kept electronically?
Yes, subject to applicable requirements. Records should remain secure, readable and accessible, with suitable permissions and backups. Test whether authorised employees can retrieve them when needed.
4. What should we do about missing evidence?
Record the gap, assess its significance and assign corrective action. Obtain missing information where possible and consider escalation. Never imply that a check occurred earlier than it actually did.
5. When should the file be updated?
Add evidence as work happens. Revisit the structure after material business or regulatory changes, and periodically check whether another employee can locate the records and understand the decisions.
