What to Prepare Before an AML Compliance Review in Dubai

You have an AML policy. Your staff have attended training. Customer documents are saved somewhere on the shared drive.

But could you pull up one customer’s file and explain why they were approved, how their risk was assessed, and what happened when a concern came up?

That’s a useful place to start when preparing for an AML compliance review in Dubai.

The work is about more than gathering documents. You need to connect your written procedures with what your team actually does, and show the records behind those decisions.

Here’s how to get ready without turning the exercise into a last-minute search through emails and folders.

First, Find out what Kind of Review you’re Preparing for

An internal health check, an independent audit, and a regulatory inspection can cover different grounds. Don’t assume they have the same purpose or document requirements.

Before collecting files, confirm:

• Who is reviewing you: an internal team, an independent reviewer, or your supervisory authority.
• What is covered: the whole program or specific areas, such as onboarding or screening.
• Which period is covered: the dates and transactions under review.
• What has been requested: the document list, sample requirements, and submission deadline.
• Who will coordinate: one person to track requests and responses.

Dubai businesses do not all fall under the same supervisory rules. Use the requirements that apply to your activities and regulator. The checklist below is a practical preparation guide, not a universal inspection notice.

1. Get your Risk Assessment Ready

Your AML risk assessment should explain the risks your business faces and how you manage them.

For DNFBPs covered by the Ministry of Economy and Tourism’s guidance, the business risk assessment should be documented, supported by data, and kept current as the business and its risks change. DNFBPs are designated non-financial businesses and professions, a category that includes specified business activities outside the financial sector. [1]

Prepare:

• Your current business risk assessment and methodology.
• The information used to reach the ratings.
• A record of changes since the previous assessment.
• Evidence of the required management review or approval.
• Actions assigned to address identified gaps.

Ask yourself: Does the assessment describe the business we operate today?

For example, if you started serving customers in a new market, check whether that change was considered. A recent date on the cover does not explain whether the assessment is still accurate.

2. Check Whether your Policies Match Daily Work

Read your AML/CFT procedures alongside a real customer journey.

Does the policy say that a manager approves higher-risk customers? Check where that approval is recorded. Does it describe a screening process? Ask an employee to demonstrate it.

Have these documents available where relevant:

• The approved AML/CFT policy and operating procedures.
• Customer acceptance and risk-rating procedures.
• Customer due diligence and enhanced due diligence procedures.
• Sanctions-screening and alert-handling procedures.
• Internal escalation and suspicious reporting procedures.
• Record-retention and access-control procedures.
• Version history and approval records.

Also check that the program addresses proliferation financing, where required. AML, terrorist financing, and proliferation financing risks should not be treated as interchangeable.

If a procedure no longer matches the workflow, record the gap and assign a fix. Don’t quietly rewrite the history of how a process operated.

3. Test a Selection of Customer Files

A folder full of documents can still leave important questions unanswered.

Choose a small mix of files for your own preparation: different risk levels, customer types, and onboarding dates. This is a readiness exercise; it does not replace the reviewer’s sample selection.

For each file, check whether you can find:

• Customer identification and verification evidence.
• Ownership information and beneficial-owner checks, where applicable.
• The purpose of the relationship and expected activity.
• The risk rating and the reason behind it.
• Relevant screening results and how alerts were resolved.
• Extra checks, supporting evidence, and approvals for higher-risk situations.
• Follow-up reviews or updates that were due.

Identification and verification requirements depend on the customer and risk involved. Use the rules that apply to your business rather than copying another firm’s document list. [2]

Try this: Open a corporate customer file. Could someone unfamiliar with the customer understand who ultimately owns or controls it? If they need three phone calls to find out, the file may need work.

4. Gather Evidence of Screening and Monitoring

“We use screening software” explains which tool you bought. It does not explain how your team handles its results.

For the controls relevant to your business, prepare evidence showing:

• What was checked and when.
• Which alerts were reviewed.
• Who reviewed them.
• The supporting information considered.
• The decision and any follow-up action.

Prepare examples of transaction or activity reviews too, where relevant. Include the explanation for unusual activity and how the matter was resolved or escalated.

The Central Bank’s record-keeping guidance for licensed financial institutions includes screening, monitoring, investigation, and analysis records. That guidance is specific to those institutions; other businesses should check their own requirements. [3]

5. Review Escalation and Reporting Records carefully

Your team should know where to take a concern. The designated reviewer should be able to explain what happened next.

Check that you can trace an internal concern from receipt through assessment to the decision taken. Keep the supporting evidence available to authorized reviewers.

A decision not to file a suspicious transaction or activity report should have a clear basis. Equally, having no reports on file does not, on its own, prove that a reporting process works. Reporting obligations depend on the applicable suspicion threshold. [4]

Handle these records with care:

• Restrict access to people authorized to see them.
• Use an appropriate secure route when responding to review requests.
• Follow applicable confidentiality and anti-tipping-off requirements.
• Don’t move sensitive reports into a widely accessible preparation folder.

6. Prepare Training Records—and Speak to your Staff

Attendance matters, but it is only part of the picture.

Gather your training plan, materials, attendance records, assessment results where used, and follow-up for missed sessions. Central Bank guidance for licensed financial institutions specifically addresses these types of evidence. [5]

Then ask staff a few practical questions:

• What would you do if a customer refused to explain a payment?
• Who would you contact about an unresolved screening alert?
• Where would you record a concern?
• What information should you avoid discussing with the customer?

Use their answers to find training gaps. Don’t coach staff to claim they follow a process they don’t understand.

7. Show what Happened to Previous Findings

If an earlier review identified a weakness, be ready to explain its current status.

A simple action tracker is more useful than a folder labelled “completed.”

These are illustrative examples, not findings about a particular business.

Be clear about work still in progress. Record the next step and a realistic deadline. Marking an issue closed before checking the fix can leave the original problem unresolved.

Your AML Compliance Review Document Checklist

Use this table as an index. Adjust it to the actual request and your applicable obligations.

Three Mistakes that make Preparation Harder

Collecting Everything without an Index

Hundreds of files are difficult to navigate. Create an index showing the request, file location, owner, and submission status. Keep sensitive material under appropriate access controls.

Updating Documents without Checking the Process

A revised policy does not show that the change has reached staff. Check whether forms, workflows, and training need updating too.

Trying to Make every File Look Perfect

Never backdate approvals or create records that suggest a check happened when it did not. Keep a factual record of the gap, what you have done now, and what remains outstanding.

Before the Review Begins, Run one Walkthrough

Take a customer relationship from start to finish:

1. Find the onboarding records.
2. Explain the risk rating.
3. Locate relevant screening and review decisions.
4. Show how concerns were handled.
5. Confirm that an authorized person can retrieve the evidence.

Notice where the walkthrough slows down. Those sticking points give you a practical list of things to address before the review.

Need Help Getting Ready?

If your records are scattered or you’re unsure whether your procedures match daily work, start with a focused gap review.

Contact Vertex Compliance to discuss AML/CFT compliance services in Dubai and the preparation support your business needs.