What type of AML Records are required to be maintained?

The types of records that must be maintained are as follows:Customer informationTransactional informationInternal/External suspicious reportedRecords pertaining to ongoing monitoringTraining LogsCompliance officer reportsCopies of reports filed on the goAML portal

AML compliance challenges associated with inadequate record-keeping

Designated Non-Financial Businesses and Professions (DNFBPs), Virtual Asset Service Providers (VASPs), and Financial Institutions (Fis) operating in UAE are required to comply with the regulations governing Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT). As per the AML/CFT regulatory framework in the UAE, regulated entities must keep a proper record of AML compliance measures.

However, if the regulated entities fail to maintain adequate AML records, they face various challenges. Inadequate AML record-keeping results in having no evidence of complying with the legal requirements. Further, the lack of data results in the inability to conclude Enterprise-Wide Risk Assessment and Customer Risk Assessment. It becomes extremely difficult to identify patterns and define rules to detect suspicious transactions. This affects the efficiency of AML-related measures aimed at detecting and preventing ML/FT activities.

Thus, it is important that regulated entities maintain adequate records to achieve excellence in AML measures.

The following is the list of challenges that regulated entities come across due to inadequate maintenance of AML records:

Compliance Risk

According to the UAE legal landscape, all regulated entities are required to maintain records of the AML-related compliance measures implemented to prevent ML/FT and PF. Inadequate record-keeping or failure to maintain records results in fines and penalties and consequential reputational damage.

Ineffective Risk Assessment

Regulated entities are required to conduct risk assessments. However, if there is no properly maintained data to work from, then the risk assessments that are carried out by the entities will be ineffective. Failure to carry out a proper risk assessment would result in deploying inadequate controls to counter ML/TF and the entity may end up establishing a business relationship with criminals.

Ineffective Monitoring

Regulated entities must engage in ongoing monitoring of transactions and business relationships in order to counter ML/TF. The monitoring procedures and controls are dictated by the data that is gathered and held. However, when record management is not effectively undertaken, then regulated entities have no access to historical data to analyse. Hence, the entire monitoring procedure becomes meaningless.

Increased Financial Risks

As stated above, without effective records, risk assessment and monitoring are ineffective. This leaves the regulated entities exposed to financial crime, including ML/FT and other PF activities.

Inaccurate Audit

Regulated entities are required to undergo an AML/CFT audit. They are required to appoint an independent auditor for this purpose. For the auditor to understand the AML compliance measures adopted by the entity, record-keeping is a must. The auditor would require access to the AML/CFT program, EWRA, KYC, Screening, and Customer Risk Assessment records. He would also need access to transaction monitoring records. Without adequate record-keeping, an independent AML audit cannot be carried out.

Reputational Damage

Failure to maintain records would result in regulatory fines and penalties, spoiling the reputation of the company. In some cases, the regulators have also required businesses to shut down their operations, and hence, record-keeping is a must.

Increased Cost

Regulated entities are required to carry out AML measures continuously in order to adapt to changes. Poor data requires more focus on the measures and calls for deeper investigation, which increases the overall cost. Moreover, the levying of fines and penalties for non-adherence to the regulatory requirement also adds to the cost.

Video on Decoding the types of Customer Due Diligence

Customer Due Diligence becomes inevitable at the time of entering a business relationship with a customer by the Financial Institutions, DNFBPs, and VASPs. It is a very crucial process and needs to be performed with caution and utmost efficiency.

This video explains three types of Customer Due Diligence measures:

Simplified Due Diligence: When the risk posed by a particular customer is classified as low, then Simplified Due Diligence must be applied.
Standard Due Diligence: When risk posed is classified as medium or when the simplified Due Diligence outcome is not satisfactory.
Enhanced Due Diligence: When, after conducting a customer risk assessment, the customer is classified as high-risk, then Enhanced Due Diligence must be carried out.

Implementing the risk-based approach to conduct Customer Due Diligence measures helps identify red flags early and saves an organisation from entering into a wrongful transaction and business relationship.

Perfecting goAML Reporting for a Real Estate Agent: Meeting Deadlines Without Fail

AML UAE helped prepare and submit regulatory reports on the goAML platform for a business entity operating in the real estate sector in Dubai, UAE.

The client has a settled business as a real estate agent in the UAE, and with an increased customer base, the risk associated with customers and transactions escalated, increasing the volume of transactions that required reporting. All goAML reporting requirements were handled internally by the client itself, which often led to inaccurate filing and missing reporting deadlines.

Customer Goals:

Our client aimed to adhere to goAML reporting while consistently meeting deadlines. Their primary goal was to adopt an effective and simplified reporting process that focuses on timely reporting and minimising the risk of non-compliance.

Challenges:

As a real estate agent with an increasing volume of transactions, the client encountered numerous challenges in goAML reporting, including understanding complex reporting requirements, managing large data volumes efficiently, and navigating strict regulatory deadlines.

Legal Background:

The real estate agent was governed by:

Federal Decree Law No (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations
Federal Decree Law No (26) of 2021 to amend certain provisions of Federal Decree Law No (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations
Cabinet Decision No (10) of 2019 concerning the Executive Regulations of Federal Decree Law No (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations
Guidelines for Designated Non-Financial Businesses and Professions (DNFBPs)
Supplemental Guidance for the Real Estate Sector issued by the Ministry of Economy

The AML/CFT framework in the UAE provides a list of Designated Non-Financial Businesses and Professions (DNFBPs), which includes real estate brokers and agents within its definition. It is mandatory for all entities working in the DNFBP sector to comply with the regulatory framework governing AML compliance in the UAE.

For this purpose and to combat ML/FT crimes, they need to implement robust measures that include prompt filing of regulatory reports as provided under the UAE’s AML/CFT regulatory framework.

Therefore, the client recognised the urgent need to adopt an effective reporting process that focuses on timely regulatory reporting and minimises the risk of non-compliance penalties.

Solution Provided by AML UAE Team:

AML UAE worked with the client and provided a comprehensive approach that encompassed data analysis, risk assessment, and deadline management.

The overall approach was to understand the company’s existing AML/CFT policies and procedures and then optimise them to ensure efficiency and cost-effectiveness. End-to-end process flowcharts for customer onboarding, ongoing monitoring, sanctions compliance, SAR/STR reporting and REAR reporting were drawn, and the new procedures were implemented to leave no room for confusion or delays.

From its vast experience in aiding regulatory reporting for clients, AML UAE provided tailored solutions to the client, enabling them to achieve goAML reporting perfection consistently.

Utilising advanced technology, industry expertise, and personalised support, we assisted the client in fulfilling their reporting obligations accurately and efficiently.

We helped meet AML Regulatory Reporting requirements by facilitating the following solutions for the client:

We conducted a thorough assessment of the client’s current processes and systems to identify any gaps in meeting goAML reporting requirements.
We helped the client implement automated systems for data collection, analysis, rule-based reporting triggers, and reporting that significantly streamlined the goAML compliance process.
We assisted in preparing, reviewing, and submitting the Semi-Annual Report by the Compliance Officer.
We aided in preparing and submitting the Suspicious Activity Report/Suspicious Transaction Report on the goAML portal.
We also helped prepare and submit additional regulatory reports such as the Real Estate Activity Report, High-Risk Country Report, Funds Freeze Report, and Partial Name Match Report.

End Result:

Through collaboration with the AML UAE Team, our client attained unparalleled accuracy and efficiency in reporting on the goAML portal.

The client experienced a significant improvement in operational efficiency. Previously, reviewing transactions and goAML reporting took an average of 5 days to complete, but they were now accomplished within one day, resulting in an 80% increase in process efficiency.

They successfully navigated regulatory complexities, met reporting deadlines without fail, and mitigated the risk of non-compliance penalties.

The guidance provided by AML UAE resulted in the timely submission of regulatory reporting and enhanced AML compliance capabilities, reinforcing their reputation as compliant professionals in the real estate industry.

Share via :

Video on Checklist for effectively implementing the AML Program

Registering on the go-AML portal of the UAE FIU is the main prerequisite under the AML framework. It is imperative for the regulated entity to verify that the business facts and information accessible on the go-AML site are up to date.

Having an AML Compliance Officer capable of framing and implementing AML rules and procedures is the second critical component required to drive the AML program.

To determine the appropriate controls needed to reduce the detected risk and evaluate the possible exposure to financial crime risks, regulated entities must conduct an enterprise-wide risk assessment.

The regulated entities have to make sure that the team uses a thorough Customer Due Diligence procedure when they are forming business relationships and onboarding a customer. Another essential component of the AML program is targeted financial sanctions implementation, and customer and beneficial owner screening.

The AML Compliance officer and the team need to be familiar with the ML FT red flags that are unique to the business to develop internal procedures and properly detect and immediately report the risk indicators as well as submit the SAR or STR.

Webinar on Decoding KYC Requirements: A Crucial Element of AML Compliance in the UAE

Webinar on Decoding KYC Requirements

The Federal Decree by Law No. (10) of 2025 and related cabinet decisions and guidelines require DNFBPs and VASPs to adopt a risk-based approach and carry out Customer Due Diligence (CDD).

Know Your Customer (KYC) has been a crucial component of CDD requirements and we often get queries from DNFBPs and VASPs related to the legal requirements around it.

The webinar on “Decoding KYC Requirements: A Crucial Element of AML Compliance in the UAE” was conducted successfully on June 5, 2024, from 11 am to 12 pm (GST).

The webinar addressed the AML/CFT Regulatory Framework in the UAE, KYC meaning and its significance, KYC requirements for individuals and corporates, circumstances and timing for conducting KYC, common deficiency around KYC measures employed by entities, significance of KYC remediation in AML compliance, best practices for conducting KYC, UBO identification, restrictions on establishing business relationships under UAE AML regulations, and red flags associated with customers with respect to KYC.

Thanks for attending our webinar.

In case you missed it, here is a recording and presentation that recaps everything we covered.

Share via :

The role of Re-KYC process in AML Compliance

Protect your business with reliable and effective AML strategies with AML UAE.

The role of Re-KYC process in AML Compliance

KYC is a critical AML compliance requirement for regulated entities in the UAE. It lets you know your customers better and gauge the risks associated with their transactions. Nowadays, authorities are also stressing on the need for re-KYC of customers to keep track of updated information. Let us learn the role of Re-KYC process in AML compliance and strengthen our defences against money laundering and terrorist financing.

What is Re-KYC?

KYC must not be a one-time event. As customers’ details and regulations change, you must also update these data points in your database. That is why re-KYC of customers is essential. Re-KYC means periodic updates of the customers’ KYC details.

For a smooth conduct of the re-KYC process, you must invest your time, effort, and money in it. Recollect the information on customers, verify them, and add them to your database. This must lead to accurate and up-to-date details on all your customers. You also need to carry out sanctions screening and customer risk assessment to classify customers into low-risk, medium-risk, and high-risk customers and apply suitable countermeasures to fight against the risks they pose.

Need help with the customer Re-KYC process?

Get in touch with us now!

Why is re-KYC of customers essential?

Re-KYC of customers is essential for every regulated entity for the following reasons:

AML/CFT policy and procedures

AML/CFT policy and procedures mandate the KYC refresh. Depending upon the local rules and regulations and the risk-based approach adopted by the regulated entity, the schedule for periodic review is predecided and triggered. For example, the organisation may have a policy to conduct re-KYC every year for high-risk customers, once every two years for medium-risk customers, and once every three years for low-risk customers.

Industry transformations

Post-COVID, business models have significantly changed. Some of the old industries do not exist anymore or have undergone significant changes. The associated ML/TF risks have changed. Re-KYC helps understand customer profiles in the changed context, align risks, and take appropriate countermeasures to fight ML/TF.

Change in customer profile

Like fluctuations in your business, your client’s business or profile also witnesses changes. For example, they expand to a new territory, add a new product or service line in their offerings, have new owners, change the source of funds, or something else. These types of deviations in your clients change their risk profiles. To incorporate the amendments in their risk profiles, you must conduct a re-KYC of customers.

Internal shifts

Your business is unique, with its own set of requirements, business models, objectives, capabilities, and procedures. Based on these factors, you also define your risk appetite to tolerate money laundering risks. Any internal shifts in these factors lead to a change in your risk appetite. This leads to changes in your AML measures and compliance policies. In such situations, re-KYC of customers is essential.

Regulatory amendments

To keep up with the regulatory changes, you may be required to gather additional information about customers. Re-KYC helps gather that information and comply with legal requirements.

FATF Greylisting of a country

If a country is greylisted, you need to take a risk-based approach and require your customers to furnish additional information as to the source of funds and source of wealth. Re-KYC helps you do that.

FATF Black listing of a country

If a country is blacklisted, you need more information about your customers in high-risk jurisdictions, and hence Re-KYC or KYC refresh is required.

Due to all these reasons, it becomes essential for regulated entities to conduct the re-KYC process. Whether you conduct it twice a year or once every two years, the aim is to have updated information. Such up-to-date and accurate data facilitates the correct risk profiling of the customer. Based on this, you can take a risk-based approach for further AML compliance initiatives. Thus, you can prevent money laundering and terrorism financing activities.

Another benefit of the KYC process is a better understanding of your customers. You can tailor your services to their needs to improve customer satisfaction. Thus, you can also enhance your customer relationships with the re-KYC of customers.

Steps of the re-KYC process

You have the reasons and benefits of the re-KYC process. But what are the steps of conducting this process?

The re-KYC process involves the following steps:

Step 1: Client communication

The first step of the re-KYC process is letting your customers know you will conduct KYC again. Communicate to them the reasons for this exercise and its importance. Inform them about the documents you will need for re-KYC.

Step 2: Information collection

Once you have identified the customers for whom you want to repeat the KYC process, list the necessary details. You might need some past information as well as dig some new details. Collect all those data points from customers.

Step 3: Information verification

In the next step, verify all the customer details with the necessary documents received from them. You must ask them for proof of identity and address, beneficial ownership, sources of funds, payment methods used, and other necessary documents. Match the details submitted by clients with these documents.

Step 4: Screening

Screen your customers against lists of sanctions, terrorists, watchlists, PEPs, or any other local and international list of criminals. Moreover, check for adverse media or social media mentions of crime-related activities.

Step 5: Risk Assessment

Assess each bit of information on your customers. Examine every slight suspicion you have about them based on their behaviour, transactions, and profile changes. Based on these results of such analysis, update their risk profile. Keep an eye on those customers whose risks have increased.

Need help with the customer Re-KYC process?

Get in touch with us now!

Best practices in re-KYC of customers

For the smooth and accurate performance of the re-KYC process, avoid making the most common errors. You can imbibe the following best practices for successful re-KYC process and quality outcomes:

Establish Re-KYC procedures

AML compliance is not an easy journey. You have to manage quite a few procedures to ensure you comply with all the requirements. KYC is one such procedure. It helps you better know your customers to prevent or mitigate their risks. So, give it the importance it deserves.

Define a strategy for conducting re-KYC of customers. Mention the steps. List the timelines, resources required, and budget for the re-KYC process. Also, define the potential challenges you might face in this process, like customers’ disagreement, and the steps to deal with them. Such a strategy enables a seamless process.

Implement KYC software

KYC is a lengthy process. If you do it manually, it takes a lot of time. Also, it requires special skills to manage this exercise without errors and hassles. So, you need to spend money on hiring skilled staff as well. Also, the manual process has increased the chances of errors. All these can affect your re-KYC process.

So, the best solution to all these problems is automating the re-KYC process. Such a solution will lead to accurate results, faster processes, and customer ease. Also, these KYC solutions raise an alert when they detect an anomaly, suspicion, or shift from the usual behaviour. Thus, you are better equipped to fight money laundering risks.

Take a risk-based approach

AML compliance is all about a risk-based approach. You have to decide the next action based on your customers’ risk levels. The same is the case with re-KYC. For high-risk customers, the frequency of re-KYC is higher. So, you must know whether your customer is high or low risk and when you last conducted their KYC.

So, if the customer is high risk, conduct a re-KYC frequently. If the risk is low, postpone it for later. Thus, you can decide the frequency and depth of your KYC procedures.

Customer communication is key

Inform your customers about the re-KYC process. They must be aware of the purpose of such data collection and document verification. It is also a good practice to obtain their consent to this exercise. Inform them about the documents needed, the time taken, and other necessary details. Constant communication from your side facilitates better relationships with customers. Since it will be a disturbing and problematic exercise for your customers, explain its significance to them.

Allocate proper resources

Re-KYC is not an administrative process. It is not a scheduled thing that you do away with by just following the steps. It needs your complete dedication and sincerity. It will help you stay away from risky customers and transactions. Thus, it is a part of your business’s risk prevention and mitigation plan.

So, you must give it much importance. Don’t forget to allocate skilful resources, a reasonable budget, and specific timelines to this exercise. Also, ensure that you do not destroy customer relationships while managing this procedure.

Ensure proper record-keeping

You must document every result and finding of the re-KYC process. Since you are analysing the client again and rebuilding the risk profile, the rationale behind it must be saved and secured. So, maintain proper records of each data point on the customer. Save the documents. These records help you during audits or investigations by regulatory authorities.

These six effective approaches can help you with a successful re-KYC process. Ensure that you imbibe them and follow the step-by-step journey. Do not forget to conduct a re-KYC of customers to be doubly sure of their risks to your business. Only with such re-KYC and due diligence can you strengthen your AML measures.

AMLUAE – your partner for conducting re-KYC of customers

AMLUAE is a prominent provider of AML compliance services in the UAE. We help you follow AML regulations in the UAE at every step. You needn’t worry about deadlines or regulatory updates; we handle everything on time and in compliance.

We also handhold you through the entire KYC and re-KYC process. Our consultants and AML experts conduct customer due diligence on your clients for accurate results. Ultimately, you will have each customer’s detailed risk profile to enable you to take a risk-based approach to your AML compliance.

Besides KYC and due diligence, we also help monitor transactions to detect suspicious ones. Our team can impart personalised training to your employees, create and implement AML policies, and manage all communication with regulatory authorities. The aim is to let you focus on your core business while we manage the AML compliance.

Transform the risk profiling process of your customers,

With AMLUAE’s help in KYC and re-KYC of customers.

Share via :

Add a comment

Related Blogs

15/04/2024

AML Compliance for Online Jewellery Marketplace

19/03/2024

Top 5 methods Criminals use to Launder money

Common-goAML-registration-mistakes-to-tackle

22/02/2024

Mistakes to avoid during goAML registration

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

Tailoring AML Strategies for Enhanced Customer Experience in DPMS Sector

AML UAE helped a Dealer in Precious Metals and Stones (DPMS) business entity in the UAE to establish Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) strategies that enhanced its customer experience while maintaining compliance requirements.

Our client has an established jewellery business in the DPMS sector. It deals with various customers and thus requires implementing effective AML/CFT measures for screening, KYC, and CDD, which also enhances the overall customer experience. The AML strategy was handled in a way that made customer engagement difficult, leading to a loss of customer base and reputation.

Customer Goals:

Our client, a prominent DPMS business entity, faced the issue of balancing AML regulations with operational efficiency. The client’s existing AML measures slowed down transactions and customer onboarding, which wasn’t ideal for user experience. Further, keeping the dynamic nature of financial crime in mind, the client had to stay alert and flexible with their compliance efforts while maintaining customer satisfaction.

Challenges:

While conducting CDD is essential for customer onboarding, it comes with its challenges. Following are a few reasons that made customers frustrated with CDD processes:

Lengthy and complex processes
Repetitive request
Delay in service
Confusion in process
Untrained employees
Negative customer experience
Data security and privacy

Our client faced issues balancing compliance with AML/CFT regulations while maintaining smooth operations and processes for customers.

Additionally, the existing AML procedures slowed down transactions and customer sign-ups. Plus, since the financial crime landscape is always changing, they had to stay alert and flexible with their compliance efforts.

This required implementing enhanced AML strategies for smooth customer experiences while adhering to the requirements of the AML/CFT regulatory framework.

Legal Background:

The DPMS business entity was governed by:

Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing
Cabinet Resolution No. (134) of 2025 Concerning the Executive Regulations of Federal Decree-Law No. (10) of 2025 Concerning Combating Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons.
Guidelines for Designated Non-Financial Businesses and Professions (DNFBPs)
Supplemental Guidance for Dealers in Precious Metals and Stones issued by the UAE Ministry of Economy

The UAE’s DPMS sector is regulated by stringent AML/CFT regulations. Compliance requirements surrounding KYC and CDD lay down effective measures for combating illicit financial activities, including ML/FT and PF. Implementing these measures is mandated and also helps maintain trust with regulators and customers.

Solution Provided by AML UAE Team:

To optimise the customer onboarding process and ensure compliance with AML regulations, AML UAE carried out the following tasks:

We implemented DPMS-tailored protocols for customer risk assessment, considering that more than 90% of customers were retail customers.
We defined and developed a clear onboarding strategy for low, medium, and high-risk customers.
We established guidelines for customer identification and verification with a clear and realistic approach.
We implemented AML software to automate the customer onboarding process.
We set up data security measures while maintaining compliance.
We established communication and feedback channels for customers to deliver value and results.
We trained employees for effective AML compliance and enhanced customer onboarding processes.

By incorporating these enhancements into the regulated entity’s AML program, we strengthened the retail jewellery business’s ability to combat financial crimes while facilitating a seamless customer onboarding experience.

End Result:

With the implementation of our tailored AML strategies, the DPMS entity transformed its customer onboarding processes. Our solution provided strategies that focused on balancing compliance and customer experience.

The solution simplified the customer onboarding process and minimised friction, resulting in increased user satisfaction and loyalty. Additionally, they observed 25% less offboarding.

Further, AML UAE’s tailored AML strategy enhanced the DPMS entity’s capability to strictly comply with AML regulations and manage risk proactively while maintaining a positive customer experience and safeguarding the company’s reputation.

The solution enhanced measures to detect and prevent financial crimes, including ML/FT, bolstering the integrity of the DPMS entity.

Our AML consulting service helped the client emerge as a trendsetter in the DPMS sector by employing new benchmarks for enhanced customer experience.

Share via :

KYC-Managed Services for Rapid and Reliable Verification for an Accounting Firm

AML UAE is providing KYC-managed services and processes for an accounting firm operating in the UAE. The accounting firm provides various services, such as bookkeeping, accounting, auditing, tax preparation and planning, and advisory services.

The client has been operating in the UAE for more than 18 years, and with its growth, there was a need to adopt an effective KYC process.

Customer Goals:

Our client, an accounting firm operating in the UAE, wanted to streamline its KYC processes and services as part of its AML/CFT compliance. It also wanted to make its customer onboarding process smooth to provide a world-class customer experience. It was in search of a reliable KYC-managed services provider who could optimise its onboarding processes and then take charge of driving its customer onboarding on a regular basis.

Challenges:

The primary challenge that our client faced was undertaking an effective KYC process to onboard customers. The department overseeing the KYC process within the firm faced issues in adopting a rapid and reliable customer identification and verification process. In most cases, it was becoming increasingly difficult to obtain data from the customers. Once the data was received, the firm did not have uniform procedures to verify KYC forms and carry out due diligence to ensure regulatory compliance. This caused delays in customer onboarding and, in some cases, loss of business.

Therefore, our clients wanted an effective way of conducting KYC processes while also ensuring a quick and accurate verification process for customers.

Legal Background:

The accounting firm was governed by the following regulations:

Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing
Cabinet Resolution No. (134) of 2025 Concerning the Executive Regulations of Federal Decree-Law No. (10) of 2025 Concerning Combating Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons.
Guidelines for Designated Non-Financial Businesses and Professions (DNFBPs)

The regulatory framework lists auditors and accountants among the Designated Non-Financial Businesses and Professions (DNFBPs). Therefore, it is mandatory for all accounting firms established in the UAE to comply with the regulatory framework governing AML compliance.

For this purpose and to combat ML/FT crimes, they need to undertake KYC-managed services in order to achieve rapid and reliable verification.

Thus, the client recognised the need to incorporate a robust and reliable KYC verification process into their AML/CFT compliance processes.

Solution Provided by AML UAE Team:

AML UAE collaborated with the client and documented all KYC and CDD procedures. It then optimised the processes to eliminate unnecessary delays and established clear roles and responsibilities. Having vast experience in managing and undertaking KYC and CDD processes, AML UAE has provided AML/CFT consultants who conduct the following tasks to ensure compliance with the regulatory requirements:

Customer identification program
Customer due diligence
Ultimate Beneficial Owner Identification
Enhanced due diligence
Risk assessment and customer risk rating
Sanctions screening
Politically exposed person screening
Adverse media screening
KYC remediation and renewals

Our services help strengthen the customer identification and verification processes and tailor them to the specific needs of accounting firms. This alignment reduces the likelihood of regulatory non-compliance and safeguards the firm from ML/TF.

End Result:

With our assistance in KYC-Managed Services, a comprehensive solution tailored for the accounting firm, our client achieved rapid and reliable KYC verifications. Our expert team of AML consultants implemented robust KYC measures to help significantly streamline its KYC process and regulatory compliance. It’s an ongoing project where we support the client in their KYC and CDD efforts on a daily basis.

With AML UAE’s assistance, the firm is able to onboard customers in less than 8 hours, compared to more than 7 working days earlier.

Additionally, it improved the overall cost savings in KYC processes by 40% compared to undertaking it by themselves.

Furthermore, the firm improved the identification of potential risks associated with a customer well in advance.

The collaborative efforts between the accounting firm and AML UAE resulted in enhanced KYC compliance requirements and also achieved time and cost savings in AML compliance capabilities.

Share via :

Customer Due Diligence Process Automation: Optimizing Regulatory Adherence

Customer Due Diligence process automation helps enhance efficiency in countering money laundering and terrorist financing. It allows DNFBPs to onboard and manage customers by using modern solutions and technologies to retrieve and evaluate data, determine risk levels, and make customer onboarding decisions based on results. The automation streamlines AML compliance efforts, reduces manual errors, and enhances the effectiveness of their risk management strategies.

This infographic provides insights into customer due diligence automation to optimise regulatory adherence.

1. Know Your Customer (KYC)

The first level of CDD is “Know Your Customer” (KYC), which involves identifying and verifying the customer’s identity and understanding the nature of the business. Different automation tools are required for different elements of KYC.

a) Customer identification and data collection

This step identifies customers using information collected from various sources, such as customer forms, online databases, and third-party providers. Automating this requires tools and software that can automatically gather relevant information. Further, DNFBPs must ensure that the data collection process complies with regulatory requirements and data security protocols.

b) Customer verification

The verification process confirms the accuracy of information collected from different sources. To automate this step, DNFBPs may employ tools that use face-match technology, verify biometrics and documents and verification algorithms. Further, while choosing tools, they must also consider predictive analytics models that validate customer data against predefined patterns and historical records.

2. Name Screening

This process involves checking customers against various data such as national and international sanction lists, watchlists and adverse media sources.

For this step, DNFBPs can use sanction screening software, which regularly updates and scans customer data against relevant databases and watchlists, such as data pertaining to Politically Exposed Persons and targeted financial sanctions. Additionally, DNFBPs should also implement adverse media tools that scan customer data against various media sources and identify potential matches.

Furthermore, they must develop protocols that are within the software for reviewing and investigating potential matches to mitigate false positives and ensure compliance.

3. Customer risk assessment

This step assesses customer risk based on factors such as transaction history, industry, and geographic location. DNFBPs can implement risk assessment and rating tools that automatically assess the AML risk based on the customer’s profile, risk factors and weighted parameters. Further, such tools should align the criteria with regulatory guidelines and update risk profiles periodically.

4. Enhanced due diligence

When customers are categorised as high-risk, it is mandatory for DNFBPs to conduct EDD. To automate the EDD process, DNFBPs can use tools that have AI-powered analytics systems to identify unusual patterns or anomalies that may require further scrutiny.

5. Ongoing monitoring

After onboarding customers, it is necessary for DNFBPs to continuously monitor customer activity for changes in risk profiles, customer business relationships or transaction patterns they usually indulge in.

a) Monitoring Customer Risk Profile

DNFBPs can set up software that employs technology to automate alerts and triggers based on their predefined risk indicators. Additionally, when selecting a tool, they should ensure that the tool has review processes for alerts and periodic re-assessment of risk profiles within its system.

b) Transaction Monitoring

For this, DNFBPs can implement transaction monitoring software and tools that automatically flag suspicious activities based on predefined rules and anomaly detection algorithms. Ensure that systems analyse vast amounts of transaction data in real-time and generate alerts for further investigation.

6. Reporting suspicion

As a compliance obligation, DNFBPs must report any suspicious activity on the goAML portal. In order to automate this process, DNFBPs can install reporting tools that aggregate data and generate customised reports automatically as required by authorities. They must ensure that the implemented system is capable of producing reports that include necessary details for compliance audits and regulatory filings, following regulations and internal policies.

7. Record maintenance

It is mandatory for DNFBPs to maintain records for CDD and further maintain them for five years after transactions are completed or termination of business relationships. To make this easy, DNFBPs can automate the entire record-keeping process by implementing tools that help maintain a centralised repository for AML records. Further, they can choose AI and machine learning tools for records and data security measures.

Why is Record-Keeping of Customer Identity and Transactions necessary?

Pathik Shah

Protect your business with reliable and effective AML strategies with AML UAE.

Why is Record-Keeping of Customer Identity and Transactions necessary?

Illicit financial activities, such as money laundering, financing terrorism, and proliferation financing (ML/FT and PF), hamper the integrity of the economy as well as the operations of business entities. To combat these illicit activities, businesses adopt robust Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) measures, which are aligned with the regulatory framework.

As part of the UAE’s AML/CFT regulatory framework, all regulated entities, including Financial Institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs), are required to maintain records of KYC, CDD, EDD, transactions, audit logs, software audit trail, AML/CFT policy, procedures, etc.

In this article, we’ll discuss why record keeping of customer identity and transactions is important and what its best practices are.

What is AML Record-Keeping?

Whenever regulated entities undertake measures and activities to mitigate ML/FT and PF risks, such as customer due diligence, transaction monitoring and AML audit, they generate several documents in the process. Maintaining these documents is necessary as it makes it easier for them to access data as and when required, which is crucial for combating financial crimes, including ML/FT and PF.

This is the essence of AML record-keeping. Therefore, record-keeping in the AML framework means maintaining documents pertaining to AML measures that include customer identity records, transaction records, adverse media checks, etc. Record-keeping thus carries a significant purpose in ensuring AML compliance.

With our AML expert guidance,

Start your AML compliance journey smoothly.

What type of records are required to be maintained?

The types of records that regulated entities need to maintain depend on the regulations they need to follow. In the UAE, regulated entities must maintain records related to various compliance measures undertaken by them.

Here is a comprehensive list of customer-related information and transactions which require record-keeping in the UAE:

1. EWRA, Internal policies, Procedures and Control Measures

The Regulated Entities must take a Risk-Based Approach and conduct an ML/TF/PF Enterprise-Wide Risk Assessment. Regulated entities are required to establish internal policies and procedures as part of their AML framework and maintain their version history.

As part of policies and procedures, regulated entities need to establish a risk appetite statement that provides the entity’s stand on accepting risks and sets a base to analyse trade-off decisions. A risk appetite statement helps everyone understand the level of risks the entity is willing to take and accordingly apply suitable control measures.

Furthermore, based on risk appetite, the regulated entity must also identify and enforce AML control measures to combat ML/FT and PF risks associated with the entity.

2. Customer Due Diligence

It is essential for regulated entities to conduct the CDD process to measure ML/FT and PF risks associated with customers. There are various elements for an effective CDD. The CDD process includes conducting know-your-customer (KYC) measures to verify the customer’s identity. It is required to maintain KYC records along with supporting documents like Emirates ID, Passport, Utility Bill, etc.

Customer risk assessment is a key component of the CDD process that helps detect and prevent ML/FT and PF risks by evaluating the risk associated with each customer. Regulated entities must maintain customer risk assessment documents as evidence of their risk profiling.

Based on customer risk assessment, regulated entities are needed to undertake Enhanced Due Diligence (EDD) for higher-risk customers that pose ML/FT and PF risks and thus present increased exposure to them. They need to maintain any additional information related to customers within CDD records concerning EDD.

3. Transactional Records

Regulated entities have to keep a record of the business relationship- transactions involved from five years of completing the transaction. The various transaction records involve purchase orders, sales orders, invoices, receipts, payments, credit and debit notes and correspondence with the business. Regulated entities must maintain all the documents to establish a proper audit trail.

4. Regulatory Reports

To meet the internal and external reporting requirements, regulated entities must maintain all submissions made to the regulatory authorities.

As a part of his responsibility, the compliance officer prepares a semi-annual AML compliance report, which he submits to the senior management. These reports must be preserved. Further, semi-annual reports submitted to the regulatory authorities must be preserved for a period of 5 years.

However, the record keeping duration varies from one supervisory authority to another.

The Virtual Assets Regulatory Authority (VARA) mandates Virtual Assets Service Providers (VASPs) to maintain records for a duration of 8 years
Dubai International Financial Centre (DIFC) requires DNFBPs to maintain AML/CFT compliance and CDD records for 6 years.
Abu Dhabi Global Market (ADGM) requires DNFBPs and VASPs to maintain AML/CFT compliance and CDD records for 6 years.

The AML regulations in the UAE mandate the regulated entities to identify suspicions related to ML/FT and PF and report such suspicions by filing a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR). As part of record-keeping compliance, they must keep records of STR/SAR.

In addition to MLRO and STR/SAR, the regulated entity needs to submit additional reports based on the nature of the customer’s business, circumstances and place of the customer’s business or transactions. These reports include the High-Risk Country Report, High-Risk Country Activity Report, Real Estate Activity Report, Fund Freeze Report, Partial Name Match Report and Dealers in Precious Metals and Stones Report. Regulated entities in the UAE are mandated to maintain such reports.

An Independent AML Audit report issued by the external auditor must be preserved for at least 5 years.

5. Correspondence and Directives Issued by Regulatory Authorities

Regulated entities should also keep records related to communication and directives issued by regulatory bodies, ensuring compliance with applicable laws and regulations. With such records, regulated entities in the UAE can effectively manage risks associated with their customers and transactions and help supervisory authorities keep checks and balances.

6. Training Logs

Training logs are key tools within the AML/CFT framework. They ensure that staff and employees within businesses are adequately trained to fulfill their responsibilities effectively. By maintaining comprehensive training logs, regulated entities demonstrate their commitment to AML/CFT compliance, fostering a culture of compliance within the organization and empowering staff to detect and prevent financial crimes effectively.

Make your record-keeping accurate, easier, and effective.

Why is record-keeping of customer-related information necessary?

Record-keeping is an integral part of the AML/CFT framework. It supports various compliance activities like customer due diligence, transaction monitoring, reporting, compliance documentation, regulatory examinations, and investigations. Properly maintained customer records are essential for compliance with AML regulations.

Here is the list of reasons that make record-keeping of customer information and transactions necessary:

Legal and Regulatory Compliance

The AML/CFT regulatory framework requires regulated entities to maintain customer-related AML records. If a regulated entity fails to maintain records, it can result in legal consequences, fines, or penalties. Therefore, having a system for record-keeping helps in avoiding legal implications.

Customer Due Diligence

AML regulations require regulated entities to conduct due diligence on their customers to assess their risk levels and verify their identities. Record keeping helps regulated entities maintain proper documentation of customer information, identity verification, and risk assessments. Furthermore, it helps them avoid any financial and reputational loss in case a customer is engaged in illicit activities.

Proactive Monitoring

Regulated entities are required to monitor customer transactions for suspicious activities that may indicate money laundering or other illicit activities. Record-keeping plays a vital role in enabling proactive monitoring from an AML/CFT standpoint.

Regulatory Reporting

When suspicious activities are detected, financial institutions must file SAR/STR with the appropriate regulatory authorities. Proper record-keeping ensures that all necessary information related to the customer’s suspicious activity is documented and can be provided to regulatory authorities.

Performance Evaluation

Record-keeping helps regulated entities assess the performance of AML measures across the entire organisation, including those measures incorporated for customers. By tracking KPIs over time, regulatory entities can easily identify AML measures’ strengths, weaknesses, and gaps for improvement.

Decision Making

Records provide valuable data and insights that aid in making informed decisions. Whether it’s about customer-business relationships, control measures, or strategic direction, having access to historical records enables better decision-making. A well-structured record-keeping system allows for better tracking of suspicions, which in turn helps in making informed decisions.

Independent AML Audit

Regulated entities need to appoint an independent AML auditor to carry out the audit of their AML/CFT compliance. Record-keeping facilitates such audits.

Inspections and Investigations

Often, regulatory authorities come for inspections and ask for various compliance records. Record-keeping also helps investigators conduct investigations into cases related to money laundering and terrorist financing.

How do you maintain customer identity and transaction records?

Record keeping procedure depends on local and global regulatory requirements. The number of records required to be maintained affects the manner in which such records are maintained. The records can be maintained physically or in an electronic form. Ideally, the following documents should be maintained:

Original documents
Photocopies of original documents
Documents stored in electronic form

It is noteworthy that the records maintained should be easily accessible. If the source documents are available in a foreign language, then translated copies must be made available to ensure AML/CFT compliance.

Ensure accurate maintenance of AML records,

With the expertise of AML UAE

Challenges for maintaining customer records

Although it is necessary to keep records of customer information and transactions, regulated entities face various challenges in maintaining an efficient system.

The following are some major challenges:

Large and Complex Data

Customer records are comprehensive data that include information relating to customer due diligence, transactions, ongoing monitoring, suspicion reports and internal policies, procedures, and controls. Thus, handling the large volume and complexity of AML records becomes challenging for businesses.

Regulatory Variations

Global businesses have to adhere to multiple laws and regulations. Such variations in regulatory requirements pose a constant challenge as every jurisdiction requires different record-keeping obligations, making adherence to regulatory frameworks challenging for the entities.

Privacy and Consent

KYC information is personal in nature. Before keeping records, regulated entities must obtain consent from the person to whom such information belongs. However, customers are hesitant to provide information due to privacy concerns. Further, remote onboarding procedures require liveness checks, IP address logging, etc. If customers are not willing to part such information, it becomes difficult to onboard customers.

Data Security

Keeping a large amount of data requires effective security measures. Businesses face challenges in ensuring the security of sensitive data. Additionally, information pertaining to customers and their transactions is very sensitive and is targeted by criminals for facilitating their illicit activities. This obligates regulated entities to deploy enhanced data security measures.

Incomplete and Inaccurate Data

There is an abundance of information collected by the regulated entity from various sources while undertaking AML measures. However, not all information is relevant, complete, or accurate. It becomes a challenge to segregate qualitative and accurate data from the amount of information available.

Best practices for effective record-keeping of customer information

It is essential for regulated entities to implement effective record-keeping measures to maintain accurate documentation concerning customers and third parties.

Here are some best practices that regulated entities can establish for record-keeping of customer information:

Implement Document Management Software

Document management tools provide a harmonious and logical filing system that is easy to understand and use. Regulated entities can implement such tools to standardise AML record-keeping processes for maintaining customer information and transactions across their operations.

Use Cloud-based Storage

Regulated entities collect a large volume of customer data for which they can use cloud-based storage. The transition to cloud-based storage solutions can help them store records while providing scalability and accessibility.

Implement Security and Privacy Guidelines

Customers have privacy concerns about data usage and retention, which makes it difficult for regulated entities to obtain consent from them. Thus, to maintain their trust, they should establish clear data usage and retention policies which comply with relevant privacy regulations.

Deploy Data Security Tools

Keeping a large amount of data requires effective security measures. For this purpose, regulated entities should implement encryption technology, firewalls, etc., to limit unauthorised access and tackle data breaches.

Backup and recovery

Maintaining customer information is very important for regulated entities, and any loss of data can lead to major repercussions. Thus, regulated entities must implement backup procedures for records to prevent data loss by system failure or cyber-attacks. Further, they should also develop a recovery plan to ensure that records can be quickly restored in the event of loss.

Regular Updates and Review

Regulated entities must regularly update their systems and underlying procedures to remain compliant with the ever-changing regulatory environment. Internal health-check reviews must be conducted to find discrepancies in record-keeping and take immediate remedial measures.

Final Words on Maintaining Effective Customer-related Records

For regulated entities, record-keeping of the identities of their customers and transactions is crucial to ensure compliance with regulations, manage risks, and easily access data for submitting it to the authorities as and when required.

AML UAE is a global AML/CFT consulting firm assisting regulated entities in deploying countermeasures to curb financial crimes.

FAQs related to record-keeping under the AML Regulatory Framework

Record-keeping in the UAE’s AML regulatory framework means maintaining documents related to AML measures that include customer identity records, transaction records, adverse media checks, etc.

As per the UAE’s AML regulations, regulated entities need to maintain AML records for five years. However, for ADGM and DIFC-regulated entities, it is necessary to keep the AML records for six years. For VASPs based out of VARA, it is required to maintain records for eight years.

Record keeping is an integral part of AML compliance as it acts as a proof of having followed regulatory requirements and risk-based approach.

The types of records that must be maintained are as follows:

Customer information
Transactional information
Internal/External suspicious reported
Records pertaining to ongoing monitoring
Training Logs
Compliance officer reports
Copies of reports filed on the goAML portal

Record-keeping is an integral part of the AML framework. A well-structured record-keeping system allows for easy tracking of any suspicious transactions and facilitates effective AML compliance measures with AML regulations.

Want to have an effective record-keeping strategy for your business?

Let’s connect and discuss your requirements.

Share via :

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

AML compliance challenges associated with inadequate record-keeping

AML compliance challenges associated with inadequate record-keeping

Related Posts

Video on Decoding the types of Customer Due Diligence

Video on Decoding the types of Customer Due Diligence

Related Posts

Perfecting goAML Reporting for a Real Estate Agent: Meeting Deadlines Without Fail

Perfecting goAML Reporting for a Real Estate Agent: Meeting Deadlines Without Fail

Video on Checklist for effectively implementing the AML Program

Video on Checklist for effectively implementing the AML Program

Related Posts

Webinar on Decoding KYC Requirements: A Crucial Element of AML Compliance in the UAE

Webinar on Decoding KYC Requirements

The role of Re-KYC process in AML Compliance

The role of Re-KYC process in AML Compliance

Why is re-KYC of customers essential?

Steps of the re-KYC process

Step 1: Client communication

Best practices in re-KYC of customers

AMLUAE – your partner for conducting re-KYC of customers

Tailoring AML Strategies for Enhanced Customer Experience in DPMS Sector

Tailoring AML Strategies for Enhanced Customer Experience in DPMS Sector

KYC-Managed Services for Rapid and Reliable Verification for an Accounting Firm

KYC-Managed Services for Rapid and Reliable Verification for an Accounting Firm

Customer Due Diligence Process Automation: Optimizing Regulatory Adherence

Customer Due Diligence Process Automation: Optimizing Regulatory Adherence

Related Posts

Pathik Shah

Why is Record-Keeping of Customer Identity and Transactions necessary?

What is AML Record-Keeping?

What type of records are required to be maintained?

1. EWRA, Internal policies, Procedures and Control Measures

2. Customer Due Diligence

3. Transactional Records

4. Regulatory Reports

5. Correspondence and Directives Issued by Regulatory Authorities

6. Training Logs

Why is record-keeping of customer-related information necessary?

How do you maintain customer identity and transaction records?

Challenges for maintaining customer records

Large and Complex Data

Regulatory Variations

Privacy and Consent

Data Security

Incomplete and Inaccurate Data

Best practices for effective record-keeping of customer information

Final Words on Maintaining Effective Customer-related Records

FAQs related to record-keeping under the AML Regulatory Framework

Fill The Details