The Inter-Relationship of Money Laundering and Terrorist Financing

inter-relationship of Money Laundering and Terrorist Financing 

The Inter-Relationship of Money Laundering and Terrorist Financing

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

It is essential to understand the concepts of Money Laundering (ML) and Terrorism Financing (TF) when embarking upon exploring the field of financial crime and Anti-Money Laundering (AML)/ Counter Financing of Terrorism (CFT) laws. This blog intends to enable financial crime enthusiasts and professionals to develop an understanding of basic concepts of ML/TF and delve into the inter-relationship of Money Laundering and Terrorist Financing.

Definition of Money Laundering

Money Laundering can be defined a process where illicit, ill-gotten gains, or profits of crime are disguised to make them appear as if such an income or profit was earned through legitimate sources 

Background of Money Laundering

Criminals, criminal syndicates or cartels, corrupt officials and politicians commit crimes or assist in the execution of crimes because of the motive to earn quick financial profits or gains. However, these financial gains earned due to criminal activities are often in the form of large amounts of cash, wire transfers in tax haven or regulatory haven countries, or in the form of virtual assets such as Bitcoin and Ethereum, to name a few. The concept of money laundering originated due to the requirement of evading detection by law enforcement agencies. 

The catch situation these criminals face is that they cannot, like a straightforward law-abiding citizen earning genuine salary or business profits, go and deposit proceeds of crime into a bank account or transfer proceeds of crime from one criminal or syndicate to another by internet banking or wire-transfer services offered by banks and other financial institutions.  

Any individuals or corporates wanting to use formal banking and financial institution services need to provide their details to fulfil regulatory compliances such as Know Your Customer (KYC) and Customer Due Diligence (CDD) requirements. 

If criminals or criminal syndicates make use of formal banking and financial institution services, they would also end up being subjected to regulatory compliance requirements, which, if they truthfully provide, then they would end up being prosecuted as providing details of their own and their sources of income would establish their connection with crimes. 

Criminals and criminal syndicates resort to money laundering to avoid such detection of earnings because of crime and prosecution by law enforcement agencies. 

The word “launder” in the concept of money laundering refers to the act of washing away the traces of the criminal or illicit origin of funds acquired by various illicit activities such as extortion, drug dealing, human trafficking, and so on.  

Process of Money Laundering

The process of money laundering enables criminals and criminal syndicates to separate the connection between them and the proceeds of crime acquired by them. Money laundering makes it possible to do so as the process of money laundering contains three steps: 

  • Placement: At this first stage, the proceeds of crime in cash form or other assets acquired as profits from criminal activity are introduced into the legitimate financial system. Examples include: 
    • Dividing large sums of money into smaller chunks and depositing the same in multiple bank accounts to avoid crossing the reporting threshold and triggering reporting requirements. 
    • Buying foreign exchange in cash with illicit cash. 
    • Purchasing gift cards with stored value in cash and using gift cards to transfer funds/carry cash. 
  • Layering: At this second stage of money laundering, the illegally acquired money is separated from its origin by the introduction of layers that help conceal or disguise the illicit origin and give fake legitimate proof of such gains. Examples include: 
    • Moving funds within the same group of shell companies by creating fake invoices. 
    • Converting deposited cash into financial instruments. 
    • Investing in real estate and high-value precious metals such as gold and silver.
  • Integration: At this third and last stage of the money laundering process, legitimacy is given to the illicit income by facilitating the re-entry of layered funds into the mainstream economy. Examples include: 
    • Creating business relationships and contracts with legitimate businesses and investing funds in such businesses 
    • Investing or purchasing high-value assets such as yachts, artwork and high-priced limited-edition vehicles and watches. 

In simple words, money laundering is a process that disguises illegal sources of gains or income and makes it appear as if the same was acquired legitimately. Criminals resort to money laundering techniques to avoid detection and prosecution by law enforcement authorities.  

Our timely and accurate AML consulting services

For your smooth journey towards your goals

Definition of Terrorist Financing

In order to understand the definition and concept of terrorism financing, it is essential to understand what terrorism means. Terrorism is the use of force, violence, and destruction of property and human life, with the intent to intimidate or force governments and people at large to support or comply with the objectives and demands of people carrying out terrorism, also known as terrorists. Examples of terrorism include mass killings through suicide bombers, hijacking and destruction of monuments.  

Carrying out terrorist activities requires extensive funding for the purchase of weapons and explosives, training of individuals to further out terrorist activities, recruitment of terrorists, and related activities.  

Process of Terrorism Financing

Terrorism Financing is a process through which terrorist organisations or individual terrorists acquire funds to further their terrorist activities. Terrorists can acquire funds for their motives through multiple means, including legal and illegal means. The process of terrorism financing is carried out in four stages: 

  • Raise: At this first stage, terrorists acquire funds by evading formal channels and collecting funds that help them in carrying out terrorist activities. Examples include: 
    • Seeking funds through donations under false pretexts, such as donations for surgery of underprivileged children. 
    • Collecting donations from supporters of similar fanatic ideologies. 
  • Store: At this second stage, terrorists, after raising funds, look to store the funds until it is safe to move these funds to prevent detection by authorities. Examples include: 
    • Purchasing cryptocurrencies or virtual assets. 
    • Purchase of high-value assets such as art and antiques. 
    • Depositing cash in several bank accounts. 
  • Move: At this stage, terrorists mobilise the funds. The movement of funds is carried out by various formal and informal ways of channelling funds. Examples include: 
    • Sale/Transfer of virtual assets. 
    • Bulk cash couriers. 
  • Use: At this stage, the goal of terrorism financing is within reach of terrorists. They utilise funds for: 
    • Purchase of weapons. 
    • Purchase of destructive materials. 
    • Recruitment of people for terrorist motives. 

Importance of Understanding the Inter-Relationship between Money Laundering and Terrorist Financing

Effective implementation of ML/TF risk mitigation measures requires persons involved in their implementation to have basic training and an understanding of core concepts of AML compliance, such as what ML/TF is and the interrelationship between them.  

The persons involved in the implementation of AML compliance measures are the customer-facing staff, the compliance team, including the AML compliance officer, and the senior management of the business, responsible for signing off the onboarding and continuation of business relationships with high-risk customers.  

Knowledge of the inter-relationship between money laundering and terrorist financing also enables businesses such as DNFBPs and VASPs to implement the risk-based approach in curtailing ML/TF in a more effective manner, as both ML/TF have similar countermeasures and red flags where one helps identify and curb another at the same time. 

Want to implement a robust framework to fight ML/TF?

Similarities between ML/TF

When it comes to addressing similarities between ML/TF, following considerations need to be made: 

1. The countermeasures in preventing the occurrence of money laundering and terrorism financing serve dual purposes, such as: 

  • Identification of suspicious activities and transactions by having suitable and adequate Know Your Customer (KYC) / Customer Due Diligence (CDD) practices in place. 
  • Regular monitoring of transactions. 
  • Compliance with AML/CFT laws and regulations. 

2. ML/TF have similar channels of execution: 

  • Relying on cash couriers, exchange houses, and similar channels to “layer” or “move” funds for illicit purposes. 

Difference between ML/TF

Money Laundering Terrorism Financing 
Motive: Money laundering is conducted with the motive to wash away or disguise the illicit origin of funds to enable the launderer to use funds and separate the illegal origin of money from the money itself.  Motive: Terrorism financing is conducted with a singular goal to further religious ideologies and spread fear and destruction by conducting terror events such as bombings or hijackings.  
Source: The source of money laundering is always through an illegal activity, a predicate offence. Source: The source of terrorism financing can be both legitimate or illegal; for example, terrorists may collect funds legally through crowdfunding or may collect funds illegally by utilising proceeds of crime earned by committing other crimes such as extortion or human trafficking racket. 
Methodology: The process of money laundering is circular in nature, meaning that the person acquiring illicit proceeds is the beneficiary or the ultimate user of laundered funds. Methodology: The process of terrorism financing starts with collecting funds from various legal and illegal sources and ends up being used by terrorists in conducting terror events. Thus, the movement of funds is linear in nature. 

Inter-relationship of Money Laundering and Terrorist Financing

Money laundering and terrorism financing are closely interlinked concepts due to their inherent nature of facilitating the movement of illicit funds through multiple channels till they are ready for final use. Both ML/TF use and rely on similar channels of carrying out the “layering” or the “moving” of money, such as cash couriers, or exchange houses. Other than this, the red flags for ML or TF might indicate the presence of another and help curtail both. 

1. Shell Companies

Both Money Laundering and Terrorist Financing involve Shell companies to hide the Ultimate Beneficial Owners. 

2. Complex Transactions

Criminals resort to complex financial transactions to make it difficult for regulatory authorities to reach the ultimate source of their ill-gotten money. This holds true for both money laundering and terrorist financing. 

3. Trade-Based Money Laundering (TBML)

Both Money Laundering and Terrorist Financing involve manipulation of trade transactions to disguise the movement of funds.

4. Shared Vulnerabilities

The word vulnerability refers to the openness to being attacked. In the context of ML/TF risk, businesses are vulnerable to being misused as a channel or instrument to further ML/TF activities by launderers or terrorists. This shared vulnerability exists due to the presence of similar structures or channels to conduct money laundering or terrorism financing. The infrastructure relied on by businesses to conduct cross-border transactions or international business transactions, or while dealing with virtual assets, is often targeted by money launderers and terrorism financing groups for exploitation and transferring proceeds for their illicit motives. 

5. Overlap in Regulatory Obligations

The regulated entities have to craft AML/CFT policies and procedures, conduct KYC and CDD, perform transaction monitoring, maintain records, appoint independent auditors, submit regulatory reports like SAR/STR, and have a proper governance framework to counter ML/TF. These obligations are aimed at tackling money laundering and terrorist financing issues simultaneously.  

6. International Cooperation

Given the cross-border nature of money laundering and terrorist financing, the countermeasures require international cooperation.  

7. Socio-Economic Impact

The prevalence of money laundering and terrorist financing have a devastating socio-economic impact. They can affect economies adversely and undermine public trust in banks and financial institutions, and therefore, it is important to address both issues together. 

8. Mutual Dependence Between Money Laundering and Terrorist Financing

As discussed earlier, terrorists always require large amounts of funding regularly to support their activities, such as the training and recruitment of new terrorists, purchase of weapons, ammunition, tracking and interception equipment, and so on. The primary motive of TF is to spread fear and destroy human lives in the name of ideologies, which is only possible through conducting terrorist activities supported by a supply of funding.  

The funding for TF is supplied through legal and illegal means. Terrorists acquire funds legally through a collection of small donations from a substantial number of individuals supporting the ideology or may receive state-sponsored funds. Terrorists can also acquire funds illegally through a collection of funds in the name of donation under a false agenda or through other crimes such as drug dealing, human trafficking, drug trafficking, and other crimes.  

Whenever the element of cross-border or international transfer of funds from one country to another comes into the picture, terrorists inevitably have to rely on money laundering processes such as layering as well as integration, where the ultimate user of illicit proceeds can access the funding across the globe, easily and without raising suspicion in the eyes of law enforcement agencies.  

The sly and swift manner in which launderers transfer and disguise copious amounts of funds is what draws terrorist groups to rely on money laundering channels to move and store their funds, waiting for the right time to make use of such funds in a manner which avoids alerting law enforcement agencies. 

Ready to fight money laundering and terrorist financing?

Equip your team with our expert AML/CFT training today!

Challenges in Combatting Money Laundering and Terrorism Financing

The challenges in combatting ML and TF are multi-fold, arising due to a variety of factors, such as:

1. Emergence of New Typologies

With increasing regulations and compliance requirements in countries that strive to combat ML/TF effectively, the launderers and terrorists frequently manage to find loopholes to circumnavigate the regulatory checks and balances to curb ML/TF risks.  

The conduct of finding loopholes and innovating ways to avoid detection and prosecution by law results in the emergence of new ML/TF typologies.  

New ML/TF typologies are used by criminals on a daily basis across the globe, making it difficult for businesses implementing detection mechanisms to identify new typologies and the regulators investigating and deciding on Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) submitted to them whether certain behaviour or transaction is actually a red-flag indicating ML/TF motive or false alert. 

 New typologies of ML/TF make it difficult for businesses to report them as they might not be aware of new means of conducting ML/TF used by criminals, leading to non-reporting of such activity or transaction and criminals passing through compliance filters without consequences. 

2. Mismatch in Regulatory Controls

The degree and extent of effectiveness and stringency of ML/TF regulations vary from country to country. This results in launderers or terrorists resorting to funnel their illicit proceeds from one weak regulatory country to another with ease and decreased chances of detection.  

This mismatch of stringency in regulatory controls results in enabling launderers and terrorists to mobilise and channel their illicit proceeds for ultimate use in laundering money and conducting terrorist events.  

3. Non-Adherence to Global Standards

The Financial Action Task Force (FATF) is a global watchdog for ML/TF controls across the world. It sets out recommendations for countries and businesses operating within to combat ML/TF risks more effectively.  

However, there are still countries that do not follow or come in alignment with FATF and other global standards, resulting in increased risk of ML/TF risks in those countries. This impact of increased risk flows from weak AML/CFT jurisdiction to countries that have their regulations in place.  

4. Lack of trained AML Professionals

The lack of trained AML professionals contributes to the compliance deficit. Many countries face a lack of trained AML professionals who can be employed by regulated businesses in their country to look after AML/CFT compliances. This lack of appropriate talent results in difficulty for businesses in adhering to applicable ML/TF compliances in totality.  

5. Lack of Awareness in Non-Financial Sector

Most medium and smallscale DNFBPs and VASPs are unaware of their AML/CFT regulatory compliance obligations. They usually go on conducting business until a fine/ penalty or inspection from the regulator takes place. This results in business being already used as a channel for laundering or terrorism financing before compliance measures are implemented. 

Global Efforts in Fighting ML/TF

The FATF, United Nations, Wolfsberg Group, Egmont Group, and multiple FATF Styled Regional Bodies (FSRBs) are testament to global efforts in fighting ML/TF. They collect and disseminate information about potential ML/TF threats in the form of suspicious activity and transaction reports received by Financial Intelligence Units (FIUs) of various countries. They analyse and map trends of ML/TF typologies and threats. By doing so, they produce new methodologies and suggestions to curb ML/TF. 

Ready to fight money laundering and terrorist financing?

Equip your team with our expert AML/CFT training today!

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

The significance of cash thresholds in fighting money laundering and terrorist financing

Significance of cash thresholds

The significance of cash thresholds in fighting money laundering and terrorist financing

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

Money Laundering and Terrorist Financing are global concerns. They have an adverse effect on the economy and society. Governments across the world have enacted various laws and regulations. One of the important controls implemented by regulators across the world is establishing cash thresholds, i.e., setting up cash transaction limits to ensure that criminals don’t indulge in large-scale placement of their illicit money.

Definition of cash thresholds

Cash thresholds are the limitations on cash transactions that regulatory authorities impose to monitor them. Cash threshold is a monetary limit and if the transaction value exceeds that limit, the regulated entities are required to report it to the authorities.

This article focuses on the significance of cash thresholds in the fight against money laundering and terrorist financing. We will understand how criminals generate illicit cash by committing predicate offences and try to place it into the legitimate economy and how regulators try to control it, and the blog throws light on the following:

  • Importance of UBO identification in cash transactions
  • Challenges in implementing cash thresholds
  • Best practices to implement cash transaction limits effectively
  • Role of technology in enforcing cash thresholds

Our timely and accurate AML consulting services

For your smooth journey towards your goals

Overview of how cash thresholds function in AML/CFT framework

Overview of money laundering and terrorist financing

Money laundering and terrorism financing are foremost matters of interest worldwide. These are types of financial crimes that are damaging the international financial system. These crimes can also affect people’s security, economic stability, and a country’s integrity.

Money laundering involves hiding the origin of illegal funds and placing them in the legal financial system. Terrorist financing means funding activities related to or causing terrorism. Thus, both are financial crimes plaguing the global economy.

Importance of fighting ML/TF for global stability and security

These are transnational crimes that affect many countries worldwide. So, regulators need to implement proper AML/CTF measures to prevent or mitigate these threats. Fighting against ML and TF guarantees strong financial systems and economies worldwide.

By fighting against ML and TF, you can also contribute to global stability, security, and integrity in the following ways:

  • The proper drafting and implementation of AML/CFT regulations help curb financial crimes, creating a stable, trustworthy, and secure financial system.
  • The AML/CFT measures aimed at blocking illicit funds from entering the financial system help prevent and detect financial crimes. They also ensure that legitimate businesses are not used as conduits for conducting illegal activities.
  • The fight against terrorist financing helps ensure the safety and security of citizens.
  • Various ML/TF countermeasures like cash transaction limits help track funds generated from other illegal activities like corruption, drug or human trafficking, bribery, and fraud. Thus, these measures help reduce crimes in the world, making it secure and better.
  • The implementation of proper AML/CTF measures contributes to international cooperation in the fight against the ML/TF.

How can cash transactions be used for money laundering and terrorist financing?

Cash payment is the most convenient way for customers to buy products and services. At the same time, it’s the most accessible medium for money launderers to commit crimes. Financial criminals use cash to launder money or finance illicit activities.

Money Laundering

Cash transactions can enable any of the three stages of money laundering – placement, layering, and integration. Whether it is placing illegal funds in the legitimate financial system, creating layers to hide its source, or bringing back the illicit money into the financial system in a clean form, cash transactions facilitate all three.

Money laundering and cash transactions:

  • Conducting small cash transactions from different bank branches or accounts.
  • Using illegal cash to buy property and then selling it at lower prices.
  • Overvaluing or undervaluing the property price to launder the difference.
  • Using illegal cash to buy luxury items and resell them to make the transaction legitimate.
  • Using cash-intensive businesses like restaurants to mix dirty money with legal revenues.
  • Placing illegal cash between legitimate cash transactions and showing higher business revenues.
  • Processing illicit cash transactions through shell companies or offshore bank accounts.
  • Using money mules to conduct multiple small cash transactions across borders.
  • Using dirty money in cash form to buy insurance or securities.
  • Converting illicit cash into different currencies through currency exchange services.
  • Using illegal cash in gambling and casinos and requesting a cheque for the remaining amount to make it look legal.
  • Moving cash across borders by over or under-invoicing or misrepresenting the quantity or quality of goods.

Terrorist financing

Cash transactions also enable the four stages of terrorism financing – collecting, storing, moving, and using funds for terrorist activities. Since one can use cash in any of these stages, terrorist financing becomes possible with cash transactions in the following ways:

Terrorist financing and cash transactions:

  • Direct cash transactions to buy weapons, explosives, or any other items necessary for terrorism.
  • Using cash to support the living needs of terrorists.
  • Buying luxury items with illicit cash and selling them later to raise funds for terrorist activities.
  • Terrorists run cash-intensive businesses like casinos, restaurants, etc., and disguise illicit money as cash generated from legitimate business activities.
  • Cash can be transported across borders via individuals, bags, or vehicles using multiple routes to avoid detection.
  • Creating charitable and religious organisations to receive cash donations and use them in terrorism activities.
  • Misrepresentation of quality, quantity, or value of goods in international trade to fund terrorism.
  • Terrorists over or under-invoice goods across borders for international trade to hide illegal cash movements.
  • Using cash to support terrorist movements across borders by blending them with refugees or migrants.
  • Using students, tourists, or other mules to transfer cash across borders to fund terrorism activities.

Why do criminals prefer cash transactions?

Criminals prefer cash transactions to conduct various activities for the following reasons:

No records

Cash transactions leave no trail, so criminals prefer them.

Involvement of third parties

It is easier to include third parties or intermediaries in cash transactions. No need to maintain records of such persons and use as many to add layers of complexity.

Convenience

Cash is a preferred way of conducting a financial transaction in several jurisdictions. In particular, cash-intensive businesses like restaurants, casinos, and retail stores. One can mix illegal money with the revenues of such businesses to show exaggerated revenues.

Easy and fast

Cash transactions are easy and fast, involving no hassles or tedious procedures.

Easy to smuggle

It is easier to smuggle cash across jurisdictions.

Convertible

Cash is the preferred payment method to buy luxury goods or deposit in bank accounts. Thus, one can convert dirty money into legitimate money.

Easy to hide

It is easier to hide illicit cash. Moreover, one can break down a large cash transaction into several smaller valued ones. Whatever way one uses, one can avoid thresholds or restrictions.

Our timely and accurate AML consulting services

For your smooth journey towards your goals

Cash thresholds and AML/CFT regulatory requirements

The UAE has laid relevant cash threshold requirements under AML/CFT regulations to curb ML/TF. Here is the list of Cash Transaction Limit in UAE:

Cash Transaction Limit for Real Estate Agents and Lawyers

Real Estate Cash Transaction Limit for Free Hold Real Estate Buy/Sale Transactions:

Real Estate Agents and Lawyers are required to report any single cash transaction or several transactions that appear to be interrelated equal to or exceeding AED 55,000/- to the UAE FIU in the form of a Real Estate Activity Report (REAR).

Cash Transaction Limit for Dealers in Precious Metals and Stones

Gold, Jewellery, Precious Stones Cash Transaction Limit:

Dealers in Precious Metals and Stones are required to submit Dealers in Precious Metals and Stones Report (DPMSR) with the UAE FIU for any single cash transaction or several transactions that appear to be interrelated equal to or exceeding AED 55,000/-.

Other AML/CFT Regulatory thresholds

Customer Due Diligence

Ocassional Transaction Limit:

Customer Due Diligence is a mandatory requirement for establishing a business relationship. In case of occasional transactions, if the transaction value equals to or exceeds AED 55,000/-, Customer Due Diligence must be performed.

If the occasional transaction involves a wire transfer equal to or exceeding AED 3,500/-, customer due diligence must be performed.

Further, Virtual Asset Service Providers (VASPs) have to carry out customer due diligence when conducting occasional transactions in favour of a client for amounts equal to or exceeding AED 3,500, whether the transaction is carried out in a single transaction or in several transactions that appear to be linked.

Threshold related to DPMS and Applicability of AML/CFT Laws

Dealers in Precious Metals and Stones when they engage in carrying out any single monetary transaction, or several transactions which appear to be interrelated, whose value is equal to or greater than AED 55,000 are required to follow AML/CFT obligations under the AML/CFT legislative and regulatory framework of the United Arab Emirates.

Record keeping

UAE requires regulated entities to maintain records of all transactions for five years. However, the record keeping duration varies from one supervisory authority to another. 

  • The Virtual Assets Regulatory Authority (VARA) mandates Virtual Assets Service Providers (VASPs) to maintain records for a duration of 8 years
  • Dubai International Financial Centre (DIFC) requires DNFBPs to maintain AML/CFT compliance and CDD records for 6 years.
  • UAE Securities and Commodities Authority (SCA) requires regulated entities to maintain AML/CFT compliance and CDD records for 10 years.

This applies to transactions above and below the cash thresholds.

Customs Declaration Form

Besides AML/CFT regulations, Travellers entering or leaving the UAE carrying currencies, negotiable bearer financial instruments, precious metals, or precious stones of value exceeding AED 60,000 have to submit the customs declaration form.

Thus, cash thresholds are a significant part of AML/CTF regulations. With these limits, one can detect and report suspicious transactions.

Why is it important to identify UBOs in cash transactions?

By the risk factors of cash transactions, you would have understood why AML measures are necessary for them. These AML measures enable an intense fight against cash transaction threats. You can also prevent possible money laundering and terrorism financing activities.

Such appropriate AML measures include KYC and CDD. Identifying UBOs is a critical element of KYC and CDD. So, make it a practice to identify the ultimate beneficial owners of cash transactions.

A UBO means an individual controlling, owning, or benefitting from an entity. They might not be the apparent owners, but they receive all the benefits or control the operations in the background. In the case of a cash transaction, it means the individual that benefits from the cash transaction.

Identifying UBOs of cash transactions helps figure out the actual person behind a cash transaction and check if they are sanctioned individuals, PEPs, or persons with criminal history. If there are any red flags around the UBOs, you can take a risk-based approach, conduct EDD and submit SAR/STR as per the facts of the case.

Significance of cash thresholds in fighting ML/TF

Cash transaction limits play a huge role in the early detection of a possible crime. Here are the points highlighting the significance of cash thresholds in fighting money laundering and terrorist financing:

Helps identify suspicious activities

Cash transaction thresholds help identify suspicious activities where customers resort to purposefully keeping transaction amounts below the regulatory reporting thresholds.

Helps fight ML/TF effectively

Cash transaction thresholds enable the identification of suspicious activities. You can stop them or conduct further investigations to confirm the suspicion. Thus, these cash transaction limitations help you strengthen your fight against money laundering, terrorism financing, and other crimes.

Ensures regulatory compliance

Setting cash transaction thresholds helps you detect reportable transactions to the UAE FIU. Hence, it ensures regulatory compliance with UAE’s AML laws.

Ongoing monitoring

Cash transaction thresholds help in the ongoing monitoring of a business relationship. One can study various trends and patterns and identify customers who structure their transactions to avoid them being reported to the authorities.

Discourages illicit activities

Cash transaction thresholds discourage illicit activities because it makes it difficult for criminals to make large-scale cash deposits.

Helps take a risk-based approach

Setting a cash transaction limit helps you identify customers conducting such risky transactions. You know their risk levels and define enhanced due diligence measures for them. Thus, you can take a risk-based approach to AML measures against money laundering and terrorism financing.

Facilitates international cooperation

Defining cash thresholds and implementing them helps follow global best practices and FATF recommendations. It shows commitment to the global fight against financial crimes by facilitating cross-border investigations.

Challenges in establishing and enforcing cash transaction thresholds

So, you can see that the significance of cash transaction thresholds is in the prevention of financial crimes. However, it is not easy to establish these thresholds, here is the list of challenges:

Structuring

Criminals tend to structure transactions in such a way that they are able to avoid reporting thresholds. The detection of this is resource-intensive, and not all small and medium-sized businesses are equipped to detect such transactions.

Use of multiple accounts

Another way criminals avoid cash thresholds is by conducting transactions through multiple accounts. When they use different accounts in the same or different financial institutions, they can avoid detection.

Resource-intensive

Cash threshold necessitates transaction monitoring to detect and analyse various trends and patterns. This increases operational burden.

False positives

Another challenge of cash thresholds is the number of wrong suspicions they generate. Many transactions exceed the cash transaction limits when they are linked, so you mark them as suspicious and generate reports. However, on further investigation, many of them will be false. Dealing with such false positives can overwhelm you and regulatory authorities.

Data quality

Data quality is also a critical test in such cash thresholds. The customer data you check has little to no information on all factors. Or the data is inaccurate. Handling all these data quality issues is a big challenge while enforcing cash thresholds.

Varying AML/CFT regulations

The problem in cash threshold implementation occurs at the time of cross-border transactions. The varying limits around cash transaction reporting make it difficult to detect illicit transactions. It becomes challenging when a customer prefers transactions in jurisdictions with no cash thresholds or limits.

Privacy concerns

Data privacy is a challenge while enforcing cash thresholds. Per the transaction monitoring requirements under AML, one needs to collect a lot of personal information about the customers. Customers might find all these queries invasive and not cooperate or form a business relationship. Thus, compliance with data privacy laws becomes a challenge with implementing cash transaction thresholds.

Employee awareness and training

Establishing and enforcing cash thresholds becomes difficult if the employees are not trained. Awareness of these cash thresholds, red flags of suspicious transactions, and managing the procedure is essential. In the absence of such awareness and training, it becomes challenging to enforce cash transaction limits.

Insider threats

Insider threats are crucial challenges in any compliance-related topic. If employees comingle with criminals, the regulatory threshold enforcement becomes next to impossible.

Evolving methods of ML/TF

Money launderers keep innovating to have as many opportunities to conduct crimes. They engage in discovering techniques to circumvent AML measures. In such cases, the existing cash thresholds might not serve the purpose.

Multiple-party transactions

A big challenge in enforcing cash thresholds is complex customer transactions. Complexity increases when there are multiple parties or jurisdictions in a transaction. The multiplicity makes tracking and detection challenging.

Cash-based economies

Establishing cash thresholds in cash-based economies is a challenge. Since most of the transactions in cash-based economies are in cash, highlighting each suspicious transaction above the cash threshold and further investigating it will be an operational burden. Thus, cash thresholds in cash-intensive countries are a challenge.

Our timely and accurate AML consulting services

For your smooth journey towards your goals

Best practices in enforcing cash transaction thresholds to fight ML/TF

To address these challenges in establishing and enforcing cash thresholds, one must adopt the following best practices:

KYC and CDD

Regulated must adopt comprehensive KYC procedures to collect all the required details of customers and carry out identity verification checks. The documentary evidence should be cross-checked, and proper due diligence must be carried out to understand the customer’s business, the expected volume of transactions, beneficial owners, and the risks associated with them. The data points resulting from KYC and CDD help create customer risk profiles. If you have these risk details on customers, it is easier to enforce cash thresholds.

Transaction monitoring software

A robust transaction monitoring software helps track transactions. It helps you create rules based on potential red flags of money laundering in your industry. Based on these rules, the software spots patterns, trends, and anomalies for you to investigate them further.

The software generates an alert if the transaction exceeds the cash threshold amount. Such software enables real-time monitoring of transactions to detect suspicion as and when they are being conducted. Thus, the software facilitates quick identification, reporting, and recording of transactions equal to or exceeding reporting thresholds.

Advanced analytics and AI

The latest advanced technologies canhelp identify linked transactions which are carried out to circumvent reporting thresholds. Data analytics allow the detection of patterns, unusual trends, or anomalies. Machine learning algorithms make pattern detection accurate. You can reduce the number of false positives and improve genuine alerts. It also helps you adapt to the evolving ML/TF risks.

Staff training

Cash threshold enforcement is enhanced if the staff is aware of its importance. Knowledge of transaction monitoring tools and cash thresholds help comply with the regulatory requirements around cash transaction reporting.

Besides training, motivating employees to align with AML/CTF initiatives is crucial.

Data privacy

Data privacy and confidentiality are common challenges in such AML compliance measures. Since you monitor your customers and their transactions, you have tons of data on them. It’s possible that you lose data, it gets hacked, or some employee leaks the data.

To solve this concern, you must implement effective data protection policies. With such data confidentiality and privacy guarantees, your customers trust you more with their details. They will give due importance to AML measures and cooperate with you.

Keeping up with regulatory updates

Despite the implementation of cash transaction threshold rules, one might commit errors in AML compliance. One must stay up-to-date with UAE’s AML requirements to avoid such mistakes. Keep checking the latest guidelines and updates on AML rules. One must also keep an eye on international AML standards.

The internal AML policies, procedures, and controls must align with national regulations and international AML best practices.

Insider threat mitigation

Insider threat is a critical challenge for regulated entities under AML laws. Insiders in the business might misuse customer data. They might also collude with customers to avoid detection of their transactions as suspicious.

One must be wary of such insider threats. Segregate the duties based on employee skills, past performance, and behaviour. Hold them accountable and responsible for the AML procedures they perform. Insider threat mitigation helps one implement cash transaction limits more effectively.

Continuous learning and adaptation

One best practice while enforcing cash thresholds is learning from past experience and innovations. One can make this possible by conducting regular reviews and health checks. One can improve upon the areas where there are gaps.

Concentrate on high-risk areas

One needs to take a risk-based approach and prioritise risks to target. Customers coming from high-risk jurisdictions, known ML/TF typologies and red flags, cash-intensive business, etc., must be taken into consideration while designing controls and cash transaction thresholds.

Global information sharing

The regulatory authorities conduct a National Risk Assessment and provide information about inherent risks related to ML/TF. Regulated entities should participate in this exercise and provide all the required information and assistance to the authorities to counter the global menace of money laundering and terrorist financing.

Record-keeping

Record-keeping is a best practice for all entities. The regulated entities must maintain all the records related to KYC, screening, risk assessment, business transactions, and regulatory reporting.

Public awareness campaigns

The regulators must run public awareness campaigns around the cash transaction threshold limits so that genuine customers cooperate with regulated entities in providing the required information.

Role of technology in enforcing cash transaction thresholds

Technology is one of the key best practices for establishing and enforcing cash thresholds. It helps you fight most of the challenges of implementing cash thresholds while monitoring transactions. Technology solutions provide the following benefits:

Automated reporting with transaction monitoring systems

Transaction monitoring systems have a reporting feature. This feature allows the generation of reports on transactions equal to or exceeding the reporting thresholds.

Thus, this automated reporting feature enables accurate and timely reports that you can submit to authorities, making you AML-compliant. Technology solutions also streamline data storage and record keeping.

Data analytics and patterns identification

Technology solutions make transaction monitoring faster, more accurate, and easier. Data analytics, predictive analytics, and machine learning help you study the data and identify patterns. You can detect the possible anomalies in transactions and better understand them.

Customer risk assessment

AML software enables ongoing monitoring of a business relationship. This helps detect trends and patterns and assign appropriate risk ratings to customers. This goes a long way in prioritising resources and countering money laundering and terrorist financing.

Real-time alerts and notifications

The best feature of transaction monitoring solutions is alerts. The solution generates alerts when it spots a reportable transaction. It also notifies you of the suspicion or a pattern or trend identified in a transaction so that you can take the required action.

Predictive analytics

Transaction monitoring technology systems use predictive analytics techniques. This technique allows you to predict future outcomes. The system generates alerts when it detects a linked

transaction crossing the statutory threshold. Such predictive analytics lets you take proactive measures so that issues do not escalate.

Adaptive learning and scalability

Transaction monitoring software with cash thresholds is adaptive to changes. Over a period of time, your business grows, risks change, new customers come, transactions increase, and various other adjustments happen. Amid all these amendments, your system also updates. It adapts to the new transaction monitoring rules based on customer and transaction characteristics. Thus, your existing system learns the new patterns, assesses large cash transactions, and adapts to changes.

AML compliance automation

AML compliance is the biggest concern for reporting entities under AML laws. With such technology systems, you can perform the AML procedures efficiently. They automate KYC, CDD, customer screening, and transaction monitoring processes. Such automation helps you achieve compliance in a faster, comprehensive, and more accurate way. Moreover, there are fewer possibilities of violating cash transaction threshold compliance requirements with audit facilities.

Location-based monitoring

Such technology systems for monitoring transactions allow location-based monitoring. This means that if the transaction is from a high-risk jurisdiction, the system highlights it. Since transactions from high-risk jurisdictions are highly risky, you can put such transactions on hold and submit the necessary SAR/STR.

Summarized output

Technology solutions enable summarized results through dashboards. User-friendly interfaces provide detailed and summarized insights to help management make quick decisions. This also facilitates collaboration with other industry players and authorities.

Security

Technology solutions for enforcing cash transaction thresholds are secure and safe systems. These solutions come with biometric and multi-factor authentication features, ensuring no unauthorised access. Data encryption and secured storage facilities keep your data private and protected from cyber threats.

Conclusion

Thus, cash thresholds play a critical role in AML/CFT compliance framework. You must understand the significance of identifying reportable transactions by setting appropriate limits on cash transactions.

Since cash will always remain a critical part of most economies, implementing cash thresholds is an excellent prevention technique. Moreover, using technological solutions with AI, machine learning, and data analytics features makes them more capable.

So, use cash thresholds to detect suspicious transactions and reduce the likelihood of money laundering in cash transactions. If you need help with these AML measures, AMLUAE is your one-stop destination. We provide a wide range of AML compliance services to help your business from the impact of money laundering, terrorism financing, and other crimes. 

Enhance your defence against financial crimes,

With AMLUAE’s initiatives to prevent the risks
in money laundering.

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

The role of shell companies in money laundering

The role of shell companies in money laundering

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

Shell companies are a preferred avenue for financial criminals to hide their crimes. These include money laundering, fraud, evading sanctions, escaping taxes, and many others. To protect yourself from these risks and prevent shell companies from exploiting your business, you need to apply proper AML measures. In this article, let’s understand the role of shell companies in money laundering and other financial crimes.  

The world of shell companies is based on committing the crime and staying undetected. Shell companies are also known as ghost companies. That means they are the vehicles used in the second stage – layering – of money laundering. Layering allows criminals to disguise the origin and place of dirty money. Thus, you must have enough AML measures to prevent the risks of shell companies in money laundering.  

Worried about the risks of shell companies in money laundering?

Contact us to prevent shell companies from exploiting your business.

What are the risks of shell companies in money laundering?

What is a shell company?

A shell company is a company without any physical presence and assets. It is not active in business operations. No services provision. No sale of goods. Moreover, it does not have any significant assets. That is why it is a great technique to hide a firm’s ultimate and real beneficial ownership. Criminals form shell companies to conduct illicit business transactions. 

Shell companies are characterised by:

  • Lack of physical presence 
  • No income 
  • No employees 
  • Occasionally hold bank accounts and investments 
  • Inactive 
  • Complex ownership structure 
  • Nominee directors and shareholders 

Are shell companies legal?

Yes, shell companies are legal even if they are inactive. An individual can form a new company to hold some assets. The newly formed company holds the asset, and that’s its only purpose. It remains inactive and does not conduct sale or purchase transactions.  

What are the legitimate and illegitimate uses of shell companies?

Shell companies and their legitimate use cases

  • To invest in various countries 
  • To raise funds from the international market 
  • To prevent tax lawsuits on assets 
  • To hold funds 
  • To hold assets like bonds, real estate, stocks, etc. 
  • To protect intellectual property rights 
  • To employ tax planning strategies 
  • To facilitate mergers and acquisitions 

Shell companies and their illegitimate use cases

  • To hide dirty money earned from illegal activities 
  • To conceal the identities of beneficial owners 
  • To evade taxes by hiding income in a shell company in a different jurisdiction 
  • To conduct fraud, scam, or a crime 
  • To store washed funds in the shell company’s accounts 
  • To hide assets during mergers and acquisitions or divorces to avoid sharing with others 
  • To finance and exchange dual-use goods with other shell companies, leading to the proliferation of financing 
  • To provide phantom services by raising invoices for services that were never rendered 

The impact of shell companies

  1. Money laundering, terrorist financing, drug trafficking 
  2. Tax evasion 
  3. Market manipulation 
  4. Unfavourable conditions for legitimate businesses 
  5. Fraud 
  6. Corruption 
  7. Illegal payments 

What is the difference between shell, shelf, and front company?

Shell companies have no business activities, significant assets, or employees. They exist on paper but not physically. They are not illegal corporations, but companies use these structures to conduct illicit transactions like money laundering, tax evasion, and concealing beneficial ownership, as well as for legitimate purposes. Trust companies use shell companies as trustees. Companies use shell companies to evade taxes through transfer pricing strategies.  

Shelf companies are incorporated companies. They can or cannot have customers but stay dormant for years with no business activities. The secretaries, shareholders, and directors of a shelf company are inactive.  

A front company is a legal business – a fully functioning company. However, criminals use front companies to hide their illegitimate financial transactions.  

Why are shell companies vulnerable to money laundering?

Shell companies’ vulnerability to money laundering is due to the following reasons: 

Anonymity

The most significant characteristic of shell companies is their anonymity. It keeps the identity of beneficial owners secret and private. This is possible because shell companies are constructed in less-regulated or tax-haven countries. These countries have no mandatory requirements for the disclosure of structure, and shareholding. You can move funds from one country to another without divulging any transaction and ownership details. This is the feature that money launderers leverage to conduct crimes.  

Low cost and easy company formation procedure

Another characteristic that makes shell companies susceptible to money laundering is the low cost and ease of formation. You don’t need to spend much money on its establishment and operations. Moreover, their setup does not involve many steps or hassles of approvals and documentation. Such ease and less-costly company structuring enable money launderers to opt for shell company formation. 

No physical presence

Shell companies do not have a physical presence. They exist only on paper. So, you will find it challenging to trace the company’s whereabouts. This is also one of the reasons why their vulnerability to financial crimes is high.  

Relaxed regulatory rules

Offshore destinations with relaxed rules are preferred destinations for shell companies. These jurisdictions do not restrict a business’s and its owners’ confidentiality, privacy, and anonymity. Strong bank secrecy rules, strict privacy laws, and relaxed regulatory standards make a country a preferred hub for shell companies.  

Superrich use such shell structures to hide their wealth because of relaxed regulations. Also, the creation of shell companies involves fewer regulatory investigations and checks. The absence of or minimal reporting requirements attracts criminals who use shell companies to commit crimes. Even low or no corporate tax rates make a jurisdiction a preferred destination for shell companies.  

A confusing network of several shell companies in different jurisdictions

The network of multiple shell companies in different jurisdictions benefits money launderers. Such a complex network lets one create a chain of several transactions. This structure makes tracing funds’ ownership, source, and destination difficult. Regulatory and investigating authorities have to handle too many jurisdictions and their laws. Also, collaboration between authorities in so many jurisdictions is a big concern. Some jurisdictions might have a vested interest in such schemes, so they don’t help in investigations.  

Worried about the risks of shell companies in money laundering?

Contact us to prevent shell companies from exploiting your business.

How do shell companies launder money?

Criminals set up a shell company, invest their proceeds of crime into it and then move funds to their own account by using fake invoices.

Red flags of financial crimes by shell companies to exploit your business

Since shell companies’ risk in money laundering is high, you must be vigilant about their activities. One way of doing that is learning about the red flags of customers’ illicit behaviour. These are the warning signs of suspicious transactions using shell companies. So, you must be aware of these red flags to spot suspicions at the right time and stop the transaction. These red flags include the following: 

  1. Atypical directorship in companies  
  2. Dubious addresses of companies 
  3. Mass registration of many directors, shared names, or addresses indicates the involvement of many shell companies.  
  4. Dormancy of a company for a few years and a sudden rise in presence with a spike in revenues 
  5. Too young or too old beneficial owners like five years or more than 100 years 
  6. Circular ownership of several companies with each other to hide beneficial ownership 
  7. Dubious addresses as address proof of entities 
  8. A mismatch between the company’s registration jurisdiction and the directors’ residency or nationality, specifically involving high-risk jurisdictions 
  9. The home jurisdiction of the shell company is a sanctioned or terrorist country or one with weak AML and other regulatory controls 
  10. Some odd financial anomalies 
  11. Ultimate beneficial ownership is significantly different from the expected 
  12. The company has not undertaken any real business activities 
  13. The formal nominees mentioned for the company are nominated agents for many shell companies 
  14. The nominees are generally the spouses, children, or relatives who do not contribute to the enterprise’s operations 
  15. The shell company conducts many transactions, but none generates income 
  16. It does not contribute to taxes, social benefits, and employee benefits 
  17. One party is the origin and destination of financial benefits in the case of international funds transfer, or the transaction is between two different businesses, but they have the same registration address 
  18. The unnecessary creation or involvement of representative offices or similar delegation services  
  19. Cash transactions, different from the usual payment mode used  
  20. Account signatory executes a large transaction but with no controlling interest in the assets or company 
  21. Involvement of family members in business transactions with no legal business purpose 
  22. Private third parties provide loans, but there is no supporting agreement, interest repayments, or collateral 
  23. Doubtful and questionable relations between parties with no clear explanation by the customer 
  24. Unusual transactions considering the client’s profile, business model, or previous transactions 
  25. The origin and destination of transaction funds involve a foreign jurisdiction with no justified linkage with the client 
  26. The business account used for a transaction is also used for personal transactions like buying assets or other reasons with no linkages to the client’s profile 
  27. Involvement of two or more parties in a transaction with no apparent reason or legal rationale 
  28. Finance from a lender – an individual or a company – without any commercial reason or justification 
  29. Goods or services transacted do not correspond to the sender or receiver’s business profile 
  30. The unwillingness of the party to disclose information on the transaction 
  31. Transactions involving beneficiaries from offshore or high-risk jurisdictions 
  32. Transactions with fake invoices having a shell company’s name as the seller of products 
  33. Complex transactions with multiple layers of buying and selling 
  34. Large volume or value transactions with other ghost companies 

With so many red flags and others, you must keep an open eye on all incoming and outgoing transactions. All these are obscuring the illicit behaviour of the transactions, which you must be aware of. It makes tracing of money laundering and criminals challenging for investigators. However, with proper AML measures and transaction monitoring, you can identify the legal, fair transactions from the illegal, unfair ones.  

How do you prevent shell companies from exploiting your business?

So, now you understand that shell corporations are risky for your business. You must safeguard yourself from these risks to reduce the likelihood of involvement in money laundering activities. You need to be proactive in your efforts to build a resilient business. To protect your business from the risks of shell companies in money laundering, you must apply the following measures: 

KYC

Know your customers. It is a critical way to prevent shell companies from exploiting your business. You must know all the details about your customers, such as: 

  • Business name 
  • Registered business address or residential address 
  • Email address and contact number 
  • Business license number 
  • Nature of business  
  • Business type and structure 
  • Business details like board of directors, date and place of establishment, and annual report 

You must collect proof of all these details. The documentary proof helps you verify your client’s identity. You can identify if your customer is a shell company or not.  

Due diligence

KYC is a fundamental way of knowing your customers. Due diligence involves more intense scrutiny. You must investigate your customers’ funds and wealth further. This will help you detect any linkage with illegal activities.  

Investigate the following about your customers: 

  • Source of funds 
  • Source of wealth 
  • Beneficial ownership (name, address, relation with the firm, national identity, and other details) 
  • The business structure 
  • Payment methods used 
  • Financial statements 
  • Geographical presence 

All these data points help you understand the customer’s background. You can get confirmation on the authenticity of the company’s business operations and business owners, customers, and suppliers. Investigating beneficial ownership and background helps you understand whether the client is a shell company created for illicit reasons. Once you know the beneficial owners and risks associated with them, you can examine any probable involvement of shell companies.  

Customer Risk Assessment

Once you manage to conduct KYC and CDD, you have a decent amount of information on your customers. Now, you can manage to create risk profiles of your customers. Based on this risk profiling, you can categorise customers as high, medium, and low risk.  

The risk profile includes rating your customer based on the risks from their products/services, geographical presence, delivery channels, and transactions. If the customer is high-risk, you need to be more cautious.  

Transaction monitoring

Monitoring shell company transactions is necessary to spot suspicions. By checking transactions, you can spot any shell company’s participation in financial crimes. For this, you must look at the transactional patterns or irregularities in customer behaviour. Also, keep a check on the value and volume of transactions. Lack of transparency or unwillingness to disclose identity or transaction details is a typical red flag of shell companies.  

So, awareness of the red flags of shell companies’ involvement in money laundering is essential. The section above contains warning signs you must be wary of when detecting shell companies’ involvement in illicit transactions.  

Technology solutions

Use technology solutions to perform your business’s AML and risk management strategies. These solutions have the latest advanced technologies, such as the following: 

  • Artificial intelligence 
  • Data Analytics 
  • Blockchain technology 
  • Machine learning 
  • Data mining 

All these technologies help you with accurate sifting and analysis of data. They help you analyse loads of data to verify customers’ identities. These technologies can identify patterns and behavioural characteristics matching potential red flags. Thus, you can identify suspicious transactions and customers linked to shell companies.  

The best part about AI is that it adapts over time to new rules. When new money laundering tactics emerge, or risks evolve, you can update your solution to these new rules. Thus, you can put up an intense fight against money laundering through shell companies. You can devise strategies against the risks of shell companies in money laundering and prevent them from exploiting your business.  

AML compliance program

To prevent shell companies from exploiting your business, you must take a risk-based approach to your AML compliance program. You must develop specific policies, procedures, and internal controls for your business. This framework depends on industry-specific risks and shell companies’ role in money laundering.  

Your framework must include KYC, CDD, and transaction monitoring. It involves continuous monitoring of risks from customers and their transactions. Knowing the risks allows you to take relevant action and stop your business’s exploitation. You must also monitor these AML programs on an ongoing basis to make improvements that bring you closer to AML compliance in UAE.  

Training

Training of frontline employees and compliance teams goes a long way in countering ML/TF risks emanating from shell companies. The training programs should revolve around the identification of UBOs, known red flags, and known ML/TF typologies.  

All these measures help you know who you are dealing with. Thus, you are aware of the risks from your customers and suppliers. Based on your risk appetite, you can decide whether to form a business relationship and transact with them. These measures help you stay vigilant against the risks of shell companies in money laundering.  

If you apply these proactive AML efforts, you can detect the illegal network of shell companies that launder dirty money. Thus, these measures help you prevent shell companies from exploiting your business. You can improve the financial system’s integrity and comply with AML regulations 

AML UAE – your partner for professional AML consulting services

AML UAE can help you design and implement customised solutions to prevent shell companies from exploiting your business. Our AML initiatives strengthen your fight against shell companies and reduce their threats. We can help you: 

  • Know your clients better 
  • Conduct due diligence checks on them 
  • Monitor their transactions on an ongoing basis 
  • Assess risks from shell companies 
  • Design appropriate AML compliance programs 
  • Select and implement the right technology solutions for your business 
  • Conduct training to strengthen your team against ML/TF risks posed by shell companies 

All these measures reduce the risks of shell companies to your business. Thus, with AML UAE’s help, you can prevent shell companies from misusing your business to conduct money laundering activities.  

Enhance your defence against financial crimes,

With AMLUAE’s initiatives to prevent the risks of shell companies
in money laundering.

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

The Risk-Based Approach in Anti-Money Laundering Compliance

Step-by-step implementation of Risk-Based Approach

The Risk Based Approach to AML: Anti-Money Laundering Compliance

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

The Risk Based Approach to AML: Anti-Money Laundering Compliance

Money Laundering and Terrorist Financing are global threats. Governments across the globe have framed laws and regulations to counter Money Laundering (ML), Terrorist Financing (TF) and Proliferation Financing (PF). The regulated entities are obligated to employ their resources to fight financial crimes. For any business, resources are always scarce, and hence they would want them to be employed efficiently. That is where the Risk Based Approach to AML compliance comes into play and helps businesses deal with financial crimes efficiently.  

Definition of Risk Based Approach (RBA):

The Risk-Based Approach (RBA) is basically the effective deployment of controls to counter the most significant ML/TF/PF risks a business is exposed to. It takes into account various risk factors, their likelihood of occurrence, impact, controls in place, and the risk appetite of the management to keep ML/TF risks at an acceptable level. Every business has its own risk-bearing capacity, and in AML compliance, it becomes essential to adopt a Risk-Based Approach in order to tackle ML, TF, and PF. Further, under an RBA, there is no such thing as ZERO risk, but it offers the most effective way to counter the risks. EDD for high-risk customers, determination of sample size by AML auditors, cash transaction thresholds, customer acceptance and customer exit policies are some of the common examples of having taken a risk-based approach.

Before going into detail about compliance requirements for a Risk-Based Approach under the UAE’s AML/CFT regulations, let us understand what a Risk-Based Approach in the AML realm means.  

What is a Risk-Based Approach in Anti-Money Laundering (AML)?

Risk Based Approach: Meaning

The UAE 1: Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Illegal Organisations required Fis, DNFBPs, and VASPs to take a Risk-Based Approach to counter money laundering and terrorist financing risks. 

The Risk-Based Approach (RBA) helps reporting entities effectively identify, assess and tackle ML/TF/PF risks. Financial Institutions (FIs), Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs) should apply appropriate measures and procedures commensurate with the risks of money laundering, terrorist financing, and proliferation financing. The Risk-Based Approach enables the reporting entities to apply their efforts optimally to mitigate ML/TF/PF and sanctions risks. The RBA provides the risk-sensitive application of AML/CFT measures. Accordingly, companies are able to apply the principle of “higher the risks, higher the controls”.  

The application of the Risk-Based Approach helps firms decide on the degree, frequency, or intensity of the ML/TF/PF/ controls. 

Enforcement of cash thresholds by entities to mitigate ML/TF risks is one example of a risk-based approach. Other examples of RBA include EDD for high-risk customers, ML/TF independent audits, etc.

Step-by-step implementation of Risk-Based Approach in AML

RBA requires proper implementation of controls for an AML program to be successful. For an effective RBA process, all steps must be looked into and implemented correctly. The following is the step-wise process that DNFBPs should undertake for taking a Risk-Based Approach to compliance: 

1. Risk Identification:

In identifying the ML/FT and PF risks to which DNFBPs are exposed, they should consider various internal and external factors such as the nature of business, product, services, risks associated with each customer, geography, especially high-risk jurisdictions and distribution channels. This step becomes a base for risk assessment, as DNFBPs are supposed to conduct risk assessments based on the factors identified to evaluate the emerging and relevant ML/FT and PF threats. 

2. Risk Assessment:

It forms the basis of the DNFBP’s RBA for the development of policies and procedures to mitigate ML/TF risk, reflecting the risk appetite of the institution and stating the risk level deemed acceptable

Step-by-step implementation of Risk-Based Approach

This step enables DNFBPs to understand the possibilities of risk materialising and the impact thereof.  

3. Controls Enforcement:

This step includes formulating mitigation measures, which would help DNFBPs to bring down ML/FT and PF risks within the risk appetite of the entity. Under this step, DNFBPs identify control measures and further include them for defining governance structure and framing AML policies DNFBPs must also assess and ensure the control effectiveness to counter ML/TF risks. 

4. Residual Risk:

It is necessary for DNFBPs to compare the risk profile to risk controls to measure the effectiveness of control measures against risk. This step requires identifying risk that remains after efforts have been made to reduce the inherent risk. The residual risk is also known as net risk. 

Residual Risk = Inherent Risk – Controls 

5. Risk Appetite:

After residual risk is identified, it is vital to compare it to determine whether it meets the risk acceptance level set out in the risk appetite. Risk appetite is set at the early stage, which defines the amount and type of risk that is accepted. As a forward-looking concept, it helps in assessing the residual risk an organisation can accept. 

6. Take Additional Measures:

After residual risk is identified, it is vital to compare it to determine whether it meets the risk acceptance level set out in the risk appetite. Risk appetite is set at the early stage, which defines the amount and type of risk that is accepted. As a forward-looking concept, it helps in assessing the residual risk an organisation can accept. 

Detect and Deter ML/FT and PF risk

With the help of our expert AML team

Principles of The Risk Based Approach to AML Compliance

Acceptance of the existence of risk is the first thing that actually matters when it comes to the principles of the RBA to AML compliance. A risk assessment should be carried out according to the intensity of risk, the risk assessment process should be examined, and the compliance process should be applied. 

Inherent Risk:

The gross riskis the risk an entity is exposed to before putting any AML/CFT controls in place. 

Residual Risk:

The residual risk is the risk the reporting entity assesses once AML/CFT controls and measures are put in place. 

According to the principles of a Risk-Based Approach, controls need to be aligned with the risks involved. The risk-based approach requires an entity to focus more on the risks that can have a higher impact.  

For instance, the Customer Due Diligence (CDD) Process for Politically Exposed People (PEPs), which undoubtedly belongs to a high-risk profile, will remain insufficient if Enhanced Due Diligence isn’t carried out for them.  

In addition, business enterprises must continuously monitor, analyse, and interpret their pool of data that falls within the scope of anti-money laundering compliance.  

The manual monitoring of a business relationship is impractical when the transaction volume is high. Therefore, the regulated entities may resort to transaction monitoring software which can help them identify suspicious patterns in customer’s transactions and help them investigate the cases further and submit SAR/STR depending on the facts of the case.

Importance of Risk-Based Approach in Anti-Money Laundering Compliance

The risk appetite and risk-bearing capacity differ from one company to another. Therefore, following the same AML process for each enterprise or individual will not fetch healthy results. 

Besides that, the risk-bearing appetite of the companies from the same industry also differs because the management style isn’t uniform everywhere.  

Here is when the need for and importance of a Risk-Based Approach come into the picture. With the help of a Risk-Based Approach, companies from various business sectors can create an anti-money laundering framework that helps them fight ML/TF effectively.  

The Traditional Tick-Box Approach vs. Risk-Based-Approach

Prior to the evolution of RBA, financial institutions (Fis) and DNFBPs were employing a tick-box approach to manage their AML compliance requirements. Under the traditional tick-box approach, merely going through a set of uniform AML standards was assessed and satisfied. However, with the changing financial landscape and advancement of technology, the Financial Action Task Force (FATF) presented the concept of RBA.  

The following is an analysis of the traditional tick-box approach vs. the Risk-Based Approach on different factors: 

Criteria  

Tick-Box Approach 

Risk-Based Approach 

Flexibility  

It is an inflexible approach as a set of compliance requirements without considering underlying unique aspects of risk. 

It is a flexible approach as it leaves the possibility to consider the unique risk profile and make it more adaptive.  

Efficiency  

In terms of efficiency, there is no scope to change and make it adaptive to new changes and risks, thus making it an inefficient approach.  

It is dynamic and adaptable, which allows efficient use of resources in combating ML/FT and PF risks, thus increasing the efficiency of AML measures.  

Resource 

This measure follows a resource-intensive approach for applying AML measures. It requires extensive manual effort and time to complete. Thus, for efficient measures, this approach can take up a lot of resources, leading to an increase in financial burden as well. 

This allows for smarter allocation of resources by focusing efforts on areas of higher risk, optimising efficiency, and enhancing effectiveness in identifying and mitigating risks. It also fosters a more dynamic and targeted approach to AML compliance. 

Effectiveness  

It is a superficial approach that only addresses surface-level aspects of AML compliance and disregards associated risks.  

It is an effective approach that focuses on in-depth learning, understanding new risks, and implementing measures accordingly.  

Prioritising  

This works by taking a one-size-fits-all approach to every risk, leaving little room for risk prioritisation 

This approach prioritises risk by incorporating a tailored method for each risk according to its impact and probability. 

Proactiveness  

It is an active approach for AML measures by working in a manner that follows standard policies without being open to the risk that requires a proactive approach.  

It is a proactive approach to compliance by entailing measures for identifying, assessing, and controlling risks.  

UAE AML/CFT Laws and FATF Recommendations Around Risk-Based Approach

What is the reasoning behind implementing a risk-based anti-money laundering approach?

The UAE has adopted effective AML laws to combat financial crimes, including ML, FT, and PF. The regulatory framework in the UAE includes federal laws that are aligned with international standards set out by the Financial Action Task Force (FATF). 

Within UAE’s legal regime, it has implicitly adopted RBA to AML compliance to understand ML/FT and PF risks and implement appropriate measures. Furthermore, Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations Guidelines for Designated Non-Financial Businesses and Professions mandate DNFBPs to implement RBA to identify, assess and understand ML/FT and PF risks and further take the most appropriate mitigating measures.  

The RBA framework is also based on FATF recommendation no. 1, which lays down the principle of applying RBA to assess and adopt measures for ML/FT and PF risks. 

Primary Elements of a Risk-Based Approach in AML Compliance for DNFBPs and VASPs

The following is the list of primary elements of a Risk-Based Approach in AML compliance for DNFBPs and VASPs: 

Primary Elements of a Risk-Based Approach in AML Compliance for DNFBPs and VASPs

ML/FT Enterprise-Wide Risk Assessment

ML/FT Enterprise-Wide Risk Assessment (EWRA), also known as Business Risk Assessment, is a key pillar of the RBA. It is an enterprise-level risk assessment that plays a pivotal role in combating ML/FT and PF risks.  

EWRA is a process of identifying all external and internal risk factors such as products, services, transactions, delivery channels, customers, geographies, technology, etc, and further assessing their impact, exploring ways to mitigate, and controlling and monitoring associated risks. 

Assessing the risk at the enterprise level helps in formulating a comprehensive and better AML framework. 

AML/CFT Policy and Procedures

AML/CFT policies and procedures are the foundational documents that outline an entity’s approach to preventing, detecting, and mitigating ML/FT and PF activities.

These documents provide guiding principles to compliance officers and employees regarding their responsibilities to ensure compliance with AML/CFT regulations and the actions required.  

These policy documents cover a wide range of areas under the AML framework that include CDD, transaction monitoring, reporting activities, and risk management. 

The policies and procedures detail the actual implementation of RBA within an organisation. What it perceives as an ML/TF/PF risk and the commensurate controls to counter it.  

With effective AML/CFT policies and procedures, DNFBPs can establish an effective AML/CFT framework within their organisation to counter financial crimes, including ML/FT and PF. 

KYC and Customer Due Diligence (CDD)

Know your customer, and the customer due diligence processes are carried out in order to identify who the customers really are and to further verify their identity and the nature of the businesses they engage with.  

These procedures are one of the most fundamental building blocks of efficient and effective anti-money laundering compliance management. Within the scope of these procedures, you can assess and determine the level of risks associated with the customer and then take necessary actions to mitigate those risks.  

Assessing the risk level of your customers accurately is an undeniable prerequisite for the Risk-Based Approach. However, without accurate customer due diligence, it is difficult to analyse risks posed by a customer.  

Sanctions Screening

Sanctions screening aims to restrict dealings with persons involved in illicit activities. For this purpose, an entity is required to screen names against sanction lists maintained by governments, international organisations, and regulatory authorities.  

DNFBPs, by conducting sanctions screening, can efficiently identify and prevent dealings that are against the regulatory framework and can also demonstrate adherence to the compliance requirements. 

As per UAE AML Regulations, DNFBPs and VASPs are required to conduct screening against the UNSC Consolidated List and the UAE Local Terrorist List.  

If the regulated entity deals with foreign countries, it can adopt a Risk-Based Approach and consider other relevant sanction lists for screening purposes. 

PEP Screening

PEP screening means screening customers to identify if they are politically exposed persons (PEPs) or are related to a person identified as PEP. PEPs pose a high risk to DNFBPs because of their prominent position, which can be misused for illicit activities like corruption and financial crimes.  

This measure involves screening customers against a PEP database to assess the nature and extent of their political exposure. 

PEP screening helps to implement RBA and a better risk assessment process, which enhances the ability to take appropriate risk mitigation measures like Enhanced Due Diligence. 

Adverse Media Screening

Any negative news about an individual customer or a business enterprise can broadly impact the decision to enter into a business relationship with them.  

Plus, keeping an eye on such news is the best way to protect your organisation from any potential risks that might come when dealing with clients with high-risk profiles.  

Adverse Media Screening helps a reporting entity adopt a Risk-Based Approach effectively and fight ML/TF risks. 

Anti-money Laundering Transaction Monitoring

The regulated entities conduct CDD and risk assessments while onboarding the customer. This helps them understand the customer profile and the expected nature, volume, and frequency of transactions.  

If the actual transactions with customers are not monitored, the risk-based approach adopted by the entity fails. What if the customer is transacting beyond his means?  

Regulated entities implement transaction monitoring software which help them segment their customers based on various attributes like age, gender, nationality, turnover, size of business, etc. and frame rules to identify and investigate exceptions.  

The system then monitors transactions and generates alerts when it finds a suspicious transaction. 

Risk based transaction monitoring helps in suitably changing customer profiles and the risks associated with them, and it helps implement RBA in its true sense.  

AML Compliance Officer

The DNFBPs and VASPs in UAE are required to designate a competent person as the company’s compliance officer. The compliance officer is responsible for AML/CFT program management, imparting AML/CFT training, and submitting regulatory reports on the goAML portal.  

The AML Compliance Officer is the human arm of the Risk-Based Approach. The compliance officer adds the human element to RBA and changes the approach to fighting ML/TF according to the risks involved.  

Thus, an AML compliance officer is an integral part of the implementation of the Risk-Based Approach. 

Independent Audit

An AML independent audit is a comprehensive review of the AML program by an external party who is not involved in the operations of the business. The purpose of conducting an AML independent audit is to outline the effectiveness of the AML program, identify gaps for non-compliance and provide recommendations for improvement. 

This measure helps maintain the transparency, integrity, and credibility of DNFBPs in the AML efforts. An external AML audit is an integral part of the RBA adopted by the regulated entity. 

Monitoring and Review

When an entity establishes business relationships with persons, it is required to conduct ongoing monitoring to address any evolving risks and changes in the compliance framework. Monitoring and review are ongoing processes of RBA in AML that continuously assess the effectiveness of the AML compliance program.  

Monitoring measures involve regular surveillance of customers, their transactions, and activities to detect any suspicious activity or unusual behaviour that may indicate potential ML/FT and PF activities.  

The review measures include periodic evaluation of the AML framework to identify changes in risk patterns, determine the capacity of control measures in combating financial crimes, and observe areas for improvement.  

By undertaking these measures, DNFBPs can proactively address compliance gaps and areas for improvement and, based on such evaluation, enhance their risk management capabilities.  

Challenges in Implementing a Risk-Based Approach

Difficulty in Identifying Risk Factors

The complexity of identifying and categorising risk factors makes it difficult to implement RBA within the AML framework. Additionally, the realm of the financial landscape keeps changing due to new trends in criminal activities, making it more difficult to identify risk. 

Difficulty in Assessing ML/TF and PF Risks

RBA requires an accurate assessment of ML/FT and PF risks. However, the assessment of ML/FT and PF risks requires knowledge about the financial landscape, known ML/TF/PF typologies, FATF recommendations, National Risk Assessment (NRA), transactions and patterns, which makes it difficult to assess. 

Challenges in Implementing a Risk-Based Approach

Difficulty in Assessing the Effectiveness of Controls

The application of AML measures requires continuous updates and monitoring due to the dynamic nature of the business. This requires continuous changes in control measures, thus making it difficult to assess the effectiveness of control measures. Further, the effectiveness of the control measures is measured by the quality of their implementation than the quantity. This adds a layer of subjectivity to the overall assessment. 

Difficulty in Identifying Risk Appetite

It is a crucial step of RBA to establish an accurate Risk Appetite Statement that lays down the level of risk an entity is willing to accept. However, it becomes difficult to identify risk appetite due to the changing landscape and the involvement of multiple parameters 

Lack of Expertise

The application of RBA is technical, and it requires knowledge of the business and existing and emerging ML/TF/PF risks and their patternsDNFBPs face challenges here due to their small size and the unavailability of competent persons internally.  

Top Management Support

RBA requires taking proactive action to combat ML/FT and PF risks and top management’s support is vital as various actions require approval from senior management, which at times can be difficult. Unavailability and resistance to change from top management makes it difficult for businesses to take proactive measures. 

Consistency in Risk Assessment Methodologies

Consistency is utmost important while adopting RBA for risk management. It helps staff stick to a uniform procedure. However, for a growing organization, changes in products, services, and technology are constant variables. This leads to inconsistency in applying RBA.  

Handling Customer Experience

RBA requires taking stringent measures to implement an effective AML framework within the organisation. These measures include undertaking enhanced due diligence and monitoring, which may cause inconvenience to customers who are not involved in any illicit activities. It is thus difficult to find a balance between mitigating AML risks and positive customer experience.  

Lack of Budget

RBA is a detailed process that requires expert knowledge and resources for effective implementation. However, such measures need budgetary support, which could be difficult for small organisations.  

Continue your AML compliance journey smoothly with handholding

from an AML expert.

Building a Robust AML Compliance Framework using RBA

Crafting an effective AML compliance framework using RBA is important to detect and deter financial crimes, including ML/FT and PF.  

Here is the list of elements required for building a robust AML compliance framework using RBA:  

Building a Robust AML Compliance Framework using RBA

Establishing a Strong AML Culture

The AML compliance culture means shared values, practices, and behaviours within a business workplace that prioritise adherence to the AML regulatory framework.  

With a strong compliance culture, businesses can efficiently and consistently employ a risk-based approach. 

Training and Awareness Programs for Staff

Compliance officers and staff need to carry out responsibilities in the AML/CFT framework for successful compliance with the AML regulatory requirements. An AML compliance framework incorporates a training program tailored to staff based on their role and responsibilities. Further, in order to have effective AML governance, DNFBPs must undertake periodic and up-to-date training program activities and maintain training records. 

With such AML training programs, employees can easily understand ML/FT and PF risks and, therefore, employ measures required to fight such risks. This goes a long way in implementing the RBA in the regulated entity.  

Customer Identification and Verification

To ensure compliance with KYC and CDD requirements, customer identification and verification systems are necessary. Customer identification and verification systems come with liveness checks, two-factor authentication, and checks for the authenticity of ID documents. Such systems help adopt a Risk-Based Approach and determine if the customer is acceptable, considering the company’s customer acceptance policy.  

Transaction Monitoring

Transaction monitoring helps identify transactions that do not align with the customer’s profile or expected business activities. There are transaction monitoring tools available to identify suspicious patterns and put transactions on hold until the compliance team investigates them and decides if there is a requirement to submit SAR/STR.  

By employing transaction monitoring tools, DNFBPs can take a Risk-Based Approach and decide if EDD is required, customer offboarding is necessary, or the system generates a false alert.

Record-Keeping

Under the UAE AML/CFT Laws, regulated entities are required to keep all AML/CFT records for a minimum of 5 years. The ADGM and DIFC-based entities are required to retain records for 6 years.  

The record-keeping serves as evidence of having taken a Risk-Based Approach.  

Reporting Structure

An effective reporting structure is required for better implementation of the AML framework to combat ML/FT and PF risks. DNFBPs must maintain records and develop a reporting system in their AML governance program.  

This measure must include systems for maintaining data on the number of customers rejected, terminated relationships, transactions monitored, and alerts generated, as well as systems for reporting suspicious transaction reports and suspicious activity reports STRs/SARs via the goAML system.  

Periodic AML/CFT compliance reporting to top management helps management take a Risk-Based Approach and determine if they need to put in more resources to counter ML/TF risks or tweak AML/CFT policies and procedures to align them with their risk appetite.  

Internal Controls and Risk Management

Internal Controls and Risk Management processes help fight ML/TF. The nature and extent of such internal control mechanisms differ from business to business, depending on the entity’s risk appetite and risk-based approach. 

Technological Support

Technology has made life easy for DNFBPs and criminals as well. To counter technologically driven criminal activities, the AML compliance framework should leave space to employ technologically driven tools.  

It also helps enhance AML compliance by quickly analysing vast quantities of data to detect suspicious patterns and anomalies that might indicate the happening of ML, FT, or PF activity.  

How Does the Risk-Based Approach Work in AML?

The Risk-Based Approach works differently for every business as no two businesses are the same, and so are the risks. It essentially boils down to the risk appetite of the regulated entity and what they think is an acceptable risk.  

There is no concept like ZERO risk in business. Risk management is resource-intensive, and businesses have to control their costs. However, they also need to ensure that the ML/TF and PF are countered and legal requirements are met.  

Regulated entities, therefore, prioritise their risks and enforce controls judicially to maintain risks at an acceptable level.  

Benefits of a Risk-Based Approach to AML

Resource Optimization

Risk-based approach to compliance focuses on allocating resources based on risk assessment and its impact on the regulated entity. It’s a need-based resource allocation which optimises resource utilisation and saves costs.  

Effective in Countering ML/TF

With elaborate steps and a defined approach, RBA  effectively counters ML/FT and PF risks. Furthermore, RBA targets the risk in a structured manner based on its impact. This increases the effectiveness of DNFBPs’ AML efforts. 

Benefits of a Risk-Based Approach to AML

Enhances Customer Onboarding Experience

RBA enhances the customer onboarding experience. It treats each customer in isolation depending on the risks they pose to the business. Low-risk customers undergo simplified due diligence, medium-risk customers undergo standard due diligence, and high-risk customers undergo enhanced due diligence. 

In the case of high-risk customers, the business can also decide to exit the business relationship if the risks are not acceptable as per the risk appetite.  

This enhances the customer onboarding experience as not everyone goes through the stringent KYC and CDD requirements.  

Improved Risk Management

RBA follows a proactive approach to prevent and mitigate financial risks, including ML/FT and PF. Such proactive measures of identifying and managing risks reduce DNFBPS’ exposure to financial crimes and illicit activities. 

Ensures Regulatory Compliance

It is essential for all DNFBPs in the UAE to adhere to the AML/CFT regulatory framework. RBA increases their attention to regulatory outcomes, and activities throughout the business lifecycle. Thus, adopting RBA in their AML framework helps DNFBPs meet their regulatory requirements effectively. 

Strategic Business Insights

RBA is a continuous process that involves risk assessment, policy framework, and the systematic application of mitigation measures. With RBA to AML, DNFBPs gain valuable insights for informed decisionmaking and improving performance. Therefore, RBA enhances flexibility in AML compliance and boosts competitiveness in the market. 

Improved Regulatory Reporting

RBA applies controls based on risk level and focuses on prioritising resources on identified risks. With such a targeted approach, it is easier for DNFBPs to focus on high-risk areas and report suspicious activities with more efficiency and accuracy. RBA, therefore, improves the reporting system, which helps DNFBPs, as well as regulatory authorities, to fight ML/TF risks effectively 

Employee Engagement

Adopting RBA requires the proactive application of measures that require quick decisionmaking for AML policies, implementation, and performance assessment. This fosters employee engagement, which enhances the overall effectiveness of AML measures and promotes responsibility among employees and a compliance culture.

Final words on Risk Based Approach

The UAE AML CFT Law requires FIs, DNFBPs, and VASPs to employ a Risk-Based Approach that is tailored to their business. The controls employed by a reporting entity should be in sync with the risks to which it is exposed. Money Laundering and Terrorist Financing risks differ from organisation to organisation and industry to industry. Therefore, DNFBPs need to assess and understand ML/TF risks associated with each customer, supplier, and third party. 

The adoption of a Risk-Based Approach does not mean that the organisation will be able to eliminate all risks related to financial crime. It only means that ML/TF risks are managed, but the organisation is still vulnerable to various risks that it couldn’t identify and assess. Risks, by their very nature, are dynamic. 

AML UAE provides extensive help and guidance on implementing a Risk-Based Approach. Contact us if you are looking to optimise your ML/TF countermeasures.

FAQs - Importance of a Risk-based Approach

What are the components of a Risk-Based Approach?

The components of a Risk-based approach include risk identification, risk assessment, controls enforcement, residual risk, risk appetite, and additional Measures 

A Risk-Based Approach to KYC means identifying ML/TF risks associated with customers and assessing and managing them through the application of appropriate AML/CFT and KYC controls. 

Simplified due diligence is enough for low-risk customers. Medium-risk customers need to undergo standard due diligence, and high-risk customers must undergo enhanced due diligence.  

Ongoing monitoring refers to continuously reviewing the customer profile and transactions throughout the business relationship. It involves regularly reviewing customer information, transaction patterns, and any relevant changes in risk factors.

The plus side of the Risk-Based Approach is its effectiveness in countering ML/TF, while the cons include the need for accurate risk assessment and identification process. 

The rule-based approach follows the compliance method, which only considers compliance with the regulatory framework. At the same time, a Risk-Based Approach follows a system that focuses on applying measures based on the risk associated with business relationships to counter ML/TF.  

Begin your AML compliance journey with a positive first step.

Contact our team to handle your Ongoing Monitoring.

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

Mitigating ML/TF risks associated with high-net-worth individuals

Mitigating MLTF risks associated with high-net-worth individuals

Mitigating ML/TF risks associated with high-net-worth individuals

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

Mitigating ML/TF risks associated with high-net-worth individuals

The ML/TF risks associated with high-net-worth individuals are high. Their relation to money laundering (ML) and terrorism financing (TF) is two-fold:

  • Fraudsters and criminals target them because of the presence of many opportunities to commit fraud.
  • High-net-worth individuals can themselves engage in illicit business activities; their wealth might be from illicit sources or dirty money.

If you have a high-net-worth individual as a customer, you are prone to money laundering in both cases. So, you must have appropriate AML measures to deal with the risks of high-net-worth individuals. But first, let’s understand what a high-net-worth individual is in AML and the ML/TF risks posed by them.

Worried about dealing with high-net-worth
customers in your business?

Talk to us and discover how to handle the ML/TF risks of high-net-worth individuals.

Risks associated with high-net-worth individuals (HNIs)

Generally, the definition of HNIs varies from industry to industry and within the same industry. However, an individual with a net worth between US$1 and US$5 million is considered a high-net-worth individual. Net worth means a person’s liquid financial assets. If the individual has a net worth of US$5-30 million, they are very high-net-worth individuals (VHNIs). Then there are ultra high-net-worth individuals (UHNIs) with a net worth exceeding US$30 million.

High-net-worth individuals are more vulnerable to money laundering and other financial crimes. The potential threats include:

  • With the digitalisation of transactions, high-net-worth individuals’ transactions are at a higher risk. Cybercriminals access these transactions to change the destination of funds transfers.
  • HNIs might be keeping funds in offshore bank accounts to enjoy the tax savings in that jurisdiction. Also, it helps them transfer funds anonymously or protect illicitly gained assets.
  • As they are HNIs, they have connections with PEPs, other HNIs, and other influential persons. Such connections might force them to take part in or assist with fraudulent transactions or money laundering activities.

In all these cases, you are at risk as a product or service provider to such HNI. So, when you onboard a high-net-worth individual, consider the risks they pose to your business. Your exposure to such risks will increase your vulnerability to money laundering and terrorism financing threats.

Considering the risks, if you do not onboard such HNIs, you will lose big sales and revenues. It will also affect your credibility in the market. It will not have much impact in the short term, but the long-term effects are unavoidable. So, you need to be cautious while dealing with the AML risks of high-net-worth individuals.

Best practices to deal with ML/TF risks posed by high-net-worth individuals

You must implement the following  best practices and AML measures to deal with the risks of high-net-worth individuals:

Maintain a list of ML/TF red flags

The first action you can take is to be aware of the fact that high-net-worth individuals are risky for your business. It does not mean they will indeed cause money laundering or terrorism financing. However, the ML/TF risks are high. So, you must know the potential red flags or warning signs of HNIs’ money laundering activities. Some of these red flags are:

  • Not cooperating in the KYC and due diligence process
  • Providing wrong documents or missing out some information in the KYC process
  • Engaging in financial transfers with unusual patterns, different from their usual transactions
  • Unexplained or erratic customer behaviour while conducting financial transactions
  • Using unrelated or unknown third parties in a transaction
  • Financial activities that don’t align with the HNI’s business
  • Sudden or unexplained large transactions to or from high-risk jurisdictions
  • Providing incorrect information on identity, business, or transactions
  • Too many transactions of buying and selling properties despite financial losses
  • Linkages to business in sectors like gambling, weapons of mass destruction, or arms trade
  • Frequent cross-border transactions in jurisdictions with no relation to HNIs’ business interests
  • A high volume of cash transactions

If you are aware of these, you can take the right action. You can investigate the transaction further to confirm the particulars. If found suspicious, you can report it to the UAE FIU.

Perform Enhanced Due Diligence

HNIs are high-risk customers. Since you know this, you must be ready to implement strict KYC and due diligence on your HNI customers. So, deep research should be conducted on these clients.

Conducting in-depth research on HNI customers’ identities is essential. You must know the following details:

  • Full names with family details
  • All the previous residential addresses
  • Past and present passports held
  • Nationalities and citizenships of different countries
  • Professional background
  • Shareholdings in different entities
  • Utility bills

Focus on finding every possible information on their wealth, funds, assets, and structuring. So, you must collect and verify the following information on HNIs:

  • Origin and legitimacy of their funds
  • Overall wealth (holdings and assets) and their sources
  • Types of assets like properties, salaries, investments, inheritances, dividends, bonuses, and shareholdings
  • Financial statements
  • Identifying their structures’ complexity
  • Presence in opaque and risky jurisdictions

All these data points help you spot suspicious activities or transactions.

Perform name screening

HNIs are hi-fi individuals known to the public. But you must be careful before dealing with them. In addition to due diligence, try every possible method to learn more about them. Conduct a deeper examination of their identities and financial behaviour. Screen them against lists of:

  • National, regional, and international sanctions released by authorities
  • Terrorists or terrorist-funding organisations
  • Politically Exposed Persons (PEPs)
  • High-profile people with links to financial crimes like money laundering, corruption, bribery, etc.

It’s not enough to check only if HNIs’ names are on the list. HNIs might have linkages to people featured in these lists. So, you must also verify those points. Use databases and intelligence tools for any linkages to illicit activities.

Another check that is essential for you is adverse media sources. Check if their names appear in any adverse news related to crimes. Any negative mention of their names in media must be investigated in depth. The issue is that some criminals own such media channels or pay them good money to hide their negative news. They plant more positive news about themselves to paint an optimistic picture. That is why you must have experts working on investigating HNIs.

Examine tax compliance status

Checking high-net-worth individuals’ sources of wealth, linkages to financial crimes, and assets is crucial. But another critical factor that is generally ignored is their tax compliance. You must know about their tax compliance status to decide on their connections with illicit activities.

Generally, criminals use many offshore bank accounts to transfer money from one tax jurisdiction to another. Also, they engage in multiple global money transfers, which is, again, a suspicious activity. They also use structures like trusts, shell companies, and charities to invest, move, and control assets.

Collect necessary data on their tax compliance to understand if they are compliant. Identify any tax evasive strategies they have used in their past or current operating years. Check if they have used shell structures or other opportunities to avoid paying taxes or mitigate tax liabilities illegally.

Ongoing monitoring

You have already conducted KYC and due diligence. However, there is a chance that you will miss some data points or fail to focus on a document. So, ongoing monitoring is essential to prevent any money laundering risks to your business from high-net-worth individuals.

Constant monitoring helps to factor in:

  • Changes in the data of HNIs
  • Emerging risks of money laundering and terrorism financing
  • Advanced technologies and techniques for collecting information
  • Variations in HNIs’ risk profiles

If you have HNIs as customers, conduct real-time monitoring of their transactions. You must look for some unusual patterns or suspicious activities. Set a threshold or limit to transactions and investigate them if you observe outliers. Manual reviews of such suspicious transactions enable you to draw more conclusions.

Scrutinise crypto investment or payment

Are your high-net-worth customers dealing in cryptocurrencies?

Do they make payments using cryptocurrencies?

If your answer is yes to any of these, you must be extra careful. Cryptocurrencies are more vulnerable to money laundering. Also, cryptocurrency transactions have a higher degree of confidentiality and privacy. This fact makes it easier to conceal the illegitimacy of a transaction.

That is why if your HNI customer uses cryptocurrencies, conduct more investigations. Check if they are trading crypto assets or have invested in such assets. All these data points help you confirm your high-net-worth customers’ legitimacy.

Partner with an expert AML consultant

All of the above measures are necessary to confirm the identities of your HNI customers. You need to know them in and out to check for any connections with financial crimes. Collecting and verifying all these data points is an arduous task. So, hiring a specialist AML consultant who performs identity verification is a better option.

Search for a services provider with expertise in KYC and customer due diligence. One, who can collect all information on high-net-worth individuals and verify with respective documents. The vendor must have industry connections, access to databases, and skilful professionals to conduct these exercises. They will have complete knowledge of UAE’s AML regulations to ensure compliance. Such expertise is essential to ensure data accuracy, relevance, and completeness for high-net-worth customers.

So, as a regulated entity in UAE with high-net-worth individuals as customers, you must apply these seven AML measures to avoid falling prey to money laundering risks. For the last one, you have the best option in AMLUAE as your expert AML compliance partner.

AMLUAE – your partner for professional AML consulting services

AMLUAE is an expert provider of AML compliance consulting services in the UAE. You can always ask our experts for help in AML compliance. With immense knowledge and extensive experience in AML compliance, our professionals can help you through any AML procedure.

We help you with KYC, due diligence, and screening of all types of customers. If the customers are high-net-worth individuals or high-risk, you’ll have more digging to do. Our AML experts manage all data collection and verification with a unique investigative approach. We help you build customers’ risk profiles so that you know whom to onboard and, thus, take a risk-based approach to fight ML/TF.

Besides KYC and due diligence, our expertise lies in:

  • Monitoring transactions of your customers
  • Conducting risk assessments and building customers’ risk profiles
  • Creating and implementing customised AML policies and procedures
  • Selecting proper AML software for your compliance needs
  • Hiring and appointing an expert AML compliance office
  • Forming a capable and skilful AML team for your business

So, for all these needs, you have one contact to call – AMLUAE.

Mitigate the AML risks of high-net-worth individuals,

With AMLUAE’s expert AML compliance strategies.

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

The role of Re-KYC process in AML Compliance

The role of Re-KYC process in AML Compliance

The role of Re-KYC process in AML Compliance

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

The role of Re-KYC process in AML Compliance

KYC is a critical AML compliance requirement for regulated entities in the UAE. It lets you know your customers better and gauge the risks associated with their transactions. Nowadays, authorities are also stressing on the need for re-KYC of customers to keep track of updated information. Let us learn the role of Re-KYC process in AML compliance and strengthen our defences against money laundering and terrorist financing.

What is Re-KYC?

KYC must not be a one-time event. As customers’ details and regulations change, you must also update these data points in your database. That is why re-KYC of customers is essential. Re-KYC means periodic updates of the customers’ KYC details.

For a smooth conduct of the re-KYC process, you must invest your time, effort, and money in it. Recollect the information on customers, verify them, and add them to your database. This must lead to accurate and up-to-date details on all your customers. You also need to carry out sanctions screening and customer risk assessment to classify customers into low-risk, medium-risk, and high-risk customers and apply suitable countermeasures to fight against the risks they pose.

Need help with the customer Re-KYC process?

Get in touch with us now!

Why is re-KYC of customers essential?

Re-KYC of customers is essential for every regulated entity for the following reasons:

Why is re-KYC of customers essential

AML/CFT policy and procedures

AML/CFT policy and procedures mandate the KYC refresh. Depending upon the local rules and regulations and the risk-based approach adopted by the regulated entity, the schedule for periodic review is predecided and triggered. For example, the organisation may have a policy to conduct re-KYC every year for high-risk customers, once every two years for medium-risk customers, and once every three years for low-risk customers.

Industry transformations

Post-COVID, business models have significantly changed. Some of the old industries do not exist anymore or have undergone significant changes. The associated ML/TF risks have changed. Re-KYC helps understand customer profiles in the changed context, align risks, and take appropriate countermeasures to fight ML/TF.

Change in customer profile

Like fluctuations in your business, your client’s business or profile also witnesses changes. For example, they expand to a new territory, add a new product or service line in their offerings, have new owners, change the source of funds, or something else. These types of deviations in your clients change their risk profiles. To incorporate the amendments in their risk profiles, you must conduct a re-KYC of customers.

Internal shifts

Your business is unique, with its own set of requirements, business models, objectives, capabilities, and procedures. Based on these factors, you also define your risk appetite to tolerate money laundering risks. Any internal shifts in these factors lead to a change in your risk appetite. This leads to changes in your AML measures and compliance policies. In such situations, re-KYC of customers is essential.

Regulatory amendments

To keep up with the regulatory changes, you may be required to gather additional information about customers. Re-KYC helps gather that information and comply with legal requirements.

FATF Greylisting of a country

If a country is greylisted, you need to take a risk-based approach and require your customers to furnish additional information as to the source of funds and source of wealth. Re-KYC helps you do that.

The role of Re-KYC process in AML Compliance

FATF Black listing of a country

If a country is blacklisted, you need more information about your customers in high-risk jurisdictions, and hence Re-KYC or KYC refresh is required.

Due to all these reasons, it becomes essential for regulated entities to conduct the re-KYC process. Whether you conduct it twice a year or once every two years, the aim is to have updated information. Such up-to-date and accurate data facilitates the correct risk profiling of the customer. Based on this, you can take a risk-based approach for further AML compliance initiatives. Thus, you can prevent money laundering and terrorism financing activities.

Another benefit of the KYC process is a better understanding of your customers. You can tailor your services to their needs to improve customer satisfaction. Thus, you can also enhance your customer relationships with the re-KYC of customers.

Steps of the re-KYC process

You have the reasons and benefits of the re-KYC process. But what are the steps of conducting this process?

The re-KYC process involves the following steps:

Steps of the re-KYC process

Step 1: Client communication

The first step of the re-KYC process is letting your customers know you will conduct KYC again. Communicate to them the reasons for this exercise and its importance. Inform them about the documents you will need for re-KYC.

Step 2: Information collection

Once you have identified the customers for whom you want to repeat the KYC process, list the necessary details. You might need some past information as well as dig some new details. Collect all those data points from customers.

Step 3: Information verification

In the next step, verify all the customer details with the necessary documents received from them. You must ask them for proof of identity and address, beneficial ownership, sources of funds, payment methods used, and other necessary documents. Match the details submitted by clients with these documents.

Step 4: Screening

Screen your customers against lists of sanctions, terrorists, watchlists, PEPs, or any other local and international list of criminals. Moreover, check for adverse media or social media mentions of crime-related activities.

Step 5: Risk Assessment

Assess each bit of information on your customers. Examine every slight suspicion you have about them based on their behaviour, transactions, and profile changes. Based on these results of such analysis, update their risk profile. Keep an eye on those customers whose risks have increased.

Need help with the customer Re-KYC process?

Get in touch with us now!

Best practices in re-KYC of customers

For the smooth and accurate performance of the re-KYC process, avoid making the most common errors. You can imbibe the following best practices for successful re-KYC process and quality outcomes:

Establish Re-KYC procedures

AML compliance is not an easy journey. You have to manage quite a few procedures to ensure you comply with all the requirements. KYC is one such procedure. It helps you better know your customers to prevent or mitigate their risks. So, give it the importance it deserves.

Define a strategy for conducting re-KYC of customers. Mention the steps. List the timelines, resources required, and budget for the re-KYC process. Also, define the potential challenges you might face in this process, like customers’ disagreement, and the steps to deal with them. Such a strategy enables a seamless process.  

Implement KYC software

KYC is a lengthy process. If you do it manually, it takes a lot of time. Also, it requires special skills to manage this exercise without errors and hassles. So, you need to spend money on hiring skilled staff as well. Also, the manual process has increased the chances of errors. All these can affect your re-KYC process.

So, the best solution to all these problems is automating the re-KYC process. Such a solution will lead to accurate results, faster processes, and customer ease. Also, these KYC solutions raise an alert when they detect an anomaly, suspicion, or shift from the usual behaviour. Thus, you are better equipped to fight money laundering risks.

Take a risk-based approach

AML compliance is all about a risk-based approach. You have to decide the next action based on your customers’ risk levels. The same is the case with re-KYC. For high-risk customers, the frequency of re-KYC is higher. So, you must know whether your customer is high or low risk and when you last conducted their KYC.

So, if the customer is high risk, conduct a re-KYC frequently. If the risk is low, postpone it for later. Thus, you can decide the frequency and depth of your KYC procedures.

Customer communication is key

Inform your customers about the re-KYC process. They must be aware of the purpose of such data collection and document verification. It is also a good practice to obtain their consent to this exercise. Inform them about the documents needed, the time taken, and other necessary details. Constant communication from your side facilitates better relationships with customers. Since it will be a disturbing and problematic exercise for your customers, explain its significance to them.

Allocate proper resources

Re-KYC is not an administrative process. It is not a scheduled thing that you do away with by just following the steps. It needs your complete dedication and sincerity. It will help you stay away from risky customers and transactions. Thus, it is a part of your business’s risk prevention and mitigation plan.

So, you must give it much importance. Don’t forget to allocate skilful resources, a reasonable budget, and specific timelines to this exercise. Also, ensure that you do not destroy customer relationships while managing this procedure.

Ensure proper record-keeping

You must document every result and finding of the re-KYC process. Since you are analysing the client again and rebuilding the risk profile, the rationale behind it must be saved and secured. So, maintain proper records of each data point on the customer. Save the documents. These records help you during audits or investigations by regulatory authorities.

These six effective approaches can help you with a successful re-KYC process. Ensure that you imbibe them and follow the step-by-step journey. Do not forget to conduct a re-KYC of customers to be doubly sure of their risks to your business. Only with such re-KYC and due diligence can you strengthen your AML measures.

AMLUAE – your partner for conducting re-KYC of customers

AMLUAE is a prominent provider of AML compliance services in the UAE. We help you follow AML regulations in the UAE at every step. You needn’t worry about deadlines or regulatory updates; we handle everything on time and in compliance.

We also handhold you through the entire KYC and re-KYC process. Our consultants and AML experts conduct customer due diligence on your clients for accurate results. Ultimately, you will have each customer’s detailed risk profile to enable you to take a risk-based approach to your AML compliance.

Besides KYC and due diligence, we also help monitor transactions to detect suspicious ones. Our team can impart personalised training to your employees, create and implement AML policies, and manage all communication with regulatory authorities. The aim is to let you focus on your core business while we manage the AML compliance.

Transform the risk profiling process of your customers,

With AMLUAE’s help in KYC and re-KYC of customers.

Share via :

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

Why is Record-Keeping of Customer Identity and Transactions necessary?

Blogs

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

Why is Record-Keeping of Customer Identity and Transactions necessary?

Illicit financial activities, such as money laundering, financing terrorism, and proliferation financing (ML/FT and PF), hamper the integrity of the economy as well as the operations of business entities. To combat these illicit activities, businesses adopt robust Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) measures, which are aligned with the regulatory framework.

As part of the UAE’s AML/CFT regulatory framework, all regulated entities, including Financial Institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs), are required to maintain records of KYC, CDD, EDD, transactions, audit logs, software audit trail, AML/CFT policy, procedures, etc.

In this article, we’ll discuss why record keeping of customer identity and transactions is important and what its best practices are.

What is AML Record-Keeping?

Whenever regulated entities undertake measures and activities to mitigate ML/FT and PF risks, such as customer due diligence, transaction monitoring and AML audit, they generate several documents in the process. Maintaining these documents is necessary as it makes it easier for them to access data as and when required, which is crucial for combating financial crimes, including ML/FT and PF.

This is the essence of AML record-keeping. Therefore, record-keeping in the AML framework means maintaining documents pertaining to AML measures that include customer identity records, transaction records, adverse media checks, etc. Record-keeping thus carries a significant purpose in ensuring AML compliance.

With our AML expert guidance,

Start your AML compliance journey smoothly.

What type of records are required to be maintained?

The types of records that regulated entities need to maintain depend on the regulations they need to follow. In the UAE, regulated entities must maintain records related to various compliance measures undertaken by them.

Here is a comprehensive list of customer-related information and transactions which require record-keeping in the UAE:

1. EWRA, Internal policies, Procedures and Control Measures

The Regulated Entities must take a Risk-Based Approach and conduct an ML/TF/PF Enterprise-Wide Risk Assessment. Regulated entities are required to establish internal policies and procedures as part of their AML framework and maintain their version history.

As part of policies and procedures, regulated entities need to establish a risk appetite statement that provides the entity’s stand on accepting risks and sets a base to analyse trade-off decisions. A risk appetite statement helps everyone understand the level of risks the entity is willing to take and accordingly apply suitable control measures. 

Furthermore, based on risk appetite, the regulated entity must also identify and enforce AML control measures to combat ML/FT and PF risks associated with the entity.

2. Customer Due Diligence

It is essential for regulated entities to conduct the CDD process to measure ML/FT and PF risks associated with customers. There are various elements for an effective CDD. The CDD process includes conducting know-your-customer (KYC) measures to verify the customer’s identity. It is required to maintain KYC records along with supporting documents like Emirates ID, Passport, Utility Bill, etc.

Customer risk assessment is a key component of the CDD process that helps detect and prevent ML/FT and PF risks by evaluating the risk associated with each customer. Regulated entities must maintain customer risk assessment documents as evidence of their risk profiling.

Based on customer risk assessment, regulated entities are needed to undertake Enhanced Due Diligence (EDD) for higher-risk customers that pose ML/FT and PF risks and thus present increased exposure to them. They need to maintain any additional information related to customers within CDD records concerning EDD.

3. Transactional Records

Regulated entities have to keep a record of the business relationship- transactions involved from five years of completing the transaction. The various transaction records involve purchase orders, sales orders, invoices, receipts, payments, credit and debit notes and correspondence with the business. Regulated entities must maintain all the documents to establish a proper audit trail.

4. Regulatory Reports

To meet the internal and external reporting requirements, regulated entities must maintain all submissions made to the regulatory authorities.

As a part of his responsibility, the compliance officer prepares a semi-annual AML compliance report, which he submits to the senior management. These reports must be preserved. Further, semi-annual reports submitted to the regulatory authorities must be preserved for a period of 5 years.

However, the record keeping duration varies from one supervisory authority to another. 

  • The Virtual Assets Regulatory Authority (VARA) mandates Virtual Assets Service Providers (VASPs) to maintain records for a duration of 8 years
  • Dubai International Financial Centre (DIFC) requires DNFBPs to maintain AML/CFT compliance and CDD records for 6 years.
  • Abu Dhabi Global Market (ADGM) requires DNFBPs and VASPs to maintain AML/CFT compliance and CDD records for 6 years.

The AML regulations in the UAE mandate the regulated entities to identify suspicions related to ML/FT and PF and report such suspicions by filing a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR). As part of record-keeping compliance, they must keep records of STR/SAR.

In addition to MLRO and STR/SAR, the regulated entity needs to submit additional reports based on the nature of the customer’s business, circumstances and place of the customer’s business or transactions. These reports include the High-Risk Country Report, High-Risk Country Activity Report, Real Estate Activity Report, Fund Freeze Report, Partial Name Match Report and Dealers in Precious Metals and Stones Report. Regulated entities in the UAE are mandated to maintain such reports.

An Independent AML Audit report issued by the external auditor must be preserved for at least 5 years.

5. Correspondence and Directives Issued by Regulatory Authorities

Regulated entities should also keep records related to communication and directives issued by regulatory bodies, ensuring compliance with applicable laws and regulations. With such records, regulated entities in the UAE can effectively manage risks associated with their customers and transactions and help supervisory authorities keep checks and balances.

6. Training Logs

Training logs are key tools within the AML/CFT framework. They ensure that staff and employees within businesses are adequately trained to fulfill their responsibilities effectively. By maintaining comprehensive training logs, regulated entities demonstrate their commitment to AML/CFT compliance, fostering a culture of compliance within the organization and empowering staff to detect and prevent financial crimes effectively.

Make your record-keeping accurate, easier, and effective.

Why is record-keeping of customer-related information necessary?

Why is record-keeping of customer-related information necessary?

Record-keeping is an integral part of the AML/CFT framework. It supports various compliance activities like customer due diligence, transaction monitoring, reporting, compliance documentation, regulatory examinations, and investigations. Properly maintained customer records are essential for compliance with AML regulations.

Here is the list of reasons that make record-keeping of customer information and transactions necessary:

Differences-between-AML-risk-management-and-AML-compliance

Legal and Regulatory Compliance

The AML/CFT regulatory framework requires regulated entities to maintain customer-related AML records. If a regulated entity fails to maintain records, it can result in legal consequences, fines, or penalties. Therefore, having a system for record-keeping helps in avoiding legal implications.

Customer Due Diligence

AML regulations require regulated entities to conduct due diligence on their customers to assess their risk levels and verify their identities. Record keeping helps regulated entities maintain proper documentation of customer information, identity verification, and risk assessments. Furthermore, it helps them avoid any financial and reputational loss in case a customer is engaged in illicit activities.

Proactive Monitoring

Regulated entities are required to monitor customer transactions for suspicious activities that may indicate money laundering or other illicit activities. Record-keeping plays a vital role in enabling proactive monitoring from an AML/CFT standpoint.

Regulatory Reporting

When suspicious activities are detected, financial institutions must file SAR/STR with the appropriate regulatory authorities. Proper record-keeping ensures that all necessary information related to the customer’s suspicious activity is documented and can be provided to regulatory authorities.

Performance Evaluation

Record-keeping helps regulated entities assess the performance of AML measures across the entire organisation, including those measures incorporated for customers. By tracking KPIs over time, regulatory entities can easily identify AML measures’ strengths, weaknesses, and gaps for improvement.

Decision Making

Records provide valuable data and insights that aid in making informed decisions. Whether it’s about customer-business relationships, control measures, or strategic direction, having access to historical records enables better decision-making. A well-structured record-keeping system allows for better tracking of suspicions, which in turn helps in making informed decisions.

Independent AML Audit

Regulated entities need to appoint an independent AML auditor to carry out the audit of their AML/CFT compliance. Record-keeping facilitates such audits.

Inspections and Investigations

Often, regulatory authorities come for inspections and ask for various compliance records. Record-keeping also helps investigators conduct investigations into cases related to money laundering and terrorist financing.

How do you maintain customer identity and transaction records?

Record keeping procedure depends on local and global regulatory requirements. The number of records required to be maintained affects the manner in which such records are maintained. The records can be maintained physically or in an electronic form. Ideally, the following documents should be maintained:

  • Original documents
  • Photocopies of original documents
  • Documents stored in electronic form

It is noteworthy that the records maintained should be easily accessible. If the source documents are available in a foreign language, then translated copies must be made available to ensure AML/CFT compliance.

Ensure accurate maintenance of AML records,

With the expertise of AML UAE

Challenges for maintaining customer records

Although it is necessary to keep records of customer information and transactions, regulated entities face various challenges in maintaining an efficient system.

The following are some major challenges:

Large and Complex Data

Customer records are comprehensive data that include information relating to customer due diligence, transactions, ongoing monitoring, suspicion reports and internal policies, procedures, and controls. Thus, handling the large volume and complexity of AML records becomes challenging for businesses.

Regulatory Variations

Global businesses have to adhere to multiple laws and regulations. Such variations in regulatory requirements pose a constant challenge as every jurisdiction requires different record-keeping obligations, making adherence to regulatory frameworks challenging for the entities.

Privacy and Consent

KYC information is personal in nature. Before keeping records, regulated entities must obtain consent from the person to whom such information belongs. However, customers are hesitant to provide information due to privacy concerns. Further, remote onboarding procedures require liveness checks, IP address logging, etc. If customers are not willing to part such information, it becomes difficult to onboard customers.

Data Security

Keeping a large amount of data requires effective security measures. Businesses face challenges in ensuring the security of sensitive data. Additionally, information pertaining to customers and their transactions is very sensitive and is targeted by criminals for facilitating their illicit activities. This obligates regulated entities to deploy enhanced data security measures.

Incomplete and Inaccurate Data

There is an abundance of information collected by the regulated entity from various sources while undertaking AML measures. However, not all information is relevant, complete, or accurate. It becomes a challenge to segregate qualitative and accurate data from the amount of information available.

Best practices for effective record-keeping of customer information

It is essential for regulated entities to implement effective record-keeping measures to maintain accurate documentation concerning customers and third parties.

Here are some best practices that regulated entities can establish for record-keeping of customer information:

Implement Document Management Software

Document management tools provide a harmonious and logical filing system that is easy to understand and use. Regulated entities can implement such tools to standardise AML record-keeping processes for maintaining customer information and transactions across their operations.

Use Cloud-based Storage

Regulated entities collect a large volume of customer data for which they can use cloud-based storage. The transition to cloud-based storage solutions can help them store records while providing scalability and accessibility.

Implement Security and Privacy Guidelines

Customers have privacy concerns about data usage and retention, which makes it difficult for regulated entities to obtain consent from them. Thus, to maintain their trust, they should establish clear data usage and retention policies which comply with relevant privacy regulations.

Deploy Data Security Tools

Keeping a large amount of data requires effective security measures. For this purpose, regulated entities should implement encryption technology, firewalls, etc., to limit unauthorised access and tackle data breaches.

Backup and recovery

Maintaining customer information is very important for regulated entities, and any loss of data can lead to major repercussions. Thus, regulated entities must implement backup procedures for records to prevent data loss by system failure or cyber-attacks. Further, they should also develop a recovery plan to ensure that records can be quickly restored in the event of loss.

Regular Updates and Review

Regulated entities must regularly update their systems and underlying procedures to remain compliant with the ever-changing regulatory environment. Internal health-check reviews must be conducted to find discrepancies in record-keeping and take immediate remedial measures.

Final Words on Maintaining Effective Customer-related Records

For regulated entities, record-keeping of the identities of their customers and transactions is crucial to ensure compliance with regulations, manage risks, and easily access data for submitting it to the authorities as and when required.

AML UAE is a global AML/CFT consulting firm assisting regulated entities in deploying countermeasures to curb financial crimes.

FAQs related to record-keeping under the AML Regulatory Framework

What is the record-keeping law in UAE?

Record-keeping in the UAE’s AML regulatory framework means maintaining documents related to AML measures that include customer identity records, transaction records, adverse media checks, etc.

As per the UAE’s AML regulations, regulated entities need to maintain AML records for five years. However, for ADGM and DIFC-regulated entities, it is necessary to keep the AML records for six years. For VASPs based out of VARA, it is required to maintain records for eight years.

Record keeping is an integral part of AML compliance as it acts as a proof of having followed regulatory requirements and risk-based approach.

The types of records that must be maintained are as follows:

  • Customer information
  • Transactional information
  • Internal/External suspicious reported
  • Records pertaining to ongoing monitoring
  • Training Logs
  • Compliance officer reports
  • Copies of reports filed on the goAML portal

Record-keeping is an integral part of the AML framework. A well-structured record-keeping system allows for easy tracking of any suspicious transactions and facilitates effective AML compliance measures with AML regulations.

Want to have an effective record-keeping strategy for your business?

Let’s connect and discuss your requirements.

Share via :

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

Addressing an Existing Low-Risk Customer’s Shift to High-Risk Status

Addressing an Existing Low-Risk Customer's Shift to High-Risk Status

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

Addressing an Existing Low-Risk Customer's Shift to High-Risk Status

Financial institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs) in UAE are required to follow a systematic mechanism to conduct a customer risk assessment, determine the money laundering, terrorism financing, and proliferation financing (ML/FT and PF) associated with each customer, and deploy adequate measures to manage the identified risks.

Based on the risk assessment, customers are categorised into three risk levels: low-risk, medium-risk, and high-risk. Based on this risk score, proportionate risk mitigation measures are adopted.

In the course of the business relationship, the level of risk the customer poses to the business may change, which requires immediate attention. Thus, the AML laws require the regulated entity not to stop at the initial assessment but also implement ongoing monitoring to observe and track the changes to the customer information and its impact on the risk profile.

When undertaking ongoing monitoring, the regulated entity might encounter a situation where a customer initially designated as low-risk shifts to the high-risk category. Such a shift may occur due to his engagement in certain transactions or his behaviour, which has subsequently changed, indicating increased ML/FT risk. Therefore, understanding the factors contributing to this shift and undertaking appropriate measures are crucial to mitigating ML/FT and PF risk and continuous AML regulatory compliance.

Customer Risk Rating

An essential aspect of risk assessment and adopting the risk-based approach is evaluating the risk the customer poses to the business, assigning the risk score in line with the identified risk and allocating an appropriate risk rating. Such a rating shall help entities determine the level of customer due diligence (CDD) measures to be deployed at the time of onboarding and on an ongoing basis.

Furthermore, risk rating enables regulated entities to make informed decisions about entering into business relationships with customers whose risk is within acceptable parameters.

Risk Rating’s nexus with customer onboarding and post-onboarding measures

The UAE AML laws mandate regulated entities to perform appropriate customer due diligence processes before establishing a business relationship. In this context, based on the outcome of the customer risk profiling and the assigned risk rating, the regulated entities determine the nature and the degree of the CDD measures to be applied.

Here, the regulated entities must apply Enhanced Due Diligence (EDD) measures when the customer is identified as posing higher ML/FT/PF risk, in addition to the standard CDD process. Similarly, for a customer classified as “low-risk”, the regulated entities are permitted to use relaxed CDD measures, i.e., Simplified Customer Due Diligence.

Thus, the customer risk rating shall empower the regulated entities to optimally use the resources and effectively manage the risk, adopting a risk-based approach.

We understand that the customer risk is dynamic and may change over time. Hence, the process of evaluating the customer profile does not end with customer onboarding. Even post-establishing a business relationship with the customers, the regulated entity is obligated to implement measures to monitor customer activities and transactions continuously to ensure that the customer profile developed at the time of onboarding holds good and the transactions executed by the customer do not contradict the original customer risk profile.

The frequency and degree of the ongoing monitoring measures to be applied varies for each customer, depending on the results of the risk assessment and risk rating given to them. As part of the ongoing monitoring of business relationships, the regulated entities must reassess the level of customer risk and decide whether there is a need to adopt enhanced due diligence measures to manage any changes in the risk level.

Detect and Deter ML/FT and PF risk

With the help of our expert AML team

Factors Shifting Low-Risk Customers to High-Risk Category

Risk scoring, or risk rating, or customer classification varies from entity to entity based on AML policies, procedures, and controls. But primarily, during the initial customer onboarding journey, the customers would be categorised as low-risk, medium-risk, and high-risk (the nomenclature or the methodology to bifurcate customers into three brackets may differ).

Notwithstanding the initial risk classification, the regulated entity might encounter a few instances during ongoing monitoring that warrant a detailed review of the customer, including reassessing the customer risk profile.

Here is the list of such factors that cause the shift in risk rating from low to high due to the following factors:

Being a PEP or association with PEP

A politically exposed person (PEP) is an individual who has been entrusted with a prominent public function and, through their prominent position or influence, is more susceptible to being involved in financial crimes like bribery or corruption.

When first onboarded with a low-risk rating, the customer may subsequently become a PEP or a close associate of a PEP, which increases the potential ML/FT and PF vulnerabilities.

Factors Shifting Low-Risk Customers to High-Risk Category

The regulated entity can detect a customer’s transition to PEP through ongoing monitoring of the customer profile, possibly through screening against the PEP database. This continuous screening of the customer scrutinises the data to look for any changes in their status and triggers an alert when any update is observed.

Therefore, when such a shift is detected from non-PEP to PEP, the regulated entity must reassess the customer risk and employ enhanced due diligence measures to manage the increased risk.

Accused with Criminal Charges or Adverse Media Coverage

Any involvement in criminal activities raises questions about the customer’s risk profile and indulgence in illicit financial crimes, necessitating heightened scrutiny.

Similarly, if any adverse media (unfavourable information about individuals, entities, or organisations that could indicate potential involvement in financial crimes, corruption, or other illicit activities) is found, the same indicates reputational risk to the regulated entity and potential involvement of customers in illicit activities.

When the regulated entities initially onboarded a customer, the customer was not involved in any criminal activity. However, after the regulated entity onboarded the customer, the customer engaged in criminal activities and was proven guilty. Such criminal acts of customers raise questions about the customers’ ethics and possible criminal association.

The regulated entity can detect criminal charges associated with the customer by implementing the latest innovations in background screening and continuous ongoing monitoring, which can give alerts when engaged with such charges. This allows the regulated entity to monitor better the customer profile, which is the key to a safe strategy from onboarding to the business relationship ends.

After a shift is detected, the regulated entity should evaluate the customer’s risk profile, monitor the customer’s activities, and, if necessary, terminate the business relationship if the customer is suspected of attempting money laundering or other financial crimes. Considering the nature of the criminal charges or additional suspicion related to ML/FT and PF, an STR/SAR must be reported on the goAML Portal.

Suspicious and Non-Cooperative Behavior

Customer monitoring does not stop with the customer’s onboarding but extends to post-onboarding decisions. It aims to monitor customers and their activities to ensure no ML/FT and PF activities are initiated.

When an existing customer designated as a low-risk customer demonstrates behaviour that deviates from the standard patterns, does not cooperate with the monitoring inquiries or is reluctant to provide any additional information, it raises red flags, which the regulated entity should be aware of and attentive to.

The regulated entity can use a transaction-based ongoing monitoring system to detect any change in the customer’s transactional pattern, which he usually does not engage in, or the overall transactional trend is contrary to the known customer profile.

To effectively counter the change in customer risk rating from low-risk category to high-risk, the regulated entity must initiate a training program to make the employees aware of the red flags and measures to identify such suspicion. Such a training program shall be conducted for compliance officers and staff, as well as methods to be used for handling such alerts, reviewing them, and taking action accordingly.

Once suspicious behaviour or transactional pattern is observed, the regulated entity must evaluate and understand the reasonableness of such change. Considering the changed circumstances and rationale, the regulated entity must reassess the risk and, if required, apply the EDD measures.

Further, if the changes suggest a potential involvement of the client in ML/FT and PF activities, the regulated entity must terminate the business relationship and file SAR/STR on goAML.

Unreasonable Growth in Net Worth

When a low-risk category customer’s profile suggests swift growth and an unexplained increase in wealth without any plausible explanations, such incidents question their engagement in criminal activities and potential illicit sources of funds.

The regulated entity can detect such exponential growth using threshold-based monitoring rules that help to identify any changes in the customer’s profile, such as increasing involvement in high-valued transactions without any economic rationale. This indicates significant growth in wealth; however, the escalated increase shows a linkage with unknown sources of funds and wealth.

The regulated entity should undertake detailed inquiries into this change and apply additional checks and verification measures to understand the legitimacy of the customer’s source of funds and wealth and evaluate its potential connection with ML/FT and PF activities.

Conducts Unusual Transaction

When a customer engages in a transaction that deviates from normal behaviour or industry standards, such incidents warrant investigation to determine and check the transaction’s legitimacy.

When a low-risk customer engages in unusual transactions, which he usually does not engage in or associates with high-value transactions, it increases concerns about their legitimacy and linkage to ML/FT and PF activities.

The regulated entity can install transaction-based and threshold-based monitoring parameters to detect unusual patterns by continuously collecting data, employing detection algorithms, and setting thresholds to identify deviations from standard business practices. Alerts generated based on these monitoring rules must be further investigated to check their authenticity and understand the purpose of such transactions.

The regulated entities must employ EDD measures to understand the source of funds/wealth involved in such unusual transactions and ensure that appropriate risk-mitigating measures are applied.

Shifts in customer’s location from Low-risk to High-risk Jurisdiction

Relocation to or conducting business in high-risk jurisdictions increases exposure to regulatory and financial risks.

a. When a customer moves to a high-risk country

It is one of the red flag indicators for AML/CFT when customers or their representatives are situated in a country prone to high risks. High-risk jurisdictions often lack stringent laws, providing a platform for criminals to engage in illicit activities.

Therefore, when a low-risk customer relocates to a high-risk country, the exposure to ML/FT and PF risk associated with the customer increases.

The regulated entity can detect shifts in customer locations to high-risk jurisdictions by implementing location-based monitoring mechanisms and regularly reviewing customer information and transaction data for any indications of change in location.

The regulated entity, upon obtaining adequate and appropriate consent from the customer under relevant and applicable data privacy laws, deploy geolocation technologies when undertaking an ongoing monitoring process of existing business relationship with a customer so that they may obtain real-time updates on customer whereabouts.

b. When a customer’s country’s status changes to a high-risk jurisdiction 

Various factors, such as political instability, global assessment by international overseeing bodies like FATF, economic unrest, and emerging issues, change a country’s status from low risk to high ML/FT risk. Thus, when a country’s status changes from a low-risk jurisdiction to a high-risk jurisdiction, a customer belonging to such a jurisdiction needs more scrutiny and monitoring as they become more vulnerable to ML/FT and PF activities.

When undertaking Know Your Customer (KYC) remediation to validate the customer details, the regulated entity can spot the change in the customer’s jurisdictional risk. Furthermore, the regulated entity must keep tracking independent sources like the FATF site or other local authorities’ websites to stay updated with the countries listed identified or notified as high-risk jurisdictions.

When the customer’s risk profile changes from low to high on account of a change in jurisdiction, the regulated entity must reassess the customer risk, identify the level of increased exposure and deploy additional CDD measures. When the shift in jurisdiction emits risk beyond the regulated entity’s risk appetite, the regulated entity must consider terminating the business relationship.

Further, under UAE AML regulations, the regulated entities are also required to file HRC or HRCA (High-Risk Country Transaction or Activity Report) when the remittances are expected from North Korea, Iran and Myanmar. Thus, if the risk shift suggests the involvement of these countries, the regulated entity must comply with the reporting.

Insistence on involving third parties in executing the transaction or for processing the payment

After onboarding, if the customers insist on involving third parties in executing transactions or paying bills, this practice diverges from standard practice and raises suspicion. Third-party involvement by a low-risk customer, without any business logic, amplifies the risk of financial irregularity. It’s important to note that this risk would vary for each business and is crucial in determining risk tolerance.

The regulated entity can detect such factors by implementing a transaction-based monitoring method to track the name of the party to whom the invoice is being issued or the party involved in processing the payment. In such cases, the regulated entity must reassess the ML/FT/PF risk associated with the business relationship and carry out necessary measures to identify the third party, its location, its activities, etc.

AML Measures upon the shift of a Low-Risk Customer to a High-Risk

It is of utmost importance to know about the factors that lead to the transition of a low-risk customer to a high-risk one. With such knowledge, the regulated entity can take sufficient measures for better regulatory compliance, help avoid penalties, and safeguard itself from any risk associated with such customers.

The UAE’s AML/CFT regulatory framework mandates the regulated entity to conduct an Enhanced Due Diligence process for every high-risk customer. Similarly, EDD measures must be undertaken when a low-risk customer shifts to a high-risk status. With EDD, adequate increased controls and risk mitigation measures can be taken to manage the heightened risk.

The following EDD measures should be taken by the regulated entity when a low-risk customer shifts to a high-risk status:

Request Additional Information and Conduct Verification

The primary measure that every regulated entity should undertake to tackle such customers is to seek supplementary information to validate their identities and transactions. Updating the current information and documents according to changes in risk rating helps it implement a better monitoring system and manage risks.

Details regarding Customer’s Source of Funds and Wealth

The regulated entity should thoroughly examine the source of funds and wealth to ensure legality and legitimacy and restrict the facilitation of transactions involving funds whose source is unknown or linked to any criminal activity. 

The regulated entity must make independent inquiries and use reliable documents to establish the legitimacy of the source of funds and wealth involved in the transaction.

Review Criminal Charges and Adverse Media and connection with Financial Crimes

When the regulated entity encounters information related to criminal charges or adverse media concerning a customer, it must thoroughly investigate the nature and circumstances of these allegations. This measure differentiates between criminal charges and adverse media related to financial crimes, including activities concerning ML/FT and PF and those unrelated to financial misconduct. Upon finding such an assessment, the regulated entity must evaluate the potential inferred risk associated with the customer profile and subsequently take measures.

Additionally, when the customer profile shifts due to adverse media, the regulated entity must ensure that it rules out fake news or news posts not backed by reliable data sources. Such measures are required to protect customers and maintain the integrity of the regulated entities.

Furthermore, in cases where the criminal charges are unrelated to financial crimes, the regulated entity should maintain enhanced observation of such customer’s activities. However, in cases where the criminal charges are related to ML/FT and PF, thorough investigations are needed, necessitating vigilant customer monitoring. If it is determined that the customer is still engaged in ML/FT and PF activities, the regulated entity must immediately report them on the goAML Portal and terminate the business relationship.

Obtain Management approval

In cases where a customer is initially categorised as low-risk, however, employing ongoing monitoring shifts to the high-risk category, the regulated entity is mandated to seek management to proceed with the existing business relationship with such a customer.

This measure helps safeguard the regulated entity by validating the business’s commitment to risk management protocols and regulatory compliance standards in dealing with high-risk customers.

Get the payment from the customer’s bank account

For enhanced traceability and transparency, the regulated entity should demand payment from the customer’s bank account, as prescribed under the UAE AML laws as one of the EDD measures. Thus, for the low-risk customer now rated as high-risk, the regulated entity must not accept the payment using alternate modes like cash or a third-party bank account.

This helps document financial transactions and makes monitoring for AML regulatory compliance easier. By aligning payments with the customer’s bank account, the regulated entity can mitigate the risk of transferring funds to an unauthorised channel and prompt greater accountability throughout the transaction.

Increased ongoing monitoring

For the customer now classified as high-risk, the regulated entity must enhance the degree and frequency of ongoing monitoring of the business relationship, transactions and CDD updates. This continuous review shall help the regulated entity keep a close eye on this customer and spot any red flags that may potentially arise during the course of the business relationship.

Continue your AML compliance journey smoothly with handholding

from an AML expert.

Determining future relations with the High-Risk Customer

When a customer shifts from a low-risk category to high-risk, careful consideration and strategic actions are required to manage associated risks and ensure regulatory compliance. For which the regulated entity takes EDD measures. The analysis and implementation of such EDD measures determine how to proceed with such customers. Here is the list of findings and recommendations which regulated entities can adopt to address the challenges posed by high-risk customers effectively:

Continue Business Relationships with Increased Monitoring

Determining future relations with the High-Risk Customer

When customers are designated as high-risk, the regulated entity continues to engage with them to conduct transactions but with a more stringent monitoring system.

Similarly, when a low-risk category customer shifts to a high-risk status, the regulated entity shall maintain the business relationship while intensifying monitoring efforts to detect any associated risks promptly.

Terminate Business Relationship

In certain circumstances, the regulated entity must terminate the business relationship with a customer when its status changes from low-risk category to high-risk.

When the increased risk exceeds the management-approved risk appetite

In cases where the risk rating exceeds the regulated entity’s management-approved risk appetite, termination of the business relationship may be necessary to mitigate exposure. Risk appetite is set for the degree of risk a business is willing to accept, and it helps the regulated entity make decisions regarding customer onboarding.

Therefore, when a low-risk category customer shifts to a high-risk status, the regulated entity must ensure that the customer remains within its risk appetite after a change in risk profile before continuing with the business relationship.

When there’s a lack of Information

Insufficient information or the inability to verify critical details raises concerns about involvement in ML/FT and PF and also hinders the entity’s efforts toward applying the EDD process. Therefore, to safeguard itself from probable ML/FT and PF risk, the regulated entity may terminate the business relationship to avoid risk and also comply with the requirement of not transacting with the customer without the successful completion of adequate CDD measures.

File SAR/STR on the goAML Portal

As part of regulatory requirements in the UAE, the regulated entity must file a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) on the goAML portal when suspicious activity pertaining to ML/FT and PF is detected.

If the customer’s risk shift is attributed to engagement in such suspicious activity, the regulated entity must file SAR or STR on the goAML Portal while ensuring compliance with the “no tipping off” requirement.

Concluding thoughts on addressing the shift of low-Risk customers to high-Risk status

The transition of a customer from a low-risk category to a high-risk underlines the changing nature of financial risk associated with customers. Timely evaluation of the customer’s shift is not just a necessity but an essential component for maintaining the integrity of the AML framework. This shift demands vigilant monitoring, proactive measures, and adherence to robust AML compliance protocols, which are vital in mitigating potential risks.

With a proactive approach and robust measures, regulated entities can effectively address such shifts and mitigate the risks associated with high-risk customers. Implementing measures related to such shifts helps to make decisions that underscore its commitment to uphold its regulatory obligations to combat illicit financial crimes.

FAQs about Customer Risk Ratings and AML Measures

What is risk assessment under the UAE’s AML compliance framework?

The Customer Risk Assessment is a critical AML measure that identifies each customer’s money laundering, financing of terrorism or proliferation financing (ML/FT and PF) risk and categorises them according to their associated risk. Customer risk assessment is crucial as it helps the entity determine the nature of CDD measures to be applied.

In the UAE, customers are classified into three main categories: low risk, medium risk, and high risk, based on ML/FT/PF risk associated with the customer.

Customers classified as high-risk require enhanced due diligence (EDD) measures to mitigate the elevated risk associated with their business relationship. EDD measures include conducting additional background checks, verifying the source of funds and wealth, obtaining approval from senior management before establishing or continuing the relationship, and monitoring transactions with more scrutiny.

Ongoing monitoring refers to continuously reviewing the customer profile and transactions throughout the business relationship. It involves regularly reviewing customer information, transaction patterns, and any relevant changes in risk factors.

Begin your AML compliance journey with a positive first step.

Contact our team to handle your Ongoing Monitoring.

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

A guide To establishing an Effective AML/CFT Framework in your business

Regulatory Obligations and AML-CFT Framework

A Guide to Establishing an Effective AML/CFT Framework in Your Business

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

A Guide to Establishing an Effective AML/CFT Framework in Your Business

Financial Institutions and Designated Non-Financial Businesses and Professions that do not abide by the Money-Laundering laws or regulations have to pay heavy penalties and face severe reputational losses. Therefore, every business has to establish an effective AML/CFT framework to operate as per the legal requirements of the country.

So, the question arises: what should you consider when managing AML/CFT compliance in your business? This article provides the best practices for establishing an effective AML/CFT framework in your business.

Compliance. Trust. Transparency

Customized and cost-effective AML compliance services to support your business always

What is an Anti-Money Laundering Framework?

Implementing elements of the Anti-money laundering (AML) framework using a risk-based approach is crucial for preventing money laundering, financing terrorism, and proliferation financing (ML/FT and PF). The AML framework is a set of policies, procedures and controls that are formed to detect, deter, and report ML/FT and PF activities.

The AML framework lays down a structured strategy that aims to fulfil regulatory obligations and achieve mitigation of ML/FT and PF risks.

Importance of an Anti-Money Laundering Framework

The following is a list of factors stating why the AML framework is essential:

Ensure regulatory compliance:

DNFBPs are required to comply with different AML regulations, including regulations imposed by national and international regulators. In case it fails to comply with such regulatory requirements, penalties and fees are imposed on DNFBPs. Therefore, with the implementation of an effective AML framework, they can ensure compliance with these regulations and stay away from associated penalties and fines.

Risk mitigation:

The major threat to DNFBPs is using their platforms to facilitate financial risks. Criminals often use them to indulge in criminal activities because of inherent vulnerabilities. The AML framework employs measures that help DNFBPs in detecting ML/FT and PF activities and further aid in combating ML/FT and PF risks.

Protect business’s reputation:

As DNFBPs work in a highly competitive market, it is essential for them to maintain a good reputation to attract and retain clients and customers. Commitment to AML compliance can act as a deciding factor for clients to enter into a business relationship with the DNFBP. Any linkage to ML/FT and PF activities can damage its reputation, which results in client and business loss. The AML framework helps DNFBPs avoid risk and maintain their reputation by laying down the best strategy within its framework.

Maintain the integrity of the financial system:

By promoting stability, preventing illicit activities, risk management, and regulatory compliance, the AML framework helps maintain the integrity of the financial system. With such measures, the AML framework enables a safe, secure and strong global economy.

Regulatory requirements around AML/CFT framework

AML regulatory framework in the UAE includes national regulations, international regulatory framework and national AML strategy.

National Regulatory Framework

The national regulatory structure in the UAE contains federal civil, commercial and criminal regulations. Because criminal legislation comes under federal jurisdiction throughout the country, the ML/FT and PF criminal activities are covered under it. The following are such regulations within the country:

  • Federal Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations.
  • Cabinet Decision No. 10 of 2019 Concerning the Implementing Regulation of Federal Law No. 20 of 2018.
  • Cabinet UBO Resolution No. 58 of 2020 on the Regulation of the Procedures of the Real Beneficiary (UBO Resolution)

International regulatory framework

The AML framework in the UAE is aligned with the international bodies network, which implements international treaties and conventions for combating illicit crimes. These integrated laws are supervised by the regional regulatory authorities. 

For such an integrated framework, the government and competent authorities in the UAE collaborated with various international bodies such as:

  • United Nations
  • Financial Action Task Force (FATF)
  • Middle East and North Africa Financial Action Task Force (MENAFATF)
  • Egmont Group of Financial Intelligence Units

National AML Strategy

The UAE government has implemented strategic decisions in the form of the National Strategy on Anti-Money Laundering and Countering the Financing of Terrorism. The strategy shapes the key initiative of the country’s national action plan. This strategy is based on four pillars that include:

  • Legislative & Regulatory Measures
  • Transparent Analysis of Intelligence
  • Domestic and International Cooperation & Coordination
  • Compliance and Law Enforcement

Furthermore, the National Committee for Combating Money Laundering and the Financing of Terrorism and Illegal Organisations looks into the implementation of strategy, emphasising effective coordination between different authorities, compliance with regulations and awareness of ML/FT risks among DNFBPs.

Compliance. Trust. Transparency

Customized and cost-effective AML compliance services to support your business always

Regulatory Obligations and AML/CFT Framework

The AML framework needs to be aligned with the statutory obligations of DNFBPs as follows:

ML/FT Enterprise-Wide Risk Assessment

ML/FT Enterprise-Wide Risk Assessment, also known as Business Risk Assessment, is an assessment that lays down an extensive plan that needs to be carried out to manage ML/FT and PF risks at an enterprise level. EWRA is a key pillar of a risk-based approach that addresses business-specific AML risks, threats, and vulnerabilities and further takes action to mitigate them.

EWRA is a continuous process to identify and assess ML/FT and PF risks that DNFBPs face in business lines, their products, and services and associated with different customers. While conducting the assessment, it considers various internal and external factors such as geographical risks, customer behavior, distribution channels and adequacy of the current AML policies.

DNFBPs with EWRA can effectively detect money laundering risks, identify mitigating measures, point out gaps and take cautious decisions relating to risk appetite and allocation of resources.

Customer Due Diligence

Customer Due Diligence (CDD) is an extensive process to identify and verify customer identity with the help of verified documents. CDD process also includes assessing customer risk profile, understanding the nature of transactions and monitoring customer activities. Additionally, it also focuses on assessing risk associated with customer’s business relationships and transactions.

Further, the CDD process differs depending on the ML/FT and PF risks that customers are associated with. CDD comes in three types: Simplified Due Diligence, Standard Due Diligence and Enhanced Due Diligence. Different CDD types are employed for each customer to mitigate ML/FT and PF risks, depending on the circumstance.

Ongoing Monitoring

Only after CDD measures are employed for customers can DNFBPSs establish business relationships with them. Once they enter into these relationships, DNFBPS must undertake ongoing monitoring measures. This measure is crucial as it continuously detects and reports suspicious activities.

Further, as part of ongoing monitoring, DNFBPs monitor business relationships with each customer on an ongoing basis to prevent any probable ML/FT and PF activities which an existing customer can pose.

DNFBPs also need to undertake ongoing monitoring of transactions. In order to undertake such a measure, they need to implement a robust transaction monitoring system that can detect suspicious activity effectively by pointing out unusual patterns and frequent transactions and alerting the involvement of high-risk jurisdictions.

Regulatory Reporting

It is a regulatory obligation under the UAE’s AML regulatory framework to swiftly report suspicious transactions or any reasonable situation where any suspicion relating to proceeds is in question. DNFBPs in the UAE must put in place and update indicators that could be used to identify possible suspicious transactions.

Regulatory reporting means submitting various reports provided under the AML/CFT regulatory framework to the relevant authorities. In the UAE, Suspicious Activity Report (SAR) or Suspicious Transactions Report (STR) are standard reports filed by DNFBPs to report any suspicious activity they come across.

Furthermore, in addition to SAR/STR, they must also file reports depending on the circumstances and nature of their business. These include filing of Partial Name Match Report (PNMR), Confirmed Name Match Report (CNMR), Real Estate Activity Report (REAR), Dealers in Precious Metals and Stones Report (DPMSR), High-Risk Country (HRC), and High-Risk Customer Activity (HRCA) reports.

AML/CFT Governance

For an effective AML framework, DNFBPs must include AML/CFT governance within their AML framework. This governance measure acts as a foundational structure. DNFBPs must include the following measures within AML/CFT governance:

  • AML governance must include compliance staffing and training to ensure that compliance officers and employees understand their responsibilities surrounding AML and further effectively undertake them.
  • It is mandated by the UAE’s regulatory framework that senior management is involved in the institution of the AML framework. Further, the law imposes various responsibilities on it, such as implementing governance and operating systems, approval of internal policies, procedures, and controls, application of the directives of Competent Authorities, and oversight of the AML/CFT compliance programme.
  • The AML framework must include an AML/CFT health check mechanism within DNFBPs that evaluates the business’s performance against all applicable AML/CFT obligations. This measure establishes ways to oversee vulnerabilities across DNFBPs, thereby strengthening the effectiveness of AML policies.
  • AML governance must include AML Independent Audit measures to evaluate efficacy and adherence to AML measures. It is an essential factor of the AML framework to engage auditors for conducting thorough reviews of current policies, procedures, and controls.

Record Keeping

Having a record-keeping system is essential within the AML framework. Records are an important source of information not only for DNFBPs but also for regulators. With record keeping, it is easier to undertake investigations and ensure transparency. As per the UAE’s AML regulatory framework, it is mandated that DNFBPs keep comprehensive information related to transactions, CDD, and any SAR/STR for five years.

Maintaining such records helps in identifying potential ML/FT and PF activities and underscores regulatory oversight. By keeping such records, DNFBPs can effectively counter ML/FT crimes and further safeguard themselves. Furthermore, having robust record-keeping practices, DNFBPs can effectively respond to regulators and commit to having a transparent and answerable culture.  

Targeted Financial Sanctions

Targeted Financial Sanctions (TFS) include measures that the regulatory authority imposes to restrict financial transactions with specific individuals, entities, or countries. DNFBPs must undertake such measures to prevent transactions with sanctioned individuals or entities and freeze their assets when identified.

To avoid indulgence with ML/FT and PF risk, DNFBPs, as part of this measure, undertake screening procedures for customers against relevant sanctions lists released by national and international bodies and further report any matches to the appropriate authorities.

How to frame effective AML Controls framework?

Here are a few ways in which you can effectively build AML Controls Framework:

1-Having Qualified Compliance Professionals

The first and foremost step to building an effective AML and CFT framework is to have an effective and efficient AML expert who wouldn’t shy away from taking the help of creativity and innovation.

A practical AML/CFT framework requires a structure of corporate governance that incorporates compliance professionals or officers who are fluent in terms of legal regulations requirements.

A guide To establishing an Effective AMLCFT Framework in your business

Anti-money laundering professionals are basically responsible for making sure that the reported issues within the organization are addressed or looked after within the organization and within a time frame that will restrict you from further damage.

In addition to that, it is your moral duty to make all the employees of your organization and not just AML professionals know about the legal and ethical responsibilities that need to be effectively managed at an individual level as well in order to comply with the legal AML regulations.

Furthermore, all the employees must understand the fundamental idea of AML/CFT. In order to effectively comply with AML or CFT regulations, all the employees must undergo interdisciplinary training or certification programs in order to identify potential risks.

2- Training of Anti-Money Laundering Experts

Anti-money laundering is a pretty dynamic subject. There is always some sort of updates, changes in regulations, proposals, or laws happening. In addition to that, various methods continue to find channels in criminals with every passing day.

Improving the overall skill set of your employees is essential in order to ensure that AML/CFT measures are actually implemented in the best possible way.

Professionals from the finance department must clearly understand the AML and CFT legislation and regulations for identifying and reporting any suspicious transactions.

Likewise, management employees who have direct contact with customers or the ones who process documents and money must understand the requirements of the Anti-Money Laundering Laws in the UAE.

Your entire staff must be well aware of the AML/CFT Framework and various roles of the consultants, compliance officers, officers, senior management, and the board of directors.

In addition to that, all of your staff members must be aware of ways in which they are supposed to react if at all they encounter suspicious activity.

3- Risk Assessment And Risk-Based Approach

The foundation of a practical counter-terrorism financing framework (CFT) and anti-money laundering (AML) is actually based on a risk-based approach.

Business enterprises should determine the risk level of the clients by conducting an accurate risk assessment during the process of client
recruitment.

Post this, enterprises should aim to implement an efficient and effective AML compliance program in accordance with the AML/CFT Framework. By developing a tailor-made control program in accordance with the risk levels of your respective clients.

  • Building policies and adequate controls to reduce the risk and even the potential of money laundering
  • Understanding the overall levels of risks associated with business transactions and relationships
  • Identifying various sources of risks and evaluating all the potential risk reduction controls
  • Effectively running the successful AML compliance programs
  • Making accurate risk-based decisions about the employees as well as customers.

In addition to that, a risk-based approach is adopted in order to detect and prevent all sorts of money laundering activities.

However, risk-bearing capacity and the risk appetite of all the companies and customers are pretty different from one another. As a result, companies would be failing miserably if they try to implement the same AML controls for every customer.

There are basically two fundamental steps for organizations to move ahead with a risk-based approach. The first one is undoubtedly assessing the risk and the second one is to appropriate control processes to various risk levels.

4- Advanced Anti-Money Laundering Policies

Highly dynamic anti-money laundering policies are needed to protect a business enterprise from criminal activities like money laundering and fully comply with relevant regulations and laws.

Enterprises need to implement robust risk-based governance to guide systems and processes. Providing a practical anti-money laundering policy framework is the topmost priority when it comes to meeting AML obligations.

Anti-money laundering policies should be easily verifiable by the authorized regulators, reflecting the overall risk appetite.

For instance, your AML policies should incorporate customer risk ranking during the recruitment process and due diligence.

Business enterprises should know their customers in order to comply with local and global legal anti-money laundering requirements and operate within the purview of the established AML/CFT Framework.

5- Know Your Customer (KYC)

Know your customer processes incorporate the process of accurately and completely defining the information of the respective customers. Generally, KYC is the most critical step in the entire anti-money laundering control process.

Once you are sure of who your customers really are, the risk levels of these customers can be evaluated without any hassle, and post which, you can apply customer due diligence (CDD) processes.

Determining the level of risks of your customers or even potential customers with the help of CDD makes the AML control process much faster and efficient for the company.

During the process of CDD, the potential customer must be screened in politically exposed persons (PEPs) and the sanction list.

If any politically exposed person is found in this list, then the need and importance of enhanced due diligence (EDD) come into the picture.

This is simply because politically exposed persons are usually considered as individuals who hail from a high-risk profile, and thus, merely CDD processes might not be sufficient. As a result, the risks and threats related to the customer’s account opening can be detected, allowing you to take more effective AML controls and establish a highly-effective AML/CFT Framework.

6- Ongoing Monitoring

Information or risks of institutions or customers may change over a period of time. For example, individuals who are not PEP might become politically exposed person by taking up any new task.

Hence, it is essential to be familiar with the information of the customer that may change over a period, also changing the risk levels of that particular customer.

Therefore, all of this information should be updated in your systems at regular intervals.

In addition to that, the accuracy of this information should also be confirmed so that it does not lose its functions of the risk-based approach.

If you are unable to keep up with the constantly changing customer information, you have to be prepared for some severe consequences.

The AML and CFT framework or policies makes an effective risk management tool. Additionally, an effective AML and CFT regime also reduces the probability of damage to the organization due to fraudulent activities.

7- Detecting And Reporting Any Suspicious Transactions

The primary purpose of anti-money laundering checks is to detect financial crimes and suspicious transactions. Financial crimes must be detected, and necessary precautions must be taken in order to bring your AML processes to their actual purpose.

Although it is pretty challenging to check suspicious transactions almost instantly, they can be detected with the help of transaction monitoring solutions available to you. All of these transactions are stopped immediately and passed onto some other AML experts.

8- Upgrade The Anti-Money Laundering System With AI-Powered Solutions

With the constant technological change, crimes are also changing their pace and ways dramatically, resulting in the evolution and development of the regulations. With this given, manual anti-money laundering controls remain insufficient in organizations that are prone to the risk of money laundering activities.

AI-powered anti-money laundering software solutions help you track the unusual transactions for the known patterns, and they reduce the risk of ML to a greater extent and thereby help in implementing an effective AML/CFT Framework.

Conclusion on Effective AML/CFT Framework in Your Business

The anti-money laundering (AML) framework is vital for preventing ML/FT and PF risks. Policies, procedures, and controls established under the AML framework help to detect, mitigate, and report illicit activities, including ML/FT and PF.

Additionally, as a structured strategy, the AML framework aids in a better understanding of the UAE’s AML/CFT regulatory compliance, thus ensuring compliance and avoiding penalties and fines. Therefore, with the implementation of the AML framework, DNFBPs can protect themselves from ML/FT and PF activities.

FAQs on Effective AML/CFT Framework

Why is AML/CFT important?

AML/CFT is essential for the following reasons.

  • In order to protect the financial systems
  • In order to prevent criminals or money launderers from enjoying the proceedings of the money laundering activities
  • In order to restrict the criminals to develop formidable economic powers and challenge the stability.

If you are a financial institution or a designated non-financial business or profession, then the chances are pretty high that you are more prone to encounter pretty risky situations on a daily basis. Hence, each employee should be aware of the AML/CFT policies of your company so that they can also play their part effortlessly.

However, it will be the responsibility of the AML Compliance Officer to ensure that an effective AML/CFT Framework is implemented in the company.

Begin your AML compliance journey with a positive first step.

Contact our team to handle your goAML registration process.

Add a comment

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

AML Compliance for Online Jewellery Marketplace

AML Compliance for Online Jewellery Marketplace

Blogs

Table of Contents

Protect your business with reliable and effective AML strategies with AML UAE.

AML Compliance for Online Jewellery Marketplace

Precious metals and stones and jewellery made from such precious metals/stones are prone to high risk of money laundering, irrespective of the channel through which commercial transactions take place. Thus, anti-money laundering (AML) compliance is equally essential for online jewellery marketplaces to safeguard the penetration of the launderers in the virtual commercial platform.

Before discussing AML compliance for the online jewellery marketplace, let us understand what an online marketplace is.

Detect and deter money laundering in the
online jewellery marketplace

With our expert AML compliance services

What is an Online Marketplace?

Online marketplaces are e-commerce platforms enabling sellers and buyers to connect and conduct business. Such platforms are often known as online, electronic, or digital marketplaces. These platforms act as intermediaries, facilitating transactions between buyers and sellers. Online marketplaces offer convenience to both buyers and sellers across the globe and usually allow for cross-border transactions, enabling sellers to reach buyers beyond their local or national borders. The operators of online marketplaces provide several services to buyers and sellers using their platform, such as payment processing, order placement and customer support.

Online jewellery marketplace

The online jewellery marketplace refers to the segment of the e-commerce industry that facilitates the purchase and sale of jewellery, providing a platform to various customers and dealers in precious metals and stones.

Who qualifies as a “Customer” for online jewellery marketplaces?

As we understand it, a customer is a person who purchases goods or services from a supplier who is engaged in the supply of relevant goods or services. A customer can be an individual or a business.

Since the online marketplaces provide services to buyers and sellers to connect and deal in transactions, it can be said that both-

  1. the sellers listed on the online marketplace to sell their products
  2. the end consumer using the platform to buy the listed items

would come under the umbrella of “customer” for an online jewellery marketplace.

Let us first explore why AML compliance is essential for online jewellery marketplaces.

Why is the online jewellery marketplace prone to ML/FT risks?

There is a high level of anonymity on online platforms, giving an opportunity to money launderers and making it difficult to track down the sellers and buyers involved in such activities.

In general, the jewellery market involves high-value transactions. With online platforms, dealing in high-value transactions for jewellery can easily be done across borders within a split of a second with less suspicion. Thus, it becomes an attractive medium for money launderers.

Fake transactions have risen with the advancement of online marketplaces. Money launderers can form fake or mispriced transactions through online jewellery marketplaces to move high-value funds. Further, the risk of impersonation or using fake identities is rising in virtual commercial platforms.

Globalisation has increased cross-border transactions. However, there isn’t a coherence between the regulatory frameworks of the countries. Different regulatory regimes in different countries affect global transactions. Some countries have strict regimes, while others have few to no restrictions. Also, some jurisdictions do not pay heed to the supervision and monitoring of every transaction. Thus, because of the lack of a standard regulatory regime across the globe, the possibility of attempted money laundering transactions through online jewellery marketplace may go unnoticed.

ML, FT and PF typologies associated with online jewellery marketplaces

a. How are online jewellery marketplaces used by Money Launderers to carry out “Structuring”?

Money launderers use a structuring methodology for conducting transactions, breaking down large transactions into smaller ones to avoid suspicion. Generally, a transaction involving a large amount attracts suspicion and regulatory attention. In the case of online jewellery marketplaces, money launderers might conduct multiple transactions below the reporting threshold under a regulatory framework to avoid detection and consequences. Additionally, money launderers use the layering method, in which small transactions are conducted using different accounts.

b. Trade-Based Money Laundering using online jewellery marketplaces

Money launderers often exploit online jewellery marketplaces to engage in ML/FT activities and conceal and circulate illicit proceeds easily. This is due to the convenience of conducting transactions from anywhere, the global reach, and the anonymity offered by online platforms.

  • Circular transactions – Circular transactions refer to deceptive financial activities conducted among companies within a single group or under the control of a single owner. They are designed to obscure the origin and movement of illicit funds, posing a significant challenge to AML efforts.
  • Invoice tampering – Launderers can manipulate invoices related to jewellery transactions by increasing or decreasing prices, allowing them to move funds across borders.
  • False Documentation – Money launderers use false documentation related to jewellery transactions to legitimise the movement of illicit funds, making them appear legitimate transactions.

These methods show how money launderers can exploit online jewellery marketplaces.

Regulatory Framework for Online Marketplace

Telecommunications and Digital Government Regulatory Authority (TDRA) regulates the e-commerce framework and transactions in the UAE. TDRA approval is sought after obtaining the necessary eCommerce business license from the respective licensing authority, such as the Department of Economic Development (DED) for the UAE Mainland entities.

Laws pertaining to e-commerce/online marketplaces

The online jewellery marketplaces are subject to e-commerce laws as prevalent in the UAE.

Federal Decree-Law No. 14 of 2023 Concerning the Modern Technology-based Trade outlines regulations governing modern technology-based trade (Federal Decree no. 14 of 2023) is the primary law governing e-commerce, including an online jewellery marketplace.

This broadly encompasses how business is carried out by online marketplaces, which provide a platform to buyers and sellers and enable them to buy and sell goods and services through websites and applications.

 

AML Compliance for Online Jewellery Marketplace

Is there any mention of AML compliance in such laws?

Laws regulating the online marketplace do not cover the requirements needed to combat ML/FT and PF. To address the risk of ML/FT and proliferation financing of weapons of mass destruction, the UAE government, in accordance with the Financial Action Task Force (FATF) recommendations, has enacted laws and regulations to combat these.

AML Compliance for online marketplace, including online jewellery marketplace, can be linked to the following AML regulations due to its nature of dealing and facilitating transactions that involve Dealers in Precious Metals and Stones (DPMS):

  • Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing
  • Cabinet Resolution No. (134) of 2025 Concerning the Executive Regulations of Federal Decree-Law No. (10) of 2025 Concerning Combating Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons.
  • Cabinet Decision No. (74) of 2020 Regarding Terrorism Lists Regulation and Implementation of United Nations Security Council (UNSC) Resolutions on the Suppression and Combating of Terrorism, Terrorist Financing, Countering the Proliferation of Weapons of Mass Destruction and its Financing and Relevant Resolution.

Additionally, the UAE authorities have issued Supplemental Guidance for Dealers in Precious Metals & Stones (DPMS) as part of Guidelines for Designated Non-Financial Businesses and Professions. These guidelines help DPMS, including the online jewellery marketplace, better understand and implement the AML compliance measures.

AML Compliance measures to be undertaken by online jewellery marketplaces

An online jewellery marketplace should set certain requirements for both buyers and sellers to ensure smooth transactions and a safe environment. By implementing these requirements, an online jewellery marketplace can provide a safe and transparent environment for transactions, enhancing trust and confidence among users. Here is the list that should be considered before facilitating any transaction:

Requirement for Buyers and Sellers

  • The online jewellery marketplace should create a system allowing buyers to create an account on the platform and provide necessary information such as name, email address, and password to continue with transactions. Only with such a personal account would buyers be allowed to make and buy jewellery.
  • The online jewellery marketplace should create a system allowing sellers or suppliers to create an account on the platform. The platform should also have a system for necessary business information and documentation as per the country’s law.
  • The online jewellery marketplace shall establish a system for identifying buyers who need to verify their identity. This requirement is necessary to ensure security and prevent fraud, as jewellery involves high-value purchases.
  • The online jewellery marketplace should provide clear terms and conditions for buyers & sellers to establish rights and responsibilities when using the platform. The language of such terms and conditions should be simple for a clear understanding.
  • For listing sellers, the platform must carry out verification to ensure compliance with platform standards and regulations before allowing sellers to engage in business through its platform.
  • The online jewellery marketplace makes sure that sellers on its platform are able to provide the necessary information, records, and documents for inspection, especially concerning compliance with AML laws and regulations.
  • The online jewellery marketplace should allow buyers to make payments only through secure payment options available to them, ensuring convenience and security during transactions. Additionally, restrictions should be imposed on cash transactions involving high-value transactions.
  • The online jewellery marketplace should incorporate a robust customer support system to assist buyers with inquiries, issues, or disputes they may encounter during the purchasing process. It should also include a system for sellers to leave reviews to provide feedback on their experiences and reporting of transactions where the buyer is suspected of being involved in ML/FT cases.

Insistence on AML Compliance from DPMS listed on the Platform

An online jewellery marketplace platform should ensure that all suppliers willing to list themselves comply with AML obligations defined under the respective country’s AML regulations before allowing them access to the platform to execute commercial transactions.

Before listing themselves on an online marketplace platform, jewellery suppliers must take necessary measures to mitigate ML/FT risks. One key measure is implementing strong and effective internal policies, controls, and procedures. Suppliers of jewellery must periodically assess these policies for effectiveness and update them accordingly as and when the need arises to ensure that no criminals exploit their business under the guise of the online marketplace.

The following is the list of policy requirements that jewellery suppliers on an online platform must include in their AML/CFT Policy Manual:

Additionally, an online jewellery marketplace should check that all DPMS sellers listed on its platform comply with the requirement of filing the Dealers in Precious Metals and Stones Report (DPMSR) on the goAML portal for the specified transactions exceeding a certain amount.

Implementation of a Risk-Based Approach

The online jewellery marketplace that facilitates jewellery transactions should have policies, procedures, systems, and controls in place in accordance with the risk-based approach (RBA) as prescribed by the UAE federal laws and FATF while supervising the transactions between buyers and sellers that it facilitates. The RBA calls for applying risk mitigation measures proportionate to the ML/FT and PF risk the business is exposed to.

As part of the risk assessment process, an online jewellery marketplace must identify specific areas of business that customers are more likely to use in order to conduct any ML/FT or PF. The online marketplace must consider the following risk factors:

  • Customer risk – In any online jewellery marketplace, customer risk refers to customer categories based on the assessment of factors that may expose them to potential financial crimes. This risk may arise from dealing with PEP (Politically Exposed Persons) or Sanctioned Individuals.
  • Geographic risk – Geographic risk for an online jewellery marketplace would mean the risk associated with transactions from which the seller/buyer originates. This may relate to jurisdictions with a higher likelihood of financial crime or inadequate regulatory frameworks.
  • Product risk – Product risk means assessing how vulnerable the product is to the online jewellery marketplace. Naturally, dealing in precious metals and stones is a risky affair, and the probability that sellers or buyers will engage in unethical or illegal activities must be assessed by the online jewellery marketplace.
  • Transactional and Delivery-Channel Risk – This relates to the potential risk for financial crime facilitated by the method of delivery, mode of payment or transfer of funds within and to the online jewellery marketplace by using wire transfers, virtual assets, routing transactions through multiple accounts and complex web of transactions.

Establishing AML Governance within the online jewellery marketplace

An Online jewellery marketplace should ensure that ML/FT and PF risk is minimised through the platform and establish a robust AML governance by formulating and implementing comprehensive AML/CFT policies and procedures to safeguard the platform from illicit activities.

  • An Online jewellery marketplace should enforce stringent AML/CFT policies and procedures encompassing customer due diligence (CDD) processes, including verifying customer identities and monitoring transactions for suspicious activities.
  • It should also employ such technologies to enhance the detection of irregular or high-value transactions and ensure compliance with regulatory requirements.
  • Additionally, suppliers’ role in maintaining the integrity of the marketplace is very critical. An online marketplace should also conduct periodic assessments and audits of suppliers to ensure ongoing compliance and mitigate potential risks.
  • An online marketplace should appoint an AML Compliance Officer, who would be responsible for designing, implementing, and monitoring our AML/CFT policies and procedures. Further, an online marketplace shall also make sure that its suppliers appoint an AML Compliance Officer to oversee their respective AML/CFT efforts.
  • As regulatory compliance, an online jewellery marketplace should register themselves on the goAML portal. It must also mandate the goAML registration of the listed suppliers.

Customer Due Diligence (CDD)

An Online jewellery marketplace should conduct comprehensive CDD procedures for customers and suppliers engaging in transactions on an online platform to verify their identities and assess the nature of their activities. Similarly, the suppliers listed on the platform must apply necessary CDD measures to mitigate the risk arising from buyers who are proposed to be onboarded through the online platform.

Know Your Customer

Know Your Customer (KYC) is a process of identifying and verifying customers before commencing a business relationship.

  • Online Marketplace:- To combat ML/FT threats, Online jewellery marketplaces must implement an adequate KYC program. An online marketplace must identify the natural or legal person with whom the business is proposing to transact, including their background, so it does not expose the platform to such criminals. For verification of identity, necessary documents must be obtained, such as identity and address proof.
  • Supplier:- An online marketplace should also ensure that its suppliers implement KYC measures and monitor their customers obtained through online and offline jewellery marketplaces. For verification, the supplier can use and rely on the documents obtained from the buyer by the online marketplace.

Customer Risk Assessment

The Customer Risk Assessment is all about identifying and evaluating the ML/FT risk the buyer and seller pose to the business.

  • Online jewellery marketplace:- An Online jewellery marketplace must conduct a Customer Risk Assessment by evaluating various factors such as transaction volume, geographical locations, frequency of transactions, and the type of jewellery sold. Additionally, the buyers must be segmented based on risk levels such as low-risk, medium-risk, and high-risk. It should also assess supplier risk based on factors like location, reputation, compliance history, and the nature of the jewellery supplied and classify the suppliers into different risk categories.
  • Supplier:- An online jewellery marketplace should also ensure that its suppliers are performing customer risk profiling to better understand the risks involved with customers obtained through the online marketplace. The risk assessed by the online marketplace and the supplier for the same buyer may differ, considering each of their business risk assessment.

Enhanced Due Diligence (EDD)

As part of CDD, if the customer’s risk is identified as high, the online jewellery marketplace must implement EDD measures to further mitigate risks associated with ML/FT. This would include the application of enhanced checks on the identity of the customers, seeking additional documents pertaining to the customer’s sources of funds, and onboarding customers only after senior management approval. Similar EDD measures must be implemented by the suppliers when the customer risk profiling suggests increased ML/FT risk.

Ongoing Monitoring of Business Relationships and Transactions

Ongoing monitoring of business relationships within an online jewellery marketplace should include the continuous evaluation of customer interactions and transactions to assess the legitimacy of these relationships. This includes keeping detailed records of customer profiles, transaction histories, and communication exchanges to facilitate ongoing monitoring and analysis.

The fundamental goal of this ongoing monitoring is to uncover suspicious activity.

  • Online jewellery marketplace:- An online jewellery marketplace must engage in continuous surveillance of transactions occurring on its platform to identify and mitigate potential risks associated with financial crimes. Transaction monitoring must include monitoring for unusually large transactions, transactions involving the same parties, and transactions that deviate from typical customer behaviour. Upon detection of suspicious activity, it should conduct reviews and take necessary actions to mitigate the risk, including reporting the same on the goAML Portal. Similarly, it must monitor business relationships with suppliers on an ongoing basis to ensure compliance with regulatory requirements and mitigate risks associated with financial crimes. This includes regular reviews of supplier performance, transactional performance, and compliance with contractual obligations.
  • Supplier:- Additionally, an online jewellery marketplace should ensure that its suppliers have an ongoing monitoring program in place for their customers and that such procedures are mentioned in their AML/CFT policies and procedures.

Reporting of Suspicious Activities/ Transactions  

An online jewellery marketplace shall ensure that all transactions likely to be part of an ML/FT and PF deal are reported to the regulatory authority in a manner prescribed by law. Thus, an online marketplace should document the relevant red flags that suggest the transaction’s likely association with ML/FT activities.  

Red flags and the Importance of Red Flag Warning

Red Flags are indicators that can help identify illegal activities like ML/FT. They are also called suspicion indicators or risk indicators. Generally, red flags are warning signs that businesses should remain alert for potential money laundering and terrorists.

The growing online jewellery marketplace has made jewellery dealings diverse. This interconnectedness of the online jewellery system has created opportunities for criminals to engage in ML/FT and PF.

List of Red Flags applicable to online jewellery marketplace

  • Customer uses more than one national or foreign bank account under his name.
  • The seller is selling products to selective customers.
  • Sudden change in the mode of payment at the time of conclusion of the transactions without any explainable or logical reason.
  • DPMS sellers frequently enter transactions of an abnormally large amount.
  • DPMS has multiple bank accounts without any business sense or DPMS entities operating bank accounts in the employee’s name.
  • Unreasonable behaviour of large complex transactions by newly formed/listed DPMS entities.
  • Irregular shipping methods inconsistent with the standard business practice of DPMS.
  • Inconsistent documentation or forged documents to disguise the transaction.

After being aware of red flags, an organisation needs to take action to report such transactions. Online jewellery marketplace and the suppliers should keep track of questionable transactions and customers and if any ML/FT/PF suspicion is observed, reporting the same with the FIU by filing suspicious transaction report (STR) or a suspicious activity report (SAR).

Sanctions Compliance Program

To ensure complete regulatory compliance for AML/CFT requirements, an online jewellery marketplace should develop a comprehensive Targeted Financial Sanctions (TFS) program that is designed to ensure adherence to relevant sanctions regimes and mitigate the risk of engaging with sanctioned individuals, entities, or jurisdictions.

  • online jewellery marketplace must have its sanctions compliance policy, which provides the procedures to carry out screening of the customers and suppliers against relevant sanctions lists and implement appropriate controls to prevent engagement with sanctioned entities.
  • A similar sanction compliance program is expected to be implemented by the suppliers, ensuring dual checks for the sanctions and restricting the access of the platform to such criminals.

Maintenance of Records

Entities subject to AML compliance must retain all records, documents, data, and statistics for all transactions for the period required under the applicable law.

  • Online jewellery marketplace needs to maintain comprehensive records of AML policies, relevant documents, transaction monitoring activities, and any remedial actions taken in response to identified risks. These records should be securely recorded and regularly reviewed to ensure accuracy and completeness and must be made readily available to the authorities when requested.
  • Further, the supplier must also retain all the records of the e-commerce transactions routed through the online jewellery marketplace.

With AML UAE, let’s make your online jewellery marketplace a safe business spot!

An online jewellery marketplace demands a vigilant approach to AML/CFT compliance due to the expansion of digital platforms, which may facilitate illicit activities. Therefore, it’s important for online jewellery marketplaces to implement AML/CFT measures in accordance with relevant regulatory frameworks.

Implementing a dedicated framework to combat ML/TF safeguards an online marketplace, upholds regulatory standards, and maintains trust among suppliers and buyers. Thus, by prioritising AML/CFT compliance, online jewellery marketplaces contribute to a safer and more secure digital marketplace for the global jewellery industry.

FAQs on AML Compliance for Online Jewellery Marketplace

What is an Online Marketplace?

An online marketplace is a centralised online platform where buyers and sellers of goods and services conduct business.

The Telecommunications and Digital Government Regulatory Authority (TDRA) regulates the licensing and supervision of online marketplaces, and the Central Bank of the UAE (CBUAE) and the Securities and Commodities Authority (SCA) govern and supervise the digital currency transaction services provided by such online marketplaces.

Online jewellery marketplaces, because of their nature of dealing in jewellery, are required to register themselves on the goAML Portal.

Begin your AML compliance journey with a positive first step.

Contact our team to handle your goAML registration process.

Share via :

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik