Three Lines of Defense under AML Program

One of the crucial risk management frameworks for the regulated entities for creating a robust protective shield against financial crime is – Three lines of defense.

The first line of defense is Frontline employees of the entity who deal with customers and suppliers, engage in service delivery and manage overall customer relations.

The employees of the entity are expected to understand and adhere to the entity’s internal AML/CFT policies, procedures and controls to identify and assess the risk arising from a business relationship or transactions. The employees must know the ML/FT red flags and their role in detecting and reporting suspicious activities or transactions to the Compliance Officer.

As a first line of AML defence, the employees must ensure that no financial criminals can penetrate the business to misuse the entity for laundering funds or executing any other financial crime.

The second line of defence is the AML Compliance Officer of the entity, working towards implementing and streamlining the AML measures.

The AML Compliance Officer is responsible for developing the entity’s comprehensive AML/CFT program, aligned with its risk exposure. The AML Policies, Procedures, and Controls must be capable enough to promptly detect and deter the risk indicators and empower the regulated entity to stay AML compliant. Not just restricted to AML framework development function, the officer must ensure that it is well communicated across the organisation, people are trained on the same and oversee its overall implementation.

The AML Compliance Officer is ultimately responsible for reporting the Suspicious Transaction Reports (STR) or Suspicious Activity Reports (SAR). The officer must receive the internal STR/SAR and investigate the same thoroughly to trace down the suspicion related to financial crime, warranting reporting with the Financial Intelligence Unit and accurately reporting the same.

The third line of defense is the Independent AML audit. The critical aspect of the AML structure is an independent AML audit to ensure the quality, relevance and effectiveness of the AML measures implemented by the entity. AML audit provides an unbiased opinion on the entity’s AML program and identifies any gaps or weaknesses requiring immediate redressal for AML compliance and protection against financial crime.

Here is an infographic discussing the three lines of AML defence – an effective financial crime risk management structure.

Partner with AML UAE to develop these shields against financial crimes. We assist you in designing and implementing the AML policies and procedures in coordination with your AML Compliance Officer. We train your team and senior management, ensuring a robust compliance culture across the organization, and everybody comes together to combat money laundering and terrorism financing. We also independently review your AML health and help you strengthen the deficiencies and adhere to AML laws.

Understanding the Lines of Defense Model in AML Compliance

The Three Lines of Defense Model is a risk management framework that works on principle of segregation of duties among different departments of business and act as a protective shield against financial crimes. The primary aim of the model is to prevent and detect early issues in business activities which led to improved and proactive decision making concerned with risk, controls, policies, and procedures.

Under Federal Decree by Law No. (10) of 2025, Financial Institutions and DNFBPs are obliged to identify, assess and continuously update ML/TF or PF-based risks within the scope of business activities. Regulated Entities carrying out business activities that fall under the scope of the AML/CFT framework are required to be compliant with new AML/CFT reforms. Businesses are required to set up an In-house AML Compliance Department fulfill the specific regulatory requirements under AML/CFT laws of the UAE.

The First Line of Defense: Frontline Business Functions

Employees of this line (for e.g. customer facing teams, relationship managers, brokers, or onboarding units) are required to follow policies and procedures aligned with AML/CFT regulations and assess third party risks in conducting day to day business activities. For instance, how suspicious transactions should be flagged and reported using established internal policies, conducting effective KYC and Customer Due Diligence, assessing the business risks and integrating the AML Screening Software and validating the same which would help detecting any unusual behavior which could lead businesses into ML/TF or PF-based risks.

Conducting AML Training for employees to prepare them for identifying potential ML/TF or PF-based risks, determining scope of risk mitigation and escalation of procedure within the business areas. It is essential to develop a comprehensive understanding of existing and evolving risks that entities are facing to determine the scope and frequency of their effective training program.

A good practice to adherence with SOPs, internal policies and procedure along with implementing external controls like National Risk Assessment, sectoral risk assessments, FATF/ FSRB/ UNDOC publications works as effective evaluation of high-risk clients and cross-border transactions.

The Second Line of Defense: Compliance and Risk Management

The second line of defense includes Compliance Officers, MLROs and risk management team which works towards policies, guidance, assurance, monitoring, reporting and controlling business transactions related to ML/TF or PF-based risks. They are directly responsible for conducting independent testing, identifying high risk areas, and ensuring implementation of policies and procedures as per the AML/CFT reforms. Further, reporting suspicious activities or transactions along with analysis and review report to FIU in accordance with the Cabinet Decision No. 134 of 2025.

Compliance Officer and MLROs are ultimately responsible for detecting proceeds of crimes, retaining customer data, and keeping all the records for not less than 5 years in accordance with the latest AML/CFT requirements.

The Third Line of Defense – Internal Audit and Independent Assurance

The Third Line of Defense is responsible for evaluation of efficiency of AML/CFT policies, controls and procedures. Henceforth, the key aspect under this is to identify the weakness of existing AML compliance programs and suggest appropriate actions.

The AML/CFT laws mandate the Regulated Entities to establish an independent audit system to trace gaps within existing compliance system, detect loopholes if any, and figure out any shortcomings within the exiting AML compliance program. The Independent Auditor must submit its audit reports to senior management which contains risk appetite and scoring, implementation of competent authorities’ directives, timelines for remediation and deficiencies in designated duties of the affected employees. Senior management is eventually responsible for maintaining appropriate and resilient AML/CFT governance.

AML UAE assists the Regulated Entities to conduct independent audit while maintaining the transparency throughout the process and ensures that businesses meet the all the regulatory requirements related to internal audit and avoid hefty penalties.

How UAE AML Regulation Align with the Lines of Defense Model

The Federal Decree by Law no. 10 of 2025 mandates DNFBPs, financial institutions and VASPs to comply with preventive measures mentioned under Chapter 8, Article 18, 19 and 20. The CBUAE sets specific guidance to implement risk-based controls, quality oversight, and effective ongoing monitoring.

AML/CFT reforms bring a new category of crime, mandates additional preventive measures to be followed by DNFBPs fostering a culture of transparency and accountability at all levels of business area. Non-compliance to adhere to the expectations set out by different supervisory authorities now leads to more firm penalties and imprisonment.

Strengthening Technology and Data Integration Across the Three Lines of Defense

Article 24 of Cabinet Decision No. 134 of 2025 provides a scope of introduction of new technologies and professionals practices for AML/CFT compliance. CBUAE Guidelines sets forth key provisions for use of enabling technologies like AI, cloud computing, distributed ledger technology, data analytics and application programming interface.

For instance, automated solutions for suspicious transactions can detect multiple types of transactions at an early stage of monitoring which ultimately leads to effective AML compliance supporting first and second lines of defense, helping them coordinate with one another. By forming and evolving their own data inventory and intelligence units, they can create a comprehensive database to bridge the gap between jurisdictional and business silos.

Aligned with this approach, AML UAE offers AML Software solutions to diagnose unusual behavior, transactions activities, and risk-based assessment as per your organization’s needs.

Common Weaknesses in the Lines of Defense Model and Their AML Impact

Despite its strengths, the model is subject to certain limitations. Firstly, the pace of reforms in law to that of alteration in internal policies and procedures of regulated entities results in misalignment with organizations’ goal. This misalignment creates departmental silos and unclear boundaries among first and second lines of defense.

Secondly, use of outdated tools like Excel to monitor or trace transactions is not ideal for prevention or early detection of potential risk within the business area. Thirdly, the Cabinet Decision suggests risk-based assessment of business relationships; however, manual insufficiency, poor data availability and contextual ambiguity in documents make it challenging to identify and verify UBOs and implement risk-based controls.

Lastly, insufficient training and unawareness among employees towards AML compliance is one of the major factors of inconsistent implementation of controls and makes passive judgement while there is a need of escalation procedures to combat ML/TF or PF-based risks.

How AML UAE Helps Organisations Strengthen all Three Lines of Defense

AML UAE enables the Regulated Entities to implement all three defense lines through a comprehensive risk management framework which covers Business Risk Assessment and governance advisory. AML Compliance related obligations such as performing CDD/EDD, real-time Transaction Monitoring, maintaining records of the customers for smooth and independent audits are also taken care of by AML UAE to keep your business fully compliant.

General FAQs on Lines of Defense

The Three Lines of Defense include the frontline employees, Compliance and Risk Management, and Internal Aduit and Independent Assurance.

The Three Lines of Defence model ensures that Regulated Entities are protected from all aspects of ML/TF or PF-based risks and create checkpoints to mitigate any such risks.

The most common gaps in the Three Lines of Defence model include inadequate training of compliance team, deficiencies in data quality, communication barriers and lack of coordination among departments, relying on legacy software tools for risk assessment, and prioritising compliance over effective risk management.