UAE AML/CFT rules expect regulated firms and DNFBPs to have their frameworks independently tested. We carry out independent AML/CFT and CPF audits and targeted health checks that show you exactly where you stand, before the regulator does.
Our methodology combines file reviews, data testing and stakeholder interviews to give you a clear, heat-mapped view of your exposure and a prioritised remediation roadmap you can take to your regulator.
Talk to usA full, independent assessment of your AML/CFT and CPF framework against your regulator’s requirements, covering governance, risk assessment, CDD, screening, monitoring, reporting, training and record-keeping. Suited to annual audit requirements and pre-inspection readiness.
A faster, focused review of the areas that matter most right now, such as a single control, a business line or the findings from a recent inspection. Suited to firms that need a quick, reliable read on their position.
Inherent risk across customers, products, channels and geographies, and whether your controls genuinely bring it down to the residual position the board has approved.
Synthetic and known-match testing of detection rates, fuzzy-matching thresholds, list coverage and refresh cycles, plus a review of alert-handling quality.
Above- and below-the-line testing of rules and thresholds against live data to close detection gaps and cut false positives.
Risk-based sampling of onboarding files, gap scoring against your own standard, and a structured back-book remediation programme.
ABC policy, gifts and hospitality registers, third-party and intermediary due diligence, and conduct risk in commercial incentives.
Dedicated PF risk assessment covering dual-use goods exposure, high-risk trade corridors and beneficial ownership opacity.
Verification that the customer and transaction data feeding your screening and monitoring systems is complete, current and correctly mapped.
Findings ranked by severity and effort, with owners, milestones and evidence requirements the regulator can follow.
A single view across every financial crime and conduct risk your supervisor will ask about.
Placement, layering and integration typologies mapped to your actual customer and product mix.
Low-value, high-risk patterns and typologies aligned to UAE national risk assessment findings.
UN, UAE Local Terrorist List, OFAC, EU and UK regime exposure, ownership aggregation and evasion typologies.
Dual-use goods, trade finance corridors and opaque ownership structures under targeted financial sanctions.
Third-party intermediaries, facilitation payments, public official exposure and incentive-driven conduct risk.
Mis-selling, suitability, conflicts of interest and market manipulation controls, where relevant to your licence.
Entity perimeter, risk taxonomy and data extraction agreed, with interviews scheduled across the first and second lines.
Data analytics, file sampling, screening and monitoring testing, and stakeholder interviews run in parallel.
Residual risk plotted by domain and business line, with each finding evidenced and rated for severity.
A prioritised remediation plan with owners and milestones, presented to the board or audit committee.
Independence is the point of an audit. Where RegLex also acts as your MLRO or designed your framework, we will say so up front and agree how independence is maintained, or recommend a separate reviewer.
Commissioned by exchange houses, payment and virtual asset firms, brokers, insurers and DNFBPs: as an annual independent audit, ahead of an inspection, or after a finding.
UAE AML/CFT rules require regulated firms and DNFBPs to have their policies, procedures and controls independently tested. Many firms, especially smaller ones, meet this by appointing an external auditor. How often and how extensive the review must be depends on your size, risk profile and regulator.
An audit is a full, independent assessment of your whole framework, suitable for annual requirements and for sharing with your regulator. A health check is a faster, targeted review of specific areas, useful when you need a quick read on your position.
At least annually, and whenever there is a material change: a new product, market, delivery channel, acquisition or significant regulatory development.
Controlled testing using synthetic and known-match data to measure detection rates, fuzzy-matching thresholds, list coverage and refresh frequency, alongside a review of alert handling and escalation quality.
An independent audit typically takes two to six weeks, depending on entity size, data availability and sample size. A targeted health check is usually faster.
Yes. Every finding is evidenced, severity-rated and traceable to source data or file references, in the format supervisors expect to see during an inspection.