An independent AML audit is not a formality. It is the closest thing to a rehearsal for a Ministry inspection, and it is the one time someone outside your compliance function tests whether your controls work, not just whether they exist. This checklist is written for DNFBPs supervised by the Ministry of Economy and Tourism. Firms in DIFC and ADGM should check the DFSA's and FSRA's own rules.
Done well, it gives your board evidence that the programme is effective. Done badly, it produces a report that an inspector will later read alongside the fines.
What the law requires
Cabinet Resolution No. 134 of 2025, the Executive Regulations to Federal Decree-Law No. 10 of 2025, requires internal policies to include "an independent audit function to test the effectiveness and adequacy of internal anti-crime policies, controls and procedures" (Article 21(6)). This carries forward the requirement in the previous Cabinet Decision No. 10 of 2019.
The Ministry of Economy and Tourism's guidelines for DNFBPs add the practical detail:
- The auditor may be internal or external, but must be independent of the compliance and operational functions being tested and free of conflicts of interest.
- External auditors should be engaged under a written contract.
- Frequency is risk-based. Factors include the National Risk Assessment, the size of the business, previous inspection findings, changes to the business and your own risk assessment. In our view, for most DNFBPs that points to at least annual testing.
- Findings should be reported to senior management and the board, with risk ratings, owners and deadlines.
Why it matters now
In the first half of 2025, the Ministry recorded 1,063 violations and more than AED 42 million in fines across DNFBPs. The main problem areas were due diligence, risk assessment and suspicious transaction reporting, which are exactly the areas an independent audit should test.
Under Cabinet Resolution No. 71 of 2024, policies that omit a required element, including the independent audit function, can attract a fine of AED 50,000 to AED 200,000. Failing to identify, assess and document your risks can cost AED 50,000 to AED 500,000.
The checklist
Use this to prepare your document pack and to test yourself before the auditor arrives.
1. Governance and the Compliance Officer
- Compliance Officer appointed at management level, with the supervisor's approval, and an alternate where needed
- Board or senior management approval of the AML/CFT/CPF policy, with a dated minute
- Periodic Compliance Officer reports to senior management, with management's responses
- Evidence the Compliance Officer has independence, access to records and adequate resources
2. Enterprise-wide risk assessment (EWRA)
- A documented EWRA covering customers, products, services, delivery channels and geographies
- Proliferation financing risk addressed separately, using the UAE's latest PF National Risk Assessment
- Kept up to date (we suggest at least annually) and after material business changes
- New products or technologies assessed before launch
3. Policies and procedures
- References updated to Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025
- Procedures that match what staff actually do
- Version control and approval history
4. Customer due diligence
- Sample of customer files showing identification, verification and beneficial ownership down to the natural person
- Risk ratings applied and justified
- Enhanced due diligence for high-risk customers, PEPs and high-risk jurisdictions, including source of funds and source of wealth
- Ongoing monitoring and periodic reviews on schedule
5. Targeted financial sanctions
- Registration on the EOCN notification system
- Screening of customers, beneficial owners and counterparties at onboarding and on list updates
- Alert handling records showing how each potential match was resolved
- CNMR and PNMR filings, where relevant, within the deadlines in the EOCN guidance (freezing measures must be notified within five business days)
6. goAML and reporting
- Active goAML registration with current users
- STR and SAR decision log, including reasons where the decision was not to file
- Threshold reports (REAR, DPMSR) filed where triggered
- No evidence of tipping off
7. Transaction monitoring
- Red flags tailored to your sector
- Alerts reviewed, escalated and closed with a documented rationale
8. Training
- Training plan, attendance records and assessments
- Role-specific content for front-line staff, senior management and the board
- Materials updated for the 2025 law
9. Record keeping
- Records kept for at least five years, retrievable on request
- Retention periods triggered correctly under Cabinet Resolution No. 134 of 2025
10. Outsourcing and previous findings
- Written agreements, oversight and any required no-objection letters for outsourced compliance tasks
- Status of findings from the last audit and the last inspection, with evidence of closure
How to prepare, in practice
- Start four to six weeks out. Assemble the document pack before fieldwork begins.
- Run your own sample. Pull ten customer files at random. If you find gaps, fix the process, not just the files.
- Close quick wins: expired IDs, missing board approvals, out-of-date legal references.
- Brief staff that the auditor may interview them, and that honest answers help.
- Do not over-manage the auditor. An audit that finds nothing on a programme with known weaknesses is a red flag in itself.
- Agree a remediation plan with owners and dates, and present it to the board with the report.
- Keep the report and remediation evidence ready for the Ministry. Inspectors often ask for both.
The purpose of the audit is not a clean report. It is a programme that holds up when the Ministry arrives.