AML Realtor Records: UAE Retention and Controls

A property deal can move from viewing to reservation payment in a matter of hours. Your AML file cannot be assembled after the fact. For UAE real estate businesses, AML realtor records are the evidence that customer checks, source-of-funds enquiries and risk decisions were completed at the right time, by the right people.

This is not simply an administrative exercise. In a sector exposed to high-value transactions, overseas buyers, corporate ownership structures and cash-payment risk, incomplete records can make it difficult to explain a transaction to senior management, an auditor or the UAE authorities. Good record keeping protects the business, supports consistent decision-making and allows brokers to spend less time searching for documents when a review arises.

Why AML realtor records matter in the UAE

UAE real estate brokers and agents fall within the anti-money laundering framework as designated non-financial businesses and professions. They must apply customer due diligence, assess risk, monitor business relationships and report suspicious activity where there are reasonable grounds for suspicion.

A completed sale is not proof that the AML process was adequate. The question is whether the business can demonstrate how it identified the customer, understood the purpose of the transaction, established the beneficial owner where a company was involved, and responded to unusual facts. The record should show the reasoning, not merely a collection of passport copies.

Poor files create three immediate commercial problems. They increase exposure to regulatory action and financial penalties; they slow down transactions when missing information must be chased at the last minute; and they leave directors with limited visibility over the risk being accepted by the business. A disciplined process turns compliance into a controlled operating function rather than a recurring fire drill.

What AML realtor records should include

The required file will vary with the customer and the transaction risk, but a useful standard is that another trained member of the team should be able to understand the relationship without relying on the original broker's memory.

Customer identification and verification

Keep the documents and data used to identify every relevant party. For an individual, this will commonly include their full name, nationality, date of birth, residential address, passport or Emirates ID details, and evidence showing how identity was verified. The file should record the date of verification and any expiry dates that require follow-up.

For a company, the record should go further. Retain the trade licence or incorporation documents, constitutional documents where relevant, registered address, authorised signatory evidence and ownership information. Establish and document the ultimate beneficial owner or owners, including the basis on which ownership or control was determined. A company name on a reservation form is not enough.

Where a customer acts through a representative, retain the authority permitting that person to act and verify both the representative and the underlying customer. This point is frequently missed in family purchases, power-of-attorney arrangements and corporate property acquisitions.

Transaction and payment trail

The file should tell the financial story of the deal. Retain the property details, reservation agreement, sale and purchase agreement, invoices, payment schedules, correspondence on the agreed consideration and evidence of payments received or facilitated.

Payment records should make clear who paid, from which account, through which route and on whose behalf. Where the payer differs from the buyer, this is a risk indicator that requires a documented explanation and, where appropriate, additional due diligence. Keep copies of bank transfer confirmations, escrow records and relevant payment instructions rather than relying on a note that payment was received.

Risk assessment and due diligence decisions

A tick-box form alone rarely explains why a transaction was assessed as low, medium or high risk. Retain the completed customer and transaction risk assessment, the factors considered, screening results and the final risk rating. Record who approved the rating and when.

For higher-risk situations, the file should show the enhanced due diligence undertaken. Examples include a politically exposed person, complex corporate ownership, a customer from a higher-risk jurisdiction, an unusual payment structure, or a transaction that does not appear consistent with the customer's known profile. Enhanced checks may involve obtaining senior management approval, establishing source of wealth or source of funds, and carrying out more frequent monitoring. The extent of evidence required depends on the risk, but the conclusion must be credible and supported.

Ongoing monitoring and internal escalation

AML obligations do not end when identification documents are collected. Retain notes of material changes, refreshed due diligence, unusual behaviour, payment amendments and compliance queries raised during the relationship.

If a concern is escalated internally, preserve the escalation record, the compliance review, supporting evidence and the decision taken. Where a suspicious transaction report is submitted through the UAE Financial Intelligence Unit's goAML system, keep the required internal documentation securely. Access must be tightly restricted. Staff must not disclose to a customer or another unauthorised person that a report has been made or is being considered.

How long must records be retained?

Under the UAE AML framework, relevant records must generally be retained for at least five years from the date a transaction is completed or from the end of the business relationship. The records must be sufficient to reconstruct individual transactions and demonstrate the due diligence and monitoring performed.

Five years is a minimum, not a reason to delete information automatically on the anniversary date. If an authority, investigation or legal requirement calls for records to be preserved for longer, the business should suspend routine destruction for the relevant file. Your retention policy should explain who can authorise deletion, how legal holds are applied and how records are securely destroyed once retention is no longer necessary.

Paper files stored in an office cupboard are difficult to control, while unstructured folders can be equally problematic. A secure digital file structure is usually more practical, provided access is role-based, documents are searchable, version history is maintained and backups are tested. AML records contain sensitive personal data, so retention and retrieval must sit alongside appropriate data-protection controls.

Build a record-keeping process your team will use

The strongest AML policy will fail if brokers regard it as separate from the sales process. Build the file as the transaction progresses. At onboarding, create a unique customer or transaction reference. Before accepting a reservation or progressing a deal, require the required identification, ownership and risk-review steps. Before completion, confirm that payment evidence and any enhanced due diligence are on file.

A practical workflow should assign ownership clearly. Front-office staff gather documents and identify red flags. The nominated compliance officer or authorised reviewer assesses escalations, approves higher-risk relationships where required and oversees reporting decisions. Finance should reconcile deposits, commission and payment evidence against the transaction file. This separation helps prevent commercial pressure from overriding risk controls.

Use a standard checklist, but require short written explanations for unusual cases. For example, a customer buying through a newly formed offshore company may be legitimate. The file should explain the ownership chain, commercial rationale, source of funds and approval decision. A well-documented rationale is more useful than an unexplained "high risk" label.

Training matters because records reflect what employees recognise. Staff should know how to spot warning signs such as reluctance to provide ownership information, third-party payments with no clear rationale, abrupt changes to the buyer, inconsistent income claims, or pressure to avoid normal documentation. Training records, attendance logs and assessment results should also be retained as part of the wider AML compliance programme.

Common gaps that create avoidable risk

Many real estate firms hold a passport copy but cannot show how they verified it, why the buyer was assessed as low risk or where the purchase funds originated. Others complete due diligence at the start but fail to update it when the buyer, payment route or ownership structure changes.

Another weakness is keeping customer files and finance records in separate systems with no shared transaction reference. This makes it harder to identify a payment from an unexpected third party or to reconstruct the sequence of events. Align your CRM, transaction tracker, accounting records and AML file naming so that the evidence can be connected quickly.

Finally, do not treat confidentiality as a reason to avoid internal escalation. Sensitive information should be protected, but relevant compliance personnel need timely access to make informed decisions. The answer is controlled access and documented workflows, not fragmented record keeping.

For directors, the right question is not whether every folder contains the same documents. It is whether each file gives a clear, proportionate account of the customer, the money, the risk and the decisions made. Establish that discipline now, and your AML records will support confident property transactions rather than interrupt them when scrutiny arrives.