How to Document AML Checks for UAE Businesses

A completed AML check is only as strong as the evidence behind it. When a UAE regulator, auditor or bank asks how you assessed a customer, identified beneficial owners, or escalated a concern, a verbal explanation will not be enough. Knowing how to document AML checks means creating a clear, dated record that shows what your business knew, what it verified, the risk it identified and the action it took.

For UAE businesses, particularly Designated Non-Financial Businesses and Professions such as real estate brokers, accountants, auditors, corporate service providers and dealers in precious metals and stones, documentation is a core part of Anti-Money Laundering compliance. It supports better commercial decisions as well as regulatory readiness.

Start with a documented AML framework

Good customer files begin before the customer does. Your internal AML policy should set out who performs checks, what evidence is required, when enhanced due diligence applies, who approves higher-risk relationships and how records are retained.

A policy copied from a template is unlikely to help during an inspection. It should reflect the reality of your business: the services you provide, the customer types you serve, the countries connected to transactions, your payment methods and the scale of your operations. A Dubai property business accepting payments from overseas investors will have a different risk profile from a local bookkeeping practice serving UAE trading companies.

Keep version-controlled copies of the policy, your enterprise-wide risk assessment, staff training records and appointed compliance officer details. Record the approval date, the person responsible and the date of the next review. This demonstrates that AML controls are actively managed rather than filed away.

How to document AML checks at customer onboarding

The customer due diligence file should allow an independent person to understand the relationship without needing to ask your team for missing context. Record the date the relationship began, the services requested, the staff member completing the review and the approval decision.

For an individual, retain a clear copy of valid identification, proof of address where required, contact details and evidence of verification. For a corporate customer, document the legal name, trade licence or incorporation information, registered address, ownership structure, authorised signatories and the identity of each beneficial owner.

Do not simply retain documents without commentary. A passport copy proves identity only when it is connected to the person, entity and verification step being assessed. Your file should state how the document was reviewed, whether its details matched company records and whether any discrepancies were resolved.

A practical onboarding record normally includes the following four elements:

• the customer and beneficial ownership information collected;

• screening results for sanctions, politically exposed persons and adverse media, including the date and screening source;

• the assigned risk rating and reasons for it; and

• the decision to accept, decline or escalate the relationship, with the approver's name and date.

Where ownership is layered through several companies, retain the ownership chart used to identify the ultimate beneficial owner. Note the percentage held, direct or indirect control, and the evidence supporting each part of the chain. If you cannot establish ownership or obtain satisfactory evidence, document the gap, the follow-up undertaken and why the relationship was declined or escalated.

Make the risk assessment specific, not generic

A risk rating should never be a label selected without explanation. Low, medium and high risk categories are useful only if the file states why a customer falls into that category.

Consider the customer’s business activity, geographical connections, ownership complexity, expected transaction values, payment route, use of cash, source of funds and exposure to higher-risk sectors. A UAE company with transparent local ownership and predictable monthly accounting fees may reasonably present a different risk profile from a cross-border structure making a high-value real estate purchase through third parties.

Record both risk factors and mitigating factors. For example, a customer may have an overseas shareholder, which increases geographical risk, but provide reliable audited accounts, clear bank evidence and a straightforward commercial rationale. The assessment should show balanced judgement rather than automatic rejection.

For high-risk cases, document the enhanced due diligence undertaken. This may include additional source-of-wealth and source-of-funds evidence, senior management approval, closer transaction monitoring and more frequent reviews. The precise level of work depends on the risk, but the rationale must be visible.

Keep source-of-funds evidence connected to the transaction

One common documentation weakness is collecting bank statements or contracts without explaining what they prove. Source-of-funds checks should establish where the money for a particular transaction came from. Source of wealth is broader: it considers how the customer accumulated their overall wealth.

For a property transaction, a file may contain a sale agreement, bank statement, loan documentation and payment trail. The useful record is not just the documents themselves. Add a concise note confirming that the funds originated from the stated account, the payment route is consistent with the transaction and any third-party payment has been investigated and approved.

If facts do not align, record the discrepancy and stop treating it as an administrative issue. An unexplained change in payer, an unusual cash component, inconsistent company activity or reluctance to provide ownership information may require escalation to the Money Laundering Reporting Officer (MLRO).

Document monitoring throughout the relationship

AML documentation does not end after onboarding. Customer records must remain current, and transaction activity should be assessed against what you know about the customer’s expected activity.

Set review dates based on risk. Higher-risk relationships generally need more frequent review, while lower-risk customers may be reviewed on a longer cycle, subject to your policy and applicable UAE requirements. Record the review date, documents refreshed, screening performed, changes in ownership or activity and the decision to retain, reclassify or exit the relationship.

For ongoing work, keep concise monitoring notes where activity differs from expectations. A single unusual payment is not automatically suspicious, but it should be assessed. Explain what was observed, what information was requested, how the explanation was corroborated and whether the matter was closed or escalated.

This creates a useful audit trail and reduces the risk that key knowledge is held only by one employee. It also helps directors identify customers or service lines that may be creating disproportionate compliance exposure.

Create a controlled escalation and reporting record

Staff should know how to raise an internal suspicious activity concern without alerting the customer. Keep a restricted internal reporting form or case record that captures the relevant facts, dates, parties involved, supporting documents and the reason for concern.

The MLRO should document their assessment, any further enquiries made, the decision reached and, where required, the submission of a Suspicious Transaction Report through the appropriate UAE reporting channel. Access to this material must be tightly controlled. Do not place sensitive suspicion reports in a general customer folder, and do not record anything that could result in tipping off the customer.

A decision not to submit a report should also be documented. The question is not whether every unusual matter leads to external reporting. The question is whether the concern was assessed promptly, independently and with enough evidence to support the decision.

Retention, security and retrieval matter

AML files must be retained for the applicable statutory period. In the UAE, AML record-keeping requirements commonly require records to be kept for at least five years after the end of the business relationship or completion of the transaction. Your business should confirm the specific obligations that apply to its sector and regulator.

Store records in a secure system with appropriate access controls, backups and an audit trail of changes. A spreadsheet may be workable for a very small business, but it can become unreliable when there are multiple entities, frequent reviews or several team members. The best system is the one that allows you to retrieve a complete customer file quickly, consistently and securely.

Avoid retaining more personal data than necessary, but do not remove evidence needed to demonstrate compliance. Align AML retention procedures with your wider data protection, document management and information security controls.

Turn documentation into management control

Well-documented AML checks are not paperwork for its own sake. They give directors visibility over customer risk, reveal gaps in onboarding discipline and make it easier to respond confidently to regulatory queries. They also protect staff by replacing informal judgement with a defined decision process.

If your current files contain documents but not decisions, start by testing a small sample. Can another person identify the beneficial owner, understand the risk rating, see the source-of-funds review and follow the monitoring history? If not, the process needs attention before a regulator asks the same question.

James Watt For Accounting & Bookkeeping Co. LLC helps UAE businesses build practical compliance processes that work alongside day-to-day finance operations. A clear AML record today gives your business more than inspection readiness - it gives leadership the confidence to grow with control.