AML/CFT Software Advisory & Setup

Under UAE Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations, obligations extend beyond banks and financial institutions to Designated Non-Financial Businesses and Professions (DNFBPs) — real estate brokers and agents involved in property transactions, dealers in precious metals and stones above specified transaction thresholds, company service providers (including those forming companies, acting as registered agents, or providing nominee director/shareholder services), independent lawyers and notaries when conducting specified financial or property transactions on a client's behalf, and accountants providing specified services. The exact obligations and their intensity depend on the entity's specific activity and its own documented risk-based assessment.

For a very small, low-volume DNFBP, a well-documented and consistently applied manual screening and record-keeping process can, in principle, satisfy the risk-based proportionality principle underpinning UAE AML/CFT regulation. In practice, manual processes struggle to keep pace with continuously updated sanctions and PEP lists, and become genuinely difficult to defend under inspection once transaction or customer volume grows. PNPC assesses proportionality as part of the initial scoping — we do not recommend software procurement as a default answer for every entity regardless of scale.

goAML is the electronic platform operated by the UAE's Financial Intelligence Unit (FIU), housed within the UAE Central Bank, through which regulated entities file Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other statutory AML/CFT disclosures. Entities falling within scope of UAE AML/CFT law — including DNFBPs — are generally required to register on goAML and designate a Compliance Officer authorised to file reports through the platform. PNPC coordinates registration for entities not yet registered and, for those already registered, ensures the internal alert workflow maps cleanly to the goAML filing process.

A Money Laundering Reporting Officer (MLRO), referred to under UAE regulation as the Compliance Officer, is the individual designated within a regulated entity as responsible for the AML/CFT programme, including reviewing internal alerts, deciding whether to file an STR/SAR, and liaising with the FIU and relevant supervisory authority. UAE AML/CFT regulations require regulated entities, including DNFBPs above the applicable scope, to appoint and register a Compliance Officer. The appointment should be senior enough to have genuine authority within the organisation and free from conflicts that would compromise independent judgement on suspicious activity decisions.

We start from the entity's documented risk-based assessment — its customer base, transaction profile, geographic exposure, and sector-specific typologies — rather than a generic vendor comparison. A real estate brokerage handling occasional high-value transactions has different screening cadence needs than a precious metals trader processing frequent cash transactions. We shortlist 2–3 platforms genuinely proportionate to the entity's actual risk and scale, present a written cost-benefit comparison, and are not tied to a single vendor relationship that would bias the recommendation.

Sanctions and PEP screening checks a customer's identity — at onboarding and on an ongoing basis — against UN Security Council sanctions lists, the UAE's Local Terrorist List, and databases of Politically Exposed Persons, to confirm the entity is not knowingly dealing with a sanctioned or high-risk individual or organisation. Transaction monitoring is a separate, ongoing function that reviews the pattern of a customer's actual transactions — value, frequency, counterparties, structuring behaviour — for activity inconsistent with their declared profile or indicative of money-laundering typologies, regardless of whether the customer appears on any sanctions list. Both are required components of a functioning AML/CFT programme; neither substitutes for the other.

UN Security Council sanctions lists, the UAE's Local Terrorist List, and major commercial PEP databases are updated frequently — sometimes multiple times within a single week. A properly configured screening platform updates its underlying list data automatically and re-screens the existing customer base on a defined cadence (commonly overnight or in near-real-time for continuously updated platforms), not just at the point of onboarding. PNPC confirms the update frequency and re-screening cadence as part of software evaluation, since a platform that only screens at onboarding leaves a business exposed to a customer who becomes designated after the relationship is already established.

An uncalibrated system — using default vendor thresholds not tailored to the entity's actual customer base — commonly generates a high volume of false-positive alerts, which either overwhelms the compliance officer or, worse, trains staff to dismiss alerts too quickly, increasing the risk that a genuine alert gets missed in the noise. PNPC's configuration process specifically tests the system against a sample of the entity's real historical data before go-live and recalibrates thresholds during the post-go-live review period to bring the false-positive rate to a manageable, defensible level.

No properly designed AML/CFT programme allows software to file an STR/SAR automatically without human review. The software's role is to flag alerts for investigation and, where relevant, to structure the case management record; the decision on whether an alert rises to the level of genuine suspicion warranting a filing remains a judgement call made by the trained Compliance Officer, based on the totality of the evidence. PNPC designs the workflow so the software supports that judgement with structured information — it does not replace it.

Yes, this is one of the more common engagements we see. A business purchases a platform, applies the vendor's default settings, and either never trains staff properly on it or never revisits the configuration as the business has grown. PNPC can conduct a configuration and effectiveness review of an existing system, identify gaps against the entity's current risk profile, and recalibrate or reconfigure the platform without necessarily requiring a full new software procurement.

All customer, transaction, and configuration data reviewed during an AML/CFT software engagement is handled under a signed engagement letter and confidentiality terms, accessed only by the specific PNPC team members assigned to the engagement. Where sample transaction data is used for configuration testing, PNPC works with the entity to anonymise or minimise personally identifiable information wherever the testing objective allows it.

Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions provide for a range of administrative and criminal sanctions for non-compliance, including substantial administrative fines that can apply per violation, suspension or revocation of licences for regulated entities, and criminal liability — including imprisonment in serious cases — for individuals involved in money-laundering offences or in wilful failure to report. The precise penalty in any given case depends on the nature and severity of the violation and is determined by the relevant supervisory authority or the courts; PNPC does not quote specific fine amounts as these are set and applied by the regulator based on the facts of each case.

For a single-entity DNFBP with a moderate customer base and an already-completed risk-based assessment, PNPC's engagement — from initial scoping through go-live — typically takes 5–6 weeks. Entities that do not yet have a documented risk-based assessment or an appointed Compliance Officer should expect that foundational governance work to be sequenced first, which extends the overall timeline. Larger or higher-risk entities, such as precious metals traders with high transaction volumes, typically require 8–10 weeks to reach a properly calibrated, tested configuration.

While DNFBPs make up a large share of PNPC's AML/CFT software advisory clients, the same advisory and configuration discipline applies to any UAE-regulated entity with AML/CFT obligations, including smaller finance companies, exchange houses, and insurance intermediaries regulated by the UAE Central Bank, and entities within DIFC or ADGM subject to those centres' own AML/CFT frameworks. The specific supervisory authority, reporting channel, and regulatory expectations differ by category, and PNPC scopes the engagement to the entity's actual regulator from the outset.

PNPC's engagement can be scoped either as a defined software selection, configuration, and go-live project, or as an ongoing retainer that includes periodic recalibration, independent effectiveness review, staff training refreshers, and advisory support through supervisory inspections. Many clients start with the initial setup and move to an ongoing advisory retainer once the system is live and the compliance function's needs become clearer in practice.

A risk-based approach — the foundational principle underlying UAE and international AML/CFT regulation — means an entity applies AML/CFT controls proportionate to the actual money-laundering and terrorist-financing risk it faces, rather than applying a uniform, one-size-fits-all control regardless of risk level. In practical terms, a higher-risk customer segment (cash-intensive transactions, complex ownership structures, higher-risk geographies) warrants more intensive screening and monitoring than a lower-risk segment. Software configuration must reflect this — applying uniform default settings across all customers regardless of risk level either wastes compliance resource on low-risk relationships or under-scrutinises genuinely higher-risk ones.

Many screening and monitoring platforms offer integration options — API connections, batch data uploads, or plug-ins for common CRM and accounting platforms — that reduce manual re-entry of customer and transaction data. The feasibility and cost of integration depends on the specific platforms involved on both sides. PNPC assesses integration feasibility as part of the software shortlisting process and factors the setup effort into the overall cost-benefit comparison presented to the client.

UAE AML/CFT regulations expect regulated entities to provide ongoing AML/CFT training to relevant staff, not a one-time induction session. PNPC's setup engagement includes tool-specific training for the Compliance Officer and frontline staff who will use the platform directly, and we recommend a periodic refresher — commonly annual — that covers both general AML/CFT awareness and any changes to the configured system, typologies, or regulatory guidance since the last session.

A UAE branch or subsidiary of a foreign group often already operates under a group-mandated AML/CFT platform selected by the parent company. In this scenario, PNPC's role typically shifts to confirming the group platform's configuration is properly localised to UAE regulatory requirements — UAE-specific sanctions lists, goAML reporting integration, and Ministry of Economy or relevant local supervisor expectations — rather than a fresh platform selection exercise. For groups with an India-linked entity, PNPC can coordinate this localisation review through our Chennai, Bangalore, Hyderabad, and Dubai offices.

KYC is the process of verifying a customer's identity and understanding the nature of their intended relationship with the business, typically at onboarding — collecting identity documents, verifying beneficial ownership for corporate customers, and understanding the customer's expected transaction profile. AML/CFT software builds on the KYC data collected: sanctions and PEP screening checks the identity data gathered during KYC, and transaction monitoring compares actual activity against the expected profile established at KYC. Weak or incomplete KYC data undermines the software's effectiveness regardless of how well the screening and monitoring tool itself is configured.

Yes. Where the risk-based assessment or a screening/monitoring alert identifies a customer requiring Enhanced Due Diligence — a Politically Exposed Person, a customer from a higher-risk jurisdiction, or a complex ownership structure — PNPC advises on the additional verification steps, source-of-funds and source-of-wealth documentation, and senior management approval process that EDD requires under UAE AML/CFT regulation, and helps configure the software's case management workflow to capture this documentation properly.

PNPC charges a fixed, agreed advisory fee for the scoping, selection, configuration, and go-live phases of the engagement, scoped to the entity's size, customer volume, and risk complexity, confirmed in writing before work begins. This advisory fee is separate from the software vendor's own licensing cost, which PNPC helps the client evaluate and negotiate but does not itself charge for. Ongoing retainer pricing for periodic review and advisory support is quoted separately once the initial scope is agreed.

That is a legitimate outcome of a proper scoping exercise for a genuinely small, low-volume entity. PNPC can instead help design and document a proportionate manual screening and record-keeping process, along with clear criteria for when the business should revisit the software question as volumes or risk exposure grow. We do not recommend software procurement where the entity's actual documented risk profile does not justify it.

Yes, indirectly but materially. A regulated entity that can demonstrate a properly configured, actively used AML/CFT programme — screening records, monitoring history, case management logs, and clean goAML filing history — presents a materially stronger compliance posture to an acquirer, investor, or banking partner during due diligence than one relying on undocumented manual processes. PNPC can format the AML/CFT programme's documentation specifically for a due diligence data room when a transaction is anticipated.

PNPC's compliance advisory team monitors updates from the Ministry of Economy, the UAE Central Bank, the Financial Intelligence Unit, and relevant free zone regulators, and factors regulatory changes into the periodic effectiveness reviews conducted for clients on an ongoing retainer. Where a regulatory change materially affects screening obligations, reporting timelines, or supervisory expectations, PNPC proactively flags the change and, where relevant, recommends a configuration update.

The first step is a scoping conversation to confirm the entity's regulatory category, the applicable supervisory authority, and whether a documented risk-based assessment, AML/CFT policy, and Compliance Officer appointment already exist. From there, PNPC proposes a sequenced plan — governance and policy foundation first if it is missing, followed by proportionate software selection and configuration — rather than jumping straight to a technology purchase.

Tipping off is the offence of disclosing to a customer, directly or indirectly, that they are or may be the subject of a suspicious transaction report or an ongoing investigation — a prohibition set out under UAE AML/CFT law that applies regardless of the reporting entity's good intentions. Case management workflows must be designed so that alert investigation, escalation, and any subsequent account restriction or relationship review do not reveal to the customer that a report has been or may be filed. PNPC reviews the configured escalation workflow specifically for tipping-off risk — including how customer-facing staff are instructed to behave if a customer questions a delay or additional document request tied to an open investigation.

UAE AML/CFT regulation requires regulated entities to retain customer due diligence records, transaction records, and records relating to any suspicious transaction analysis and reporting for a minimum retention period set out in Federal Decree-Law No. 20 of 2018 and its implementing regulations, generally running for a period of years from the end of the business relationship or the date of the transaction, whichever is relevant — entities should confirm the current prescribed period with PNPC or the relevant supervisor rather than relying on a remembered figure, as retention requirements can be updated. PNPC configures the software's data retention and archival settings to meet this requirement, including ensuring records remain retrievable, not just stored, for the full retention window.

UAE AML/CFT regulation does not universally mandate that screening and monitoring data be hosted on servers physically located within the UAE, but data protection obligations under UAE federal personal data protection law, sector-specific rules (particularly for DIFC and ADGM entities under their own data protection regimes), and any group-level data governance policy can all bear on where customer and transaction data may be hosted and processed. PNPC reviews the proposed platform's hosting location and data protection terms as part of software shortlisting, flagging any residency or cross-border transfer consideration relevant to the client's specific regulatory position.

Software licensing costs vary substantially by platform tier, customer volume, and module selection (screening only versus screening plus full transaction monitoring and case management), and are set and quoted directly by the software vendor — PNPC does not mark up or take commission on licence fees. As a general orientation, a bare sanctions/PEP screening tool sized for a small DNFBP typically sits at the lower end of available platforms, while a full monitoring-and-case-management suite for a higher-volume entity commands a materially higher licence cost. PNPC presents the actual vendor quotes for shortlisted options in writing during the selection phase rather than estimating a figure in the abstract.

Both fall within DNFBP categories under UAE AML/CFT law, but their risk typologies and supervisory touchpoints differ. A DMCC-licensed precious metals and stones dealer typically faces higher cash-intensity risk, specific transaction-value reporting thresholds relevant to the sector, and DMCC's own compliance oversight alongside the federal framework. A mainland real estate broker under Ministry of Economy oversight typically faces lower transaction frequency but higher per-transaction value, with beneficial ownership and source-of-funds scrutiny on property purchases as the dominant risk theme. PNPC calibrates monitoring rules, screening cadence, and the case management workflow to the specific typology profile of the sector, not a generic DNFBP template.

Yes. Where a single licensed entity operates across multiple emirates, or a group has related entities licensed in different free zones (each potentially under a different immediate regulator), PNPC designs a coordinated AML/CFT technology and governance approach that respects each entity's specific supervisory requirements while avoiding duplicated, inconsistent, or contradictory screening and monitoring practices across the group. Centralising the underlying platform where feasible, with entity-specific configuration layers, is often more cost-effective and easier to govern than fully separate systems per licence.

Beyond licence pricing, PNPC reviews proposed vendor contracts for data ownership and portability on termination (can the entity export its full screening and case history if it switches platforms later), service-level commitments on list-update frequency and system uptime, liability and indemnity terms relevant to a compliance-critical system, and any auto-renewal or lock-in clauses that could leave the entity committed to an underperforming platform. These commercial terms sit alongside, not instead of, the configuration and effectiveness questions PNPC evaluates.

Yes, where relevant. AML/CFT software configuration sits within PNPC's broader IT Risk & Technology Assurance practice, and for clients also engaging PNPC for internal audit, IT general controls review, or specialised audit and certification work, the AML/CFT technology environment is assessed as part of that wider control landscape rather than in isolation — avoiding duplicated fieldwork and giving management a single, coherent view of technology-dependent controls across the business.

No. The configured platform generates alerts, structures the case record, and can flag a customer against sanctions or PEP lists, but the decision on whether an alert amounts to genuine suspicion warranting an STR/SAR filing through goAML remains the Compliance Officer's judgment call, informed by the totality of the evidence rather than a system-generated score alone. PNPC's configuration deliberately routes every alert to a named reviewer rather than allowing any auto-close or auto-file rule.

No. goAML registration gives the entity the ability to file STRs/SARs with the FIU, but it says nothing about whether the entity has a documented risk-based assessment, an AML/CFT policy, functioning CDD/EDD procedures, sanctions and PEP screening, staff training, or a working internal escalation process feeding into that portal. PNPC treats goAML registration as one checkpoint within a wider programme, not the finish line, when scoping a software advisory engagement.

Alert thresholds are set against the entity's own transaction and customer data — value bands, payment methods, counterparty patterns, and sector typology — rather than a vendor's generic default. PNPC tests proposed thresholds against a sample of the entity's actual historical activity before go-live specifically to see whether the rule set produces a manageable, genuinely risk-relevant alert volume, then documents the reasoning behind each threshold so it can be defended to an inspector later.

Before any vendor conversation, PNPC confirms the entity's DNFBP or regulated category and supervisory authority, reviews (or helps build) the documented risk-based assessment, and profiles the actual customer base and transaction patterns. Only once that picture exists does PNPC shortlist platforms proportionate to the entity's real exposure, rather than starting from a vendor's feature list.

A configured platform with no accompanying documentation is a fragile deliverable — it cannot show an inspector why thresholds were set the way they were, who approved the configuration, or how the technology maps to the written policy manual. PNPC's engagement produces a configuration record, a calibration log, and an alignment note tying the software to the AML/CFT policy, alongside the working system itself.

Yes. PNPC can review an existing vendor-led configuration, identify gaps against the entity's actual risk profile and current regulatory expectations, and either recalibrate the existing setup or, where the underlying platform genuinely cannot be configured to meet the entity's needs, recommend a considered migration rather than continuing to build on a weak foundation.

Every recommendation is tied to the entity's actual licence activity, customer segment, transaction typology, and existing governance maturity, with an explicit note of what fact — a change in customer base, transaction volume, or supervisory guidance — would change the recommendation. A real estate broker and a precious metals trader receive materially different configuration advice even though both are DNFBPs.

PNPC recommends retaining the risk-based assessment used to size the platform, the configuration and threshold rationale, testing results from the pre-go-live calibration, training records for the Compliance Officer and relevant staff, the policy-alignment review, and any correspondence with the supervisory authority — alongside the standard screening, case-management, and STR/SAR records the software itself retains.

The registered Compliance Officer / MLRO should sign off on the configuration and workflow, since they carry personal accountability for the programme's operation, with senior management or the board acknowledging the overall setup and its resourcing implications where the entity's governance structure requires that level of sign-off.

No. PNPC controls the pace of its own scoping, configuration, and testing work, but overall timing also depends on the entity's existing governance readiness (whether a risk assessment and Compliance Officer are already in place), vendor implementation support, and the volume of historical data available for testing — all factors PNPC flags early rather than committing to a fixed date before scoping is complete.

PNPC recommends a full configuration and effectiveness review at least annually, and additionally whenever the entity's customer base, transaction volumes, or geographic exposure changes materially, a new typology emerges in the sector, or UAE AML/CFT regulatory guidance is updated. Day-to-day alert monitoring is continuous, but the underlying rule set and screening parameters should not simply run untouched between reviews.

The handover pack includes the configuration record (screening sources, sensitivity settings, monitoring thresholds and the rationale behind them), the pre-go-live testing results, the policy-alignment note tying the software to the written AML/CFT manual, training records for the Compliance Officer and relevant staff, and a calendar for the post-go-live calibration review and subsequent periodic effectiveness reviews.

AML/CFT software advisory covers technology selection, configuration, testing, and workflow design; it does not extend to conducting the entity's underlying risk-based assessment from scratch as a separate statutory deliverable, providing regulated investment or legal advice, or acting as the entity's registered Compliance Officer. PNPC states these boundaries in writing at the outset so the engagement is not mistaken for a broader compliance-outsourcing or regulated-advisory service.

Yes, where needed. If the entity requires bespoke software development or deep technical integration work beyond configuring an existing platform, or if a specific legal question arises about the entity's regulatory scope, PNPC coordinates with the relevant licensed IT integrator or legal specialist while continuing to own the overall AML/CFT advisory and configuration relationship.

Delay after a documented inspection finding typically narrows the entity's options: a supervisor expecting remediation within a set timeframe leaves less room for a considered software selection process, increasing the risk of a rushed, poorly configured deployment or, in more serious cases, escalation to formal enforcement action under Federal Decree-Law No. 20 of 2018. PNPC prioritises finding-driven engagements precisely because the remediation clock is already running when the request reaches us.

PNPC confirms the entity's licence activity and DNFBP or regulated category, identifies the relevant supervisory authority, asks whether a documented risk-based assessment and appointed Compliance Officer already exist, and gets a first-pass picture of customer volume and transaction profile. This determines whether the engagement starts with governance foundation work or moves straight to software shortlisting.

PNPC flags this as a governance gap to close before or alongside the technology work — a configured platform with no appointed, registered Compliance Officer to review its alerts is a control on paper, not a control in practice. PNPC can support the entity in scoping the Compliance Officer role and initial policy documentation in parallel with software shortlisting so both land together at go-live.

Not without review. A new business line or customer segment can introduce risk typologies the original configuration was never designed to catch — cash-intensive activity, a new geography, or a different customer profile. PNPC reassesses the risk-based assessment and, where needed, extends screening sources and monitoring rules to cover the new exposure rather than assuming the existing setup automatically scales.

A well-configured, actively used AML/CFT programme — documented screening history, case management records, and a clean goAML filing history — is evidence an acquirer or investor's due diligence team increasingly expects to see from a regulated UAE entity. PNPC can format the existing configuration records and effectiveness reviews specifically for a due diligence data room when a transaction is anticipated.

Almost always, yes. High false-positive rates on common names usually trace to match sensitivity (fuzzy-matching thresholds) left at the vendor's cautious default, no secondary identifiers (date of birth, nationality, identifier numbers) being used to disambiguate, and no documented process for clearing a false match. PNPC recalibrates the match thresholds against the entity's real customer base, configures the tool to weigh secondary identifiers, and — critically — documents the clearance rationale for each dismissed match so the decision is defensible rather than looking like an alert quietly ignored.

Yes, and this is one of the most consequential record-keeping points. A decision not to file is itself a compliance decision the MLRO must be able to justify later. The case-management record should capture the alert, the evidence reviewed, the reasoning, and the named person who decided the activity did not meet the suspicion threshold — with the same discipline as a decision to file. Under Federal Decree-Law No. 20 of 2018 and its implementing regulations, CDD and transaction records tied to that analysis must be retained for the prescribed period, and PNPC configures the software so a 'no-file' disposition produces a retained, retrievable record rather than simply closing the alert with no trace.