AML/CFT Risk Assessment & Customer Risk Profiling

A DNFBP is a business category identified under the UAE's AML/CFT Implementing Regulation as carrying elevated money-laundering risk despite sitting outside the traditional financial sector. The categories typically include real estate brokers and agents, dealers in precious metals and stones (above prescribed cash-transaction thresholds), corporate service providers (including company formation agents and registered agents), independent auditors, and independent legal and accounting professionals when carrying out specified activities such as managing client funds or acting on behalf of a client in a financial transaction. Whether your specific licensed activity falls within scope depends on the precise nature of the services you provide, not just your trade licence category name.

Yes. The obligation to maintain a documented, risk-based AML/CFT programme — including an Enterprise-Wide Risk Assessment, Customer Due Diligence procedures, and an appointed MLRO — applies to obliged entities regardless of whether any suspicious activity has ever actually occurred. The framework is preventive by design: it exists to detect and deter money laundering and terrorist financing before it happens, and regulators inspect for programme adequacy independent of whether an incident has occurred.

An Enterprise-Wide Risk Assessment (also called a Business Risk Assessment) is a documented evaluation of the specific money-laundering and terrorist-financing risks your business is exposed to, assessed across customer types, products and services, delivery channels, and geographies. A generic AML policy states abstract legal obligations; an Enterprise-Wide Risk Assessment applies those obligations to your actual book of business and produces a risk rating that drives everything downstream — how due diligence intensity is calibrated, which customers require Enhanced Due Diligence, and where monitoring resources are concentrated.

Customer Risk Profiling is the methodology by which each customer is scored against defined risk factors — ownership complexity, PEP status, transaction geography, cash-intensity, source-of-funds clarity, and the nature of the products or services used — and assigned a rating, typically low, medium, or high. That rating then determines the applicable due diligence tier: Simplified Due Diligence for genuinely low-risk relationships meeting prescribed conditions, Standard Customer Due Diligence for the majority of relationships, and Enhanced Due Diligence for higher-risk categories, which requires additional verification steps such as source-of-wealth confirmation and senior management approval before onboarding.

A Politically Exposed Person is an individual who holds, or has held, a prominent public function — senior government officials, judiciary members, senior military officers, senior executives of state-owned enterprises, and senior political party officials — along with their immediate family members and known close associates. PEP status does not prohibit a business relationship, but it mandates Enhanced Due Diligence: additional identity and source-of-wealth verification, senior management approval before onboarding, and more frequent ongoing monitoring, because of the elevated corruption and money-laundering risk historically associated with this customer category.

The MLRO is the individual formally designated to receive internal reports of suspicious activity, decide whether the threshold for filing a Suspicious Transaction Report or Suspicious Activity Report is met, and file that report through the goAML platform. The role requires genuine independence — the MLRO must be able to file an STR/SAR without requiring prior approval from business management, since requiring sign-off would defeat the purpose of the safeguard. The person appointed should have sufficient seniority, access to relevant information across the business, and — ideally — direct reporting access to senior management or the board.

goAML is the reporting platform operated by the UAE's Financial Intelligence Unit through which obliged entities and their MLROs file Suspicious Transaction Reports, Suspicious Activity Reports, and certain other statutory reports. Registration on the platform is generally expected of obliged entities as part of a functioning AML/CFT programme, independent of whether a report has ever actually been filed — the readiness to report promptly, if the need arises, is itself part of what a compliant programme demonstrates.

Once a staff member identifies a transaction or customer pattern that raises genuine suspicion, it is escalated internally to the MLRO under the documented procedure. The MLRO assesses whether the pattern meets the statutory threshold for filing a Suspicious Transaction Report or Suspicious Activity Report, and if so, files it through goAML. Critically, the customer must not be informed that a report has been made or is being considered — this 'tipping off' prohibition is a separate offence under the Federal Decree-Law, independent of the underlying suspicion itself.

The Enterprise-Wide Risk Assessment should be reviewed on a defined periodic cycle — commonly annually — and refreshed immediately whenever a material trigger event occurs: a new product or service line, a new delivery channel, expansion into a new customer geography, a materially changed customer base, or new Ministry of Economy or FATF guidance that changes the risk landscape. A static risk assessment that has not been revisited in several years, regardless of business changes, is a common and easily identified inspection finding.

The Implementing Regulation empowers the Ministry of Economy (for DNFBPs) and the relevant financial regulator (for licensed financial entities) to impose administrative sanctions for non-compliance, which can include financial penalties, formal warnings, suspension or restriction of licensed activities, and in serious or repeated cases, licence revocation. The severity of the sanction generally scales with the nature and persistence of the breach — an isolated documentation gap is treated differently from a systemic failure to conduct due diligence or a failure to report a genuinely suspicious transaction. Specific penalty amounts are prescribed by Cabinet Decision and are subject to periodic revision; PNPC advises on the current position rather than quoting a fixed figure that may have since changed.

AML/CFT and ESR are separate regulatory frameworks, administered under different legal instruments — AML/CFT under Federal Decree-Law No. 20 of 2018 and its Implementing Regulation, ESR under Cabinet Decision No. 57 of 2020 — and historically applied to many of the same entities, drawing on overlapping corporate and ownership information. Importantly, ESR Notification and Report filing was discontinued for financial years starting on or after 1 January 2023 under Cabinet Decision No. 98 of 2024, so ESR is no longer a live, ongoing annual filing obligation for current financial years. A corporate service provider today is typically a DNFBP subject to active AML/CFT obligations, while any ESR relevance is now confined to closing out pre-2023 financial year positions or responding to a historical enquiry. PNPC coordinates AML/CFT work with any residual ESR record-keeping or historical query where relevant, rather than treating current-year ESR as an active parallel filing.

AML/CFT obligations apply based on the nature of the licensed activity and the supervising authority, not on mainland versus free zone status. A free zone company carrying on a DNFBP-category activity — for example, a free zone corporate service provider or a free zone real estate brokerage — is subject to the same federal AML/CFT framework as its mainland equivalent, generally supervised by the Ministry of Economy unless the free zone itself is a financial free zone (such as DIFC or ADGM) with its own dedicated financial regulator applying an equivalent but separately administered regime.

Enhanced Due Diligence (EDD) is a heightened level of Customer Due Diligence applied to relationships assessed as higher risk — including PEPs, customers connected to jurisdictions identified by FATF as having strategic AML/CFT deficiencies, relationships involving complex or non-transparent beneficial ownership structures, and cash-intensive or high-value transactions above the thresholds relevant to your DNFBP category. EDD typically requires additional identity verification, source-of-wealth and source-of-funds documentation, senior management approval before the relationship is accepted, and more frequent ongoing monitoring than a standard-risk relationship receives.

UAE obliged entities are expected to screen customers and counterparties against the UAE's Local Terrorist List, maintained pursuant to Cabinet Decision, and the United Nations Security Council Consolidated List, which the UAE gives domestic effect to under its targeted financial sanctions framework. A positive or partial match requires immediate escalation and, where confirmed, freezing of funds and reporting obligations under the targeted financial sanctions regime — a materially different and faster process than a standard STR filing.

The Implementing Regulation prescribes minimum record-retention periods for CDD documentation, transaction records, and risk assessment files, generally running from the end of the business relationship or the date of the transaction, whichever the specific record type requires. Records must be available for prompt production to the supervisory authority on request — an obligation that in practice requires organised, retrievable filing, not merely retention in principle.

PNPC supports clients extensively in building the MLRO function, training the appointed individual, and providing ongoing guidance on suspicious activity assessment — but the MLRO role itself generally needs to sit with someone embedded in the business, with direct access to customer and transaction information and the authority the role requires. Some regulatory frameworks and free zone regulators do permit outsourced or shared MLRO arrangements under specific conditions; where that structure is appropriate and permitted for a client's specific licence and regulator, PNPC discusses it as part of scoping rather than assuming it is available by default.

Both are reports filed through goAML to the UAE Financial Intelligence Unit, and the two terms are often used close to interchangeably in UAE guidance, though 'Suspicious Transaction Report' typically refers to a report tied to a specific transaction, while 'Suspicious Activity Report' can capture a broader pattern of activity or behaviour that raises concern even without a single identifiable transaction. In either case, the filing obligation and the tipping-off prohibition apply equally.

Yes, materially. Real estate transactions carry distinct risk indicators — high-value cash purchases, third-party or nominee buyers, and rapid resale patterns — while corporate service providers face risks concentrated around beneficial ownership opacity, shell company formation, and nominee director/shareholder arrangements. The Enterprise-Wide Risk Assessment and Customer Risk Profiling methodology for each DNFBP category should be built around the risk indicators genuinely relevant to that specific business, not a single undifferentiated template applied across categories.

Simplified Due Diligence (SDD) is a reduced level of Customer Due Diligence permitted for relationships genuinely assessed as low risk under prescribed conditions — for example, certain regulated public entities or listed companies subject to disclosure requirements that provide adequate transparency by themselves. SDD is not a default or a shortcut; it is only available where the risk assessment specifically supports it, and it does not remove the obligation to identify the customer and understand the nature of the relationship — it reduces the intensity, not the requirement, of due diligence.

PNPC has an operating Dubai office and offices across India, giving us direct visibility into both jurisdictions' compliance frameworks for clients whose ownership, customers, or fund flows span both countries. On the UAE side, we build the DNFBP-appropriate AML/CFT programme under Federal Decree-Law No. 20 of 2018. Where the same group has Indian entities or Indian-resident beneficial owners, we coordinate the UAE risk assessment with the disclosures and source-of-funds documentation that may also be relevant to Indian FEMA and RBI reporting for the same underlying ownership structure — under one engagement rather than two disconnected advisors working from incomplete pictures of each other's requirements.

A template policy document alone does not constitute a compliant programme. Ministry of Economy and financial free zone inspections test whether the risk assessment reflects the business's actual customers and transactions, whether CDD has genuinely been applied and documented at the intensity the risk rating requires, whether the MLRO function operates with real independence, and whether staff have been trained. A policy document that has never been operationalised — no risk-rated customer files, no MLRO with real authority, no training records — fails inspection regardless of how professionally the document itself reads.

Inspections can be routine and risk-based (as part of the Ministry's ongoing supervisory programme across DNFBP categories), or triggered by specific concerns — a whistleblower report, information from another regulator or financial institution, or patterns identified through the FIU's own analysis. Because routine inspections are not always predictable, the practical position for any DNFBP is to maintain an inspection-ready programme continuously rather than treating readiness as something to assemble only once an inspection notice arrives.

PNPC scopes and quotes a fixed, agreed fee for the initial programme build — covering the Enterprise-Wide Risk Assessment, Customer Risk Profiling methodology, Policies and Procedures Manual, MLRO support, and goAML registration — confirmed in writing before work begins. Existing customer file remediation is typically scoped separately once the size and risk complexity of the customer book is known, since remediation effort scales with book size in a way the initial programme build does not. Ongoing annual review and MLRO support are offered as a retainer.

A group-level Enterprise-Wide Risk Assessment methodology and a shared Policies and Procedures framework can often be designed once and adapted across related entities under common ownership and management, which is more efficient than building each entity's programme in isolation — but each licensed entity still needs its own entity-specific risk assessment output, its own designated MLRO function (which can, in appropriate structures, be a shared individual across group entities where permitted), and its own customer file discipline, since each entity is separately supervised and separately accountable at inspection.

Beneficial ownership transparency — understanding who ultimately owns or controls a customer, beyond the nominal or corporate shareholder on record — is a core input into Customer Risk Profiling. A customer with a simple, transparent ownership structure is generally lower risk on this dimension than one with layered corporate entities, nominee shareholders, or ownership routed through jurisdictions with weak corporate transparency requirements. This overlaps directly with the UBO register obligation applicable to most UAE entities, and PNPC's AML/CFT engagement typically draws on the same UBO documentation gathered for that separate filing.

PNPC's engagement does not end at policy delivery. We provide the annual Enterprise-Wide Risk Assessment refresh, support for onboarding new higher-risk customers requiring Enhanced Due Diligence, real-time guidance to the MLRO when a genuine suspicious-activity question arises, updates to the programme when Ministry of Economy or FATF guidance changes, and support producing the documentation pack promptly if an inspection notice arrives.

Corporate service providers offering nominee director, nominee shareholder, or registered agent services sit at a particularly sensitive point in the AML/CFT framework, because these services can — deliberately or inadvertently — be used to obscure genuine beneficial ownership. The risk assessment for this category needs specific attention to know-your-client procedures on the underlying principal (the person actually instructing the nominee arrangement), documented understanding of why a nominee structure is being used, and enhanced ongoing monitoring of entities administered under such arrangements.

Independent accountants and auditors are typically captured within DNFBP scope specifically when performing certain activities on behalf of a client — such as managing client money, securities, or other assets, managing bank or securities accounts, or acting on behalf of a client in relation to the creation, operation, or management of a company. Routine bookkeeping or statutory audit work performed without exercising that kind of client-fund or transaction control may sit outside the narrower DNFBP trigger, but the boundary depends on the exact scope of services provided and should be confirmed rather than assumed.

Common red flags include: a customer reluctant to provide standard identification or beneficial ownership information, transactions structured just below reporting or verification thresholds, unusual urgency with no clear business rationale, payment from or to a party unrelated to the underlying transaction, use of cash for transactions where electronic payment would be the norm, and counterparties connected to jurisdictions with weak AML/CFT regimes. The specific red-flag list should be tailored to the DNFBP category — real estate red flags differ materially from corporate service provider red flags.

Yes. We support clients who are already facing an active inspection or a specific regulatory query — assessing the gap between the existing programme and what is being requested, compiling and organising the documentation that does exist, remediating urgent gaps where time allows, and supporting the client's formal response. This work is more constrained by the compressed timeline than a proactive engagement, but a documented, honest effort at remediation generally supports a materially better outcome than an unaddressed gap.

Where an e-commerce or online business falls within DNFBP scope — for example, an online real estate portal facilitating brokerage, or a corporate service provider operating primarily through a digital onboarding flow — the remote, non-face-to-face delivery channel is itself a risk factor that the Enterprise-Wide Risk Assessment needs to address specifically: how identity is verified without in-person contact, how document authenticity is confirmed, and what additional verification steps compensate for the absence of a face-to-face relationship.

Banks apply their own Know Your Customer standards under Central Bank of the UAE guidance, which overlap substantially with — but are not identical to — the CDD documentation a DNFBP builds for its own AML/CFT programme. A well-documented internal AML/CFT programme, with clean beneficial ownership records and source-of-funds documentation already on file, materially eases a bank's own KYC review and account-opening or account-maintenance process, since much of the same underlying documentation satisfies both purposes.

A newly licensed DNFBP has the advantage of building the Enterprise-Wide Risk Assessment, Customer Risk Profiling methodology, and CDD discipline into its operating process from day one — every customer onboarded from the start is captured under the correct methodology. An established business with an existing customer book faces the additional file remediation exercise of retrofitting risk ratings and CDD onto customers who were onboarded before a proper programme existed, which is materially more effort but equally necessary.

The Financial Action Task Force (FATF) is the global standard-setting body for AML/CFT policy, and the UAE is a member jurisdiction whose domestic framework — Federal Decree-Law No. 20 of 2018 and its Implementing Regulation — is designed to align with FATF's 40 Recommendations. FATF also periodically identifies jurisdictions with strategic AML/CFT deficiencies (commonly referred to informally as 'grey list' or 'black list' status), and transactions or customers connected to such jurisdictions are treated as a specific elevated risk factor within UAE Customer Risk Profiling methodologies.

goAML registration and the underlying risk assessment/policy build are not sequential in the sense of one blocking the other, but PNPC generally advises registering the entity and its proposed MLRO on goAML early in the engagement rather than waiting for the full Policies and Procedures Manual to be finalised. This gives the MLRO time to become familiar with the platform before the first live filing decision, and demonstrates to an inspector that platform readiness was addressed as part of the programme build rather than as an afterthought once a suspicious pattern had already arisen.

Both regimes trace back to the same underlying UAE AML/CFT policy objectives, but they are administered differently. DNFBPs outside a financial free zone are supervised by the Ministry of Economy under the federal Implementing Regulation issued under Cabinet Decision No. 10 of 2019. Entities licensed within the DIFC or ADGM are instead supervised by the DFSA or FSRA respectively, each of which issues its own AML rulebook modules that are broadly equivalent in substance — risk assessment, CDD/EDD, MLRO, sanctions screening, STR/SAR reporting — but differ in specific documentation, reporting templates, and supervisory expectations.

AML/CFT screening and monitoring software can meaningfully support a programme — automating sanctions and PEP list checks, flagging transaction patterns for review, and maintaining an audit trail — but it does not substitute for the judgment involved in scoping the Enterprise-Wide Risk Assessment to the business's actual risk exposure, designing a defensible Customer Risk Profiling methodology, or deciding whether a flagged pattern genuinely meets the STR/SAR threshold. Software is a control and workflow aid; the risk assessment, the scoring methodology, and MLRO decision-making remain professional judgment calls that a tool cannot make on the entity's behalf.

These are treated as two distinct workstreams under one coordinated engagement. The AML/CFT Risk Assessment and Customer Risk Profiling build proceeds on its own timeline as an active, ongoing obligation. Any residual pre-2023 Economic Substance Regulations matter — for example, an unresolved Notification or Report for a financial year ending on or before 31 December 2022, or a historical enquiry from the Ministry of Finance — is scoped and closed out separately as a historical matter, since ESR Notification/Report filing was discontinued for financial years starting on or after 1 January 2023 under Cabinet Decision No. 98 of 2024 and is not an ongoing current-year filing requirement.

In practice, an inspector checks whether the intensity of due diligence applied to a given customer file is consistent with that customer's documented risk rating — not whether every file received the maximum level of scrutiny. A low-risk customer file with Simplified Due Diligence applied and clearly documented reasoning for that rating is a compliant outcome; so is a PEP file with Enhanced Due Diligence, senior management sign-off, and enhanced monitoring evidence. What fails inspection is either applying the same shallow checklist to every customer regardless of risk, or applying a low-risk treatment to a customer whose risk factors clearly warranted a higher rating.

The entity itself, and specifically its appointed MLRO and senior management, carry the statutory compliance responsibility under Federal Decree-Law No. 20 of 2018 and its Implementing Regulation — this cannot be outsourced or transferred to an external advisor. PNPC's role is to build a defensible, business-specific programme, train the people who operate it, and remain available for ongoing guidance, but the day-to-day application of CDD, the MLRO's STR/SAR decisions, and the entity's overall accountability to the Ministry of Economy or its supervisory authority rest with the licensed entity.

Ministry of Economy and financial free zone inspections are sample-based, not exhaustive — an inspector typically requests a spread of files deliberately weighted toward your higher-risk ratings (PEP relationships, high-value or cash-intensive customers, complex ownership) because that is where under-scoped due diligence does the most damage. A programme that looks clean across low-risk files but falls apart on the two or three genuinely high-risk relationships tends to score worse than one with minor cosmetic gaps evenly spread, because the inspector reads a weak high-risk file as evidence the risk-based methodology is not really being applied where it matters most.

In many DNFBP structures a single suitably senior individual can hold both the general compliance officer role and the MLRO function, provided the person has the independence, seniority, and unfiltered access to customer and transaction information that the MLRO role specifically requires, and provided the combined workload does not compromise either function. What does not work is a nominal split where an MLRO is named on the org chart but the real decisions sit with someone else, or a combined role held by someone too junior to challenge senior management. Some financial free zone rulebooks are more prescriptive about separation and seniority than the federal DNFBP regime, so the answer partly depends on which regulator supervises you.

A defensible score is built from weighted factors — customer type, beneficial-ownership complexity, PEP status, the geographies the customer and its funds touch, cash-intensity, product or service used, and delivery channel — each with documented criteria that map to a low, medium, or high band. The way you stop grade inflation is by making the methodology deterministic rather than discretionary: certain factors (a PEP connection, a FATF-listed jurisdiction, an opaque ownership chain) force a minimum rating regardless of the composite score, so a front-line user cannot quietly rate a high-risk customer 'low' to avoid the EDD workload. The scoring logic, not individual staff judgment in the moment, is what an inspector tests against your actual files.

File remediation scales with the size and risk mix of the book, not with a fixed calendar — a few hundred low-complexity files is a different exercise from a smaller book heavy with PEPs and layered corporate structures. In practice we run remediation in risk-priority order so the highest-risk files close first, meaning your worst exposure is addressed in the early weeks even if the full book takes longer. You can and should keep onboarding new clients during remediation, because new clients go straight onto the corrected methodology from day one — it is the legacy files onboarded under no proper process that need the retrofit.

No. If you cannot identify and verify the ultimate beneficial owner and understand the ownership and control structure, you cannot complete Customer Due Diligence, and the framework requires you to decline or terminate the relationship rather than substitute 'extra monitoring' for identification you never obtained. Enhanced monitoring is a tool for higher-risk relationships you can identify, not a workaround for a customer who will not let you identify them at all — and a persistent refusal to disclose beneficial ownership is itself a red flag that should prompt the MLRO to consider whether an STR is warranted, independent of whether you take the customer on.

They draw on the same underlying ownership information but serve different purposes and are not interchangeable. The UBO register filed with your licensing authority under Cabinet Decision No. 58 of 2020 records who ultimately owns or controls your own entity; the AML/CFT CDD file records your understanding of who ultimately owns or controls each customer. The overlap is real — the same shareholder charts, passports, and control analysis often feed both — which is why we gather the documentation once and apply it to both obligations, but the customer-side beneficial ownership analysis is the larger and more continuous piece of work.

We start with a diagnostic rather than adoption: we test whether the inherited Enterprise-Wide Risk Assessment actually reflects the current customer base and product mix, whether the Customer Risk Profiling methodology was ever applied to real files or just documented, whether the named MLRO holds the role with genuine authority, and whether goAML registration and screening are live. Very often an inherited programme is a well-written binder with no operating evidence behind it — clean policy, empty file room — in which case adopting it wholesale would mean inheriting its inspection risk. We tell you honestly whether it can be built on or needs rebuilding from the risk assessment up.

The bulk of the programme — the Enterprise-Wide Risk Assessment, methodology design, policy drafting, sanctions and PEP screening configuration, file remediation, and MLRO training — is coordinated remotely through secure document exchange and video sessions. What tends to need local presence is the practical side of goAML registration (which is tied to UAE-registered credentials and often the entity's establishment card), any in-person identity verification your CDD process relies on for non-face-to-face customers, and coordination with a UAE bank's own KYC team. PNPC's operating Dubai office handles those on-the-ground touchpoints rather than treating the whole engagement as fully virtual.

The administrative penalty is often the smallest cost. A template programme that fails inspection typically triggers a remediation deadline under supervisory pressure, meaning you rebuild the entire risk assessment and remediate the full customer book under a compressed regulatory timeline rather than a planned one — more expensive and more disruptive than building it properly the first time. Beyond that, a flagged AML/CFT deficiency can surface in your bank's periodic KYC refresh and in any acquirer's or lender's due diligence, and correspondent-banking sensitivity means an AML finding can jeopardise account relationships in a way a fine never shows on paper.

The two regimes are separate, but the underlying data overlaps in useful ways. The beneficial-ownership and control mapping you build for AML/CFT Customer Risk Profiling often clarifies related-party and connected-person relationships that also matter for Corporate Tax transfer-pricing and disclosure under Federal Decree-Law No. 47 of 2022, and clean CDD source-of-funds records support the substance-over-form position a tax file may later need. PNPC flags these touchpoints where they exist rather than running AML/CFT in a silo, but we are clear that a strong AML file does not by itself discharge any Corporate Tax obligation — they are aligned, not merged.

Sanctions screening has to run against the current UAE Local Terrorist List and the live UN Security Council Consolidated List, both of which are updated on no fixed schedule, and FATF's list of jurisdictions under increased monitoring changes at its plenary cycles. A programme screening against a snapshot taken months ago will clear a customer who has since been listed, or will treat a jurisdiction as normal-risk after FATF has flagged it — either of which is a live, findable gap at inspection. That is why re-screening the existing book, not just screening at onboarding, is a core part of the control rather than an optional extra.

Single-jurisdiction advisors tend to build a UAE-side Customer Risk Profiling methodology that treats the Indian end of the ownership or fund-flow chain as a black box — so an Indian-resident beneficial owner, an Indian source of funds, or an inbound remittance gets a generic 'foreign' rating rather than a properly evidenced one. PNPC's Dubai and India offices let us evidence both ends of the chain: the UAE customer risk assessment reflects what the Indian ownership actually looks like, and where the same fund flows touch Indian FEMA or RBI reporting for the underlying owner, the two files tell one consistent story rather than contradicting each other.

The pack an inspector or free zone supervisor requests is specific: the dated Enterprise-Wide Risk Assessment, the Policies and Procedures Manual, the MLRO appointment and mandate records, a sample of CDD files spanning low, medium, and high risk ratings, sanctions and PEP screening logs, training attendance records, and any STR/SAR filing records. In practice you are expected to produce this promptly on request, not assemble it over weeks — which is the whole point of maintaining it as a live, organised file rather than reconstructing it from scattered emails once a notice arrives. PNPC keeps the pack indexed and current so production is retrieval, not a fire drill.

Compliance programme design, risk assessment, CDD/EDD methodology, MLRO support, and inspection readiness sit squarely within PNPC's advisory scope. The line is crossed when law enforcement or the Public Prosecution opens a criminal investigation, when the matter becomes contentious litigation, or when a specific STR/SAR decision needs privileged legal opinion on criminal exposure — at those points you need UAE-licensed legal counsel, and our compliance work supports but does not replace them. We flag that boundary early rather than letting an advisory engagement drift into territory that requires a lawyer.

Before handover we test the programme the way an inspector would: we sample-check that customer files actually carry ratings consistent with the documented methodology, that every high-risk file has the EDD steps its rating demands, that the MLRO mandate genuinely confers independent authority, that goAML registration and screening are live rather than planned, and that training and screening logs exist and are current. Where anything is documented but not yet operating, we flag it as an open item rather than presenting the programme as inspection-ready, because a QC pass that only checks the policy reads well repeats the exact failure that template programmes fail on.