AML/CFT Software Advisory & Setup: What It Actually Involves

AML/CFT Software Advisory & Setup: What It Actually Involves

AML/CFT Software Advisory & Setup helps UAE Designated Non-Financial Businesses and Professions (DNFBPs), financial institutions, and other regulated entities select, configure, and embed the right anti-money-laundering and counter-terrorism-financing technology into their day-to-day compliance workflow — not just install a tool and leave the policy manual untouched. The UAE's AML/CFT framework under Federal Decree-Law No. 20 of 2018 (as amended) and its Cabinet Decision implementing regulations requires real customer screening, real transaction monitoring, and real suspicious transaction reporting through the goAML platform — obligations that a spreadsheet and manual judgement calls struggle to meet consistently once transaction volumes grow.

What This Actually Covers

AML/CFT Software Advisory & Setup is the practice of assessing a regulated UAE entity's money-laundering and terrorist-financing risk profile, then selecting, configuring, and operationalising the screening, monitoring, and reporting technology needed to meet its obligations under UAE AML/CFT law. The UAE framework rests on Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations (as amended by subsequent decree-laws), its Cabinet Decision executive regulations, and sector-specific guidance issued by the relevant supervisory authority — the UAE Central Bank for banks, insurers, and finance companies; the Securities and Commodities Authority (SCA) for capital markets participants; the Ministry of Economy for Designated Non-Financial Businesses and Professions (DNFBPs) operating on the mainland; and individual free zone authorities (including DMCC for precious metals and stones traders, DIFC and ADGM through their own regulators) for entities licensed within their jurisdictions.

For the full scope, current process and what PNPC includes, see the dedicated AML/CFT Software Advisory & Setup service page.

Signs This Applies to You

• The business is a Designated Non-Financial Business or Profession (DNFBP) under UAE law — real estate brokers and agents, dealers in precious metals and stones, company service providers, independent lawyers, notaries, and accountants providing specified services — and is legally required to maintain an AML/CFT programme, including screening and monitoring capability
• The business is currently relying on manual sanctions-list checks (spreadsheet lookups, ad hoc web searches) that cannot keep pace with list updates, growing customer volumes, or a supervisory inspection's expectation of a documented, repeatable screening process
• A supervisory authority inspection, external auditor, or bank has flagged the absence of automated screening or monitoring as a control gap, or the business has received a finding requiring remediation within a specified timeframe
• Transaction volumes or customer numbers have grown to the point where manual review of every transaction for suspicious patterns is no longer realistic, and a risk-scoring or rules-based alert system is needed to prioritise the compliance officer's attention

Before You Assume You Need This

• The business has not yet completed its own documented AML/CFT risk assessment and does not have a Compliance Officer or AML/CFT policy in place — software selection should follow the risk assessment and policy design, not precede it, since the risk assessment determines what the software actually needs to screen and monitor for
• A very small, low-transaction-volume DNFBP where a well-documented manual screening and record-keeping process, reviewed periodically by PNPC, may satisfy the risk-based proportionality principle at the current scale, with software introduced as volumes grow
• The business is not a DNFBP or otherwise regulated entity under UAE AML/CFT law and has no supervisory obligation to maintain AML/CFT controls — in this case, the priority is confirming regulatory scope, not procuring software

Questions We're Actually Asked

Which UAE businesses are actually required to have AML/CFT screening and monitoring in place?

Under UAE Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations, obligations extend beyond banks and financial institutions to Designated Non-Financial Businesses and Professions (DNFBPs) — real estate brokers and agents involved in property transactions, dealers in precious metals and stones above specified transaction thresholds, company service providers (including those forming companies, acting as registered agents, or providing nominee director/shareholder services), independent lawyers and notaries when conducting specified financial or property transactions on a client's behalf, and accountants providing specified services. The exact obligations and their intensity depend on the entity's specific activity and its own documented risk-based assessment.

Do I need software, or can I meet AML/CFT obligations with a well-documented manual process?

For a very small, low-volume DNFBP, a well-documented and consistently applied manual screening and record-keeping process can, in principle, satisfy the risk-based proportionality principle underpinning UAE AML/CFT regulation. In practice, manual processes struggle to keep pace with continuously updated sanctions and PEP lists, and become genuinely difficult to defend under inspection once transaction or customer volume grows. PNPC assesses proportionality as part of the initial scoping — we do not recommend software procurement as a default answer for every entity regardless of scale.

What is goAML and does my business need to register on it?

goAML is the electronic platform operated by the UAE's Financial Intelligence Unit (FIU), housed within the UAE Central Bank, through which regulated entities file Suspicious Transaction Reports (STRs), Suspicious Activity Reports (SARs), and other statutory AML/CFT disclosures. Entities falling within scope of UAE AML/CFT law — including DNFBPs — are generally required to register on goAML and designate a Compliance Officer authorised to file reports through the platform. PNPC coordinates registration for entities not yet registered and, for those already registered, ensures the internal alert workflow maps cleanly to the goAML filing process.

Getting This Right From the Start

Talk to PNPC's Dubai compliance team before your next inspection or your next platform renewal — an AML/CFT technology setup sized to your actual risk profile, not a vendor's default configuration.

PNPC Global has advised Dubai businesses since 1986. Explore the full Business Transformation & Technology Consulting practice for related services, or go straight to the AML/CFT Software Advisory & Setup page for specifics.

Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.