A Practical Guide to AML Risk Assessment
AML Risk Assessment is the foundation document every other piece of a UAE AML/CFT programme is built on — the written, entity-specific evaluation of customer risk, geographic risk, product/service risk, and delivery-channel risk that Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations require every Designated Non-Financial Business and Profession and regulated financial entity to hold and keep current. Without a documented risk assessment, everything downstream — CDD calibration, enhanced due diligence triggers, screening cadence, staff training scope, even the goAML registration itself — sits on an assumption rather than an assessed fact.
What This Actually Covers
An AML/CFT risk assessment is the documented process by which a UAE entity identifies, analyses, and rates its exposure to money laundering, terrorist financing, and proliferation financing risk, and uses that rating to calibrate the rest of its compliance programme. The obligation is set out in Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism, as amended, together with Cabinet Decision No.
For the full scope, current process and what PNPC includes, see the dedicated AML Risk Assessment service page.
When You'd Need This
- Your business is a newly licensed DNFBP — real estate brokerage or development, dealing in precious metals and stones above the prescribed cash threshold, corporate service provision, independent legal or accounting practice — and has not yet documented a risk assessment ahead of onboarding its first customers
- You are registering, or preparing to register, on the goAML platform and need the risk assessment that should sit behind (or alongside) that registration, not a bare portal sign-up with nothing supporting it
- Your existing risk assessment was written at incorporation and has never been revisited, while your customer base, product mix, or jurisdiction exposure has since changed materially
- You have received a Ministry of Economy, Central Bank, DFSA, FSRA, or VARA inspection notice or finding that specifically flags an absent, outdated, or generic risk assessment
When It Isn't the Right Fit
- You already have a current, well-documented risk assessment and specifically need the CDD onboarding procedures, screening design, or staff training built around it — that sits under KYC & Customer Due Diligence Advisory rather than a fresh risk assessment
- You need the goAML portal registration itself completed with credentials issued — that is the mechanical registration step, though PNPC generally recommends the risk assessment accompany or precede it rather than standing alone
- Your business does not fall within any DNFBP, financial institution, or VASP category under UAE AML law — confirm applicability first through a scoping call before commissioning a formal risk assessment
Questions We're Actually Asked
What exactly is an AML risk assessment, and how is it different from an AML policy?
The risk assessment is the analytical document that identifies and rates the entity's exposure to money laundering and terrorist financing risk across customer, geographic, product, and delivery-channel dimensions. The AML policy is the procedural document that sets out what the entity does in response to that risk — CDD steps, screening cadence, escalation procedures. ' A policy without a risk assessment behind it is not properly risk-based, since there is no documented analysis driving its calibration.
Is having a documented risk assessment legally mandatory, or is it just good practice?
It is a legal requirement, not a discretionary best practice, for entities within scope of Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions. The risk-based approach is a core structural expectation of the UAE's AML/CFT framework — regulated entities are expected to understand and document their own risk exposure rather than applying uniform treatment to every customer regardless of actual risk.
How is customer risk actually assessed — what factors go into the rating?
Customer risk considers factors including whether the customer is an individual or corporate entity, the complexity and transparency of its ownership structure, whether it or its beneficial owners are Politically Exposed Persons, the nature and cash-intensity of its business activity, and how long and how transparently the relationship has operated. These factors are combined into a documented rating — typically standard, simplified, or enhanced — that then determines the depth of due diligence applied.
Where PNPC Fits In
Talk to PNPC's Dubai team before your onboarding decisions rest on assumptions rather than a documented, defensible risk assessment.
PNPC Global has advised Dubai businesses since 1986. Explore the full IPR & AML Compliance practice for related services, or go straight to the AML Risk Assessment page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.