Documentation — What to Get Right Before You Start
Documentation is the engagement through which PNPC builds, organises, and maintains the written record every UAE Designated Non-Financial Business and Profession and regulated financial entity must be able to produce on demand under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism — the risk assessment, board-approved policies and procedures, MLRO appointment records, CDD/EDD files, screening evidence, training logs, and STR/SAR escalation trail. Supervisory authorities do not inspect intentions; they inspect paper.
What You're Really Buying
AML/CFT Documentation is the discrete but essential discipline of converting a business's anti-money laundering obligations under Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decision No. 10 of 2019 (as amended) into a written, organised, and retrievable evidence file.
For the full scope, current process and what PNPC includes, see the dedicated Documentation service page.
When You'd Need This
- You have a functioning AML/CFT compliance practice — CDD is performed, screening happens, staff are briefed — but none of it is written down in a form that could be produced to an inspector today
- Your existing AML policy manual, risk assessment, or MLRO appointment record was drafted years ago, has never been reviewed, and no longer reflects your current business activity or the current Cabinet Decision text
- You have received a Ministry of Economy, Central Bank, DFSA, FSRA, or VARA inspection notice and need your documentation set assembled, indexed, and inspection-ready on a compressed timeline
- Your goAML registration is complete but the risk assessment, policies, and procedures behind it were never formally drafted or were built from an unadapted template
What This Doesn't Cover
- You do not yet have any AML/CFT compliance activity to document — no risk assessment has been performed, no CDD methodology exists, and no Compliance Officer has been appointed; that is a full KYC & Customer Due Diligence Advisory build, not a documentation exercise layered on top of nothing
- You have not yet confirmed whether your business falls within a DNFBP or regulated Financial Institution category at all — an applicability assessment should come first, since documenting an obligation that does not actually apply wastes effort
- You need the goAML organisation and Compliance Officer portal registration itself completed and have not yet registered — that is the goAML Portal Registration & Reporting Assistance engagement, though it is frequently paired with documentation work
Quick Answers
Why do I need a separate Documentation engagement if we already do our AML compliance work properly?
Because UAE supervisory authorities inspect the written record, not your general good-faith conduct. An inspector reviewing a customer file checks whether the risk rating, beneficial ownership look-through, and screening result were actually recorded — not whether you personally believe the work was done well. A business that performs CDD correctly but never documents it is, from the inspector's perspective, indistinguishable from a business that skipped CDD altogether, because there is no evidence to examine either way.
What is the minimum document set every DNFBP needs to be able to produce?
At minimum: a board-approved AML/CFT policy and procedures manual, a documented business-wide risk assessment, the Compliance Officer/MLRO appointment record, CDD files for customers with beneficial ownership identification, sanctions/PEP screening evidence, staff training attendance records, and — where applicable — the internal escalation trail and goAML submission confirmation for any STR/SAR filed. The exact depth expected scales with the size and complexity of the business, but every category above should exist in some form for any in-scope entity.
How is documentation different from the risk assessment or the CDD advisory work itself?
The risk assessment and CDD advisory engagements design and implement the underlying methodology — what risk factors matter, how customers are categorised, what triggers enhanced due diligence. Documentation is the discipline of capturing, organising, and maintaining the written evidence that this methodology was actually applied to real customers and real decisions, in a form that can be retrieved and produced on request. You can have a well-designed methodology and a poorly documented file, or vice versa — the two are related but distinct pieces of work.
Where PNPC Fits In
Talk to PNPC's Dubai AML/CFT team before an inspector asks for a file you cannot produce.
PNPC Global has advised Dubai businesses since 1986. Explore the full IPR & AML Compliance practice for related services, or go straight to the Documentation page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.