Drafting of AML policies and procedures — What to Get Right Before You Start
Drafting of AML policies and procedures is the engagement through which PNPC produces the written, board-approved AML/CFT policy manual and operating procedures that every UAE Designated Non-Financial Business and Profession, financial institution, and Virtual Asset Service Provider must maintain under Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations. This is not a downloaded template with your company name inserted.
Understanding the Service
Drafting of AML policies and procedures is the production of the written compliance framework that Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (the AML/CFT Law), together with Cabinet Decision No. 10 of 2019 and its subsequent amendments, requires every regulated entity to hold and to actually operate under.
For the full scope, current process and what PNPC includes, see the dedicated Drafting of AML policies and procedures service page.
Is This Relevant to Your Business?
- Your business falls within the DNFBP categories under UAE AML law — real estate brokerage or development, dealing in precious metals and stones above the prescribed cash threshold, corporate service provision, independent legal or accounting practice — and has no written, board-approved AML/CFT policy at all
- You are a newly licensed regulated entity (financial institution, VASP, DNFBP) and need the AML/CFT policy manual and CDD procedures drafted before you can lawfully begin onboarding customers
- Your existing policy was purchased or copied as a generic template and has never been calibrated to your actual customer base, products, geography, or delivery channels
- Your existing policy predates the current Cabinet Decision amendments, FATF guidance updates, or a material change in your business (new product line, new customer segment, new jurisdiction exposure) and is due for a substantive rewrite rather than a light edit
Before You Assume You Need This
- You do not yet have a completed AML/CFT risk assessment — the policy should be drafted from the risk assessment's findings, not written in parallel or ahead of it; PNPC generally recommends the risk assessment as the first deliverable, often within the same engagement
- You are not a DNFBP, financial institution, or VASP and your business activity does not fall within any AML/CFT-regulated category under UAE law — confirm applicability first through a scoping call before commissioning a policy drafting engagement
- You need only the goAML portal registration completed with no policy drafting involved — that is a narrower, standalone registration engagement, though PNPC recommends the risk assessment and policy accompany or precede registration
Questions We're Actually Asked
What exactly does 'drafting of AML policies and procedures' include, separate from the risk assessment or the CDD advisory work?
This engagement is the production of the written, board-approved policy manual and operating procedures themselves — the document set covering CDD/EDD tiers, beneficial ownership identification, sanctions/PEP screening, escalation, record-keeping, and STR/SAR filing procedure. It is drafted from a risk assessment (existing or produced alongside) and precedes the day-to-day CDD advisory and staff training work, which apply the policy in practice.
Can we just use a template AML policy and change the company name and logo?
Doing so leaves a document that describes a generic business, not yours — and supervisory authorities specifically test whether the policy's content matches the entity's actual customer base, transaction patterns, and controls. A template with the name changed is a recognised, recurring inspection finding, not a shortcut that saves time in the long run.
Does the policy need to be board-approved, or can a manager just sign off on it?
UAE AML/CFT expectations are that the policy is adopted at the appropriate senior governance level — typically the board of directors or equivalent senior management for smaller entities — reflecting genuine institutional ownership of the compliance function, not a document produced and filed away by a junior staff member without formal sign-off.
Where PNPC Fits In
Get an AML/CFT policy manual built from your actual business, not a template — speak to PNPC's UAE compliance team.
PNPC Global has advised Dubai businesses since 1986. Explore the full IPR & AML Compliance practice for related services, or go straight to the Drafting of AML policies and procedures page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.