A Practical Guide to Setup of AML Software
Setup of AML Software is the engagement through which PNPC selects, configures, and operationalises the sanctions/PEP screening, transaction-monitoring, and case-management technology that sits underneath a UAE entity's AML/CFT programme required under Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations. A screening tool bought and switched on with default settings answers almost none of the questions a Ministry of Economy or Central Bank inspector actually asks — what lists it screens against, how often it re-screens, how alerts are triaged, and whether the configuration reflects your documented risk assessment.
What You're Really Buying
Setup of AML Software is the technical implementation layer of a UAE entity's anti-money laundering and counter-terrorist financing (AML/CFT) compliance function — the sanctions and Politically Exposed Person (PEP) screening tool, the transaction-monitoring system, and the case-management workflow that a Designated Non-Financial Business and Profession (DNFBP) or regulated financial entity uses to actually execute the customer due diligence, ongoing monitoring, and suspicious-activity escalation obligations set out in Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Cabinet Decision No. 10 of 2019 (as amended).
For the full scope, current process and what PNPC includes, see the dedicated Setup of AML Software service page.
Is This Relevant to Your Business?
- Your business is a DNFBP or regulated financial entity under UAE AML/CFT law and does not yet have a sanctions/PEP screening tool in place, or is currently relying on manual, ad hoc name checks
- You have a screening subscription already but have never had its list sources, screening frequency, and match-handling workflow reviewed against your actual risk assessment and written policy
- Your customer or transaction volume has grown to the point where manual review is no longer defensible, and screening or monitoring alerts are accumulating faster than they can be triaged
- You are newly licensed in a regulated sector — financial services, a Virtual Asset Service Provider, or a DNFBP category — and need the screening infrastructure built before you can lawfully onboard customers at scale
When It Isn't the Right Fit
- You do not yet have a documented AML/CFT risk assessment or written policy — configuring screening software before that foundation exists means the tool has nothing calibrated to configure against; a KYC & CDD Advisory engagement to build the policy and risk methodology should come first or alongside
- You have not yet confirmed whether your business actually falls within a DNFBP or regulated category under UAE AML law — an applicability assessment should precede any technology purchase
- You need standalone goAML portal registration completed with no wider screening or monitoring technology decision in scope — that is a narrower registration engagement
Quick Answers
Does UAE AML law require us to use a specific software product?
No. Federal Decree-Law No. 20 of 2018 and its Cabinet Decision implementing regulations are technology-neutral — they require that screening, monitoring, and record-keeping obligations are actually met, not that a specific vendor's product is used. In practice, meeting those obligations consistently and at scale is very difficult without software once an entity has more than a handful of customers, but the choice of tool is the entity's own, subject to it actually covering the entity's risk profile.
We already have a screening subscription — why would we need a setup engagement?
Having a subscription and having a correctly configured tool are different things. The most common gap PNPC finds when reviewing an existing screening tool is that it only checks at onboarding with no periodic re-screening scheduled, or that its thresholds were left at generic vendor defaults never calibrated to the entity's actual customer base and transaction sizes. A setup or reconfiguration engagement reviews what the tool is actually doing against what your written AML policy says it should be doing.
What is the difference between sanctions screening and transaction monitoring?
Sanctions and PEP screening checks a customer's or counterparty's identity against reference lists — the UN Consolidated Sanctions List, the UAE Local Terrorist List, and PEP databases — typically at onboarding and periodically thereafter, to confirm you are not dealing with a designated or high-risk individual. Transaction monitoring is a separate, ongoing function that watches the pattern of a customer's actual activity — transaction size, frequency, and structuring — against their expected profile, to flag behaviour inconsistent with what was expected at onboarding, regardless of whether the customer's identity screens clean.
Where PNPC Fits In
Get your AML screening and monitoring software configured to match your actual risk profile, not the vendor's defaults — talk to PNPC's Dubai compliance team.
PNPC Global has advised Dubai businesses since 1986. Explore the full IPR & AML Compliance practice for related services, or go straight to the Setup of AML Software page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.