What Are Audit Professionals’ Duties Under UAE Anti-Money Laundering Law?

Why Are Audit Professionals Classified as DNFBPs Under UAE AML Law?

The UAE’s anti-money laundering framework, currently governed by Federal Decree-Law No. 10 of 2025 and its implementing Cabinet Resolution No. 134 of 2025, classifies audit professionals as Designated Non-Financial Businesses and Professions, commonly referred to as DNFBPs. This classification exists because auditors occupy a unique position: their work involves examining a client’s accounts, books, records, and internal procedures in enough depth to identify potential money laundering risk and detect suspicious activity that other parties might miss.

Because of this access and insight, UAE AML law places direct legal obligations on audit professionals themselves, separate from any obligations their audit clients carry. An auditor who fails to meet these obligations is exposed to regulatory penalties independently of whatever findings the audit itself produces.

What Are the Core Duties of Audit Professionals Under UAE AML Law?

Audit professionals, as DNFBPs, are required to build and maintain a risk-based AML program covering several core obligations:

• Identifying and assessing money laundering and terrorism financing risk connected to their own business and to their clients
• Maintaining risk-based customer due diligence and ongoing monitoring procedures
• Identifying and reporting suspicious transactions to the Financial Intelligence Unit
• Appointing a qualified compliance officer and ensuring adequate staff screening and training
• Screening clients, beneficial owners, and management against sanctions lists

These obligations apply across the range of audit activity, including financial audits of a client’s books and periodic accounts, operational audits of internal controls and governance structures, and compliance audits assessing adherence to legal and regulatory requirements.

How Must Audit Professionals Identify and Assess Money Laundering Risk?

UAE AML law requires audit professionals to approach risk assessment from two distinct perspectives. First, they must identify and assess the money laundering risk connected to their own business, based on the nature and type of clients they serve. Second, where engaged in that capacity by a client, they must identify and assess the client’s own money laundering risk as part of the audit engagement itself.

This dual requirement exists because audit work regularly touches activity that can carry money laundering exposure. Auditors may handle client funds, conduct valuations of assets or liabilities, review approvals for changes in a company’s capital structure or dividend payouts, or assess the write-off of uncollected debts. Each of these activities can expose the audit professional to risk if not properly assessed, which is why the law requires auditors to weigh factors such as customer risk, geographic risk, product and service risk, and delivery channel risk as part of a documented risk assessment process.

What Risk Factors Must Audit Professionals Consider?

When conducting a risk assessment, audit professionals are required to consider a defined set of factors, including:

• Client type, size, complexity, and transparency of ownership structure
• Country of origin of persons associated with the client, including beneficial owners, to determine any connection to a high-risk jurisdiction
• The client’s industry or sector, and whether it is associated with elevated money laundering risk
• The channel through which the client was introduced and through which the relationship is maintained
• The type, size, complexity, and geographic origin of financial arrangements connected to the client
• Any unusual features of the client’s financial arrangements or circumstances, particularly compared against standard local market practice

These factors must be considered both when assessing the audit firm’s own exposure and when performing audit procedures on a client’s internal AML controls. The methodology used should be proportional to the size and nature of the audit business, applied consistently across engagements, and documented along with the rationale for the approach adopted.

What Customer Due Diligence Obligations Apply to Audit Professionals?

Audit professionals are required to conduct customer due diligence before entering into any business relationship. This includes obtaining and verifying client identity information from reliable, independent sources, and screening both new and existing clients, along with their beneficial owners and management, against applicable sanctions lists.

Particular attention must be paid to a client’s ultimate beneficial ownership register. Auditors are expected to verify beneficial ownership information as part of due diligence rather than accepting client-provided information at face value, since obscured beneficial ownership is one of the more common risk indicators in money laundering schemes.

What Is the Duty to Report Suspicious Transactions?

Where an audit professional reasonably suspects that a transaction is connected to money laundering or terrorism financing, UAE AML law requires an immediate report to the Financial Intelligence Unit. Audit firms are expected to maintain internal indicators and procedures that help staff identify potentially suspicious activity as part of routine engagement work, rather than relying on ad hoc judgment calls.

Suspicious Transaction Reports must be filed through goAML, the reporting platform used to submit such reports to the Financial Intelligence Unit. Registration with goAML is mandatory for audit professionals subject to these obligations, and failure to file a required report is treated as a compliance breach independent of whether the underlying suspicion is later confirmed.

What Is the Duty to Appoint a Compliance Officer?

Audit professionals are required to appoint a compliance officer competent to carry out the role defined under UAE AML law. The compliance officer is responsible for overseeing the firm’s AML program, including risk assessment methodology, due diligence procedures, staff training, and suspicious transaction reporting.

Audit firms must also ensure adequate staff screening and ongoing AML training, since the compliance officer’s oversight role depends on staff across the firm understanding their own obligations to identify and escalate potential red flags during engagements.

What Sanctions List Screening Obligations Apply to Audit Professionals?

Audit professionals are required to comply with directives issued by the UAE’s competent authorities relating to United Nations Security Council sanctions resolutions issued under Chapter VII of the UN Charter. This includes registering for the UAE’s automatic sanctions list update system, which provides instant access to updated targeted financial sanctions lists from both the UN Security Council consolidated list and domestic terrorism lists.

Screening obligations apply on an ongoing basis, not only at client onboarding. Audit firms are expected to re-screen existing clients as sanctions lists are updated, and to have a documented process for acting on any match identified during that ongoing screening.

Worked Example: How an Audit Engagement Can Trigger AML Obligations

Consider an audit firm engaged to conduct a statutory audit for a trading company with several related-party transactions and a beneficial ownership structure that runs through two intermediate holding entities in different jurisdictions. During fieldwork, the audit team identifies a pattern of large, round-figure cash payments to a supplier that has no clear commercial relationship with the client’s core business, along with a recent, unexplained change in the company’s declared beneficial owner.

Under UAE AML law, this scenario triggers several distinct obligations simultaneously. The audit firm’s customer due diligence procedures should have already flagged the multi-jurisdictional ownership structure as a higher-risk factor during client acceptance, requiring enhanced due diligence rather than standard onboarding checks. The unusual cash payment pattern and the unexplained beneficial ownership change both meet the threshold for reasonable suspicion, which obligates the firm to file a Suspicious Transaction Report through goAML, independent of whether the payments are ultimately explained during the audit. The compliance officer should be involved at the point the pattern is identified, not after the audit is finalized, since the reporting obligation is triggered by reasonable suspicion rather than by confirmed wrongdoing.

This example illustrates why AML obligations for audit professionals cannot be treated as a separate compliance exercise running alongside the audit. The obligations are triggered by observations made during ordinary audit fieldwork, which means audit staff need to be trained to recognize these indicators as part of standard engagement procedures, not as a specialized task handled only by the compliance officer after the fact.

What Are the Consequences of Non-Compliance for Audit Professionals?

Audit professionals who fail to meet their obligations under UAE AML law face regulatory penalties that are separate from any liability connected to the underlying audit engagement itself. Penalties can apply for failures such as inadequate risk assessment documentation, deficient customer due diligence, failure to appoint a competent compliance officer, or failure to file a required Suspicious Transaction Report through goAML.

Enforcement action can include financial penalties, restrictions on the audit professional’s ability to practice, and in serious cases, referral for further investigation. Because these obligations are assessed independently of whether an underlying transaction turns out to be connected to actual money laundering, an audit firm can face penalties purely for a procedural failure, such as an undocumented risk assessment methodology or a missed sanctions list update, even where no suspicious activity is ultimately confirmed. This is one of the main reasons AML compliance needs to be treated as an ongoing operational function rather than a documentation exercise completed once and revisited only when a regulator asks for it.

How Should Audit Firms Build an Effective AML Compliance Program?

An effective AML program for an audit firm combines the elements above into a coordinated structure: a documented, risk-based methodology for assessing both the firm’s own exposure and each client’s risk profile, verified customer due diligence procedures applied consistently across engagements, a trained compliance officer with real authority to escalate concerns, and working procedures for both suspicious transaction reporting and sanctions list screening.

Firms should treat their AML program as something that requires periodic review and update, not a one-time setup. Risk assessment methodologies, client risk profiles, and sanctions screening procedures should all be revisited on a regular cycle, and any changes should be documented along with the reasoning behind them, since regulators expect to see an audit trail showing the program has been actively maintained rather than filed away after initial implementation.

Frequently Asked Questions (FAQs)

How Farahat & Co. Can Help

Farahat & Co. supports audit firms and DNFBPs with AML compliance program design, risk assessment methodology, customer due diligence procedures, and goAML registration under current UAE Anti-Money Laundering Law.

Contact Farahat & Co. today to discuss your AML compliance requirements as an audit professional.