MoE AML Inspection UAE 2026 — a 30-Day Prep Playbook for DNFBPs

The Ministry of Economy and Tourism (MoET) — the former Ministry of Economy, renamed in 2025 — is the federal supervisor for anti-money laundering and counter-terrorism financing across most Designated Non-Financial Businesses and Professions categories: real estate brokers and agents, dealers in precious metals and stones, auditors, accountants, tax consultants, and corporate service providers. Lawyers and notaries are supervised separately by the Ministry of Justice.

The UAE rewrote the whole framework in 2025 — a new Decree-Law in October, a new executive regulation in December — and anti money laundering UAE supervision now reaches firms that never expected a regulator to knock. If your AML compliance in Dubai, Sharjah or Abu Dhabi has been running on a goAML login and good intentions, a supervisor working from Article 49 of Cabinet Decision 134 of 2025 will find that out quickly.

Here is the part people get wrong before they start. No UAE instrument gives you a guaranteed notice period. Article 16 of the Decree-Law puts desk-based and field-based supervision on the same footing, and Article 49(9) lets the supervisor request whatever information it considers necessary. Firms that treated AML compliance as a binder collecting dust find out, too late, that the binder is the audit. What follows is the thirty-day preparation cadence we use when a MoET inspection notice lands on a client’s desk — our own working framework, not a statutory timetable.

Who gets picked, and why it probably isn’t random

Selection is risk-based because the executive regulation says it must be. Article 49(9) of Cabinet Decision 134 of 2025 requires supervisory authorities to conduct off-site and on-site supervision and inspections “on a risk-based basis”, and to request and obtain any information they consider necessary to do it. Article 49(10) then names the three inputs that set the frequency.

The three statutory inputs to inspection frequency

Source: Cabinet Decision 134 of 2025, Article 49(9) and 49(10). Checked 5 August 2026.

That third input is the practical lever. A dealer in precious metals and stones and a real estate brokerage both sit in higher-risk sectors under input (a) and cannot change that. What they can change is the quality of the written programme the supervisor scores under input (c). A firm whose Business Risk Assessment is a live document, whose customer files carry a recorded risk rating with reasoning, and whose training register is current, presents a lower residual risk than an identical firm working from a template — and the regulation makes that difference count towards how often it is visited.

Note what Article 16 of Federal Decree-Law 10 of 2025 also says: supervisory and inspection operations may be “desk-based or field-based”. A document request that arrives by email is supervision, not a warm-up for it. Firms that treat off-site requests as administrative correspondence and answer them late are being observed while they do it.

The legal framework underpinning all of this is Federal Decree-Law 10 of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing — a Federal Decree-Law, not a Federal Law, issued 30 September 2025 — and its executive regulation Cabinet Resolution 134 of 2025, issued 29 October 2025. Article 41(1) of the decree-law repealed Federal Decree-Law 20 of 2018 and Article 70 of the resolution repealed Cabinet Decision 10 of 2019.

Both commence by formula rather than on a stated date: two weeks after Official Gazette publication under Article 42 of the decree-law, thirty days after publication under Article 71 of the resolution. We could not confirm the Official Gazette issue or publication date from a primary source on 5 August 2026, so we quote the issuance dates printed on the instruments themselves and leave the commencement date out rather than repeat a figure from commentary.

Article 41(3) of the new Decree-Law keeps regulations, resolutions and circulars made under the 2018 law alive until superseded, which is why Cabinet Resolution 71 of 2024 still governs DNFBP administrative fines even though its own cross-references point at the repealed 2019 regulation.

The current AML instrument stack for a UAE DNFBP

Sources: uaelegislation.gov.ae and the CBUAE Rulebook. Checked 5 August 2026. We have not found a published Article 39 schedule; where a source quotes per-violation fines “under the 2025 law”, check whether it is actually quoting Cabinet Resolution 71 of 2024.

What the notice actually says (and asks for)

Be clear about one thing before the planning starts: neither Federal Decree-Law 10 of 2025 nor Cabinet Decision 134 of 2025 prescribes a minimum notice period, and the Ministry of Economy and Tourism does not publish one. Anyone quoting you a guaranteed number of days is quoting practice, not law. The thirty-day framework in this playbook is our own preparation cadence, chosen because it is long enough to rebuild an evidence set and short enough to be realistic — not because a regulation grants it.

What the law does fix is the substance. Article 49(9) gives the supervisor the right to request and obtain any information it deems necessary. Article 22(5) of the executive regulation puts a matching duty on the compliance officer: cooperate with the supervisory authority and the Unit, provide the data they request, and enable their assigned personnel to access the records and documents needed for their work. There is no negotiating position built into either provision.

A document request list is the practical centre of the exercise, and every item on the list below traces to a specific obligation you can point at. Build the binder against the obligations rather than against a rumoured template.

The evidence set, and the article that requires it

Source: the articles cited, from the texts published on uaelegislation.gov.ae and the CBUAE Rulebook. Checked 5 August 2026.

The six things Article 21 says your policy manual must contain

Source: Cabinet Decision 134 of 2025, Article 21 (Division Seven). The whole set must be approved by senior management, proportionate to identified risks and to the nature and size of the business, and reviewed and updated on an ongoing basis. Checked 5 August 2026.

DNFBPs in higher-risk segments should expect deeper sampling. A dealer in precious metals operating in gold and jewellery will face questions on cash-equivalent inventory controls and walk-in customer thresholds. A real estate broker will be asked to demonstrate source-of-funds verification for the most recent ten transactions above the AED 55,000 cash-payment threshold.

The 30-Day Pre-Inspection Checklist

The window between notice and visit is short. The following sequence treats the thirty days as four working weeks, each with a defined objective. The MLRO owns the timeline; the senior management signatory must be available to sign refreshed documents; the operations lead pulls files on request.

Days 1 to 7 — Foundations. Confirm the MLRO appointment letter is current, signed by the licensed manager, and on file. Retrieve the goAML registration certificate and verify that the registered MLRO matches the appointment letter (a frequent mismatch when MLROs change without updating goAML, which our goAML registration guide covers in detail). Confirm the Business Risk Assessment carries a date within the previous twelve months and that it actually reflects the firm’s current client book — not a template inherited from a consultant in 2022. Pull the AML/CFT policy manual and confirm senior management approval is documented by signature and date on the cover page or in an approval minute.

Days 8 to 14 — Customer files. Pull a stratified sample of customer due diligence, enhanced due diligence and simplified due diligence files. Aim for at least twenty files across the spectrum, with deliberate inclusion of higher-risk profiles (PEPs, offshore beneficial owners, cash-intensive sectors). For each file confirm: identification documents within validity, beneficial ownership chain documented to the natural person, risk classification recorded with reasoning, sanctions screening evidence dated at on-boarding and at the most recent annual review.

Verify sanctions-screening logs. The obligations cited in items 33 to 41 of the Cabinet Resolution 71 of 2024 schedule are those in Article 21 of Cabinet Resolution 74 of 2020: registering on the Executive Office for Control and Non-Proliferation website to receive designation notifications, constantly verifying databases and transactions against the Security Council, Sanctions Committee and local lists, freezing promptly and without prior warning on a match, and reporting to the Executive Office.

OFAC SDN screening is commercial practice where there is a US-dollar or US nexus, not a UAE legal requirement — say so plainly when the inspector asks, because claiming a legal basis you do not have is worse than describing a control you chose. Confirm the beneficial owner register required by Cabinet Resolution 109 of 2023 is current and reconciles to customer files.

Days 15 to 21 — Reporting and training. Pull the suspicious transaction report log. Inspectors will not penalise a firm for filing zero STRs if the rationale is documented; they will penalise a firm that filed zero STRs without any documented monitoring activity, because that indicates the monitoring did not occur. Retrieve training attendance records for every staff member who interacts with customers, covering at least one session in the past twelve months with content tailored to the firm’s sector. Article 21(6) of Cabinet Decision 134 of 2025 requires an independent audit function to test the effectiveness and adequacy of the internal policies, controls and procedures. Where that audit has been completed, confirm the report is on file with management’s response to each finding.

Days 22 to 30 — Rehearsal. Conduct a dry-run inspection with the MLRO playing the inspectee role and a senior team member or external advisor playing the inspector. Walk through the document request list end to end. Prepare physical and digital evidence binders organised in the exact sequence of the inspector’s checklist so files can be produced within minutes, not hours. Brief reception staff on inspector arrival protocol, brief operations staff that questions outside their remit must be referred to the MLRO, and confirm meeting room availability with screen-share capability for digital evidence.

The penalty ladder, and where the numbers actually come from

Three different instruments impose three different ranges, and they are routinely blended in circulation. They are not interchangeable, and a supervisor cannot impose a court’s fine.

Which range applies to what

Sources: Federal Decree-Law No. 10 of 2025 (CBUAE Rulebook) and Cabinet Resolution No. 71 of 2024 (uaelegislation.gov.ae). Checked 5 August 2026. An inspection produces a supervisory penalty. The Article 26 and 27 figures belong to a criminal prosecution and are reproduced here only so they are not mistaken for what an inspector can impose.

If the Ministry decides to fine you — the Cabinet Resolution 71/2024 clock

Source: Cabinet Resolution No. 71 of 2024, Article 4, as published on uaelegislation.gov.ae. Checked 5 August 2026. Article 4(3)(b) is the sentence worth reading twice: the Minister may substitute a different penalty, but the grievance may not leave the aggrieved party worse off.

The practical point in that table is Article 4(5). You cannot go to court first. A firm that lets the 30-working-day grievance window pass while it takes legal advice has closed its own route of challenge, whatever the merits.

The thresholds an inspector will test against your files

Most inspection findings are not exotic. They are a customer file that should have triggered due diligence at a numeric threshold and did not. Article 3 and Article 7 of Cabinet Decision 134 of 2025 set those numbers, and Article 28 adds the wire-transfer data rules. Every UAE DNFBP should be able to point at the trigger that applies to its own licensed activity without looking it up.

Cabinet Decision 134 of 2025 — the numeric triggers

Sources: Cabinet Decision 134 of 2025 and Cabinet Resolution 109 of 2023, as published on uaelegislation.gov.ae. Checked 5 August 2026. Note that a threshold is a floor, not a licence: Article 7(1) requires CDD on commencing any business relationship, where a crime is suspected, or where there are doubts about previously obtained identification data, regardless of amount.

The AED 55,000 line is the one that most often produces a finding for a Dubai or Sharjah dealer in precious metals, because Article 3(3) counts “several transactions that appear to be linked” and a file structured as three payments of AED 20,000 is exactly what the drafting is aimed at. The same logic applies to the AED 11,000 gaming threshold and the AED 3,500 wire threshold. A monitoring rule that only tests single transactions will pass its own test and fail the inspector’s.

What changed when the 2025 framework landed

A firm still working from a 2019-vintage policy manual will fail on citations before an inspector reaches the substance. The table below is the mapping we use when we rebuild a UAE policy manual against the current texts.

Old framework to new — the mapping that has to be in your manual

Sources: FDL 10/2025 Art 41; CR 71/2024 Art 8; CR 109/2023 Art 22; CD 132/2023 Art 8. Checked 5 August 2026.

Two of those rows cause most of the trouble. Cross-references to “Article 21” for the compliance officer are now wrong — that Article governs internal policies, and the officer’s duties moved to Article 22. And Cabinet Resolution 71 of 2024 still cites the repealed 2019 regulation in its own legal-reference column, which is correct as drafting and confusing as reading: the fine schedule survives under Article 41(3) of the new Decree-Law even though the articles it points at have been replaced.

Fifteen questions we’d put to your MLRO before the inspectors do

These are our own rehearsal questions, each written back from a specific obligation in Federal Decree-Law 10 of 2025, Cabinet Decision 134 of 2025 or Cabinet Resolution 109 of 2023 rather than from any published inspection script. They are neither exhaustive nor predictive. But if an MLRO has one afternoon left before the visit, rehearsing crisp, evidence-backed answers to each of these is the highest-leverage thing they can do with it.

1. “Show me your Business Risk Assessment dated within the last twelve months. Walk me through the methodology.”
2. “Pick this customer file at random. Walk me through how you on-boarded this client and what triggered the risk rating you assigned.”
3. “Show me the sanctions screening evidence for this specific transaction on this specific date.”
4. “Who is your MLRO? Where is the signed appointment letter? Has the MLRO completed mandatory training in the past twelve months?”
5. “How many suspicious transaction reports have you filed in the past twelve months? For zero filings, where is the documented monitoring rationale?”
6. “How often do you train staff on AML obligations? Where are the attendance records, the content of the training, and evidence of comprehension testing?”
7. “What is your customer risk classification methodology? Walk me through the scoring matrix.”
8. “Demonstrate ongoing monitoring of an enhanced due diligence client. Show me the trigger events and the review cadence.”
9. “How do you identify and handle politically exposed persons? What additional approvals are required before on-boarding a PEP?”
10. “Where is your ultimate beneficial owner register? When was it last updated and what was the trigger for the update?”
11. “What is your record retention policy? Where are the files held? Article 25(2) of Cabinet Decision 134 of 2025 counts five years from the most recent of relationship end, account closure, an occasional transaction, completion of a supervisory inspection, completion of an investigation, or a final court judgment — show me how your schedule handles that.”
12. “Show me an example of a customer you offboarded for AML concerns. What was the trigger, what was the rationale and what was the STR position?”
13. “How do you handle the risk of tipping off a customer who is the subject of a suspicious transaction report?”
14. “What was the trigger for your last internal compliance review and what corrective actions were implemented?”
15. “Demonstrate that senior management has formally approved your AML programme. Show me the minutes or the signed approval.”

Every question has a documentary answer. If the answer is verbal, it does not count. Inspectors record answers verbatim and reconcile them to the file.

Scoping the remediation work

When the gap assessment is complete the firm faces a remediation workload. There is no fixed price for it — the cost is driven by how many gaps the assessment surfaces, the sector, the size of the client book and how deep the file-level rework has to go, so any provider should quote against your specific position rather than a headline range. The main workstreams to scope are:

• Policy manual refresh with documented senior management approval — an advisory-supported job that aligns the manual to how the firm actually operates rather than a generic template.
• Business Risk Assessment refresh — priced by sector complexity, geographic spread and how deep the underlying client analysis needs to go.
• Sanctions-screening tooling — a subscription that scales with transaction volume, real-time screening and how much adverse-media coverage is included.
• Staff training — a sector-specific external session with case studies and a comprehension test at the end.
• Independent AML audit — Article 21(6) of Cabinet Decision 134 of 2025 requires an independent audit function to test the effectiveness and adequacy of the internal policies, controls and procedures. It covers programme adequacy, sample testing and a written report with findings.
• Customer file remediation — priced by how much each file is missing: an identification refresh, an undocumented UBO chain, absent screening evidence, or a risk rating that was never put on file.

A firm with a clean operating culture but lapsed documentation is a lighter job than one with structural gaps — no current BRA, screening done ad hoc, training non-existent. Rather than guess at either duration, prioritise by exposure: put the workstreams that close the largest published fine first.

Remediation workstreams, ranked by the exposure each one closes

Source: the list annexed to Cabinet Resolution No. 71 of 2024, uaelegislation.gov.ae. Checked 5 August 2026. Ranking is by the published fine, not by how long the work takes — a screening procedure can be written in a week and closes a bigger number than a file remediation that takes a month.

For a scoped, fixed quote against your own gap assessment, book a free consultation rather than working to a guessed number.

After the inspectors leave: the three ways this ends

Inspections close in one of three broad positions. The one you want is the clean outcome: the file closes with no action required and the firm returns to the ordinary risk-based cycle described in Article 49(10). The second is a remediation instruction. Article 17(2) of Federal Decree-Law 10 of 2025 gives the supervisor an express power to order the submission of periodic reports on the measures taken to remedy a violation — so remediation is not an informal understanding, it is a reporting obligation with the supervisor still watching.

The third outcome is an administrative penalty. Cabinet Resolution 71 of 2024 sets the notification and grievance timetable above, and Article 3(1) confirms the Ministry can impose a supervisory penalty from Article 17(1), a fine from the annexed list, or both. Grievances succeed on a documentary basis, not on a view that the penalty is harsh: Article 4(3) lets the Minister amend a penalty by reference to the violation, the nature of the activity and the volume of transactions of the facility — all of which are evidenced from your own records.

One consequence sits outside the fine. Article 17(4) of Federal Decree-Law 10 of 2025 provides that “in all cases, the Supervisory Authority may publish the administrative penalties imposed by it through various media outlets.” That is a discretionary publication power over individual penalties, not a standing public register — but it is a real one, and it is the exposure a firm cannot pay off.

“

The fine is not the whole exposure. Article 17(4) lets the supervisor publish the penalty through media outlets, and Article 17(1) puts a sector ban, director suspension and licence revocation on the same menu as the money.

Where Velmont Crest fits on inspection prep

Velmont Crest supports DNFBPs through inspection preparation in an advisory capacity. The MLRO remains the firm’s appointed officer of record and the senior management signatory remains accountable for programme approval. Our role is to compress the preparation timeline, raise the quality of the evidence and reduce the operational burden on a team that still has a business to run.

The engagement typically covers: a gap assessment scored against the MoE inspection template, evidence binder assembly indexed to the inspector’s likely document request list, customer file remediation with documented rationale for each rating decision, a Business Risk Assessment refresh anchored to the firm’s actual client book, sanctions-screening methodology documentation, the senior management approval trail, and mock-interview support for the MLRO and operations team. We do not attend inspections in the role of the firm’s MLRO and we do not represent the firm to the Ministry as its appointed officer. We prepare the firm so its own MLRO walks into the inspection room ready.

For firms whose bookkeeping is also under our care, the inspection preparation benefits from financial records that already tie to customer files and transaction monitoring. For firms preparing simultaneously for corporate tax registration and AML inspection, sequencing the two workstreams against a single calendar avoids the documentation overlap that frequently overwhelms in-house teams. Whichever route applies, the destination is the same: an inspection-ready posture maintained year-round rather than rebuilt in panic every cycle.

Before the notice arrives is also the moment to get the underlying programme right. Our MLRO appointment guide for the UAE covers the officer inspectors will question first, while the sector templates — the gold trader DPMS AML programme and the AML programme for UAE law firms — show what a defensible file looks like in the two most heavily inspected DNFBP categories.

Talk to our AML compliance advisory team before the inspection notice arrives, not after. The thirty-day window is workable. The seven-day window — when the notice has been sitting unopened in an MLRO’s inbox — is not.