AML/CFT governance & policy
Board-approved AML policy, procedures manual and governance structure mapped to your licence, sector rules and risk appetite.
AML & Compliance · UAE
AML compliance consultants in Dubai & the UAE
Winnow builds, remediates and operates risk-based Anti-Money Laundering (AML/CFT) programmes for DNFBPs and other sectors — aligned with SCA, MoE and FIU expectations, and powered by our Winscan screening platform.
- Risk-based, sector-specific frameworks
- goAML STR/SAR reporting
- MLRO support & training
- Inspection-ready audit trail
2025UAE AML Decree-Law No. 10
4Regulators we cover (CBUAE·SCA·MoE·FIU)
10+Regulated sectors served
6–8 wksTypical programme build
Anti-Money Laundering compliance, done properly
Money-laundering and terrorist-financing controls are no longer optional paperwork in the UAE — they are a licence condition. Since the introduction of Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 10 of 2019, every financial institution and Designated Non-Financial Business or Profession (DNFBP) must run a documented, risk-based AML/CFT programme and be able to prove it works when a supervisor inspects.
Winnow Management and Tax Consultant LLC is a Dubai-based AML and compliance consultancy built by practitioners who have sat on both sides of the table. We translate the rulebooks of the Central Bank of the UAE (CBUAE), the Securities & Commodities Authority (SCA), the Ministry of Economy (MoE) and the Financial Intelligence Unit (FIU) into a programme that fits the way your business actually operates — then we help you run it. Where it helps, we operationalise the framework with Winscan, our UAE-hosted AML screening software.
Whether you are setting up a new entity, remediating after a regulator finding, or simply want an independent set of eyes before your next inspection, we give you a defensible, audit-ready Anti-Money Laundering framework — not a binder of templates that falls apart under scrutiny.
What we deliver
End-to-end AML/CFT services
Every element of a compliant UAE programme, delivered by a team that understands the regulators behind the rules.
Enterprise-wide risk assessment
A documented EWRA scoring customer, product, channel, geography and delivery risk — the foundation every UAE supervisor expects to see.
Sanctions, PEP & adverse media
Screening against UN, OFAC, EU, HMT and UAE local lists, PEP databases and adverse media, with documented match-resolution.
KYC, CDD & enhanced due diligence
Onboarding flows for individuals and entities, UBO identification, source-of-funds checks and EDD for high-risk relationships.
goAML STR / SAR reporting
goAML registration, plus preparation, review and filing of suspicious transaction and activity reports in the FIU's required format.
MLRO outsourcing & advisory
Outsourced or supported MLRO — report review, escalation oversight, senior-management reporting and regulator liaison.
AML training & awareness
Role-based AML/CFT training for staff, MLROs and boards, with attendance records and assessments for your audit file.
Independent AML audit & gap assessment
Independent review of your programme against UAE regulation, with a prioritised remediation roadmap and inspection readiness check.
Responsible gold sourcing (OECD DDG)
OECD Due Diligence Guidance and DPMS AML programmes for UAE gold and precious-metals dealers, including supply-chain reporting.
Audit-ready by design
A programme you can defend in an inspection
When a supervisor calls, evidence is everything. We build your AML/CFT framework so every policy, decision and report is documented and retrievable — turning your next inspection from a scramble into a non-event.
- Board-approved AML/CFT policy & procedures
- Documented enterprise-wide risk assessment
- Screening with logged match resolution
- goAML registration & STR/SAR audit trail
- Training records for every staff member
- Independent audit & inspection readiness
Who we work with
Risk profiles differ by sector — so do supervisors and reporting regimes. We build for each.
Gold & precious metals dealers (DPMS)
Real estate brokers & agents
Auditors & accounting firms
Law firms, notaries & legal professionals
Corporate service providers
Exchange houses & money service businesses
Finance companies & lenders
Insurance companies, takaful & brokers
Fintechs, VASPs & payment providers
DIFC, ADGM, DMCC & free-zone entities
How we work
From gap to audit-ready in four steps
A disciplined engagement model that ends with a programme you can defend in front of a regulator.
Assess
Structured AML gap assessment against UAE regulation, your sector and existing controls. Output: a prioritised remediation roadmap.
Design
Policies, risk matrix, onboarding flow, screening rules and goAML workflow — tuned to your products and risk appetite.
Implement
Deploy Winscan, migrate data, register on goAML, train your team and operate first-cycle reporting until it runs cleanly.
Monitor
Quarterly reviews, regulatory-change tracking, refresher training and audit support — so the programme stays inspection-ready.
Why Winnow for AML compliance in Dubai
Regulatory depth
Fluent in CBUAE, SCA, MoE and FIU rulebooks — and the practical expectations of each supervisor.
Risk-based, not templated
Frameworks engineered to your business and risk profile, so controls are proportionate and defensible.
Tech + advisory in one
Expert-led programme operationalised by Winscan — your policy and your tooling actually match.
MLRO-grade expertise
Practitioners who have run compliance functions and faced regulator inspections first-hand.
Audit-ready evidence
A complete, defensible chain of records for every decision — built for the day the regulator calls.
Partner, not vendor
Embedded reviews, training and regulator liaison — we stay with you beyond go-live.
Frequently asked
AML compliance in the UAE — your questions
The things MLROs, business owners and auditors ask us most often.
What is AML compliance and who needs it in Dubai and the UAE?
AML (Anti-Money Laundering) compliance is the set of controls a business must operate to detect and prevent money laundering and terrorist financing. In the UAE it is governed by Federal Decree-Law No. 10 of 2025, Cabinet Decision No. 10 of 2019 and sector rules from the Central Bank (CBUAE), Securities & Commodities Authority (SCA), Ministry of Economy (MoE) and the Financial Intelligence Unit (FIU). Financial institutions and DNFBPs — auditors, accountants, lawyers, real estate brokers, corporate service providers and dealers in precious metals and stones — must implement a risk-based AML/CFT programme, appoint an MLRO, register on goAML and file suspicious transaction reports.
What does an AML compliance programme in the UAE include?
A complete UAE AML programme includes an AML/CFT policy and procedures manual, an enterprise-wide risk assessment, customer risk rating methodology, KYC/CDD and enhanced due diligence onboarding, sanctions and PEP screening, ongoing monitoring, a goAML registration and STR/SAR reporting workflow, record-keeping, staff training and an independent AML audit. Winnow designs each of these around your sector, products and risk appetite — never from a generic template.
Who is the regulator for AML compliance in the UAE?
It depends on your sector. Banks, exchange houses and finance companies are supervised by the Central Bank of the UAE (CBUAE); capital-markets firms by the SCA; DNFBPs (auditors, lawyers, real estate, precious metals, corporate service providers) by the Ministry of Economy; and free-zone entities by their zone authority (e.g. DIFC's DFSA, ADGM's FSRA, DMCC). All suspicious transaction reporting flows through the UAE FIU's goAML portal.
What is a DNFBP and do DNFBP AML rules apply to my business?
A DNFBP is a Designated Non-Financial Business or Profession — including real estate agents and brokers, dealers in precious metals and stones, auditors and accountants, lawyers and notaries, and company/trust service providers. If you operate one of these businesses in the UAE you are subject to the same core AML/CFT obligations as financial institutions, including goAML registration, risk assessment, screening and STR filing.
What are the penalties for AML non-compliance in the UAE?
UAE AML penalties range from administrative fines (typically AED 50,000 to AED 5,000,000 per violation) to licence suspension and, in serious cases, criminal liability. Common triggers are failing to register on goAML, not filing STRs, weak customer due diligence and no enterprise risk assessment. A documented, risk-based programme is the most reliable defence in a regulator inspection.
Can Winnow act as our outsourced MLRO or Compliance Officer?
Yes. For eligible entities we provide MLRO and Compliance Officer support — report review, suspicious-activity escalation oversight, board and senior-management reporting, training and inspection readiness. The exact scope depends on your licence and sector rules, and is agreed up front.
How long does it take to become AML compliant?
A typical first programme — gap assessment, policies, risk assessment, screening setup and goAML registration — runs around 6 to 8 weeks, depending on your size and sector. Remediation of an existing programme can be faster. We start with a gap assessment so you have a clear, prioritised roadmap from day one.
Do you provide AML software as well as consulting?
Yes. Winnow Management and Tax Consultant LLC is also the team behind Winscan, our UAE-hosted AML screening platform covering KYC onboarding, sanctions & PEP screening, customer risk rating, ongoing monitoring and goAML reporting. You can engage us for advisory only, software only, or a combined programme where the software operationalises the framework we design.
Explore related services
Make your next AML inspection a non-event
Book a no-pressure compliance conversation — we'll tell you where you stand and what an audit-ready programme looks like for your sector.