For licensees with a framework or review due
A licensee with an AML framework or review due
The short answer
A licensee with an AML/CFT framework to build, or a review, audit or inspection due, should test the framework against its own regulator's rulebook and the federal AML law. For a VARA licensee, Part III of the Compliance and Risk Management Rulebook sets the test: a Money Laundering Reporting Officer (MLRO) with at least two years of AML/CFT experience, a Compliance Officer with five years in compliance, and a quarterly MLRO report to the board. We close the gaps in order of risk and assemble the evidence a reviewer will ask for.
A reviewer judges an AML framework on two points: whether it fits the business's actual risks, and whether it can be shown to work. The first is the business risk assessment (customers, products, geographies, channels) and the policies that follow from it. The second is evidence: due-diligence files, monitoring alerts and how each was closed, suspicious transaction reports filed on goAML, training records and the MLRO's quarterly reports to the board. Under VARA's rulebook those reports must be available to VARA on request, so a framework that exists only on paper fails at that point.
Reviews arrive from several directions: the regulator's inspection cycle, the rulebook's periodic independent review, an auditor's request, or a bank's or counterparty's onboarding questions. The businesses that pass reviewed themselves first. Under VARA's rulebook the MLRO and Compliance Officer appointments are themselves reviewed every year, so that date belongs in the diary. The work here is that self-review, ordered by risk and finished before the regulator's letter arrives.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the gap review and the remediation is fixed against a defined scope, with ongoing support monthly, in your engagement letter.
- Timing
- The gap review in weeks; remediation ordered by risk; the review, audit or inspection supported on its own schedule.
- What's included
- A gap review against the rulebook and the law
- Risk assessment, policies and processes built or corrected
- The evidence pack a reviewer asks for
This is for you if
- You are licensed by VARA, a financial free-zone regulator, the Central Bank or another authority that requires an AML framework.
- Your framework has to be built for a licence application or a new activity.
- An independent review, an audit or a regulator's inspection is due, or overdue.
- A bank or a counterparty has asked to see your AML controls before onboarding you.
This may not be the right route if
- You want a framework written to be filed and forgotten.
- You want a legal opinion on the law; that comes from a licensed law firm, which we coordinate.
- You expect the regulator's finding to be promised.
At a glance
- Indicative cost
- Regulator fees, where any, are the regulator's; the Velarozone service fee for the gap review and the remediation is fixed against a defined scope, with ongoing support monthly, in your engagement letter.
- Timing
- The gap review in weeks; remediation ordered by risk; the review, audit or inspection supported on its own schedule.
- What's included
- A gap review against the rulebook and the law
- Risk assessment, policies and processes built or corrected
- The evidence pack a reviewer asks for
What this service includes
- A gap review of the framework against the regulator's rulebook and the federal AML law, ordered by risk.
- The business risk assessment written or refreshed; policies and procedures drafted or corrected.
- Customer due-diligence, monitoring and reporting processes designed to produce evidence as they run.
- Training delivered and recorded; the MLRO's quarterly board report set up, including the summary of Anonymity-Enhanced Transactions where VARA's rulebook applies.
- The evidence pack prepared for the independent review, the auditor or the regulator.
What it does not include
- Legal opinions on the law or the rulebook, which come from a licensed law firm.
- Any assurance of the regulator's or a reviewer's finding.
- Acting as a shield: a compliance officer reports what the rules require, including to the regulator.
Process
How the work is sequenced
Each stage has its own dependencies (activity approvals, document legalisation, authority processing, and bank review), and we report progress against them rather than against one overall date.
- 01
Gap review
The framework read against the rulebook and the law; findings ordered by risk.
- 02
Remediate
Risk assessment, policies, processes and governance built or corrected.
- 03
Evidence
Files, registers and records assembled as a reviewer will ask for them.
Need the officer as well as the framework? The fractional-roles page fills the role.
Prefer to start in writing? Send the details through the contact form.
Start with a structure assessment
In an initial consultation you receive a plain-language decision summary, a document-preparation list, and the next actions for your situation. Current figures are confirmed within your adviser-reviewed route comparison.
What a reviewer tests
The framework, element by element
A review walks these in order and asks for the evidence behind each.
Elements of an AML/CFT framework and the evidence a reviewer expects for each.
Business risk assessment
- What it must do
- Identify and rate the risks the business actually runs
- Evidence
- The assessment, its methodology and its approval
Policies and procedures
- What it must do
- Say what staff do about each risk
- Evidence
- Documents, versions, approvals, staff acknowledgement
Customer due diligence
- What it must do
- Identify, verify and risk-rate every customer, with enhanced measures where required
- Evidence
- Sampled customer files
Monitoring
- What it must do
- Monitor continuously against written indicators, using methods that Senior Management has approved
- Evidence
- Alerts, who reviewed each, how it was closed, and the Senior Management approval of the methods
Reporting
- What it must do
- Report suspicion to the UAE FIU on the goAML platform, immediately under VARA's rule, and never tip off the customer
- Evidence
- goAML filings, the MLRO's register, and FIU or VARA information requests answered within 48 hours
Governance and training
- What it must do
- VARA: an MLRO with two years' AML/CFT experience, a Compliance Officer reporting to the Board, trained staff
- Evidence
- Appointment files reviewed annually, quarterly MLRO reports to the board, training records
| Element | What it must do | Evidence |
|---|---|---|
| Business risk assessment | Identify and rate the risks the business actually runs | The assessment, its methodology and its approval |
| Policies and procedures | Say what staff do about each risk | Documents, versions, approvals, staff acknowledgement |
| Customer due diligence | Identify, verify and risk-rate every customer, with enhanced measures where required | Sampled customer files |
| Monitoring | Monitor continuously against written indicators, using methods that Senior Management has approved | Alerts, who reviewed each, how it was closed, and the Senior Management approval of the methods |
| Reporting | Report suspicion to the UAE FIU on the goAML platform, immediately under VARA's rule, and never tip off the customer | goAML filings, the MLRO's register, and FIU or VARA information requests answered within 48 hours |
| Governance and training | VARA: an MLRO with two years' AML/CFT experience, a Compliance Officer reporting to the Board, trained staff | Appointment files reviewed annually, quarterly MLRO reports to the board, training records |
The service
Regulatory consulting and fractional roles
VARA licensing advisory, AML/CFT framework work, and fractional MLRO, compliance officer and CFO cover for regulated businesses.
See the consulting service
Every route is planned against how the business will actually operate in the UAE.
After the licence
What you may also need
The four services most founders in this situation ask about next, each on its own page.
Visas & PRO services
Residence visas for owners, staff and family, plus the MOHRE labour files, medicals and Emirates ID renewals that keep a licence and its people in good standing. A sponsored visa lasts 1, 2 or 3 years; approval stays with the authority.
→UAE bank account setup
A bank-ready file built around your ownership, activity and expected transactions, matched to the bank whose risk appetite suits your profile. The bank alone decides approval and timing.
→Accounting & tax
Monthly bookkeeping, VAT and corporate-tax filings and year-end accounts, with statutory audit signed by a registered auditor.
→Legal services
Contracts, corporate documents, disputes and regulatory matters, advised by lawyers licensed to practise in the UAE and named in the engagement letter.
→
Questions
Frequently asked
- How often must the framework be reviewed?
- It depends on the regulator. Under VARA's rulebook the MLRO and Compliance Officer appointments are reviewed annually, the MLRO reports on the framework's effectiveness to the board every quarter, and the monitoring methods are reviewed periodically. Your own regulator sets the independent review cycle and inspection dates. We diarise all of them.
- Can the same person be compliance officer and reporting officer?
- Under VARA's rulebook the MLRO may hold another non-client-facing role only if the duties do not conflict, and it names the Compliance Officer and head of risk roles as ones that can. The Compliance Officer must be full-time and report directly to the Board. Both appointments are reviewed annually. Other regulators set their own rules.
- What does a regulator's inspection look like?
- Expect a request for documents and files, interviews with the officers, and sampled customer files and monitoring records. Under VARA's rulebook the MLRO's quarterly board reports must be available on request. After a suspicious transaction report, information requests from the UAE FIU or VARA must be answered within 48 hours. The evidence pack is built so each request is answered from the file.
- Our bank has asked for our AML policy. Is that normal?
- Yes, for licensed and higher-risk businesses; the bank has its own obligation to understand your controls. A framework that can be shown is what keeps the account open.
- What does it cost?
- A gap review and remediation are quoted as a fixed Velarozone service fee against a defined scope; ongoing support is monthly. Both are itemised in your engagement letter.
Sources
- UAE AML/CFT framework guidance
- Virtual Assets Regulatory Authority (VARA)
- Central Bank of the UAE, the UAE banking and payments regulator
Regulations, fees, and eligibility can change. Every regulatory statement is re-checked before publication and dated above.
Legal notes and scope
Velarozone provides setup and operational-readiness coordination. This page is general information, not legal, tax, immigration, or banking advice.
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.
Regulatory outcomes are decided by the regulator; nothing here asserts a finding, a licence category or a timeline the regulator has not published or decided. Legal opinions come from a licensed law firm under its own engagement.