Compliance and AML/CTF Requirements in DIFC

Compliance Framework in DIFC: A Comprehensive Approach

An effective compliance system is the foundation of successful operations in the DIFC. The DFSA adheres to a risk-based approach and expects regulated firms to have a robust compliance infrastructure, proportional to the scale and complexity of the business.

Three Lines of Defence

The DFSA expects the implementation of the three lines of defence model:

Line	Responsible Functions	Description
1st line	Business Units	Front office, operational units
		Primary risk control, adherence to procedures, documentation
2nd line	Compliance & Risk	Compliance Officer, Risk Officer
		Independent monitoring, policies and procedures, advisory role
3rd line	Internal Audit	Internal Audit (or outsourced)
		Independent assessment of effectiveness of 1st and 2nd line controls

Role of the Compliance Officer in DIFC

The Compliance Officer is one of the Controlled Functions requiring DFSA approval:

Duty	Description
Regulatory oversight	Monitoring compliance with all applicable DFSA rules
Policy development	Development and updating of compliance policies & procedures
Training	Training employees on regulatory requirements
Monitoring	Regular compliance checks (compliance testing)
Reporting	Annual report to the Board and DFSA
Advisory	Advising the business on compliance matters
Breach management	Investigation and remediation of breaches
Regulatory liaison	Interaction with the DFSA

Requirements for the Compliance Officer:

Minimum 5 years’ experience in compliance/regulation of financial services
Direct access to Senior Management and the Board
Independence from business units
Sufficient resources for function performance
Professional qualifications (ICA, ACAMS, etc. — recommended)

AML/CTF Framework in DIFC

The DIFC follows international FATF standards and the UAE Federal AML Law. Regulatory requirements are set out in the DFSA AML Rulebook.

Key Components of the AML Framework

Component	Requirement	Documentation
Risk Assessment	Enterprise-wide AML risk assessment	Documented risk matrix, annual review
Policies & Procedures	Comprehensive AML/CTF policies	AML Policy, CDD Procedures, SAR Procedures
CDD/KYC	Customer Due Diligence for all clients	KYC forms, verification documents, risk rating
EDD	Enhanced Due Diligence for high-risk clients	Source of wealth, source of funds documentation
Ongoing Monitoring	Transaction monitoring, periodic reviews	Monitoring reports, trigger alerts
Sanctions Screening	Screening against sanctions lists	OFAC, UN, EU, UAE lists; screening logs
SAR/STR	Suspicious Activity Reporting	Internal escalation, goAML reporting
Record Keeping	Records retention minimum 6 years	CDD files, transaction records
Training	Regular AML training for all staff	Training records, attendance, testing

Customer Due Diligence (CDD) Requirements

Client Type	Standard CDD	Enhanced CDD (EDD)
Individuals	ID verification (passport, Emirates ID), proof of address, source of funds (basic)	+ Source of wealth, detailed financial profile, independent verification
Corporates	Certificate of incorporation, shareholder register, directors list, UBO identification	+ Corporate structure chart, group accounts, media searches
Trusts	Trust deed, trustees, beneficiaries, settlor	+ Full understanding of trust purpose, protector details
Funds	PPM/Prospectus, subscription agreements, look-through to underlying investors	+ Full investor list, AML procedures of fund manager

High-Risk Categories (require EDD)

PEPs — Politically Exposed Persons (and their close relatives/associates)
High-risk jurisdictions — countries from FATF grey/black lists
Complex structures — multi-level structures, nominees, bearer shares
Cash-intensive businesses — businesses with a high proportion of cash
Correspondent banking — relationships with correspondent banks
Private banking — high-net-worth clients (HNWI)
Non-face-to-face — remote onboarding with no physical meeting

Money Laundering Reporting Officer (MLRO)

The MLRO is a separate Controlled Function, often combined with that of Compliance Officer in smaller firms:

Function	Description
SAR Management	Receiving and assessing internal suspicious activity reports
goAML Reporting	Filing SAR/STR to the UAE Financial Intelligence Unit via goAML
AML Program Oversight	Responsibility for effectiveness of the AML program
Annual AML Report	Annual report to the Board and DFSA on AML compliance status
Regulatory Contact	Contact point for the DFSA and FIU on AML matters

Sanctions Compliance

DIFC firms are required to comply with various sanctions regimes:

Regime	Applicability	Consequences of Breach
UAE Federal Sanctions	Mandatory	Criminal liability
UN Sanctions	Mandatory (implemented in UAE law)	Criminal liability
OFAC (US)	For USD transactions or US nexus	Secondary sanctions, fine, exclusion from US banking
EU Sanctions	For EUR transactions or EU nexus	Fines, restriction from EU banking
UK Sanctions	For GBP transactions or UK nexus	Criminal liability in the UK

Best Practice: Screening against the consolidated list (UN + UAE + OFAC + EU + UK) at onboarding and regularly (daily or per transaction).

Conduct of Business Rules

Apart from AML, firms must comply with COB (Conduct of Business) rules:

Area	Requirement
Client Classification	Proper classification (Retail, Professional, Market Counterparty)
Suitability	Assessment of suitability of recommendations for the client
Disclosure	Disclosure of product, risk, commission information
Best Execution	Obligation to execute at the best price
Conflicts of Interest	Identification, management, and disclosure of conflicts of interest
Inducements	Restrictions on receiving/providing inducements
Client Assets	Segregation of client assets, reconciliation
Complaints	Complaints handling procedure
Marketing	Fair, clear, not misleading communications

Reporting Obligations

Report	Deadline	Recipient	Contents
Quarterly Regulatory Return	30 days after quarter-end	DFSA	Capital, risk metrics, business data
Annual Audited Financials	4 months after year-end	DFSA	Audited financial statements
Compliance Officer Report	Annually	Board + DFSA	Compliance activities, issues, recommendations
MLRO Annual Report	Annually	Board + DFSA	AML program status, SARs, issues
Breach Notification	Immediately / 1 working day	DFSA	Material regulatory breaches
Suspicious Activity Report	Immediately	goAML (FIU)	Suspicious transactions/activities
Material Changes	Before change / 7 days after	DFSA	Changes to business, people, capital, control

Penalties for Non-Compliance

Breach	Typical Sanction
Late filing of returns	$500 per day late (automatic)
AML documentation failures	$10,000 - $100,000 per instance
Failure to report SAR	$50,000 - $500,000+, personal liability
Suitability failures	$50,000 - $200,000, client compensation
Conflicts of interest breaches	$50,000 - $300,000
Serious AML failures	$500,000 - $1,000,000+, license conditions/revocation
Sanctions violations	Criminal referral, unlimited fines

Compliance Program: Key Elements

Compliance Manual — comprehensive policies & procedures manual
Compliance Monitoring Plan — annual plan of compliance testing
Compliance Risk Assessment — assessment of key compliance risks
Training Program — annual training calendar, attendance tracking
Breach Register — log of all compliance breaches and remediation
Regulatory Register — tracking of all regulatory obligations and deadlines
Conflicts Register — log of identified conflicts of interest
Gifts & Entertainment Register — tracking of inducements
Complaints Register — log of client complaints and resolution

Recommendations for the CIO

Invest in compliance infrastructure — saving on compliance = risk of major losses
Hire experienced CO/MLRO — experience in DFSA-regulated firms is preferred
Automate where possible — screening, monitoring, reporting systems
Regular training — not only annual, but also when regulatory changes occur
Board engagement — compliance should be an agenda item at every Board meeting
External review — periodic independent compliance review