The AML/CFT laws and regulations in the UAE require regulated entities to maintain various records in relation to AML compliance. Further, the entities also take a risk-based approach and define the AML/CFT policies and procedures. An independent review of the AML/CFT program and records goes a long way in ensuring legal compliance. Here is the article providing insights into the Role of External AML Audits and Compliance Reviews in AML Compliance.
The Designated Non-Financial Businesses and Professions (DNFBPs) and Virtual Asset Service Providers (VASPs) operating in the UAE are required to have in place adequate Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) policies, procedures, and controls to mitigate the Money Laundering, Financing of Terrorism, and Proliferation Financing of weapons of mass destruction (ML/FT/PF) risks and to ensure compliance with the AML/CFT regulations. As a part of compliance with AML/CFT regulations, the DNFBPs and VASPs need to carry out independent AML audits to assess the effectiveness of the AML/CFT policies, procedures, and controls.
The term auditing is generally used to refer to the checking and assessment of a business’s books of accounts. However, from the perspective of UAE’s AML/CFT regulations, an AML Audit checks the effectiveness and efficacy of the AML/CFT measures taken by the businesses operating in the UAE.
The AML/CFT measures that usually fall under the ambit of AML Audit are the enterprise-wide risk assessment and AML/CFT policies, procedures, and controls relied upon to mitigate the ML/FT and PF risks.
The UAE’s AML/CFT regulations require the DNFBPs and VASPs to have an independent and bias-free AML audit function. AML audit can be undertaken by an internal audit function or entities or professionals providing external AML audit services.
An External AML audit becomes necessary for DNFBPs and VASPs due to the presence following reasons:
The nature of business for DNFBPs and VASPs is diverse and dynamic, leading to growth and expansion opportunities in several ways, such as opening branches, hiring a larger workforce, expanding in newer jurisdictions, and mergers and acquisitions. These opportunities bring along with them an increase in ML/FT and PF risk, requiring enhancement in ML/FT and PF risk mitigation measures, leading to an increase in ML/FT and PF risks. Such an increase in risk factors leads to the need to enhance risk mitigation measures and necessary updates and changes in the AML/CFT framework. Changes in the AML/CFT framework require auditing to ensure that such measures are effective in curbing ML/FT and PF.
Additionally, AML audits help the DNFBPs and VASPs to ensure continuous compliance with the AML/CFT regulations in the UAE, which provides for the need to conduct AML audits.
An external AML audit is conducted by professionals or entities with knowledge and experience of the AML/CFT regime applicable to the UAE.
An External AML Auditor can be appointed by ensuring that the following requirements are being met:
1. While looking for a suitable External AML Auditor, the DNFBPs and VASPs must ensure that an External AML Auditor has sound knowledge and understanding of the AML/CFT laws and regulations applicable in the UAE, including the relevant free zone where the DNFBP or VASP is operating in, this will ensure that the outcome of the AML Audit is in alignment with the applicable laws and regulations.
2. DNFBPs and VASPs must ensure that an External AML Auditor has relevant sector-specific knowledge and understanding of AML/CFT measures for which they are offering AML Audit services. For example, selecting an External AML Auditor with experience in the gold sector is the right choice for a DNFBP that is dealing with precious materials and stones as that would help the external AML auditor to deliver better AML audit findings to the DNFBP in the gold sector.
3. DNFBPs and VASPs must ensure that the External AML Auditor has comprehensive and in-depth knowledge of the limitations and capabilities of technology-based AML solutions that DNFBPs and VASPs usually rely on. The knowledge of technology based solutions would help the external AML auditor assess the procedural aspects of ML/FT risk mitigation requirements such as those concerning Customer Due Diligence (CDD) or name screening through the use of automation tools and software by testing or assessing the efficacy of results achieved by such tools and software. This would ensure that the AML audit report is formulated by taking into consideration the use of technology-based AML solutions, making the AML audit report complete in every sense.
4. DNFBPs and VASPs must ensure that the External AML Auditor has a stellar market reputation for their services. Ensuring this will increase their goodwill by creating an image of integrity in the marketplace.
5. DNFBPs and VASPs must ensure that the External AML Auditor follows a collaborative approach with them, enabling them to ensure that every effort made by DNFBPs and VASPs to curb ML/FT and PF is not going in vain and the external AML Auditor guides them in the right direction to remedy any shortcomings observed during the AML Audit.
The independent AML Auditor’s findings and recommendations contain the key potential to improve and enhance the AML compliance measures of any DNFBPs and VASPs. These recommendations must be seriously considered, and measures must be taken to remedy the shortcomings of the existing AML compliance framework. The DNFBPs and VASPs must also ensure that the recommendations are implemented uniformly across the branches and subsidiaries of the DNFBPs and VASPs to ensure that no potential ML/FT or PF threat is overlooked. The findings, reports, and recommendations for AML audits must be adequately catalogued and recorded by DNFBPs and VASPs to fulfil regulatory compliance requirements.
Conclusion
The DNFBPs and VASPs in UAE aiming to achieve ML/FT and PF-free business operations must formulate and implement robust AML/CFT policies, procedures, and controls.
Such policies, procedures, and controls must be tested and audited frequently to ensure that the CDD measures, risk assessment measures, and strength of CDD measures are adequate to mitigate ML/FT and PF risks.
Furthermore, when AML Audits are carried out by external AML Auditors, the DNFBPs and VASPs must ensure that such auditors are appropriate and suitable to carry out AML audits to help achieve maximum benefits out of such external AML audits.
Lastly, the findings and recommendations of the AML audit should be implemented uniformly across branches and subsidiaries to mitigate ML/FT and PF risks.
Jyoti is a Chartered Accountant and Certified Anti-Money Laundering Specialist (CAMS), having around 7 years of hands-on experience in regulatory compliance, legal advisory, policy-making, tax consultation, and technology project implementation.
Jyoti holds experience with Anti-Money Laundering regulations prevalent across various countries. She helps companies with risk assessment, designing and deploying adequate mitigation measures, and implementing the best international practices to combat money laundering and other financial crimes.
