· Jurisdiction Briefing

ADGM: the MLRO must be UAE-resident, filed with the FSRA for approval, and reporting twice a year

Chapter 12 of the FSRA's Anti-Money Laundering and Sanctions Rulebook is short. It says who may hold the Money Laundering Reporting Officer role in Abu Dhabi Global Market, what the firm owes that person, what the person is answerable for, and what must reach…

Illustration for “ADGM: the MLRO must be UAE-resident, filed with the FSRA for approval, and reporting twice a year”

Chapter 12 of the FSRA’s Anti-Money Laundering and Sanctions Rulebook is short. It says who may hold the Money Laundering Reporting Officer role in Abu Dhabi Global Market, what the firm owes that person, what the person is answerable for, and what must reach the firm’s leadership and the regulator. This briefing walks through it as it stands in the rulebook AML VER11.210526, together with the handful of Rules elsewhere in the rulebook that Chapter 12 points to.

One note on names. The rulebook says “the Regulator”, which it defines as the ADGM Financial Services Regulatory Authority. It says “Relevant Person” for the firm. This briefing says “the FSRA” and “the firm”.

Who has to appoint one

Rule 1.2.1(2) sets out which chapters apply to whom. Chapters 1 to 14 apply to an Authorised Person, other than a Credit Rating Agency, and to a Recognised Body. Chapters 1 to 6 and 11 to 14 apply to a Representative Office. Chapters 1 to 9 and 11 to 15 apply to a DNFBP. Chapter 12 sits inside each of those ranges. A non-profit organisation is the exception: only Chapter 16 applies to it.

Appointment: an individual, a form, and a UAE address

Rule 12.1.1(1) requires the firm to appoint an individual as MLRO. That individual must have an appropriate level of seniority, experience and independence, and carries responsibility for implementation and oversight of the firm’s compliance with the Rules in the AML Rulebook. The appointment is made by completing and filing the form the FSRA specifies, for the FSRA’s approval.

Rule 12.1.1(2) then adds the residence condition. The MLRO must be resident in the UAE, and the Rule applies that to an outsourced MLRO under Rule 12.1.6 as well. The Guidance leaves one door open, and qualifies it:

> “In appropriate circumstances, the Regulator may, for a limited period, waive > the requirement for an MLRO to be resident in the UAE.”

There is one concession for the smallest DNFBPs. Under Rule 12.1.2, where a DNFBP comprises one officer, partner or principal, that person can also be the MLRO, but only with the prior approval of the FSRA.

The deputy, and what happens when the MLRO leaves

A firm other than a Representative Office must appoint an individual as deputy MLRO, to fulfil the role in the MLRO’s absence (Rule 12.1.4). The Guidance says the deputy need not apply for the FSRA’s approval.

If the MLRO leaves the firm’s employment, Rule 12.1.3 applies: the firm must immediately appoint a new MLRO or arrange temporary cover.

Absence short of departure is dealt with in Guidance. The firm should make adequate arrangements to stay compliant while its MLRO is away. Adequate arrangements, it says, would include appointing a temporary MLRO for the period of absence, or making sure the firm’s AML/TFS systems and controls allow it to keep complying when the MLRO is absent.

Both the MLRO and the deputy carry a personal conduct duty towards the regulator. Rule 12.1.5 requires them to deal with the FSRA in an open and co-operative manner, and to disclose appropriately any information of which the FSRA would reasonably be expected to be notified.

Outsourcing the role

Rule 12.1.6 allows a firm to outsource the MLRO role to an individual outside the firm, provided that individual “is and remains suitable to perform the MLRO role”. Note the word “remains”. Suitability is a continuing condition, so it has to be checked more than once.

The Guidance closes off the idea that outsourcing moves the responsibility. Where a firm outsources specific AML/TFS tasks of its MLRO to another individual or a third-party provider, including one inside its own corporate Group, the firm remains responsible for ensuring that the duties undertaken by the MLRO ensure its compliance with the AML Rulebook. The firm should also satisfy itself of the suitability of anyone who acts for it in the role.

The Guidance to Rule 12.2.1 returns to the point. The FSRA considers that a firm will need to consider that Rule most especially when appointing an outsourced MLRO, and that any external MLRO will need the actual or effective level of seniority the role requires.

What the firm owes its MLRO

Rule 12.2.1 is headed “Qualities of an MLRO”, but it is drafted as a duty on the firm. The firm must ensure that its MLRO has:

  • direct access to the Governing Body and Senior Management;
  • sufficient and up-to-date qualifications and experience for the role, and appropriate opportunities to undertake training;
  • sufficient resources, including, if necessary, an appropriate number of appropriately trained Employees to help the MLRO perform the duties in an effective, objective and independent manner;
  • a level of seniority and independence within the firm that lets the MLRO act on their own authority;
  • timely and unrestricted access to the information the firm has about the financial and business circumstances of a customer, or of any Person on whose behalf the customer is or has been acting, sufficient to carry out the responsibilities in Rule 12.3.1;
  • unrestricted access to relevant information about the features of the Transaction the firm has entered into, or may have contemplated entering into, with or for that customer or Person.

The independence point is repeated in Chapter 14. Under Rule 14.3.4, if the MLRO decides to make a SAR/STR, the firm must ensure that the decision is made independently and is not subject to the consent or approval of any other Person.

What the MLRO is answerable for

Rule 12.3.1 requires the firm to ensure that its MLRO implements, has oversight of, and is responsible for, the following matters:

  • the day-to-day operations for the firm’s compliance with its AML/TFS policies, procedures, systems and controls;
  • acting as the point of contact for internal notifications of suspicious activity from Employees under Rule 14.2.2, and taking appropriate action under Rule 14.3.1 once one is received;
  • making Suspicious Activity/Transaction Reports in accordance with Federal AML Legislation;
  • acting as the firm’s point of contact for competent UAE authorities and the FSRA on money laundering issues, and responding promptly to their requests for information;
  • receiving and acting upon the relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions described in Chapter 11;
  • establishing and maintaining an appropriate money laundering training programme and adequate awareness arrangements under Chapter 13;
  • reviewing and assessing the firm’s AML/TFS policies, procedures, systems and controls for consistency with the AML Rulebook and Federal AML Legislation, and recommending updates and enhancements if necessary.

On internal notifications, Rule 14.3.1 sets the pace. On receiving an internal notification the MLRO must, without delay, investigate and document the circumstances, determine and document whether a SAR/STR must be made under Federal AML Legislation, and, if required, make it as soon as practicable. Where no SAR/STR follows, Rule 14.3.2 has the MLRO document the reasons.

None of this moves accountability off the firm’s leadership. Under Rule 1.3.3, responsibility for the firm’s compliance with the AML Rulebook lies with every member of the Governing Body and its Senior Management. The same Rule requires every member of the Governing Body, the Senior Management and the MLRO, as the case may be, to exercise due skill, care and diligence in carrying out their responsibilities under the rulebook.

The semi-annual report, and the copy that goes to the FSRA

Rule 12.4.1 sets a reporting cycle. The MLRO must report semi-annually to the Governing Body or Senior Management on:

  • the results of the review under Rule 4.1.1(4);
  • the firm’s compliance with Federal AML Legislation and the FSRA’s Regulations and Rules, the AML Rulebook included;
  • relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions, and how the firm has taken them into account;
  • internal notifications of suspicious activity made to the MLRO, and the action taken on them, including the grounds for all decisions;
  • SARs/STRs made by the firm, with the action taken and the grounds for all decisions;
  • other relevant AML/TFS matters as they concern the firm’s business.

The items on internal notifications and on SARs/STRs both reach beyond the firm’s own staff. They cover notifications and reports made by the firm’s agents, or by members of its Group where acting on its behalf.

The review is the link to Chapter 4. Rule 4.1.1(4) requires the firm to review the effectiveness of its AML/TFS policies, procedures, systems and controls at least annually, taking into account the business risk assessment under Chapter 6. The review may be done internally by the internal audit or compliance function, or by a competent firm of independent auditors or compliance professionals. Under Rule 4.1.2 it must cover at least sample testing of customer documentation, an analysis of all SARs/STRs to highlight where procedures or training may need to be enhanced, and a review of the adequacy of the responsibility and oversight exercised by the Governing Body and Senior Management.

The report does not end at delivery. Rule 12.4.2 requires the firm to ensure that its Governing Body or Senior Management promptly assess the report, take action as required to resolve any identified deficiencies, and make a record of both the assessment and the action.

Then comes the step that makes this an external document. Under Rule 12.4.3, the firm must provide to the FSRA a copy of the MLRO’s report and a copy of the record the Governing Body or Senior Management made. The MLRO’s report is also on the list of records in Rule 4.5.1, which must be kept for at least six years, counted from the last to occur of the events that Rule lists.

A separate filing: the annual AML Return

The semi-annual report is not the AML Return. Rule 4.6.1 requires the firm to complete the prescribed AML Return form and submit it to the FSRA by the end of April each year, covering 1 January to 31 December of the preceding year. A firm licensed or authorised on or after 1 November of the preceding year is excepted. The Guidance refers to FEES 1.2.7 for the fees payable for late submission of Regulatory Filings, and adds that the FSRA may take further action in addition to imposing a fee.

Four things worth doing

  1. Test the appointment against 12.1.1 and 12.2.1 together. One Rule is about the person and the other is about what the firm gives the person. An MLRO with the right background and no direct line to the Governing Body meets only one of them.
  2. Put suitability of an outsourced MLRO on a review cycle. The Rule says “is and remains suitable”. Record who checks it and when.
  3. Write the semi-annual report knowing a copy goes to the FSRA. It goes with the record of the assessment and action by the Governing Body or Senior Management. Give the grounds for each decision on internal notifications and SARs/STRs, as the Rule asks, and make sure the response is minuted in a form you are content to send.
  4. Plan cover before you need it. The Rule on a departing MLRO says “immediately”. Agree now who steps in, and whether your deputy arrangement would hold for an absence of several weeks.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu