· Jurisdiction Briefing

ADGM: two FSRA final notices on AML, five late AML Returns and a company service provider’s 104 customers

The ADGM Financial Services Regulatory Authority published two Final Notices for contraventions of its Anti-Money Laundering and Sanctions Rulebook in November and December 2025. One went to Payward MENA Holdings Limited on 17 December 2025. The other went to…

Illustration for “ADGM: two FSRA final notices on AML, five late AML Returns and a company service provider's 104 customers”

The ADGM Financial Services Regulatory Authority published two Final Notices for contraventions of its Anti-Money Laundering and Sanctions Rulebook in November and December 2025. One went to Payward MENA Holdings Limited on 17 December 2025. The other went to FWS Group Ltd on 24 November 2025. Both were issued under section 251 of the Financial Services and Markets Regulations 2015, and both firms settled.

One case is about a filing that did not reach the regulator for years; the other is about a business that did not recognise who its customers were. This briefing sets out what each notice says the FSRA found, which Rules it found contravened and how it set the penalty, then what an MLRO can take from them.

A note on names. The notices call the FSRA “the Regulator” and the rulebook “the AML Rules”. This briefing says “the FSRA”. Rule numbers are given as the notices cite them. The rulebook in force today is AML VER11.210526, dated after both notices; one Rule that sits under a different number there is noted below.

Payward MENA Holdings: five AML Returns, filed on one day

Payward MENA Holdings Limited (“PMH”) held a Financial Services Permission granted on 12 December 2019 to operate a Multilateral Trading Facility and to provide custody.

What the FSRA found

AML Rule 4.6.1 requires a Relevant Person to complete and submit its AML Return by the end of April each year, covering 1 January to 31 December of the preceding year. The notice records that PMH submitted its AML Returns for the calendar years 2020 to 2024 on 16 December 2025, each of which had been due by 30 April of the following year.

It was not for want of reminders. The notice lists FSRA notices to Relevant Persons about the AML Return, issued between February 2020 and March

  1. The 2024 one made submission through the FSRA Connect platform mandatory

and said the FSRA would no longer accept any other form of submission.

The notice then sets out the correspondence with the firm. On 26 July 2024 the FSRA wrote that a late fee had been imposed, that PMH had to submit its outstanding 2023 AML Return immediately, and that it would consider disciplinary action if PMH did not. On 28 April 2025 PMH confirmed it had access to FSRA Connect but said that, due to internal issues, it was unable to submit the AML Return. On 12 May 2025 PMH told the FSRA that the primary user previously associated with its account had left the company, and asked for new credentials to be issued to the MLRO. Further reminders followed in May, June and August 2025.

What was contravened

The FSRA found that PMH contravened:

  • AML Rule 4.6.1, for failing to complete and submit each of its 2020 to 2024 AML Returns by 30 April of the following year;
  • GEN Rule 2.2.3 (Principle 3 of the Principles for Authorised Persons), for failing to have adequate systems and controls to ensure that it complies with the Regulations and Rules; and
  • FEES Rule 1.2.7, for failing to pay the late fees associated with the outstanding Returns. A late fee of USD 500 per late AML Return applied, and for the calendar years 2021 to 2024 PMH owed late filing fees totalling USD 2,000.

Why a penalty, and how much

The FSRA said the late filing fees alone did not adequately address PMH’s persistent non-filing and would not deter such conduct in the future. It noted that the delay was approximately five years, and that the missing Returns had hindered its ability to assess PMH’s compliance with AML requirements over an extended period. It also considered there was a high likelihood that the Returns would have remained outstanding if no action was taken.

The notice works through the five steps in section 8.5 of the FSRA’s Guidance & Policies Manual. It put the seriousness figure at USD 50,000. It treated as mitigating that PMH had no previous history of non-compliance, that its operations were limited in scale and duration with a limited number of clients, and that the FSRA did not identify any customer loss, misuse of client assets, or financial crime arising from the contraventions. It treated as aggravating that PMH was made aware of the breaches but did not address them in a timely manner. The net result was a 10% reduction, to USD 45,000. No deterrence uplift was applied. A 20% discount for early settlement brought the penalty to USD 36,000. The FSRA acknowledged that PMH and its senior management cooperated fully and that PMH has remediated the issues.

FWS Group: a business centre that had more customers than it thought

FWS Group Ltd (“FWS”) was incorporated in ADGM on 1 September 2022 and carries on business as a registered Company Service Provider, which makes it a Designated Non-Financial Business or Profession (DNFBP). It operates a business centre where other entities take short-term or flexible leases of offices or desks.

FWS had outsourced two things. The running of the centre went to a third party the notice calls Company A, which collected rent from tenants. Its compliance function went to Company B, which also provided its MLRO. FWS has no staff working in ADGM.

The FSRA reviewed FWS between 7 November and 29 December 2023. Its findings relate to the period from 1 December 2022 to 30 December 2023.

Who the customers were

FWS and Company B initially told the FSRA that FWS had only one customer, Company A. The FSRA looked at the arrangements and disagreed. Among other points, the contract between Company A and FWS named FWS as the customer, each tenancy contract had FWS as a party to the agreement, and FWS was responsible for the property costs payable to the ADGM landlord. The FSRA concluded that the tenants were customers of FWS, not of Company A. That made 104 customers, each of which needed a customer risk assessment and appropriate CDD.

The notice is clear that outsourcing did not move the responsibility. In the FSRA’s words, FWS “still had the ultimate responsibility (as a DNFPB) for ensuring compliance with the AML Rules and is therefore liable for any failure to meet them.”

What the file review found

The FSRA reviewed ten of the 104 customer files. Its findings, as the notice states them:

  • Policies and procedures. They did not reference the requirements of AML Rule 8.3.1 on standard CDD.
  • Business risk assessment. The policies referred to one, but there was no evidence that FWS had conducted one.
  • Customer risk assessment. FWS stated there was no available evidence that customer risk assessments were completed for any of its 104 customers. One reviewed customer had been rated low risk with no explanation on file, and the documents held related to its overseas parent rather than to the customer renting the space.
  • Identity verification. Only seven KYC forms were present on the ten files. For all ten, the files lacked certified true copies of identification documents and/or evidence that the originals had been sighted. Eight lacked Articles and/or Memorandum of Association.
  • Ongoing CDD. For one customer, the identification documents its director had provided had expired on 4 March 2021. The rental period ran from 17 April 2023 to 30 April 2024. The FSRA said this demonstrates that ongoing CDD was not being undertaken.
  • Enhanced due diligence. Source of funds and source of wealth information was limited or missing on all ten files. For one customer identified as a PEP, FWS did not undertake EDD, and the file held no adverse information even though the customer’s Beneficial Owner had adverse media and was on the Sanctions Lists of three foreign jurisdictions.

The MLRO who was not there

Only when asked during the review, on 20 December 2023, did FWS disclose that its MLRO had been on long-term sick leave since August 2023 and that Company B had replaced the appointed MLRO with an individual acting as Deputy MLRO. The FSRA said the deputy role was meant to be temporary, that FWS failed to notify it promptly of the change, and that FWS did not appoint a new MLRO until June 2024, ten months after the MLRO was absent.

What was contravened

The FSRA found contraventions of AML Rules 4.1.1(1), 4.1.1(2)(a) and 4.1.1(2)(d) (policies, procedures, systems and controls); 6.1.1 (business risk assessment); 7.1.1(1)(a), 7.1.1(1)(b) and 7.1.2(1)(a) (customer risk assessment); 8.3.1(1)(d) (ongoing due diligence); 8.3.2 (verifying customer identity); 8.4.1(c) (source of funds and source of wealth for high-risk customers and PEPs); 12.1.1(1) (appointing a suitable MLRO); and 15.6.1(d) (promptly informing the FSRA of a change in MLRO).

On that last one: in the rulebook in force today, AML VER11.210526, the duty on a DNFBP to promptly notify the FSRA of any change in its MLRO sits in Rule 15.3.1(d).

The penalty

The FSRA described the contraventions as revealing systemic weakness in FWS’s customer risk assessment, CDD and, where required, EDD practices, and noted that the failings extended across all 104 customers. It found no aggravating factors. It counted as mitigating that FWS had no previous history of non-compliance, cooperated, ran a remediation programme and strengthened its AML systems and controls, and it adjusted the penalty by 15%, to USD 63,750. No deterrence uplift was applied. A 20% early-settlement discount brought the penalty to USD 51,000. FWS agreed not to refer the matter to the Appeals Panel.

What an MLRO can take from these

  1. Treat the AML Return as a control, not a form. Part of what the Payward MENA notice describes is administrative: the primary user of the firm’s FSRA Connect account had left. The FSRA still found a systems-and-controls failure under GEN 2.2.3, and said the late fees were not enough. Keep more than one registered user on the portal, put the April deadline in the compliance calendar with a named owner, and record the filing in your board reporting.
  2. Decide who your customer is from the contracts, not from the operating model. The FSRA looked at who signed, who was named and who bore the costs. If a third party runs a business line in your name, read those contracts with the CDD rules open beside them.
  3. Outsourcing compliance does not outsource accountability. The FWS notice says so plainly. Rule 12.1.6 lets a firm outsource the MLRO role to an individual outside the firm, provided that individual “is and remains suitable”. Ask your provider for evidence you could show the FSRA: the customer list it is working from, the risk ratings, and the files.
  4. Know the difference between a deputy and a replacement. Rule 12.1.4 requires a deputy MLRO to fulfil the role in the MLRO’s absence, and Rule 12.1.3 requires the firm to immediately appoint a new MLRO or arrange temporary cover if the MLRO leaves. FWS had a deputy in place and was still found in breach: the FSRA said the deputy role was meant to be temporary, and found that FWS did not file the form appointing a new MLRO or promptly notify it of the change. If your MLRO’s absence runs beyond a short period, make the notification decision in writing.
  5. Check your file before the regulator samples it. The FSRA reviewed ten files out of 104. Pick ten of your own at random and test them against the same points: a documented risk rating with reasons, certified or sighted identification, constitutional documents, current director IDs, and source of funds and wealth where the risk calls for it.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu