November 11, 2026 · Jurisdiction Briefing · 7 min read

UAE: the Compliance Officer’s five duties and high-risk countries under Cabinet Resolution No. (134) of 2025

Two short Divisions of the UAE Executive Regulations sit side by side. Division Eight sets out who the Compliance Officer is and what the role does. Division Nine says what a firm must do when a customer or a transaction comes from a high-risk country.

Cabinet Resolution No. (134) of 2025 holds both. The CBUAE Rulebook shows the Resolution effective from 14 December 2025, with the status In-Force. This briefing reads Articles (22) and (23), and the articles they connect to in the Resolution and in Federal Decree by Law No. (10) of 2025.

Both articles bind the same three groups: financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs).

The appointment: four conditions in one sentence

Article (21) already requires internal policies to include compliance management arrangements, “including the appointment of a Compliance Officer at management level”. Article (22) then sets the conditions. The firm must appoint a Compliance Officer who is:

at management level;
under the firm’s responsibility;
independent in decision-making;
of appropriate competence and experience.

Independence and seniority are written into the appointment itself, not left to a policy. Our reading: a reporting line that lets a business head overrule the Compliance Officer’s decisions is hard to square with “independence in decision-making”.

The Resolution does not mention a deputy or alternate Compliance Officer.

The five duties

Article (22) lists five duties.

Monitoring transactions related to the Crime. “The Crime” is the Decree by Law’s defined term: money laundering and its predicate offences, the financing of terrorism, or proliferation financing. The Arabic text uses the word ضبط, which in our reading leans towards detecting and controlling such transactions rather than only watching them.
Deciding on suspicious transactions. The Compliance Officer reviews records, receives, examines and assesses suspicious transaction data, and decides whether to notify the Financial Intelligence Unit or to retain the matter, stating the reasons, in full confidentiality.
Reviewing the AML/CFT/CPF systems. This means reviewing internal systems and procedures, assessing their consistency with the Decree by Law and the Resolution, evaluating the firm’s level of compliance, and proposing updates. It ends in periodic reports.
Training. Developing, implementing and documenting ongoing programmes and training plans for employees on all matters related to the Crime and how to combat it.
Cooperating with the authorities. Cooperating with the Supervisory Authority and the Unit, providing any data they request, and giving their assigned staff access to the records and documents they need.

The decision not to report is a decision

Duty 2 gives the Compliance Officer two outcomes, notify or retain, and requires reasons. The reporting duty itself sits in Article (18) of the Decree by Law: where a firm suspects, or has reasonable grounds to suspect, that a transaction or funds are proceeds of or related to the Crime, “regardless of their value”, it must notify the Unit without delay and directly.

Our reading: a file that records only the reports filed, and not the reasons for each matter retained, does not show the second half of duty 2.

The periodic report goes up, and can go out

Under duty 3, the periodic reports go directly to Senior Management. A copy goes to the concerned Supervisory Authority on its request, and that copy includes Senior Management’s observations and decisions.

Senior Management is a defined term. It covers the persons with authority to take strategic and executive decisions materially affecting risk management, compliance policies and operational governance, including chief executive officers, general managers and board members.

Our reading: because the supervisor can ask for the report together with management’s response, the minutes of what Senior Management decided on each recommendation belong in the same file as the report.

The supervisor’s side: a list of Compliance Officers

Article (49) expands the competences of Supervisory Authorities. Clause (18) is about this role. In the English text it reads: maintaining an updated list of the Compliance Officers of supervised entities, notifying the Unit of it, and requiring such entities to obtain its prior approval before appointing their Compliance Officers.

The Arabic text of the same clause says that the Supervisory Authority may (ولها) require prior approval. Our reading of the Arabic: prior approval is a power the supervisor can use, rather than a step that applies in every case. Check what your own Supervisory Authority requires before you appoint or replace a Compliance Officer.

Article (23): high-risk countries

Article (23) has two clauses.

Enhanced due diligence. Firms must apply Enhanced Customer Due Diligence measures proportionate to the level of risk arising from a Business Relationship or Transactions with a natural or legal person from countries identified by the National Committee as high-risk, or from countries with deficiencies in their AML/CFT/CPF systems.
Countermeasures. Firms must apply countermeasures and any other measures required by the Supervisory Authority, whether on its own initiative or as determined by the National Committee, in relation to those same two groups of countries.

Two groups, not one. The article names countries the National Committee identifies as high-risk, and countries with deficiencies in their systems. The second clause also lets the Supervisory Authority require measures on its own initiative.

Who decides which countries

The Decree by Law sets up the National Committee for Combating Money Laundering, the Financing of Terrorism, and Proliferation Financing under the chairmanship of the Governor (Article (13)). Article (14)(3) makes it competent to coordinate with the Concerned Authorities and refer to the relevant international information sources to identify high-risk countries and countries with deficiencies, to determine countermeasures and other appropriate measures commensurate with the degree of risk, and to direct the Supervisory Authorities to verify that firms apply them, “without obstructing or delaying their legitimate and charitable activities”.

Neither the Decree by Law nor the Resolution names a particular international list.

The Supervisory Authority carries the decisions to firms. Under Article (49)(16) of the Resolution, it must establish controls and procedures to ensure that firms are notified of, and comply with, National Committee decisions on enhanced due diligence measures and countermeasures, on concerns about deficiencies in other countries’ systems, and any other decisions of the Committee.

What “enhanced” can mean

Article (23) does not list the measures. Article (5)(2)(c) gives examples of Enhanced Due Diligence measures, “by way of example”, among them:

obtaining and verifying additional information on the customer, the beneficial owner and the amount of funds, including from public databases and open sources;
obtaining additional information on the purpose of the relationship or the reasons for transactions;
taking Reasonable Measures to identify the source of funds and wealth of the customer and the beneficial owner;
increasing the degree and level of ongoing monitoring;
carrying out the first payment through an account in the customer’s name with a financial institution subject to equivalent due diligence standards;
obtaining Senior Management approval to commence or continue the relationship.

“Proportionate to the level of risk” is the test in Article (23)(1). Our reading: the file should show which of these measures were chosen for the country exposure and why, not just that a high-risk flag was raised.

Where the country list reaches beyond Article (23)

The same country risk appears in other parts of the Resolution:

Risk assessment. Article (5)(1)(a) requires firms to consider countries and geographic risk, with the other risk factors, before deciding the overall level of risk.
High-Risk Customers. The definition includes customers from high-risk countries.
Reliance on third parties. Article (20)(1) allows reliance taking into account the countries identified by the National Committee as high-risk and countries with deficiencies. Where the third party is in the same Financial Group, Article (20)(2)(b) requires that any high country risks are adequately mitigated through the group’s policies and controls.

Article (23) does not define what makes a person “from” a country. Our reading: the policy should say which links count, for example nationality, residence, place of incorporation or the location of the counterparty, and apply them the same way in onboarding and in transaction monitoring.

How the two articles meet

The Compliance Officer’s duty 3 is to assess whether internal systems are consistent with the Decree by Law and the Resolution. Article (23) is one of the provisions those systems have to apply, and it can change whenever the National Committee or the Supervisory Authority decides new measures. Our reading: the periodic report is a natural place to show that each new decision was received, applied and tested.

What to do with this

Check the appointment against the four conditions. Management level, under the firm’s responsibility, independent in decision-making, competent and experienced. Write down how the reporting line protects the independence.
Confirm your supervisor’s approval process. Before appointing or replacing the Compliance Officer, check whether your Supervisory Authority requires its prior approval.
Plan cover. The Resolution does not mention a deputy. Decide who acts when the Compliance Officer is absent, and how that fits the supervisor’s process.
Record the retained matters. For every suspicious-transaction matter not reported, keep the reasons, held in confidence.
Keep management’s response with the report. File Senior Management’s observations and decisions with each periodic report, ready for a supervisor’s request.
Track both country groups. Keep a current record of the countries the National Committee identifies as high-risk and those with deficiencies, and of the measures your Supervisory Authority requires, and show where each one is applied in onboarding, monitoring and reliance.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates