What This Guide Covers
This AML guide for ADGM companies explains how anti-money laundering rules work inside Abu Dhabi Global Market. You will learn what the ADGM AML Rulebook is, who must follow it and who checks your compliance.
We then walk through the core obligations one by one: your business risk assessment and AML policies, customer due diligence, the MLRO role, staff training, suspicious activity reporting, record keeping and the annual AML Return. We finish with a simple table showing how ADGM rules differ from UAE federal AML law.
AML Guide for ADGM Companies: How the Rules Work
If you have set up in ADGM, or you are about to, you have probably heard people talk about “the Rulebook” as if everyone already knows what it is. Don’t worry if you don’t. This AML guide for ADGM companies starts right at the beginning.
Here is the big picture. ADGM companies follow two layers of AML rules. The first layer is UAE federal AML law, which applies across the whole country, ADGM included. Today that means Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025. If you are reading guides that still quote the 2018 law, they are out of date. The second layer is ADGM’s own rulebook, which adds more detail on top.
For the full federal picture, our guide to AML laws in the UAE is a good starting point.
What Is the ADGM AML Rulebook?
The ADGM AML Rulebook is the Anti-Money Laundering and Sanctions Rulebook issued by the Financial Services Regulatory Authority (FSRA), ADGM’s financial regulator. That’s why you will also see it called the FSRA AML Rulebook. Both names mean the same document. It sets out how ADGM firms must manage money laundering, terrorist financing and sanctions risk. Where international guidance and the Rulebook disagree, the Rulebook wins for ADGM firms. The FSRA finalised its latest round of updates in May 2026. The changes mostly align the Rulebook with the new federal law, so the day-to-day impact is small, but your policies should now refer to the current laws.
Who Needs to Follow It?
Most ADGM entities fall into one of four groups, and each group follows a different set of chapters:
| Type of ADGM entity | Examples | Rulebook chapters that apply |
|---|---|---|
| Authorised Persons and Recognised Bodies | Banks, fund managers, brokers, fintechs, virtual asset firms | Chapters 1–14 |
| Representative Offices | Local offices of overseas financial firms | Chapters 1–6 and 11–14 |
| DNFBPs | Real estate agents, company service providers, accountants, lawyers | Chapters 1–9 and 11–15 |
| Non-profit organisations | Charities and similar bodies | Chapter 16 |
So, a small ADGM accounting firm doesn’t follow the same rules as a bank, but it still has real obligations. If you are a DNFBP, our guide to AML laws for DNFBPs covers the federal side in more depth.
Who Checks Your Compliance?
It depends on what you do. The FSRA supervises financial firms. For DNFBPs, the ADGM Registration Authority handles AML monitoring under an arrangement with the FSRA. And whoever your supervisor is, suspicious activity reports go to the UAE Financial Intelligence Unit (FIU) through the goAML system.
Get ADGM AML Compliance Support
Business Risk Assessment and AML Policies
Everything in your AML programme starts with one question: where could someone use your business to launder money? Your business risk assessment answers that question, and every other control grows out of it.
What Your Business Risk Assessment Should Cover
A good risk assessment looks honestly at five areas:
- Customers: Who are they, how complex are their structures, and do any of them come with higher risk?
- Products and services: Which of your offerings could be misused, and how easily?
- Countries: Where are your customers based, and where does their money come from?
- Delivery channels: Do you meet clients face to face, or onboard them remotely or through introducers?
- Technology: Do new systems or products create new risks?
Once it is written, don’t leave it in a drawer. Review it at least once a year, and again whenever something changes, such as a new product, a new market or a change in the law. Regulator reviews of ADGM DNFBPs have flagged risk assessments that looked generic and didn’t reflect the actual business. A template with your company name dropped in won’t pass. This is what a risk-based approach looks like in practice: more effort where the risk is higher.
Turning the Risk Assessment into Policies and Controls
Your AML policies should follow directly from what the risk assessment found. If you deal with lots of overseas corporate clients, your policy needs strong beneficial ownership checks. If you take in cash or crypto, your monitoring rules need to reflect that.
Senior management should approve the policies and own them. In ADGM, regulators expect the board and senior managers to show real oversight, not just a signature on page one. If you need help building a framework that fits how you work, see our AML policies and procedures service.
Customer Risk Assessment and Customer Due Diligence
This is the part of AML that your team deals with every day. Customer due diligence (CDD) is simply about knowing who you are dealing with, why they want to work with you, and whether their activity makes sense.
Rating Your Customers: Low, Medium or High Risk
Before or during onboarding, every customer should get a risk rating. The main things to consider are:
- The customer’s ownership and control structure
- The type of business they run
- The nature and purpose of the relationship with you
- Their nationality and where they live
- For companies, where they are incorporated
A local individual buying a simple service is usually low risk. A layered offshore company with unclear owners is not. The rating decides how deep your checks need to go.
When You Need to Do CDD
You must carry out CDD:
- Before you start a business relationship
- Before an occasional transaction above the threshold
- Whenever you suspect money laundering or terrorist financing
- When you doubt the documents or information a customer gave you earlier
Under federal law, financial institutions must apply CDD to occasional transactions of AED 55,000 or more, and to occasional wire transfers of AED 3,500 or more. The ADGM Rulebook sets its own threshold for occasional transactions in US dollars, so check which one applies to your activity.
What CDD Actually Involves
In practice, CDD comes down to four things:
- Identify and verify the customer using reliable, independent documents.
- Find the real owners. For companies, trace ownership until you reach the actual people who own or control it (the beneficial owners).
- Understand the purpose of the relationship and the kind of activity you expect.
- Keep watching. Ongoing monitoring checks that transactions stay in line with what you know about the customer.
Extra Checks for High-Risk Customers
When a customer is rated high risk, standard checks aren’t enough. You need enhanced due diligence (EDD). That usually means:
- Gathering more information on the customer and its owners
- Confirming source of wealth and source of funds
- Getting senior management approval before onboarding
- Monitoring the relationship more often and more closely
Low-risk customers, on the other hand, may qualify for simplified checks. That only applies where your risk assessment genuinely supports it, and never where there is suspicion.
PEPs and Sanctions Screening
Two checks deserve special attention. First, find out whether the customer, its beneficial owners or senior managers are politically exposed persons (PEPs). PEPs usually need EDD. Second, screen all of them against the UAE Local Terrorist List and the UN Consolidated List, at onboarding and whenever those lists are updated. If you find a confirmed match, you must act immediately and report it. Screening isn’t a box ticked once at onboarding.
Money Laundering Reporting Officer (MLRO)
Every ADGM firm needs a named person who owns AML compliance. In ADGM, that’s the MLRO.
Who Can Be Your MLRO in ADGM?
Your MLRO must be a UAE resident, senior enough to make independent decisions, and fit and proper for the role. The FSRA must approve the appointment for Authorised Persons.
What the MLRO Does
The MLRO receives and reviews internal suspicion reports, decides whether to file with the FIU, and keeps the AML programme up to date. Federal law also expects the compliance officer to review your AML systems and prepare regular reports for senior management. In practice, that means a periodic MLRO report covering the state of your AML controls, key risks, reporting activity and any gaps that need fixing. The MLRO also oversees staff training and works with regulators when they ask for information.
If Your MLRO Leaves, or You Want to Outsource
People move on, so plan for it. If your MLRO leaves, appoint a replacement quickly, or at least a Deputy MLRO to cover in the meantime, and notify the regulator. The Rulebook also allows firms to outsource the MLRO role to a third party. Just remember that outsourcing the person doesn’t outsource the responsibility. Your firm remains accountable.
Get Professional Help to Strengthen Your AML Compliance
AML Training and Awareness
Your policies only work if your people understand them. The FSRA expects AML training that is proportionate to your firm’s risks and to each employee’s role. A front-desk onboarding officer needs different training from a board member.
Run training at least once a year and update it whenever your risks, products or the rules change. Good training uses real examples from your own business, such as how a suspicious client might behave, or what an unusual payment looks like in your sector.
Keep records of every session: the date, how long it lasted, what was covered and who attended. When an inspector asks how your team knows what to do, those records are your proof.
Reporting Suspicious Activities
At some point, someone on your team will see something that doesn’t feel right. What happens next matters a lot.
How Reporting Works in Practice
The flow is simple:
- Staff raise an internal report. Any employee who notices something suspicious reports it to the MLRO straight away, with all the details they have.
- The MLRO investigates. They review the customer, the transaction and the background, and decide whether the suspicion holds up.
- The MLRO files with the FIU. If it does, the MLRO submits a suspicious transaction report (STR) or suspicious activity report (SAR) through goAML.
Federal law says reports must go to the FIU without delay, whatever the amount involved. Keep an up-to-date list of red flags for your business, such as unexplained third-party payments, reluctance to share ownership details, or activity that doesn’t match the customer’s profile. It helps staff spot problems early.
Don’t Tip Off the Customer
Once you suspect something, be careful what you say. It’s illegal to tell a customer, directly or indirectly, that a report has been made or is about to be made, or that they are being investigated. This is called tipping off, and it’s a criminal offence under federal law. Train your team to keep conversations neutral and to escalate rather than explain.
AML Record Keeping
Good records prove you did what you say you did. ADGM firms should keep:
- Business risk assessments and AML policies
- CDD documents and information collected from customers
- Business correspondence and transaction records
- Internal and external suspicious activity reports, plus investigation notes
- Communication with the FIU and regulators
Federal law requires records to be kept for at least five years. ADGM firms must keep AML records for at least six years under the Rulebook, so follow the longer ADGM period. Store records so you can find and hand them over quickly, because regulators will expect you to produce them promptly on request.
AML Annual Return
This one is ADGM-specific. Every year, ADGM firms must complete and submit an AML Return covering the calendar year from 1 January to 31 December. The deadline is the end of April of the following year.
The return asks for information about your customers, risks, controls and reporting activity. It isn’t a formality. Regulators use it to decide where to focus their supervision, and the Registration Authority has reviewed the quality of AML Returns filed by DNFBPs. Firms licensed late in the year should check the latest Rulebook for how the first return works for them.
A simple tip: keep your data organised during the year, so the return is a pull of numbers rather than a scramble in April.
Take the Next Step Towards Stronger AML Compliance
ADGM AML Rules vs UAE Federal AML Law: Key Differences
No AML guide for ADGM companies is complete without comparing the two layers side by side. Here is where the ADGM rules go further than federal law:
| Topic | UAE federal AML law | ADGM AML Rulebook |
|---|---|---|
| Who supervises | Sector supervisors such as the Central Bank, MoET or MoJ | FSRA for financial firms; Registration Authority for DNFBPs |
| MLRO | Compliance officer at management level | MLRO must be a UAE resident; FSRA approval for Authorised Persons |
| Record keeping | At least 5 years | At least 6 years |
| Annual reporting | No ADGM-style annual return | AML Return every year, due by end of April |
| DNFBP scope | Set by federal regulations | ADGM defines DNFBPs in its own Rulebook |
The takeaway is simple. Meet federal law as your baseline, then layer the ADGM requirements on top. Where the two differ, follow whichever is stricter. That way you comply with both.
Need Help with ADGM AML Compliance?
An AML guide for ADGM companies can show you what the rules say, but applying them to your own business is the hard part. ADGM’s rules are detailed, and the FSRA and Registration Authority do inspect. Weak risk assessments, late reports or thin CDD files can lead to fines, restrictions and even loss of registration. For a breakdown of what’s at stake, see our guide to AML fines and penalties in the UAE.
GRC Advisors works with ADGM companies to build AML programmes that hold up under inspection. As ADGM compliance specialists in the UAE, we help with business risk assessments, AML policies, MLRO support, CDD reviews and training. When an inspection is coming, our regulatory inspection readiness service tests your evidence the way a supervisor would, and our internal audit team gives you an independent view of how well your controls work.
How GRC Advisors Helps ADGM Companies
GRC Advisors is a UAE-based governance, risk and compliance advisory firm. We work with banks, fund managers, fintechs, VASPs and DNFBPs across ADGM, DIFC, VARA and the UAE mainland. Our ADGM regulatory advisory work covers AML/CFT frameworks, risk assessments, MLRO support, CDD, training and inspection readiness, all built on current law. Whether you are setting up in ADGM or tightening an existing programme, our GRC services help you stay compliant and inspection ready.
Need an MLRO You Can Rely On?
FAQs About AML for ADGM Companies
What is the ADGM AML Rulebook?
It is the FSRA’s Anti-Money Laundering and Sanctions Rulebook. It sets out the AML, counter-terrorist financing and sanctions rules for ADGM firms, on top of UAE federal AML law.
Does UAE federal AML law apply in ADGM?
Yes. Federal AML law applies across the whole UAE, including ADGM. ADGM firms follow both federal law and the ADGM AML Rulebook.
Who supervises AML for ADGM companies?
The FSRA supervises financial firms. The ADGM Registration Authority monitors AML compliance for DNFBPs under an arrangement with the FSRA.
Does my ADGM company need an MLRO?
Yes. Every ADGM firm covered by the Rulebook needs an MLRO who is a UAE resident, fit and proper, and senior enough to act independently.
How long must ADGM companies keep AML records?
At least six years under the ADGM Rulebook. That’s longer than the five-year federal minimum, so follow the ADGM period.
When is the ADGM AML Return due?
The AML Return covers 1 January to 31 December and must be submitted by the end of April of the following year.
What happens if an ADGM company breaks AML rules?
There are two sides. Regulators can issue fines, restrictions or withdraw a firm’s licence or registration. Separately, serious breaches such as tipping off or failing to report can be criminal offences under federal law.
