Who is covered
Start with the activities you actually carry out and your jurisdiction, not just the company name. The Ministry of Economy and Tourism's March 2026 guidance covers its supervised real-estate brokers, precious-metals/stones dealers, independent accountants/auditors and trust/company service providers. Law firms have a different supervisor, and DIFC/ADGM supervisory arrangements differ. Verify your scope before choosing a programme.
What you must have
- goAML registration where required, with controlled authorised access
- A risk-based programme covering governance, policies, due diligence and monitoring
- Compliance responsibility, training, reporting and record keeping
- Applicable targeted-financial-sanctions procedures, checked against the relevant official guidance
Why it matters
The March 2026 guidance reflects Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. Old templates should not be treated as current merely because they carry your company logo. Verify the rules and supervisor relevant to your activities.
Bank KYC and your own AML programme are different
A bank asking for company documents is assessing its customer relationship. That does not, by itself, determine whether your company is a DNFBP or show that your own compliance duties have been fulfilled.
Likewise, a goAML registration receipt is not a completed operating programme. Keep scope assessment, portal administration and day-to-day compliance responsibilities distinct when commissioning support.
Make the policy usable by the team
Use these management questions to test whether your process works in practice. This is an organisational review aid, not an exhaustive legal checklist.
| Question | A useful working record |
|---|---|
| Who decides whether a new engagement can start? | A named decision owner and clear escalation route. |
| What evidence supports the decision? | A file index showing received, reviewed and missing material. |
| What happens when information changes? | An action log with a trigger, owner and completion date. |
| Can a colleague cover an absence? | A controlled handover without shared passwords. |
| How do we know training was understood? | Attendance and a practical exercise with recorded follow-up. |
| Can we explain an exception later? | The reason, approval and evidence rather than an undocumented verbal decision. |
A practical onboarding review
Imagine a prospective customer provides a licence under one name and a payment instruction under another. Do not silently overwrite the file to make it match. Record the inconsistency, ask for an explanation through the appropriate process and refer it to the authorised compliance person.
A mismatch does not by itself prove criminal conduct. Equally, a familiar customer name is not a reason to skip a required review. Keep facts, assumptions and decisions separate.
Do not turn a concern into a customer conversation
The official guidance addresses suspicious-activity reporting and the prohibition on tipping off. Staff should use their approved internal escalation route, not ask a customer whether a suspicious-activity report should be filed.
Do not post customer records or suspicions into a public chat, the Meraki website contact form or an unapproved AI tool. Use an agreed secure channel and the authorised compliance process.
Ask for a defined scope of support
Before appointing support, separate applicability review, registration assistance, policy work, training and ongoing operational support. Ask who owns each deliverable, what information is required, what is excluded and how the work will be handed over.
Meraki can discuss its AML/goAML support scope and coordinate specialist work where needed. An introductory enquiry does not appoint a compliance officer or transfer management's responsibilities.
AML and goAML support Beneficial ownership support Discuss your compliance scope
