Case Study: UAE DNFBP Compliance
How a Dubai Real Estate Brokerage Turned a Registration-Stage AML/CFT Framework Into an Operational Compliance Process
Meeting the registration and onboarding requirements applicable to a Designated Non-Financial Business or Profession (DNFBP) under the UAE AML/CFT framework is often treated as a one-time milestone. In practice, the firm submits a policy, completes a goAML registration and ticks a box. However, for real estate brokerages handling high-value transactions, that approach leaves a gap. The paperwork says one thing. What happens at the point of sale can be another.
Below, this case study explains how Compliance7 supported a Dubai real estate brokerage. First, Compliance7 assessed the existing framework against actual transaction activity and applicable UAE DNFBP requirements. The engagement then focused on embedding the required controls into the day-to-day transaction workflow. Those controls covered customer due diligence, beneficial ownership verification, sanctions and PEP screening, source-of-funds review, escalation and management oversight.
Engagement at a Glance
- Client: Dubai-based real estate brokerage, registered as a DNFBP under the UAE AML/CFT framework
- Challenge: AML/CFT program built to satisfy registration requirements, not embedded into day-to-day transaction workflows
- Service: UAE DNFBP gap assessment, customer due diligence framework redesign and goAML/reporting alignment
- Key deliverables: Gap assessment, transaction-level CDD/EDD procedures, beneficial ownership and source-of-funds workflow, staff training, governance documentation
- Outcome: AML/CFT controls embedded into the transaction workflow, with defined CDD/EDD, screening, escalation and management oversight processes
The Problem
A UAE DNFBP Policy on Paper, a Different Process at the Point of Sale
In the UAE, real estate agents and brokers fall within the Designated Non-Financial Businesses and Professions sector. Accordingly, they are subject to applicable AML/CFT obligations based on their activities and the relevant regulatory framework. The brokerage had completed the registration and AML/CFT onboarding requirements applicable to its business. Naturally, a policy document prepared at the time supported that work. In practice, however, the compliance function did not reach how the sales team actually handled transactions.
Real estate transactions in the UAE regularly involve overseas buyers, corporate purchase structures and higher-value payments. Those factors can increase AML/CFT risk. Consequently, they require a more structured customer due diligence approach.
Sales staff were collecting basic identification documents. However, they gathered source-of-funds information inconsistently. The same applied to source-of-wealth information, where the risk profile warranted it. Meanwhile, nobody consistently traced beneficial ownership behind corporate buyers beyond the immediate signatory. Sanctions and PEP screening was also not a structured step in the transaction workflow.
The firm’s written policy described a compliance program that, in practice, was not what was happening at the point of sale.
As a result, the brokerage faced a problem of evidence. It could not consistently demonstrate that the required customer due diligence, screening and escalation controls were being applied across its transactions.
The Solution
Rebuilding the Framework Around the Transaction Workflow
The brokerage engaged Compliance7 to assess its AML/CFT program against actual transaction activity. The objective was to rebuild that program as an operational process, not a standalone policy document. Therefore, the engagement began with a gap assessment. That assessment compared the existing policy against applicable UAE DNFBP requirements. It also compared the policy against how the team actually conducted transactions day to day.
Mapping Controls to Transaction Stages
Compliance7 mapped each transaction stage, from initial buyer engagement through to closing. Compliance7 then matched each stage to the due diligence step required at that point:
- Assess risk
- Apply the appropriate level of CDD
- Verify beneficial ownership
- Review source of funds where warranted
- Screen for sanctions and PEP exposure
- Escalate unusual or higher-risk matters
- Document the decision
Source of Funds and Escalation Triggers
Compliance7 defined source-of-funds expectations. It also defined source-of-wealth expectations where risk warranted them. Clear risk indicators and escalation triggers sat alongside those expectations. This mattered particularly for transactions involving overseas buyers, corporate purchase vehicles or other elevated-risk factors.
Management Oversight
Finally, Compliance7 also prepared governance documentation. That documentation gave the firm’s senior management defined visibility into higher-risk transactions. It also covered any escalations arising from them.
What the UAE DNFBP Compliance Engagement Covered
The engagement ran across seven areas. Each one tied to a point in the transaction workflow, rather than to the policy document.
| Area | Support Provided |
|---|---|
| Gap assessment | Comparing the existing AML/CFT policy against applicable DNFBP requirements and actual transaction practice |
| Transaction risk assessment | Establishing risk indicators and escalation triggers based on customer profile, ownership structure, geography, payment method and transaction characteristics |
| Customer due diligence | Redesigning CDD procedures for buyers and sellers, including enhanced measures for higher-value and international transactions |
| Beneficial ownership | Building a structured process for tracing beneficial ownership behind corporate purchasers, beyond the immediate signatory |
| Sanctions and PEP screening | Embedding screening as a defined step within the transaction workflow rather than an ad hoc check |
| goAML and reporting | Reviewing registration status and establishing a clear internal process for suspicious transaction identification and reporting |
| Staff training | Training the sales team on red flags and CDD/EDD requirements specific to real estate transactions |
Applicable obligations depend on the nature of the business and the activities actually carried out.
The Result
Controls Tied to Transaction Stages, Not to a Document
The brokerage moved away from an AML/CFT framework that existed primarily at registration stage. Consequently, a structured operational process now sits within the transaction workflow. Defined stages of the transaction now carry customer due diligence, beneficial ownership checks, screening, source-of-funds review and escalation. Crucially, staff no longer perform them inconsistently or retrospectively.
Furthermore, sales staff had a practical process to follow. Staff could then document higher-risk transactions and compliance escalations. Defined governance routes brought them to senior management.
For other UAE DNFBP businesses, the same pattern tends to apply. A framework written for registration will not, by itself, show a supervisor what happens at the point of sale. Only an operational process can do that.
Supervisory assessments and enforcement decisions remain the responsibility of the relevant UAE competent and supervisory authorities. Compliance7’s role is to assess the framework against applicable requirements, strengthen the operational design of the controls and help the business demonstrate that its documented AML/CFT framework reflects how it actually operates.
Relevant UAE DNFBP AML/CFT Framework
This use case relates to the UAE AML/CFT framework applicable to DNFBPs. That includes Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations, its implementing regulations and applicable guidance and supervisory requirements. Specific obligations depend on the nature of the business and the activities carried out. They should be assessed against the current regulatory framework.
Frequently Asked Questions (FAQ)
Which UAE businesses are classified as DNFBPs for AML/CFT purposes?
UAE DNFBPs include real estate brokers and agents. They also include dealers in precious metals and precious stones, auditors and certain legal and corporate service activities. However, scope depends on the applicable AML/CFT framework and the specific activities performed.
What customer due diligence is expected of a real estate brokerage under UAE AML/CFT rules?
Real estate agents and brokers are generally expected to conduct customer due diligence on buyers and sellers involved in property transactions. That typically includes identity verification and beneficial ownership analysis for corporate purchasers. Furthermore, enhanced measures such as source-of-funds and source-of-wealth evidence may apply to higher-risk or higher-value transactions.
What is the risk of an AML/CFT policy that exists only on paper?
A policy that is not embedded into actual transaction practice creates a gap. On one side is what a DNFBP can show a supervisor on paper. On the other is what its staff are actually doing day to day. Notably, a supervisory inspection or examination is specifically designed to identify that gap.
How can a UAE DNFBP operationalise an AML/CFT program that is not working in practice?
A DNFBP can begin by comparing its documented AML/CFT policies against its actual customer and transaction workflows. The aim is to identify where the business does not apply required controls consistently. Those controls include customer due diligence, beneficial ownership verification, screening, source-of-funds / source-of-wealth review, escalation and suspicious transaction reporting. The framework can then be redesigned around defined transaction stages, responsibilities, escalation routes and record-keeping requirements.
Is Your DNFBP AML/CFT Program Built for Registration or for Daily Operations?
Does your real estate, precious metals or other DNFBP business have an AML/CFT policy developed for registration but never embedded into daily operations? If so, Compliance7 can assess the gap. Compliance7 can then help redesign the framework around your actual transaction workflow.
