AML/CTF Compliance Framework for Virtual Asset Businesses in UAE

Every regulated VASP must appoint a Money Laundering Reporting Officer (MLRO) with a minimum of 2 years' experience in AML/CFT compliance. The MLRO bears legal responsibility for the firm's AML programme and is the primary contact with the UAE Financial Intelligence Unit (FIU). Under VARA requirements, the MLRO must be a UAE resident.

A documented ML/TF/PF Business Risk Assessment identifying and assessing risk exposure from the firm's virtual asset activities — by product, client type, geography, delivery channel, and transaction size. Must be reviewed and updated annually or upon material changes.

Comprehensive written policies aligned with UAE Federal Decree-Law No. 10 of 2025, VARA Compliance and Risk Management Rulebook, and FATF Recommendations for virtual assets. Policies must cover:
Customer Acceptance Policy
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures
Ongoing monitoring and periodic review
Suspicious Activity Reporting (SAR) and Suspicious Transaction Reporting (STR) procedures
Sanctions screening and PEP identification
Travel Rule implementation
Counter-Proliferation Financing (CPF) controls — mandatory under 2025 law
Record-keeping procedures (minimum 5 years)

Risk-based CDD applied to all clients before establishing a business relationship or executing a transaction:
Identity verification — individual or entity
Ultimate Beneficial Owner (UBO) identification — 25% ownership threshold
Source of funds verification
PEP screening — domestic and foreign politically exposed persons
Sanctions screening — UAE local lists, OFAC, EU, UN sanctions
Enhanced Due Diligence (EDD) for high-risk clients and high-risk jurisdictions
Ongoing monitoring and periodic review of client risk profiles

Continuous, real-time monitoring of all transactions. Wire transfers and virtual asset transactions exceeding AED 3,500 require full originator and beneficiary details. Automated red flag detection for:
Structuring and smurfing patterns
High-risk wallet addresses (mixers, darknet markets, sanctions-linked wallets)
Unusual volume, frequency, or geographic patterns
Transactions involving high-risk jurisdictions (FATF grey/black lists)

All UAE VASPs are expected to deploy blockchain analytics tools for wallet screening and transaction monitoring. Standard tools accepted by VARA and ADGM/FSRA:
Chainalysis — industry standard, VARA-referenced in guidance
Elliptic — widely used, integrated with major exchanges
TRM Labs — strong for institutional and DeFi-facing businesses
Crystal (BitRank) — popular for smaller VASPs

Registration on the UAE FIU's goAML platform is mandatory for all regulated VASPs regardless of size or activity level. Failure to register is treated as an automatic internal controls failure by inspectors. STRs must be submitted immediately upon forming a suspicion — no delay is permitted.

Ongoing, role-based AML training is a compulsory obligation — not a one-time exercise. The CBUAE's October 2025 best practices guidance establishes a role-based training framework. Generic annual e-learning delivered uniformly to all staff is unlikely to satisfy an inspector. Training must be documented with logs available for inspection.