In short:  DIFC AML compliance means meeting three sets of obligations at once — the UAE federal AML regime under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, the DIFC Regulatory Law 2004, and the DFSA’s own AML, Counter-Terrorist Financing and Sanctions Module, which was amended with effect from 2 March 2026. In practice that means a DFSA-approved MLRO resident in the UAE, a documented business risk assessment adopted by senior management, records kept for six years rather than the federal five, and an annual AML Return filed on the DFSA ePortal by the end of September covering 1 August to 31 July.

A firm that moves from mainland Dubai into the Dubai International Financial Centre usually arrives with an AML programme it believes is finished. It has a goAML account, a policy document, a screening tool and a compliance officer. Within a quarter it discovers that none of that was wrong, but all of it was incomplete, because DIFC AML compliance is not a variant of the federal regime. It is the federal regime plus a second rulebook that is more prescriptive in almost every direction that matters.

The gap widened in 2026. The DFSA’s amended AML Module came into force on 2 March 2026, and the regulator published a set of frequently asked questions alongside it covering governance, risk assessments, digital onboarding, outsourcing and internal audit. Read together, the amendments and the FAQs do something more pointed than add rules. They reallocate accountability, and for anyone who owns DIFC AML compliance that reallocation is the material change. A great deal of what firms had quietly delegated to the compliance function now has to be decided, and evidenced, at executive level.

This briefing sets out what DIFC AML compliance requires in practice, where the DFSA framework differs from the ADGM equivalent supervised by the FSRA, and what a firm should have in place before its next supervisory contact. It is written for the people who carry the obligation: senior executive officers, board members, MLROs and the compliance teams who support them.

1. What DIFC AML compliance actually consists of

The single most common misreading in DIFC AML compliance is treating the DFSA AML module as a substitute for federal law. It is not. A DIFC firm is a UAE entity operating in a financial free zone, and the federal AML framework applies to it in full.

Federal Decree-Law No. 10 of 2025, which came into force on 14 October 2025, and its executive regulations in Cabinet Resolution No. 134 of 2025, in force from 14 December 2025, set the national baseline. They carry the criminal provisions, the goAML reporting duty and the obligation to maintain internal anti-crime policies approved by senior management. Cabinet Decision No. 74 of 2020 adds the targeted financial sanctions regime. None of this is displaced by free zone status.

Above that sits the DIFC Regulatory Law 2004, which gives the DFSA the power to authorise firms, inspect them, compel information and impose financial penalties within the Centre. And above that sits the DFSA AML module itself, which converts broad federal duties into specific, testable rules — the qualities expected of an MLRO, how a business risk assessment must feed customer risk assessments, how long records are held, when the annual return is due.

The practical rule for DIFC AML compliance: where two layers address the same subject, the stricter requirement governs. Record retention is the cleanest illustration. The federal minimum is five years. The DFSA requires six. A DIFC firm that wrote its retention policy from the federal text is non-compliant by a full year and will not discover it until an inspector asks for a file from year six.

This is why DIFC AML compliance work rarely looks like building something new. It usually looks like taking an adequate federal programme and raising it, clause by clause, to the DFSA standard — then evidencing that the raise happened and was approved by the right people.

2. What changed on 2 March 2026, and why the FAQs matter more than the rule text

The DFSA confirmed that the updated AML and Glossary Modules came into force on 2 March 2026, describing the purpose as providing clarity on the AML regime in the DIFC and aligning it with the federal legislation enacted in 2025. A further AML rule-making instrument followed, in force from 1 April 2026. Both waves matter for DIFC AML compliance, because between them they reset who is expected to decide what.

Firms reading only the amended rules will underestimate the change. The accompanying FAQs are where the regulator states its expectations in plain terms, and they are unusually direct about a behaviour the DFSA clearly sees often: approval decisions being routed to the compliance function because that is where the AML expertise sits.

Key point:  Senior management approval for politically exposed persons, Enhanced Customer Due Diligence and correspondent banking must be given by a member of executive management with significant responsibility for money laundering risk. The DFSA states that approval should not be automatically deferred to the Compliance Officer or the MLRO.

That sentence rewires a lot of day-to-day DIFC AML compliance practice. The MLRO may analyse, recommend and document. The MLRO does not approve. For most firms the fix is not a new control but a new record: a decision log that names the executive who approved, the date, and what they were shown.

Internal anti-crime policies, controls and procedures must be approved by senior management under Article 21 of Cabinet Resolution No. 134 of 2025, a requirement that reaches financial institutions, designated non-financial businesses and professions, and virtual asset service providers alike. The DFSA also expects a risk-based approach to be cascaded from senior management through the organisation, with risk appetite and the customer acceptance policy documented rather than assumed.

The FAQs are equally specific on digital onboarding, which matters to the fintech and asset management firms that make up a growing share of the Centre and a growing share of the DIFC AML compliance questions we are asked. Digital identity tools may be used for customer due diligence, but firms should use government-authorised systems where these are stipulated. For Emirates ID verification the DFSA points to the Federal Authority’s online validation gateway or UAE Pass, and expects the firm to retain both a copy of the Emirates ID and the digital verification record. Where a third-party solution is used instead, the firm must assess its assurance level and reliability on a risk basis, and remains responsible for the outcome.

Internal audit also receives explicit treatment in the DFSA AML module. Under AML Rule 9.4.1 an Authorised Person’s internal audit function must conduct regular reviews of the effectiveness of the firm’s money laundering policies, and the federal executive regulations require an independent audit function to test the adequacy of internal anti-crime policies. The DFSA expects audit frequency to reflect the National Risk Assessment, the firm’s own risk profile and supervisory feedback, and the scope to reach customer due diligence policies, training, outsourced functions and the case management and SAR systems. An annual tick-box review no longer meets the standard for DIFC AML compliance.

3. The MLRO: approval, residency and the deputy

MLRO approval is the part of DIFC AML compliance that cannot be solved with a document. In a mainland company the MLRO is an internal appointment. In the DIFC the position is regulated. For an Authorised Firm the MLRO is an Authorised Individual, which means the DFSA approves the person and not merely the post — and withdrawal of that approval is a live supervisory tool, not a theoretical one.

AML Rule 11.3.1 and its guidance set out the qualities the DFSA expects of an MLRO, and they apply to every Relevant Person. For an Authorised Firm the MLRO must additionally meet the fitness and propriety requirements in GEN section 7.6. The DFSA has made clear that non-compliance with the expectations around the role is capable of raising fitness and propriety concerns about the individual — which is a materially different exposure from a rule breach recorded against the firm.

Three practical conditions cause most of the delay in MLRO approval. DIFC applicants are expected to nominate someone sufficiently senior to act on a suspicion without seeking clearance from the business line that generated it. The MLRO must be resident in the UAE and genuinely available to the firm; a name attached to a licence from another time zone does not satisfy the requirement in substance, and the DFSA asks about the arrangement directly. And cover must exist, so that an internal notification never waits for a return from leave.

A recurring weakness in DIFC AML compliance reviews is the deputy who exists on paper. If the deputy has no standing access to the screening system, no authority to file, and has never handled a live notification, the firm has an escalation gap it cannot see until the week it matters, and it is one of the few DIFC AML compliance weaknesses that surfaces only under pressure.

What the MLRO owes the board

The MLRO must report to the governing body or senior management at least annually in the DIFC. That annual MLRO report is not a formality, and it is one of the first documents a supervisor will ask to see because it reveals, in a single artefact, whether the compliance function has visibility, whether the board is using it, and whether DIFC AML compliance is being run or merely described.

A credible annual MLRO report covers the period’s internal notifications and their outcomes, suspicious activity reports filed with the Financial Intelligence Unit and the notifications made to the DFSA, screening alert volumes and how they were resolved, sanctions matches and any freezing action, training delivered and completion rates, the status of the business risk assessment and when it was last approved, findings from internal audit or external review, outstanding remediation with owners and dates, and the MLRO’s own assessment of whether the resources available to the function are adequate. The last item is the one most often omitted and the one supervisors look for.

ADGM firms should note the difference: under the FSRA Rulebook, reporting to the governing body or senior management is expected at least semiannually. A group that runs one reporting calendar across both free zones will be under-reporting on the Abu Dhabi side.

4. The annual AML Return — two free zones, two clocks

Both the DFSA AML module and the ADGM FSRA AML Rulebook require an annual AML Return. Firms assume the two are broadly aligned. They are not, and the difference catches groups with entities in both centres every year.

In the DIFC, AML Rule 14.5.1 requires the return to be submitted by the end of September each year, covering the period from 1 August of the previous year to 31 July of the reporting year. It is filed on the DFSA ePortal and applies to Authorised Persons, Registered Auditors and certain designated non-financial businesses and professions. Senior management should review and approve the return before it is submitted — it is not an MLRO-only document, and a return that no executive has seen is a governance finding waiting to happen.

The ADGM FSRA AML Rulebook takes the opposite approach. Rule 4.6.1 requires submission by the end of April each year, covering 1 January to 31 December of the preceding year. The return is completed on the FSRA Connect portal, a signed copy must be uploaded before submission, all mandatory questions must be answered, and the form cannot be edited once filed. Both Relevant Persons and Representative Offices are in scope.

Watch for this:  Because the DIFC return closes its period on 31 July and the ADGM return closes on 31 December, a group operating in both centres cannot produce one set of statistics and file it twice. Alert counts, SAR numbers, training completion and onboarding volumes all have to be cut twice, on two different period boundaries.

The practical consequence for DIFC AML compliance is that management information has to be captured continuously rather than reconstructed in August. Firms that pull their numbers only when the return falls due routinely discover that the case management system cannot report cleanly on the period required, and the return goes in with estimates that the next inspection will test.

5. Reporting a suspicion: the chain the DFSA will test

Suspicious activity reporting is where DIFC AML compliance is most visible to a supervisor, because every step leaves a timestamp.

Registration on goAML is mandatory for every Relevant Person, and it is a federal obligation rather than a DFSA one — the report goes to the UAE Financial Intelligence Unit, not to the regulator. What the DFSA AML module adds is the notification that follows: under AML Rule 13.3.1 a Relevant Person must notify the DFSA immediately following submission of a suspicious activity report to the FIU.

The sequence a firm must be able to evidence runs as follows. An employee forms a suspicion and makes an internal notification to the MLRO. The MLRO inquires into the circumstances and documents that inquiry. The MLRO determines whether a report to the FIU is required, and records the determination — including, critically, a decision not to report, which is the step firms most often leave undocumented. Where a report is required it is filed through goAML. The DFSA is then notified immediately after submission. And the firm continues to manage the relationship without tipping off the customer. For DIFC AML compliance purposes the federal reporting duty and the DFSA notification are separate obligations, and both are tested.

Document the decision not to report. A file showing that the MLRO considered the matter, weighed it and concluded no report was warranted is a defensible position. A file that is simply silent is indistinguishable, to an inspector, from a suspicion that was never considered at all.

Sanctions reporting runs on its own, shorter clock. Under the targeted financial sanctions regime a positive or potential match must be reported, and freezing action taken, without delay — which the DFSA treats as within 24 hours of the listing decision. Notifications are made through the Sanctions Notifications Form on the DFSA ePortal, and firms must be registered with the Executive Office to receive list updates as they are issued rather than relying on a vendor’s refresh cycle. In DIFC AML compliance terms, a screening tool that refreshes overnight is already outside the window.

6. Record keeping: six years, and when the clock starts

Retention is the quietest failure in DIFC AML compliance and one of the easiest to fix.

DFSA AML Rule 14.4.1 requires records to be kept for at least six years. The ADGM equivalent, FSRA AML Rule 4.5.1, also requires six. The federal minimum is five. The additional year is not the difficult part, however. The difficult part is the trigger.

The six years do not run from the date a document was created. They run from the latest of several events: the end of the business relationship, completion of the transaction, the conclusion of any related investigation, or the issue of a related judgment. This is where DIFC AML compliance diverges most sharply from ordinary corporate record keeping. A customer onboarded in 2019 whose relationship ended in 2025 generates a retention obligation that runs into 2031 — and if that customer was the subject of an investigation that concluded later still, later again.

Most document management systems are configured to purge on creation date plus a fixed period. That configuration will delete records a DIFC firm is required to hold. Checking it is a half-day exercise; discovering the problem at inspection is not. It is the cheapest DIFC AML compliance fix on this list.

7. DIFC and ADGM side by side

Groups with a presence in both financial free zones need to know precisely where the two regimes diverge, because DIFC AML compliance and the ADGM FSRA AML regime are close enough to invite a single policy and different enough to make that policy fail. The table below sets out the differences that most often create findings.

	DIFC — DFSA	ADGM — FSRA
Rulebook	AML, Counter-Terrorist Financing and Sanctions Module, amended in force 2 March 2026	Anti-Money Laundering and Sanctions Rulebook
Annual AML Return period	1 August to 31 July	1 January to 31 December
Annual AML Return deadline	End of September (Rule 14.5.1)	End of April (Rule 4.6.1)
Filing portal	DFSA ePortal	FSRA Connect, with signed copy uploaded
Record retention	At least 6 years (Rule 14.4.1)	At least 6 years (Rule 4.5.1)
MLRO reporting to the board	At least annually	At least semiannually (Rules 12.4.1, 12.4.3)
MLRO status	Authorised Individual for an Authorised Firm; fitness and propriety under GEN 7.6	Appointed under the AML Rulebook; approved person requirements apply
Business risk assessment	AML chapter 5, feeding customer risk assessment under Rule 6.1.1	Rule 6.1.1, approved by senior management
Reporting a suspicion	goAML to the FIU, then notify the DFSA immediately after submission (Rule 13.3.1)	goAML to the FIU, with FSRA notification requirements
Also in scope	Registered Auditors and certain DNFBPs, including DIFC real estate developers	Relevant Persons and Representative Offices

The headline for anyone running DIFC AML compliance across both centres is that the substance is close but the calendar is not. Two returns, two periods, two board reporting rhythms, and one set of underlying data that must be capable of being cut both ways.

8. Outsourcing the MLRO function: what moves and what never does

Outsourcing the MLRO role, or supporting an in-house MLRO with an external team, is permitted and widespread in the DIFC, and for a large number of firms it is how DIFC AML compliance is actually delivered day to day. The DFSA addresses it directly. What the regulator is careful to state is where the line falls.

Under GEN Rules 5.3.21 and 5.3.22 and AML section 8.2, a firm that outsources remains responsible for compliance with, and liable for any failure to meet, the outsourced obligations. The outsourcing agreement is expected to address sub-outsourcing and intra-group arrangements. Where the outsourced MLRO’s back office also performs sanctions screening or customer due diligence, those services should be covered in the agreement in addition to the MLRO provisions themselves — a point firms frequently miss, because the screening is treated as a tool rather than an outsourced regulated activity.

A well-constructed arrangement therefore transfers execution: day-to-day performance of the role, review of internal notifications, drafting and filing of reports, screening and due diligence operations, preparation of the annual AML Return and the board report. It cannot transfer liability for failure, senior management’s approval decisions, ownership of the business risk assessment, the approved individual’s own fitness and propriety, or the firm’s accountability when the DFSA arrives.

Test your arrangement:  If the DFSA asked today who approved the last PEP relationship, who adopted the current business risk assessment, and who signed off the last annual AML Return, could you name a person inside the firm for each — and produce the minute? If the answer is the outsourced provider, the arrangement is structured incorrectly.

9. What supervision and enforcement actually look like

Both regulators have shown a willingness to fine, and the published cases are instructive because the failings are ordinary rather than exotic. DIFC AML compliance failures are rarely sophisticated.

In the ADGM, the FSRA fined a multi-asset brokerage USD 504,000, equivalent to approximately AED 1.85 million, for failing over a period of nearly six years to implement adequate measures to detect and report suspicious transactions, with associated deficiencies in customer due diligence, customer risk assessment, record keeping and transaction monitoring. No actual money laundering was identified. The firm received a settlement discount and a further reduction for cooperation and prompt remediation.

In the DIFC, the DFSA imposed a provisional fine of USD 25,000 on a trading and investment business for failing to report a series of alleged wash trades. The amount is modest; the principle is not. The failing was a reporting decision, not a systems failure.

Read together, the two cases make the same point about DIFC AML compliance: regulators are testing whether suspicions are recognised, escalated, decided and reported — and whether that chain is documented. Sophisticated typologies are rarely what brings a firm undone. An undocumented decision usually is.

The findings that recur

These are the DIFC AML compliance findings that appear most often in the review work we do for firms in the Centre, in rough order of how frequently they are raised.

• A business risk assessment that exists but was never formally approved by senior management, or has not been refreshed after a material change in products, customers or geographies.
• Customer risk assessments that do not demonstrably use the output of the business risk assessment, which the amended rules require explicitly.
• PEP, Enhanced Due Diligence and correspondent banking approvals signed by compliance rather than executive management.
• A deputy MLRO appointed in name with no operational access or authority.
• Screening performed against a vendor list that is refreshed on a schedule rather than immediately on a listing change.
• Training recorded as delivered without evidence of completion, and without role-specific content for front-office staff.
• Retention policies built on the five-year federal minimum.
• An annual AML Return assembled from estimates because management information was never captured on the required period.

10. A ninety-day plan to close the gap

For a firm that suspects its DIFC AML compliance programme has drifted, the following sequence addresses the highest-risk items first and produces documentary evidence at each stage.

Days 1 to 30 — establish the position

• Map every obligation that applies to the entity across the three layers, and record which rule each control satisfies.
• Retrieve the current business risk assessment and confirm the date and method of senior management approval. If there is no minute, there is no approval.
• Confirm the MLRO’s approval status, UAE residency, and that a deputy exists with live system access.
• Test the retention configuration in the document management system against the six-year requirement and the correct trigger events.
• Pull twelve months of internal notifications and confirm each has a documented determination, including those that did not result in a report.

Days 31 to 60 — fix the governance layer

• Rebuild the approval matrix so PEP, EDD and correspondent banking decisions sit with named executive management, and create the decision log that evidences it.
• Refresh the business risk assessment against the National Risk Assessment and the firm’s current book, and take it to the board for formal adoption.
• Align customer risk assessment methodology with the business risk assessment so the link is demonstrable rather than asserted.
• Review the outsourcing agreement for sub-outsourcing, intra-group arrangements and any screening or due diligence the provider performs.
• Register with the Executive Office for sanctions list updates and confirm screening runs on listing change, not on a schedule.

Days 61 to 90 — build the evidence file

• Stand up management information that reports on both the DIFC period and, where relevant, the ADGM calendar year.
• Produce the annual MLRO report to board standard, including an honest assessment of resourcing.
• Commission or schedule an independent review of the AML programme covering due diligence, training, outsourced functions and case management.
• Run a dry inspection: assemble the documents a supervisor would request and identify what cannot be produced within a working day.
• Close remediation items with named owners and dates, and report completion to the governing body, so the DIFC AML compliance position is recorded rather than asserted.

11. Where Ontrax fits

Ontrax Compliance & Risk Management Ltd is based in the DIFC and works with Authorised Firms, DNFBPs and Registered Auditors across both financial free zones. DIFC AML compliance is not a template exercise, and we do not treat it as one.

Our MLRO Services for DIFC & ADGM cover the full function: acting as outsourced or seconded MLRO, supporting an in-house MLRO through approval and beyond, preparing the annual AML Return, building the annual MLRO report to board standard, and standing with the firm through DFSA and FSRA supervisory engagement. Where a firm would rather retain the role internally, we provide the deputy cover, the review capacity and the independent challenge that makes the appointment credible.

If you take one action:  Ask for the minute that records senior management’s approval of your current business risk assessment. If it cannot be produced in an hour, that is the first gap in your DIFC AML compliance programme, and everything downstream of it is affected. Speak to Ontrax about MLRO services for the DIFC and ADGM.

Frequently asked questions

What is DIFC AML compliance?

DIFC AML compliance is the set of anti-money laundering obligations that apply to a firm operating in the Dubai International Financial Centre. It combines the UAE federal AML regime under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, the DIFC Regulatory Law 2004, and the DFSA’s AML, Counter-Terrorist Financing and Sanctions Module. All three apply simultaneously, and where they overlap the stricter requirement governs.

When did the amended DFSA AML Module come into force?

The amended AML and Glossary Modules came into force on 2 March 2026. The DFSA published supporting FAQs at the same time covering governance, risk assessments, digital onboarding, outsourcing and internal audit. A further AML rule-making instrument took effect on 1 April 2026. Every DIFC AML compliance programme should have been re-tested against both.

Does the UAE federal AML law apply inside the DIFC?

Yes. The DIFC is a financial free zone, not an exclusion from federal law. Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and the targeted financial sanctions regime under Cabinet Decision No. 74 of 2020 apply to DIFC firms in full, alongside the DFSA rulebook.

Does the MLRO have to be resident in the UAE?

Yes. A DIFC firm’s MLRO is expected to be resident in the UAE and genuinely available to the business. The DFSA asks about the arrangement directly, including where the role is outsourced or performed at group level, and an MLRO who is not present in substance will not satisfy the requirement.

Is the MLRO an approved position in the DIFC?

For an Authorised Firm the MLRO is an Authorised Individual, so the DFSA approves the person as well as the appointment. AML Rule 11.3.1 and its guidance set out the expected qualities, and the individual must meet the fitness and propriety requirements in GEN section 7.6.

Do DIFC firms need a deputy MLRO?

Cover for the MLRO’s absence is expected, so that an internal notification is never delayed. The deputy needs the same system access and the same authority to act as the MLRO; a deputy who exists only on an organisation chart is a common and avoidable finding.

When is the DIFC annual AML Return due?

Under AML Rule 14.5.1 the return is due by the end of September each year and covers 1 August of the previous year to 31 July of the reporting year. It is filed on the DFSA ePortal, and senior management should review and approve it before submission. It is the single clearest annual test of whether DIFC AML compliance is being managed at board level.

How does the ADGM annual AML Return differ?

The ADGM return is governed by FSRA Rule 4.6.1. It covers the calendar year, 1 January to 31 December, and is due by the end of April. It is filed on FSRA Connect with a signed copy uploaded, and applies to Relevant Persons and Representative Offices.

How long must a DIFC firm keep AML records?

At least six years, under DFSA AML Rule 14.4.1, which is one year longer than the federal minimum. The period runs from the latest of the end of the business relationship, completion of the transaction, the conclusion of a related investigation, or the issue of a related judgment.

Who has to approve a PEP relationship in the DIFC?

A member of executive management with significant responsibility for money laundering risk. The DFSA has stated that approval should not be automatically deferred to the Compliance Officer or the MLRO. The same applies to Enhanced Due Diligence and correspondent banking relationships.

Can a DIFC firm outsource the MLRO function?

Yes. Outsourcing is permitted under GEN Rules 5.3.21 and 5.3.22 and AML section 8.2, but the firm remains responsible for compliance with, and liable for any failure to meet, the outsourced obligations. This is the single most misunderstood point in DIFC AML compliance. The agreement should cover sub-outsourcing, intra-group arrangements and any screening or due diligence the provider performs.

What goes into the annual MLRO report?

Internal notifications and their outcomes, reports filed with the FIU and notifications made to the DFSA, screening alert volumes and resolutions, sanctions matches and freezing action, training delivered and completion rates, the status of the business risk assessment, audit and review findings, outstanding remediation with owners and dates, and the MLRO’s assessment of whether the function is adequately resourced.

Is goAML registration required for DIFC firms?

Yes. goAML registration is mandatory for all Relevant Persons. Suspicious activity reports are filed with the UAE Financial Intelligence Unit through goAML, and under AML Rule 13.3.1 the DFSA must be notified immediately following submission.

How quickly must a sanctions match be reported?

Without delay, which the DFSA treats as within 24 hours of the listing decision. Freezing action and the notification through the Sanctions Notifications Form on the DFSA ePortal both fall within that window, which is why firms must receive list updates directly from the Executive Office rather than relying on a vendor refresh cycle.

Sources and further reading

· DFSA — AML and Glossary Module amendments in force, FAQs published

· DFSA — Anti-Money Laundering, Counter-Terrorist Financing and Sanctions FAQs (March 2026)

· DFSA — Overview of AML/CTF and Sanctions obligations

· ADGM FSRA — Anti-Money Laundering and Sanctions Rulebook

· ADGM FSRA — FCCP Notice No. 26 of 2025, updating the annual AML Return form

· DFSA — Notice of Amendments to Legislation

This briefing is general information on DIFC AML compliance and is not legal advice. Rules change; verify the current text of the DFSA and FSRA rulebooks before acting. Ontrax Compliance & Risk Management Ltd, Dubai International Financial Centre.