In short:  Outsourced AML compliance in the UAE is permitted only in part. Joint guidance issued by the UAE Supervisory Sub-Committee states that a firm must not outsource the role of the Compliance Officer or MLRO, nor the entire compliance function, under any circumstances. Specific tasks — enhanced due diligence, AML training, framing controls and system support — may be outsourced, but only after obtaining a Letter of No Objection from the relevant supervisory authority. A DNFBP that genuinely cannot appoint a Compliance Officer internally may appoint a third-party or virtual compliance officer under conditions set by the Ministry of Economy and Tourism, with the supervisor’s prior written approval and with accountability remaining with the board.

There is a sentence in the UAE’s joint supervisory guidance that a large part of the compliance services market has not yet absorbed. It is short, it is unqualified, and it reads: a licensed financial institution, DNFBP or virtual asset service provider must not outsource the role of the Compliance Officer or MLRO, nor the entire compliance function, under any circumstances.

That sentence does not make outsourced AML compliance unlawful. It makes outsourced AML compliance a question of structure rather than permission, drawing a distinction between handing over work and handing over the role, and it puts the whole weight of UAE supervisory expectation on which side of that distinction a given arrangement falls. Firms that understand the distinction can build an outsourced AML compliance model that is both efficient and defensible. Firms that do not will keep buying something their regulator has already said they cannot have.

This briefing sets out where the line falls, what can legitimately cross it, what the Letter of No Objection process requires, how the Ministry of Economy and Tourism’s third-party Compliance Officer route works for DNFBPs, and what supervisors have actually been finding when they inspect outsourced arrangements. It is written for the board and senior management, because in outsourced AML compliance they are the people who cannot delegate the consequence.

1. The rule, stated plainly

The rule that governs outsourced AML compliance is not buried. The Joint Guidance on the AML/CFT/CPF Compliance Officer and Money Laundering Reporting Officer was issued by the UAE Supervisory Sub-Committee on behalf of eight supervisory authorities: the Central Bank of the UAE, the Securities and Commodities Authority, the Ministry of Justice, the Ministry of Economy and Tourism, the DFSA, the FSRA, VARA and the GCGRA. It builds on Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. It is guidance rather than new legislation, and where it conflicts with the legal framework the legal framework prevails — but it is the clearest statement yet of what the supervisors expect to see.

The prohibition, verbatim: “LFI/DNFBP/VASP must not outsource the role of the CO/MLRO nor the entire Compliance Function under any circumstances.”

Two things are prohibited in outsourced AML compliance, and they are not the same thing. The first is outsourcing the role — appointing a provider, rather than a person inside the firm’s governance structure, to be the Compliance Officer or MLRO. The second is outsourcing the entire compliance function — contracting out the whole of the firm’s AML capability so that nothing meaningful remains internally.

What is permitted is the outsourcing of specific AML compliance tasks. The guidance gives examples: enhanced due diligence, AML and CFT training, framing controls, and system support. The condition attached is not optional and is not a formality. Tasks may be outsourced only after obtaining a Letter of No Objection from the relevant supervisory authority.

The underlying federal position on outsourced AML compliance supports the same reading. Article 22 of Cabinet Resolution No. 134 of 2025 requires an entity to appoint a Compliance Officer at management level and under their responsibility, with independence in decision-making and appropriate competence and experience. Article 21 requires internal anti-crime policies approved by senior management, and Article 21(6) requires an independent audit function to test their effectiveness. Article 20 permits reliance on a third party to apply customer due diligence measures, but the entity remains responsible for the accuracy of those measures — and the Resolution treats outsourcing as a separate category from third-party reliance, precisely because the firm keeps supervision and control.

2. The distinction that makes sense of everything: appointment versus abdication

Read on its own, the prohibition appears to rule out outsourced AML compliance altogether. Read alongside the Ministry of Economy and Tourism’s March 2026 DNFBP guidelines, it resolves into something more workable.

Those guidelines permit a third-party Compliance Officer where the DNFBP cannot appoint a suitably qualified and independent officer internally. The appointment requires the supervisory authority’s prior written approval. The individual must pass the same fit and proper evaluation, must be independent of operational and revenue-generating roles, must have unrestricted access to information, records, systems and staff, and must operate under a clearly drafted contract. Ultimate accountability stays with senior management and the board, and appointing a third-party officer does not relieve the DNFBP of its obligations.

The distinction:  What the guidance prohibits is abdication — a contract under which a provider “handles compliance” and no identified, approved, accountable officer sits inside the firm’s governance structure. What the framework permits is appointment — an individual, who may be sourced externally, formally appointed to the role, approved by the supervisor, fit and proper tested, independent, with full access, reporting to a board that retains accountability.

Everything that follows in well-run outsourced AML compliance is downstream of that distinction. An outsourced AML function supplies people, capacity, systems and method. The firm supplies the appointment, the authority, the decisions and the consequence. If those four stay inside, the arrangement is defensible. If any of them drift outward, the arrangement is the one Appendix 1 of the joint guidance describes.

3. What can never be outsourced

Whatever shape an outsourced AML compliance arrangement takes, four things stay inside the firm permanently, regardless of how capable the provider is or how the contract is drafted.

The role itself

The Compliance Officer or MLRO is a person appointed at management level, under their own responsibility, with independence in decision-making. The guidance expects an appropriate level of seniority and experience, operational independence, freedom from conflicts of interest whether pecuniary or otherwise, and access to the board to report and discuss key issues. An alternate must also be appointed, and both the officer and the alternate must be fit and proper tested on integrity, qualifications, experience and skills. Where the duties are delegated to someone holding other responsibilities, that person must not have day-to-day responsibility for sales or customer relationship management.

The decision to report

Assessing suspicious transaction data and deciding whether to notify the Financial Intelligence Unit is a duty of the Compliance Officer under Article 22 of Cabinet Resolution No. 134 of 2025. This is the hard edge of outsourced AML compliance. A provider may investigate, analyse, draft and prepare. The determination belongs to the appointed officer, and the firm must be able to show who made it and on what basis — including when the determination was that no report was required.

Senior management approval

Internal anti-crime policies must be approved by senior management. So must the business risk assessment, the risk appetite and the customer acceptance policy. Approvals for politically exposed persons, enhanced due diligence and correspondent relationships belong to executive management, not to compliance and not to a provider. These are the approvals a supervisor asks to see minuted.

Accountability

The board and senior management remain ultimately accountable for outsourced AML compliance. This is stated in the federal framework, restated in the MoET guidelines, and reflected in the free zone rulebooks. No contractual term has ever moved it, and none will.

4. The Letter of No Objection: the step most firms skip

The most commonly missed requirement in outsourced AML compliance in the UAE is also the simplest. Outsourcing a task is permitted only after obtaining a Letter of No Objection from the relevant supervisory authority. Not after notifying. Not after the fact. Before.

The practical discipline the LNO process imposes on outsourced AML compliance is scoping. A supervisor cannot form a view on “compliance support services”. It can form a view on “enhanced due diligence file preparation for high-risk corporate customers, with the determination retained by the MLRO”. Firms that struggle to draft the application usually discover that the reason is the arrangement itself: the scope is vague because the boundary was never thought through.

A useful test before applying: does this task contain a decision? Whether to report, whether to onboard, whether to approve, whether to escalate. If it does, it is not a delegable task — it is part of the role, and no Letter of No Objection will make it otherwise.

An outsourced AML compliance application should also address the provider’s qualifications and understanding of UAE obligations, capacity, conflicts of interest, data protection, and the sub-outsourcing chain. Supervisors are alert to arrangements where a UAE provider in turn routes work to an offshore team, because that is the pattern the deficiency list singles out.

5. The third-party Compliance Officer route for DNFBPs

Outsourced AML compliance takes a particular form outside the regulated financial sector. For designated non-financial businesses and professions — real estate brokers and agents, dealers in precious metals and stones, auditors, corporate service providers, lawyers and notaries — the Ministry of Economy and Tourism’s March 2026 guidelines open a route that is frequently misdescribed in the market as “outsourced MLRO”.

The route is conditional and narrow. It is available where the DNFBP cannot appoint a suitably qualified and independent Compliance Officer internally — not where it would simply prefer not to. The supervisory authority’s prior written approval is required for the appointment, and the DNFBP must notify the authority of any change to the role or its reporting lines.

The conditions are cumulative, and an outsourced AML compliance arrangement that satisfies six of them satisfies none. The third party must have the qualifications, experience and understanding of the DNFBP’s business model, risk profile and regulatory mandates. The DNFBP must perform the same fit and proper evaluation it would for an internal candidate, covering AML and CFT experience, professional reputation and the absence of criminal or regulatory infractions. The officer must be independent of operational and revenue-generating roles, must have unrestricted access to relevant information, records, systems and staff, and must work to a clearly drafted contract setting out responsibilities, scope of work, reporting lines and confidentiality. An alternate or deputy must be designated and vetted in the same way. And the DNFBP must periodically review the third-party officer’s performance.

The condition that decides it:  Unrestricted access to relevant information, records, systems and staff. A virtual compliance officer who receives a monthly spreadsheet and has no system login does not meet this condition, whatever the contract says. If the arrangement cannot pass this test, it is not a third-party appointment — it is outsourcing the role, which is prohibited.

6. What supervisors are actually finding

The joint guidance does something unusually helpful: it publishes the deficiencies the supervisory authorities recorded in their assessments. Taken together they read as a precise description of an outsourced AML compliance arrangement that has drifted past the line.

Four of the eleven concern oversight that has moved offshore: compliance tasks handled by regional offices with limited oversight of UAE operations, little or no oversight of search, freeze and unfreeze orders from the Financial Intelligence Unit, limited oversight of customer due diligence quality assurance, and inadequate oversight of remediation after a gap analysis.

Four more concern an officer who is not meaningfully present: no dedicated, independent Compliance Officer in a senior position; insufficient involvement in key controls such as sanctions screening and transaction monitoring tuning; insufficient seniority and restricted access to senior management and the board; and insufficient reporting to the board, senior management and the supervisory authority.

The remaining three concern ownership: limited experience and understanding of UAE AML, CFT and CPF obligations; a lack of accountability and ownership; and no real understanding of how to build a programme tailored to the firm’s own risk rather than lifted from a template.

Read the list as a self-assessment. If more than two or three describe your arrangement, the problem is not the provider’s performance. It is the shape of the arrangement, and it will not be fixed by changing provider.

7. The reporting the officer still owes

Outsourced AML compliance does not reduce the reporting burden. It changes who prepares the report, not who owns it.

The joint guidance expects a bi-annual Compliance Officer and MLRO report to senior management and to the relevant supervisory authority. Twice a year, and it goes to the regulator as well as the board. The officer should be able to brief the board on changes in the firm’s money laundering, terrorist financing and proliferation financing risk exposure; regulatory changes affecting the framework; national and international developments and trends; the results of the business-wide risk assessment; risk appetite and tolerance; the effectiveness of the programme, including its failures as well as its successes; resource constraints; relevant statistics such as suspicious transaction report submissions; and findings from internal audits and supervisory examinations.

The board, for its part, is expected to provide adequate resources. The resourcing item is the one most often left out of a report prepared by a provider, for obvious reasons, and it is the one supervisors look for. An officer who never reports a constraint is either exceptionally well resourced or not reporting candidly.

Alongside this, DNFBPs file a range of reports through goAML: suspicious transaction and suspicious activity reports, and the specialised report types their sector requires. The Compliance Officer acts as the main liaison for the Financial Intelligence Unit and the supervisory authority, must notify the authority of any change to the role or reporting lines, and must ensure records — customer files, risk assessments, internal reports and reports filed — are kept for at least five years. Tipping off remains a criminal offence.

8. The free zone overlay: DIFC, ADGM and an apparent conflict

Firms in the financial free zones face what looks at first like a contradiction in the rules on outsourced AML compliance, and it is worth addressing directly.

The DFSA’s own AML guidance addresses outsourcing of the MLRO function under GEN Rules 5.3.21 and 5.3.22 and AML section 8.2, and expects the outsourcing agreement to cover sub-outsourcing, intra-group arrangements and any screening or due diligence the provider’s back office performs. It states that the firm remains responsible for compliance with, and liable for any failure to meet, the outsourced obligations. The FSRA takes a comparable approach. Both the DFSA and the FSRA are among the eight authorities on whose behalf the joint guidance was issued.

The resolution is the same distinction that governs outsourced AML compliance everywhere else in the UAE. The free zone rules govern how an outsourcing arrangement must be documented and supervised when one exists; the joint guidance states that the arrangement can never extend to the role itself or the whole function. In the DIFC the point is reinforced structurally, because for an Authorised Firm the MLRO is an Authorised Individual — the DFSA approves the person, which makes it impossible for the role to sit with an unnamed provider. In the ADGM the appointment is similarly subject to approved person requirements.

For a DIFC or ADGM firm:  You may engage a provider to supply the individual, to support the function and to perform delegated tasks. The individual must still be approved by your regulator in their own name, must be resident in the UAE, must be independent and available, and must have a deputy. The contract governs the service. It does not govern the role.

9. What a compliant arrangement actually looks like

The outsourced AML compliance model that survives supervisory scrutiny is a hybrid: a small retained core and a delegated layer, joined by evidence.

In a sound outsourced AML compliance model the retained core is deliberately small. An appointed Compliance Officer or MLRO, approved by the supervisor, senior and independent. An alternate, fit and proper tested, with the same access. A board and senior management who approve policies, the risk assessment, risk appetite and the escalated customer decisions. And the determination on whether a suspicion is reported.

The delegated layer is where outsourced AML compliance earns its place, supplying what the core cannot produce alone: the capacity an outsourced AML function is built to supply — volume enhanced due diligence and file build on higher-risk customers, role-based training with completion records, policy and procedure drafting framed to the firm’s actual risk, and screening and monitoring support including tuning, alert triage and the production of management information.

What joins them is not the service level agreement. It is the Letter of No Objection for each delegated task, the contract that sets out scope, reporting lines, access rights, confidentiality, sub-outsourcing and termination, the access itself, the firm’s documented periodic review of provider performance, and the bi-annual report that goes to senior management and to the supervisor. Those five artefacts are what an inspector asks for, and they are what distinguish a compliant outsourced AML compliance arrangement from a prohibited one.

Questions to put to any provider

Before signing any outsourced AML compliance agreement, put these seven questions in writing and keep the answers. Each one maps to a condition a supervisor will test.

• Who will be the appointed officer, by name, and will they be approved by our supervisory authority in that name?
• Will they be resident in the UAE and available to us, and how many other appointments do they hold?
• Which specific tasks are you performing, and have we obtained a Letter of No Objection for each of them?
• What system access will the officer have, and will it be direct and unrestricted?
• Who sub-contracts what, and is any part of this work performed outside the UAE?
• Who drafts the bi-annual report, who approves it, and will it disclose resource constraints candidly?
• On termination, how and when do our records, case files and reporting history come back to us?

10. If your current arrangement is on the wrong side of the line

Most firms whose outsourced AML compliance arrangement is non-compliant did not set out to break the rule. They bought a service described in the market’s language rather than the regulator’s. The remediation is usually structural rather than punitive.

First, establish the facts

• Identify, by name, the person currently holding the Compliance Officer or MLRO role and confirm whether the supervisory authority approved that appointment in writing.
• List every AML task currently performed by a third party and check whether a Letter of No Objection exists for each.
• Confirm whether an alternate has been designated and fit and proper tested.
• Establish what system access the officer actually holds, as opposed to what the contract promises.

Then, rebuild the core

• Appoint or confirm the officer inside the governance structure and obtain the supervisor’s written approval.
• Return every decision to the firm: reporting determinations, onboarding and exit decisions, PEP and enhanced due diligence approvals.
• Minute senior management approval of the policies, the business risk assessment and the risk appetite.
• Secure direct, unrestricted system access for the officer and the alternate.

Then, regularise the delegation

• Re-scope each delegated task in terms a supervisor can assess, and apply for the Letter of No Objection.
• Rewrite the contract to cover scope, reporting lines, access, confidentiality, sub-outsourcing, performance review and record handover.
• Start a documented periodic review of provider performance.
• Produce the next bi-annual report to board standard, including a candid statement on resourcing.

Doing this in the open is better than being found. Remediating outsourced AML compliance voluntarily is treated very differently from remediating it under direction. A firm that has identified the gap, appointed properly and applied for the Letters of No Objection is in a materially different position from one that has not, even if the remediation is still in progress.

11. How Ontrax structures it

Ontrax Compliance & Risk Management Ltd builds outsourced AML compliance arrangements the way the guidance requires them to be built: a named, approved officer inside your governance structure, and a delegated layer behind them that carries the volume.

Our Outsourced AML Function supplies the delegated layer — enhanced due diligence, policy and procedure framing, training, and screening and monitoring support — scoped so that each element can be put to your supervisory authority for a Letter of No Objection. Our Virtual Compliance Officer service provides the individual: a qualified, UAE-resident officer appointed in their own name, independent of your revenue lines, with direct system access and an alternate behind them. Where you already have an internal officer, our MLRO Provision service supplies deputy cover, review capacity and independent challenge so the appointment stands up to scrutiny.

We will say plainly when an outsourced AML compliance arrangement a client asks for cannot be provided compliantly. That is a short conversation at the outset and a much longer one at inspection.

If you take one action:  Find the written approval from your supervisory authority for your current Compliance Officer or MLRO appointment, and the Letter of No Objection for each task your provider performs. If either is missing, your outsourced AML compliance arrangement has a gap that a single inspection will find. Speak to Ontrax about structuring it correctly.

Frequently asked questions

Can you outsource AML compliance in the UAE?

Only in part. Joint guidance from the UAE Supervisory Sub-Committee states that a firm must not outsource the role of the Compliance Officer or MLRO, nor the entire compliance function, under any circumstances. Specific tasks such as enhanced due diligence, training, framing controls and system support may be outsourced after obtaining a Letter of No Objection from the relevant supervisory authority. In practice this means outsourced AML compliance is a supported model, never a replacement one.

Who issued the joint guidance on the CO/MLRO function?

The UAE Supervisory Sub-Committee, on behalf of eight authorities: the Central Bank of the UAE, the Securities and Commodities Authority, the Ministry of Justice, the Ministry of Economy and Tourism, the DFSA, the FSRA, VARA and the GCGRA. It builds on Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.

What is a Letter of No Objection and when do I need one?

It is written confirmation from your supervisory authority that it does not object to a specific AML task being performed by a third party. You need it before the provider begins the work. Outsourcing a task without one is a breach in itself, regardless of how well the task is performed.

Which AML tasks can be outsourced?

The guidance gives enhanced due diligence, AML and CFT training, framing controls, and system support as examples of delegable outsourced AML compliance work. The practical test is whether the task contains a decision — whether to report, onboard, approve or escalate. Tasks that carry a decision belong to the appointed officer and cannot be delegated.

Can a DNFBP appoint a third-party Compliance Officer?

Yes, under the Ministry of Economy and Tourism’s March 2026 guidelines, where the DNFBP cannot appoint a suitably qualified and independent officer internally. The appointment needs the supervisory authority’s prior written approval, the same fit and proper evaluation, genuine independence, unrestricted access to information and systems, a clear contract, a designated alternate, and periodic performance review.

Does appointing a third-party Compliance Officer transfer responsibility?

No. The guidelines state that ultimate accountability for compliance remains with the DNFBP’s senior management and board, and that appointing a third-party officer does not relieve the DNFBP of its obligations. The officer may be sourced externally; the responsibility is not.

Is a virtual compliance officer allowed in the UAE?

A virtual compliance officer arrangement is workable in the UAE provided the individual is formally appointed in their own name, approved by the supervisory authority, independent of operational and revenue roles, and has unrestricted access to information, records, systems and staff. What is not allowed is a virtual compliance officer contract under which a provider supplies “compliance” with no identified, approved, accountable officer inside the governance structure.

Does the prohibition apply to DIFC and ADGM firms?

Yes. Both the DFSA and the FSRA are among the eight authorities on whose behalf the guidance was issued. Their own rulebooks govern how an outsourcing arrangement must be documented and supervised; the joint guidance establishes that the arrangement cannot extend to the role itself or to the whole function. In the DIFC the MLRO of an Authorised Firm is an Authorised Individual approved by name.

Is a deputy or alternate Compliance Officer mandatory?

An alternate must be appointed, and both the officer and the alternate must undergo a fit and proper test covering integrity, qualifications, experience and skills. An alternate who exists on paper but holds no system access and has never handled a live escalation does not satisfy the expectation.

How often must the Compliance Officer report?

The joint guidance expects a bi-annual report to senior management and to the relevant supervisory authority — twice a year. It should cover risk exposure, regulatory and typology developments, the business-wide risk assessment, risk appetite, programme effectiveness including failures, resource constraints, reporting statistics, and audit and examination findings.

Can the Compliance Officer also hold a commercial role?

Where duties are delegated to someone with other responsibilities, the guidance states that person should not have day-to-day responsibility for sales or customer relationship management. MoET’s guidelines accept that dual roles may be unavoidable in smaller entities, but expect clear reporting lines, board oversight and segregation of duties in high-risk processes.

What are supervisors finding wrong with outsourced arrangements?

The guidance lists eleven deficiencies. They cluster into three patterns: oversight that has moved to regional or offshore teams, an officer who lacks seniority, involvement and board access, and an absence of accountability and ownership for UAE obligations. Most describe arrangements where the work left the firm and the ownership left with it.

How long must records be kept?

For DNFBPs under the MoET guidelines, at least five years for customer files, risk assessments, internal reports and reports filed. DIFC and ADGM firms are held to at least six years under their respective rulebooks. Where a provider holds records on your behalf, the contract must guarantee their return on termination.

What should I ask a provider before signing?

Who the appointed officer will be by name and whether your regulator will approve them in that name; whether they are UAE-resident and how many other appointments they hold; which specific tasks are covered and whether a Letter of No Objection exists for each; what direct system access the officer will have; whether any work is sub-contracted or performed outside the UAE; who drafts and approves the bi-annual report; and how records are returned on termination.

Sources and further reading

· UAE Supervisory Sub-Committee — Joint Guidance on the AML/CFT/CPF Compliance Officer and MLRO (CBUAE copy)

· Ministry of Economy & Tourism — DNFBP Guidelines, March 2026

· Cabinet Resolution No. 134 of 2025 — Executive Regulations to Federal Decree-Law No. 10 of 2025

· DFSA — Anti-Money Laundering, Counter-Terrorist Financing and Sanctions FAQs

· ADGM FSRA — Anti-Money Laundering and Sanctions Rulebook

· CBUAE — Anti-Money Laundering resources

This briefing is general information on outsourced AML compliance in the UAE and is not legal advice. Guidance and rules change; verify the current text with your supervisory authority before acting. Ontrax Compliance & Risk Management Ltd, Dubai International Financial Centre.