AML Policy and Risk Assessment Template for UAE Real Estate Brokers

This guide explains what both documents must contain under UAE law, the mistakes MoET sees most often, and how to get our free skeleton template to build on.

The rules come from Federal Decree-Law No. 10 of 2025 (FDL 10/2025), its Executive Regulations in Cabinet Resolution No. 134 of 2025 (CR 134/2025), and the Ministry of Economy and Tourism’s Supplemental Guidance for Real Estate Agents & Brokers (2026). The wider picture is in our AML guide for real estate agents.

Why do you need both, and in what order?

• The risk assessment comes first. It is your own analysis of where money laundering, terrorist financing and proliferation financing risks sit in your business: which customers, countries, property types, payment methods and channels.
• The policy comes second. It sets out what you do about those risks: the controls, procedures and who is responsible for them.

The law links the two. You must identify, assess and document your risks (CR 134/2025, art. 5(1)), then adopt policies approved by senior management to manage them (art. 5(2)). A policy that doesn’t follow from your risk assessment won’t pass an inspection.

The risk assessment (EWRA)

Under CR 134/2025, art. 5(1), you must:

• consider all relevant risk factors: customers, countries and geographic areas, products and services, transactions, and delivery channels;
• do it in proportion to the nature and size of your business;
• take into account the results of the National Risk Assessment;
• document the process and the results, keep them, update them on an ongoing basis, and give them to MoET on request.

You must also assess the risks before you launch a new product, practice or technology, such as accepting crypto or onboarding clients remotely (art. 24).

MoET’s guidance for brokers points to these risk areas:

• Customers: individuals or companies, foreign buyers, PEPs, buyers who act through intermediaries, nominees or legal structures.
• Countries: where buyers and their money come from, and links to high-risk jurisdictions.
• Property and transactions: off-plan or ready, price bands, unusually high values, quick resales and flips.
• Payment methods: bank transfer, mortgage, cash, crypto, payments from third parties.
• Channels: face to face, remote onboarding, referrals.
• The national picture: the National Risk Assessment rates the inherent risk of real estate as high. It points to high-value deals, cross-border purchases and complex ownership, and names intermediaries and third-party payments as recurring typologies.

1. Business profile, with numbers: deals per year, share of cash, crypto and foreign buyers.
2. Method: how you score likelihood and impact.
3. Inherent risk for each factor.
4. Controls in place.
5. Residual risk and overall rating.
6. Action plan.
7. Update log.
8. Senior management approval.

The AML policy

Under CR 134/2025, art. 21, your policies, controls and procedures must be approved by senior management, proportionate to your risks and to the nature and size of the business, and reviewed and updated on an ongoing basis. They must include at least:

1. customer due diligence, including how you manage risk when a relationship starts before verification is complete;
2. procedures for reporting suspicious transactions;
3. compliance management, including a Compliance Officer at management level;
4. employee screening to high standards of fitness and propriety;
5. regular training for the compliance function and other staff;
6. an independent audit function that tests the policies.

A broker’s policy normally also covers:

• governance and roles;
• registration on goAML and with the EOCN;
• risk assessment and risk appetite;
• customer risk rating;
• KYC for individuals and companies, and beneficial owners;
• source of funds and source of wealth;
• sanctions and PEP screening;
• simplified and enhanced due diligence;
• high-risk countries;
• reliance on third parties;
• ongoing monitoring;
• what to do when checks can’t be completed;
• targeted financial sanctions;
• red flags and internal escalation;
• STR, SAR, REAR and HRC reporting;
• tipping off;
• record-keeping for five years;
• training, reports to senior management, independent audit and policy review.

The checks themselves are covered in our KYC guide for brokers and our guide to goAML reports.

Mistakes MoET finds

From MoET’s 2026 guidance and the Cabinet Resolution No. 71 of 2024 list of violations:

• No senior management approval. A policy without it is the first line of the CR 71/2024 list.
• Generic documents. MoET’s guidance asks brokers to go beyond generic compliance and tailor their controls to real estate. A template written for a bank or for the UK, with no mention of the REAR, goAML or the EOCN, doesn’t do that.
• A policy that doesn’t match the risk assessment, or no risk assessment at all.
• Not updated after the 2025 law. FDL 10/2025 and CR 134/2025 replaced the 2018 framework, and a policy that still cites Decree-Law No. 20 of 2018 is out of date.
• On paper only. MoET’s guidance notes risk assessments that aren’t documented, high-risk cases that aren’t escalated and controls applied inconsistently.

The fines are per violation. Breaching the duties in art. 19(1) of FDL 10/2025, which include the risk assessment and the policy, is also a crime punishable by imprisonment and/or a fine of at least AED 10,000 (art. 35(3)). More in our guide to AML fines in the UAE.

Free skeleton template

Our skeleton lists every section of a broker’s AML policy and risk assessment, what belongs in each one and which article of the law it answers. You or your Compliance Officer then write the text for your business.

Ask for the skeleton template on WhatsApp → We send it to the number you write from.

Or get the full set

Our AML subscription for brokers includes the complete AML documentation set:

• the policy and procedures manual, with a senior management sign-off page;
• the business-wide risk assessment template;
• the Compliance Officer appointment letter;
• KYC onboarding forms for individuals and companies.

Your Compliance Officer reviews and adopts the documents.

See what’s included and the price →

This guide is general information, not legal advice.

What this means for you

Two documents carry a broker’s AML programme: